Privacy policy

Who is responsible

The data controller is SARL New Global Industrial Resources, trading as NAGTAR. Sourvia is the public sourcing interface operated by that company.

Controller

SARL New Global Industrial Resources

Trading name

NAGTAR

Platform

Sourvia

Registered office

Algeria

Privacy contact

info@nagtar.com

We are established outside the European Union, and we address buyers in the European market. We apply the GDPR standard to everyone who uses Sourvia, regardless of where they are.

What we collect

We hold what you send us, plus the technical data needed to run the site.

• Sourcing requests: company, contact name, business email, phone, product, quantity, destination, Incoterm, specifications, a target price if you provide one, and your message.
• Accounts: company name, professional email and password. A session cookie keeps you signed in.
• Team invitations: the email address of the person you invite, and their role.
• Contact messages: company, name, email and message.
• Newsletter: your email address only.
• Supplier applications: company, contact details, and the capacity or product information you submit.
• Technical data: server logs such as IP address and browser type, kept for security and troubleshooting.

We do not ask for special category data. Do not include personal details in free-text fields beyond what is needed to discuss a sourcing request.

Why we are allowed to use it

• Steps prior to a contract: answering a sourcing request, qualifying a requirement, preparing an offer and operating your account.
• Legitimate interests: keeping records of commercial exchanges, protecting forms from abuse, and keeping the website secure and available.
• Consent: the newsletter. You can unsubscribe at any time. Withdrawal does not affect processing that took place before it.
• Legal obligation: retaining commercial and accounting records where the law requires it.

What stays confidential

Target prices are not copied into supplier inquiries. Supplier purchase prices, internal notes and commissions are not shown to other buyers. A commission record follows the written agreement and does not, by itself, create a right to payment.

How long we keep it

• Requests that do not lead to a transaction: 24 months from the last exchange, then deleted.
• Requests that lead to a transaction: for the commercial relationship, then for as long as accounting and commercial record-keeping rules require.
• Accounts: while the account is open, then deleted or anonymised unless a record must be kept.
• Newsletter addresses: until you unsubscribe, plus a suppression record so we do not write to you again by mistake.
• Server logs and short-lived security counters: for the limited period needed to operate and protect the site.
• Measurement data: up to 12 months, and only when analytics is configured.

Who else processes it

The providers below process personal data for us when they are configured. They are not allowed to use it for their own advertising. We do not sell personal data and we do not share it with advertising networks.

NAGTAR

Sourcing requests are transmitted so the team can qualify, negotiate and coordinate export. Without the API configuration, a request stays queued and is not marked as delivered.

Supabase

When a dedicated project is configured, account and request data are stored there. Otherwise they stay in the application store used for that deployment.

Resend

Transactional email, only when an API key is configured. Without a key, the email is not sent.

PostHog, EU cloud

Page views and product events, only when a project key is configured. The host is the European endpoint. Prices, email addresses, phone numbers and supplier names are removed before an event is sent.

Transfers outside the EU

Some providers may be established outside the European Economic Area. We are established in Algeria, which is not covered by a European Commission adequacy decision. Where data leaves the European Economic Area, the transfer relies on the European Commission Standard Contractual Clauses included in our agreements with those providers, where those clauses apply. Measurement is pointed at PostHog’s European Union cloud when analytics is enabled.

Cookies and measurement

A session cookie is strictly necessary to keep you signed in. It is not used for advertising.

When a PostHog key is configured, measurement starts as the page loads. There is no separate consent banner. We do not use advertising cookies, retargeting pixels or social tracking. You can block analytics in your browser. Clearing cookies ends the current signed-in session.

Your rights

You can ask us to act on any of the following. We answer within one month, and we do not charge you for a reasonable request.

• Access: a copy of the personal data we hold about you.
• Rectification: correction of anything inaccurate.
• Erasure: deletion, where we have no overriding obligation to keep the data.
• Restriction: pausing our use of your data while a dispute is resolved.
• Portability: the data you gave us, in a machine-readable format.
• Objection: an objection to processing based on our legitimate interests.
• Withdrawal of consent: for the newsletter, at any time.

Write to info@nagtar.com. We may ask you to confirm your identity before acting, so that your data is not disclosed to someone else.

If you are in the European Union and you believe we have not handled your request properly, you can lodge a complaint with the supervisory authority of the country where you live or work.

Security

The site is served over HTTPS. Access to buyer requests, supplier prices and internal notes is limited to the roles that need them. To report a vulnerability, write to security@nagtar.com.

Changes to this policy

We update this page when our processing changes. The date at the top is the current version. If a material change affects data you already sent us, we will tell you directly where we have a way to reach you.