Legal
Privacy Policy
This policy explains how Mesa (“Mesa”, “we”, “us”) collects, uses, shares, and protects personal information when you use the Mesa procurement platform at mesa.live. We process personal information in line with the Data Privacy Act of 2012 (Republic Act No. 10173) of the Philippines.
Information we collect
Company and account information
- When a company registers: company name, industry, address, city, country, website, and the name, email address, and phone number of the contact person.
- For each user: name, email address, role, and account status. Passwords are stored only in hashed form.
- If you sign in with Google: your Google account identifier and the name and email address on that account.
Procurement information
- Procurements you create and their documents, messages, clarifications, evaluation scores, approvals (including e-signature images), and award documents.
- Information about providers, such as company name, contact name, email address, phone number, documents, and project history, entered by buyers or submitted by providers.
- Quotations, documents, questions, and messages that providers submit through a private link.
Usage and security information
- The IP address used to sign in, and the approximate location derived from it (city, region, country, and approximate coordinates).
- Records of actions taken on a procurement, with the time and the person who took them (the audit trail).
Feedback
- Messages and attachments you send through the in-app feedback form.
How we use information
- To provide the platform: running procurements, sending invitations and private links, and delivering quotations to the buyer.
- To send service emails, such as invitations, account and password emails, verification codes, approval requests, and award or regret notices.
- To review and approve company registrations and manage subscription plans and limits.
- To keep the platform secure: verifying sign-ins, preventing misuse, and keeping an audit trail.
- To respond to support requests and feedback, and to improve the platform.
We process personal information to perform our agreement with your organization, for our legitimate interests in operating and securing the platform, to comply with legal obligations, and with your consent where the law requires it.
How information is shared
- Within your organization: users in your company can see procurements and records according to their role and module access.
- Between buyers and providers: providers see the procurement details a buyer shares with them. Buyers see the quotations, documents, and messages providers submit.
- Service providers we use: email delivery (Google’s Gmail service), Google sign-in (Google), IP-based location lookup (ip-api.com), and the infrastructure that hosts the platform. They receive only what they need to provide their service.
- When required by law: to comply with a legal obligation, a lawful request from authorities, or to protect rights and safety.
We do not sell personal information.
Storage and security
Access to data is limited by role and module permissions, passwords are hashed, uploaded files are checked by type, and actions on procurements are logged. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.
How long we keep information
We keep account and procurement records while your organization’s account is active and afterwards for as long as needed for audit, dispute, and legal purposes. When information is no longer needed, we delete or anonymize it.
Your rights
Under the Data Privacy Act, you have the right to be informed, to access your personal information, to object, to have it corrected, to have it erased or blocked, to data portability, and to claim damages. You can also file a complaint with the National Privacy Commission. To exercise your rights, email us at mesa2.admin@gmail.com. If you use Mesa through your employer, we may refer your request to your organization’s administrator.
Browser storage
Mesa keeps your sign-in session in your browser’s local or session storage, along with a few display preferences. We do not use advertising cookies or third-party analytics.
Children
Mesa is a business tool and is not intended for anyone under 18.
Changes to this policy
We will post any changes on this page and update the date above. If a change is significant, we will let organization administrators know.
Contact
Questions about this policy or your personal information: mesa2.admin@gmail.com. See also our Terms of Service.