Easy Lease Procurement Platform – supplier.easylease.ae
Version 1.0 · Last updated: 27 October 2026
1. About this policy
This Privacy Policy explains how Easy Lease Group collects, uses, stores, shares and protects personal data through the Easy Lease Procurement Platform at supplier.easylease.ae (the "Platform").
In this policy, "Easy Lease Group", "we", "us" and "our" mean Easy Lease Motorcycle Rental P.J.S.C. and its subsidiaries. The Platform is operated by the Group Procurement Department of Easy Lease Group.
"You" means any person whose personal data we process through the Platform, including supplier representatives, supplier users, guest submitters, people named in supplier documents and visitors to the Platform.
This policy applies to the Platform only. Other Easy Lease Group websites and services have their own privacy notices.
2. Laws we follow
We process personal data in line with the data protection laws that apply in our countries of operation, including:
- United Arab Emirates: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.
- Kingdom of Saudi Arabia: the Personal Data Protection Law issued by Royal Decree No. M/19 of 1443H, as amended, and its implementing regulations.
- Kingdom of Bahrain: Law No. 30 of 2018 on the Protection of Personal Data.
Where more than one law applies, we follow the stricter requirement.
3. Personal data we collect
3.1 Data you give us
| Category | Examples |
|---|---|
| Account data | Full name, business email address, mobile number, password (stored only in hashed form), multi-factor authentication settings |
| Company contacts | Names, positions, email addresses and phone numbers of the primary contact, authorised signatory and finance contact |
| Identity data | ID or passport number, nationality and copy of ID or passport of the authorised signatory; powers of attorney or authorisation letters |
| Company documents | Trade licences, commercial registrations, tax and VAT certificates, Chamber of Commerce, Zakat, GOSI, Saudization, ICV and other certificates, which may include names of owners, managers or partners |
| Bank data | Bank name, account name, IBAN, SWIFT/BIC and bank letter |
| Declarations | Your acceptance of declarations and policies, including any relationships with Easy Lease Group staff that you declare |
| Tender participation | Questions, clarification requests, NDA acceptances, submissions, prices, proposals, CVs or team details included in submissions, and correspondence |
| Guest submitter data | Company name, contact name, email address, mobile number and country |
| Contact form data | Name, email, company and message |
Please provide personal data about other people, such as colleagues named in a submission, only if you are allowed to share it with us and have told them about this policy.
3.2 Data we collect automatically
- Security and usage data: IP address, browser and device type, sign-in times, failed sign-in attempts, pages and records accessed, downloads, and actions taken. We record these in an audit log to protect the Platform and the integrity of tenders.
- Cookies: see section 10.
3.3 Data from other sources
We may verify information you provide using public registers, issuing authorities, banks, credit and due-diligence services, sanctions lists, and references you provide.
4. Why we use personal data and our legal basis
| Purpose | Legal basis |
|---|---|
| Creating and securing your account, including email verification and multi-factor authentication | Performance of a contract (Terms of Use); legitimate interests in security |
| Assessing, approving and maintaining supplier registrations, including document verification and expiry reminders | Steps taken at your request before entering into a contract; legitimate interests in selecting qualified suppliers |
| Running tenders: sharing tender documents, answering clarifications, receiving and evaluating submissions, making awards and sending notices | Performance of a contract or pre-contract steps; legitimate interests in fair, competitive procurement |
| Preparing award letters and contracts, including electronic signature | Performance of a contract |
| Due diligence, anti-bribery, conflict-of-interest, sanctions and fraud checks | Legal obligations; legitimate interests in preventing fraud and corruption |
| Keeping audit records of procurement decisions and Platform activity | Legal obligations; legitimate interests in accountability and audit |
| Sending tender alerts that match your categories and countries | Your registration choices and our legitimate interests; you can change alert settings at any time |
| Responding to enquiries and requests | Legitimate interests; legal obligations for data protection requests |
| Establishing, exercising or defending legal claims | Legitimate interests; legal obligations |
Where a law requires consent for a particular processing activity, we ask for it at registration or submission and record your consent with the version of this policy you accepted. You may withdraw consent at any time (see section 9); this does not affect processing before withdrawal or processing based on another legal basis.
We do not use your personal data for marketing unrelated to procurement, and we do not sell personal data.
We do not make decisions about you based solely on automated processing. Evaluation scores are given by Easy Lease Group evaluators, and every approval, rejection and award is made by an authorised member of staff.
5. Who can see your data
5.1 Inside Easy Lease Group
Access is limited by role:
- Group Procurement staff see supplier records and the tenders they work on.
