1. About this Policy
This Privacy Policy describes how SCmple Solutions LLC (“SCmple”, “we”, “us”) collects, uses, and shares personal data when you:
- visit scmple.com or any SCmple marketing property;
- submit a form on our website, for example to request a demo, ask a question, discuss a partnership, or download a resource;
- or create or use a SCmple user account on the SCmple supply-chain-management platform (the “Platform”).
Controller / Processor scope. For personal data collected through our website and for SCmple user accounts themselves, SCmple acts as the Data Controller under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the UK GDPR.
For business and operational data that our customers upload into the Platform in the course of using the Services, SCmple acts as a Data Processor on behalf of the customer (who is the Controller). That relationship is governed by a separate Data Processing Addendum (DPA), which we make available to all B2B customers. This Privacy Policy does not govern the processing of customer-uploaded operational data. Please refer to the applicable DPA instead.
2. Who We Are
SCmple Solutions LLC
116 Village Boulevard, Princeton, NJ 08540
For all privacy and data-protection matters, contact us at info@scmple.com
3. Personal Data We Collect
We collect only the personal data we need to provide, secure, and support our Platform and website. We do not collect demographic data such as age, gender, household income, political affiliation, race, or religion.
3.1 Account Identity Data
When you register or are provisioned with a SCmple account:
- Email address
- First and last name
- Profile picture (optional)
- User preferences (date format, time zone)
3.2 Authentication & Security Data
Created and used to keep your account and the Platform secure:
- Password, stored only as a bcrypt hash (we never store plaintext passwords)
- Two-factor authentication (TOTP) secret, where 2FA is enabled
- Login-activity records: IP address, user-agent string, approximate geographic location inferred from IP (country, region, city), sign-in timestamps, and success/failure status
- Session identifiers
- Account-lockout and password-reset tokens, used transiently
3.3 Audit-Log Data
For changes made within the Platform, we record the identity of the user who made the change, so that Controllers (our customers) can meet their own accountability obligations.
3.4 Website Data
When you visit scmple.com, our hosting and security provider records the requesting IP address, user-agent, referrer, and request path to deliver the site and protect it from abuse. See Section 14 (Cookies) for the cookies we use.
3.5 Information You Submit Through Our Website Forms
When you contact us or request a resource, we collect the details you enter in the form:
- Contact form: first and last name, work email, company name, job title, the reason for your request, how you heard about us (optional), and any comments you add
- Resource download forms: first and last name, work email, and the resource you requested
With each submission we also record the page you submitted it from and, where present, the campaign tags (UTM parameters) in the link that brought you to our site. Our forms never ask for confidential supply chain data, and we ask that you do not include it.
3.6 Website Analytics
Where you allow it (see Section 14), we use HubSpot and Google Analytics to understand how our website is used, including the pages you view, how you arrived at the site, approximate location derived from your IP address, and your device and browser type. If you later submit one of our forms, HubSpot links your earlier visits to the details you submitted, so that we can respond to your request with relevant information.
4. Legal Bases for Processing
We rely on the following legal bases under Article 6(1) GDPR:
| Processing activity | Legal basis |
|---|---|
| Creating and maintaining your SCmple user account; delivering the Services you have signed up for | Article 6(1)(b), performance of a contract |
| Security logging, fraud prevention, platform integrity, and technical availability | Article 6(1)(f), our legitimate interest in running a secure, reliable service |
| Retaining records where required by tax, accounting, or other applicable law | Article 6(1)(c), legal obligation |
| Responding to requests you submit through our website forms (demo requests, questions, partnership inquiries, and resource downloads), and following up with you about that request | Article 6(1)(b), steps taken at your request before entering into a contract, and Article 6(1)(f), our legitimate interest in responding to business inquiries |
| Website analytics and HubSpot tracking cookies | Article 6(1)(a), consent, for visitors in the EEA, the UK, and Switzerland; Article 6(1)(f), our legitimate interest in understanding and improving our website, elsewhere |
| Protecting our forms and website from spam, bots, and abuse | Article 6(1)(f), our legitimate interest in running a secure, reliable service |
| Sending marketing communications (only where you have opted in, e.g., newsletter signup) | Article 6(1)(a), consent, which you may withdraw at any time |
We do not rely on processing of Article 9 GDPR special-category personal data, and the Platform is not designed to collect it.
