HospiSourcing is a business-to-business (B2B) sourcing and procurement platform for the hospitality industry. It is intended for hotels, resorts, restaurants, other hospitality businesses and the suppliers, manufacturers and distributors that serve them. It is not a consumer service.
HospiSourcing is a business platform operated by S-DESIGN, a business registered in Bosnia and Herzegovina.
This policy applies to personal data we process through the hospisourcing.com website and the request and application forms available on it.
1. Who is responsible for your data
The data controller for personal data processed through the platform is S-DESIGN, SD S-DESIGN vl. Šijerkić Sead, with its registered address at Lijevča bb, 72220 Zavidovići, Bosnia and Herzegovina.
Registration number: 4320718990008.
For any privacy question or to exercise your rights, contact legal@hospisourcing.com.
2. Data we collect
2.1 Information you provide directly
- Contact details such as your name, email address and company name.
- Business information such as your country, delivery location, website and the categories of products or services you buy or supply.
- Procurement request information you submit as a buyer, including item descriptions, quantities, specifications, desired delivery dates, budget range, additional requirements and any documents or images you upload.
- Supplier application information you submit as a supplier, including your manufacturing or distribution status, the countries you serve, minimum order quantities, certifications, catalogue links and any documents you upload.
- Communications you send to us by email or through the platform, including the content of those messages.
2.2 Information created when you use the platform
- Platform usage data such as the pages you view and the actions you take on the site, collected in aggregate by our cookieless analytics (see section 5).
- Technical and log data such as IP address, browser and device information and timestamps, generated by our hosting and infrastructure providers for security, diagnostics and availability.
2.3 Information we do not collect
- We do not buy personal data from third parties.
- We do not use advertising cookies or sell personal data to advertisers or data brokers.
- The platform does not currently offer user accounts, so we do not collect account credentials at this stage. If accounts are introduced, this policy will be updated before they go live.
3. Why we process your data and our legal bases
Under the GDPR we must have a legal basis for each processing activity. The table below sets out what we rely on.
| Purpose | Legal basis |
|---|---|
| Responding to your procurement request and preparing offers, including sharing the requirement with relevant suppliers | Performance of a contract or steps taken at your request before entering a contract (Article 6(1)(b)) |
| Reviewing and processing supplier applications | Steps taken at your request before entering a contract and our legitimate interests in operating a supplier network (Article 6(1)(b) and 6(1)(f)) |
| Communicating with you about your request or application | Performance of a contract and our legitimate interests in responding to enquiries (Article 6(1)(b) and 6(1)(f)) |
| Securing the platform, preventing misuse and maintaining availability | Our legitimate interests in protecting the platform and its users (Article 6(1)(f)) |
| Improving the platform and understanding how it is used | Our legitimate interests in operating and improving a B2B platform, using cookieless analytics that sets no cookies and no personal identifiers (Article 6(1)(f)) |
| Complying with legal, tax and accounting obligations | Compliance with a legal obligation (Article 6(1)(c)) |
Legitimate interests
Where we rely on legitimate interests, we have considered the impact on you and limited the processing to what is needed to run a B2B sourcing service. You have the right to object to processing based on legitimate interests (see section 10).
4. Who we share your data with
- Suppliers relevant to your request. When you submit a procurement request as a buyer, we share the information needed to quote — typically the requirement, quantities, specifications and delivery location — with suppliers we invite to respond. We do not share your contact details with a supplier unless it is necessary to progress your request.
- Service providers (processors). We use a small number of providers that process data on our behalf:
- Supabase — database and file storage for procurement requests, supplier applications and uploaded documents.
- Our hosting provider — infrastructure used to serve the website.
- Umami — privacy-focused, cookieless analytics.
- An email delivery provider — used to send internal notifications about new requests and applications, when configured.
- Professional advisers and authorities where we are legally required to disclose information or need to establish, exercise or defend legal claims.
- A successor entity in connection with a merger, acquisition or transfer of assets, subject to this policy.
We do not sell personal data.
5. Cookies and analytics
We use browser storage to remember your cookie preference. We do not use advertising or cross-site tracking cookies.
Analytics is provided by Umami in its cookieless mode. It does not set cookies on your device and does not build a profile of you. It records aggregate page views and referral information. Because it is cookieless and does not identify you, it runs by default; you can turn it off at any time in the cookie settings. The full detail is set out in our Cookie Policy.
6. International transfers
Some of our service providers may process data outside the European Economic Area. Where that happens, we rely on appropriate safeguards under the GDPR, such as an adequacy decision or standard contractual clauses, and we take steps to ensure your data receives a comparable level of protection.
7. How long we keep your data
We keep personal data only as long as necessary for the purposes described in this policy. Procurement requests and supplier applications are retained for 1 year unless a longer period is required for legal, tax or accounting reasons.
When data is no longer needed, we delete it or anonymise it. Documents you upload are deleted together with the related record unless we need to keep them to fulfil a legal obligation.
8. How we protect your data
We use appropriate technical and organisational measures to protect personal data, including encrypted connections, restricted access to the data we hold and limiting access to those who need it to operate the service. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
9. Your rights under the GDPR
You have the following rights in relation to your personal data:
- Access — to request a copy of the personal data we hold about you.
- Rectification — to have inaccurate or incomplete data corrected.
- Erasure — to request deletion of your data where there is no overriding legal reason for us to keep it.
- Restriction — to ask us to limit how we use your data.
- Objection — to object to processing based on our legitimate interests or to direct marketing.
- Portability — to receive data you provided in a structured, commonly used, machine-readable format, or to have it transmitted to another controller where technically feasible.
- Withdraw consent — to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, contact legal@hospisourcing.com. We will respond within the timeframes required by law.
You also have the right to lodge a complaint with the data protection supervisory authority in the country where you live, work or where the alleged infringement occurred. We would appreciate the chance to address your concern first.
10. Children's data
The platform is a B2B service intended for businesses and their representatives. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
11. Changes to this policy
We may update this policy to reflect changes to the platform or to legal requirements. The current version is always published on this page with the date it was last updated. Where changes are material, we will take reasonable steps to bring them to your attention.
12. Contact us
For privacy questions, requests or complaints, contact legal@hospisourcing.com. You can also reach our general contact address at hello@hospisourcing.com.