- Evaluators see submissions only for tenders they are assigned to, only after the tender is opened, and only after confirming they have no conflict of interest.
- Auditors have read-only access for audit purposes.
- The Easy Lease Group business that requested a tender may receive evaluation results and award information.
Tender submissions are sealed and encrypted until the closing time. No one, including Platform administrators, can read them before the tender is opened.
5.2 Service providers
We use carefully selected service providers who process data on our behalf, under written contracts that require them to protect it and use it only on our instructions:
| Provider type | Purpose |
|---|---|
| Amazon Web Services | Hosting, storage, email delivery, malware scanning and security monitoring |
| Bot protection provider | Protecting public forms from automated abuse |
| Electronic signature providers (for example Nexa24 or Docusign) | Signing award letters and contracts |
| Microsoft | Sign-in for Easy Lease Group staff |
| Professional advisers and auditors | Legal, audit and compliance services, under confidentiality duties |
5.3 Other disclosures
We may disclose personal data when required by law, a court or a government authority, to protect the rights, property or safety of Easy Lease Group or others, or in connection with a restructuring, merger or sale of a business, subject to confidentiality protections.
Other suppliers never see your personal data. Answers to clarification questions are published without identifying who asked.
6. Where your data is stored and international transfers
The Platform is hosted in Amazon Web Services' data centres in the United Arab Emirates. Personal data may also be accessed by Easy Lease Group companies in the UAE, the Kingdom of Saudi Arabia and the Kingdom of Bahrain for the purposes in section 4. Some service providers may process limited data in other countries.
When personal data is transferred out of the country where it was collected, we do so only as permitted by the applicable law, for example where the destination country provides an adequate level of protection or where appropriate safeguards are in place, such as approved contractual clauses. Where the law requires it, we carry out a transfer risk assessment and keep the data transferred to the minimum necessary.
7. How long we keep data
Procurement records form part of Easy Lease Group's permanent audit and governance record. For this reason, we keep supplier registrations (including rejected registrations), tender records, submissions, evaluations, awards, guest submissions and audit logs on a long-term basis and do not routinely delete them. Older records are moved to secure archive storage.
If you ask us to erase your personal data and no legal exception applies, we anonymise your personal details, such as your name, contact details and identity documents, while keeping the company and tender records needed for audit and legal purposes.
8. How we protect your data
We use technical and organisational measures appropriate to the risk, including:
- Encryption of data in transit and at rest, with sealed-bid encryption for tender submissions until opening.
- Mandatory multi-factor authentication for all user accounts.
- Role-based access controls checked on every request, and a tamper-evident audit log.
- Malware scanning of every uploaded file.
- Web application firewall, rate limiting and bot protection.
- Regular security testing, including independent penetration tests.
- Confidentiality obligations for staff and service providers.
No system is completely secure. Please keep your password and authentication device safe and tell us immediately if you suspect unauthorised access to your account.
9. Your rights
Subject to the conditions and exceptions in the applicable law, you have the right to:
- Be informed about how we process your personal data.
- Access your personal data and obtain a copy.
- Correct inaccurate or incomplete data. Most company and contact details can be updated directly in your account; some changes require review by Group Procurement.
- Erase your personal data or have it anonymised, where we no longer have a lawful reason to keep it in identifiable form.
- Restrict or object to certain processing.
- Receive your data in a structured, commonly used format. Vendor Admins can download their company and user data from the Platform.
- Withdraw consent where processing is based on consent.
- Complain to the relevant authority: the UAE Data Office, the Saudi Data and Artificial Intelligence Authority (SDAIA), or Bahrain's Personal Data Protection Authority.
To exercise your rights, email [email protected] with the subject "Data Protection Request". We may need to verify your identity before acting on a request. We respond within the time required by the applicable law.
10. Cookies
The Platform uses only cookies that are necessary for it to work securely:
| Cookie | Purpose | Duration |
|---|---|---|
| Session cookie | Keeps you signed in | Until sign-out or session timeout |
| Security token | Protects forms against cross-site request forgery | Session |
| Bot protection | Distinguishes people from automated programs on public forms | Short-lived |
We do not use advertising cookies or third-party tracking cookies. Because these cookies are strictly necessary, they cannot be switched off without stopping the Platform from working.
11. Children
The Platform is for businesses and their representatives. It is not intended for anyone under 18, and we do not knowingly collect their personal data.
12. Changes to this policy
We may update this policy from time to time. We will publish the updated version on the Platform with a new "Last updated" date and, for material changes, notify registered users by email or in the Platform.
13. Contact us
Easy Lease Group – Group Procurement Department
Email: [email protected]
Website: supplier.easylease.ae
To report a security concern, email [email protected].