5. How We Use Your Personal Data
We use your personal data to:
- Provide, operate, and maintain your SCmple account and the Platform;
- Authenticate you, enforce access controls, and protect your account and our Services from unauthorized access, fraud, and abuse;
- Respond to your support requests and communicate with you about your account, service-affecting incidents, and material changes to our Services or this Policy;
- Respond to demo requests, questions, and partnership inquiries you send us, provide the resources you request, and follow up with you about them;
- Understand how our website is used and improve its content and performance, where you allow analytics cookies;
- Protect our website and forms from spam, bots, and abuse;
- Meet our legal and regulatory obligations; and
- With your consent, send you marketing communications you can unsubscribe from at any time.
We do not sell your personal data, and we do not rent or lease it to third parties for their own marketing purposes.
7. International Data Transfers
SCmple is headquartered in the United States. Most processing of personal data takes place in the United States (via our cloud-hosting providers) and in the European Union (our application error and performance monitoring runs in the Netherlands). Our website providers (HubSpot, Google, and Cloudflare) process website and form data in the United States and in other countries where they operate.
Where we transfer personal data of individuals in the European Economic Area, the United Kingdom, or Switzerland to a country that is not covered by an adequacy decision, we rely on the 2021 European Commission Standard Contractual Clauses (Implementing Decision (EU) 2021/914) to provide appropriate safeguards, supplemented, where the exporter is in the UK, by the UK Information Commissioner’s International Data Transfer Addendum.
Consistent with the Schrems II judgment of the Court of Justice of the European Union (Case C-311/18, July 16, 2020) and the European Data Protection Board’s Recommendations 01/2020, we apply supplementary technical measures to protect personal data in transit and at rest, including:
- TLS 1.2 or higher for all traffic between you and the Platform;
- AES-256 encryption at rest in our managed database and object storage;
- Field-level encryption of sensitive integration credentials;
- Strict key management under SCmple’s and our infrastructure providers’ control.
We do not rely on the EU-US Privacy Shield, which was invalidated by the Court of Justice in Schrems II.
You may request a copy of the safeguards in place for a specific transfer by contacting us at info@scmple.com.
8. Data Retention
We retain personal data only as long as we need it for the purposes set out in this Policy.
- Account identity and authentication data are retained for the life of your SCmple account. When your account or your organization’s SCmple tenant is deleted, we remove the associated personal data from our production systems within 30 days, and from our rolling backup cycle within a further 35 days.
- Login-activity and audit-log records are retained for up to 24 months, or longer where we are required to do so by law or where records are needed to investigate an ongoing security incident.
- Website server logs are retained for up to 90 days.
- Information you submit through our website forms, and the related contact record, is retained for as long as needed to respond to your request and maintain our business relationship, and is deleted or anonymized no later than 24 months after our last interaction with you, unless you ask us to delete it sooner.
- Website analytics data in Google Analytics is retained for 14 months.
- Records we are required to keep by law (for example, tax and accounting records) are retained for the period prescribed by the applicable law.
For personal data that our customers upload into the Platform, retention is governed by the applicable customer DPA.
9. Security of Your Personal Data
We maintain a documented information-security program and apply technical and organizational measures appropriate to the risk, including:
- Passwords stored only as bcrypt hashes; two-factor authentication; a password policy aligned with NIST SP 800-63B (length-based strength, breached-password reuse blocking, no arbitrary periodic rotation);
- TLS 1.2+ in transit, AES-256 at rest, CSRF protection, HSTS;
- Role-based access control, tenant isolation at the application layer, and strict separation between development, staging, and production environments;
- Continuous database backups with point-in-time recovery, application audit logging, and filtered error monitoring;
- Hosting exclusively with SOC 2 Type II and ISO 27001 certified infrastructure providers;
- Annual review of security policies; peer code review and static analysis on application changes.
A more detailed set of Technical and Organizational Measures is set out in Annex II of our DPA and available to B2B customers under NDA.
No security program can guarantee absolute security, but we actively monitor and improve ours.
10. Your Data-Protection Rights
Subject to the conditions set out in Chapter III of the GDPR (and equivalent provisions of the UK GDPR), you have the right to:
- Access the personal data we hold about you
- Rectify personal data that is inaccurate or incomplete
- Erase personal data (“right to be forgotten”), where one of the grounds under Article 17 applies
- Restrict processing in defined circumstances (Article 18)
- Data portability, i.e., receive your personal data in a structured, commonly used, machine-readable format (Article 20)
- Object to processing based on our legitimate interests (Article 21)
- Withdraw consent at any time, where processing is based on your consent (Article 7(3))
To exercise any of these rights, contact info@scmple.com. We respond within one month of receiving a verifiable request, as required by Article 12(3) GDPR. That period may be extended by up to two further months where the request is complex or where we receive a large number of requests; we will tell you within one month if we need more time and why.
Where you are a user of a customer’s SCmple tenant, your organization (as Controller) is the first point of contact for these requests. We will forward any request received directly to your organization and assist as required by our DPA with that customer.
Residents of U.S. states. Depending on where you live, you may have similar rights under U.S. state privacy laws, including the rights to know, access, correct, and delete your personal information. You can exercise them by contacting info@scmple.com, and we will not discriminate against you for doing so. We do not sell personal information or share it for cross-context behavioral advertising. Our website does not currently respond to browser “Do Not Track” signals.
11. Right to Lodge a Complaint with a Supervisory Authority
If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the right under Article 77 GDPR to lodge a complaint with a data-protection supervisory authority. You may do so in the Member State of your habitual residence, your place of work, or the place of the alleged infringement.
- EEA residents. A current list of national supervisory authorities is maintained by the European Data Protection Board at edpb.europa.eu/about-edpb/about-edpb/members_en. SCmple has no establishment in the EEA, so there is no lead supervisory authority, and you may contact the authority in the Member State where you live or work.
- United Kingdom residents. The Information Commissioner’s Office (ICO) at ico.org.uk.
- Swiss residents. The Federal Data Protection and Information Commissioner (FDPIC) at www.edoeb.admin.ch.
We encourage you to contact us at info@scmple.com first, so that we have an opportunity to resolve the matter directly.
12. Personal Data Breach Notification
We maintain incident-response and breach-notification procedures aligned with Articles 33 and 34 GDPR.
Where a personal data breach is likely to result in a risk to the rights and freedoms of natural persons, SCmple will notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach.
Where the breach is likely to result in a high risk to the rights and freedoms of natural persons, we will also notify affected data subjects without undue delay, in clear and plain language, and describe the nature of the breach, the likely consequences, the measures taken or proposed to address it, and a point of contact for further information.
For personal data that our customers upload into the Platform, our notification runs through the Controller under the applicable DPA, as described in Section 10 of that DPA.
13. Children
The SCmple Platform is a business-to-business supply-chain product that is not directed to, and not intended for use by, children under the age of 16. We do not knowingly collect personal data from children. If you believe we may have collected personal data from a child, please contact info@scmple.com and we will take steps to delete it.
14. Cookies and Similar Technologies
SCmple uses cookies and similar technologies on our website and Platform as follows:
- Strictly necessary cookies are required for sign-in, session management, and CSRF protection on the Platform, and for security and bot protection on our website, including the Cloudflare Turnstile check on our forms and the cookie that records your cookie choices. These cannot be disabled without breaking core functionality.
- Functional cookies are used to remember your preferences on the Platform (e.g., date format, time zone).
- Analytics cookies are set on our website by HubSpot (for example, hubspotutk, __hstc, __hssc, and __hssrc) and by Google Analytics (for example, _ga and _ga_*). They help us understand how the website is used and, if you submit a form, connect your visits to your request. For visitors in the EEA, the UK, and Switzerland, they are set only after you accept them in our cookie banner.
We do not set advertising cookies on our website, and we do not set advertising or behavioral-tracking cookies on the Platform. You can change your cookie choices at any time through cookie settings. Most browsers also allow you to control cookies through their settings. Disabling strictly necessary cookies will prevent you from signing in.
15. Automated Decision-Making and Profiling
We do not use your personal data to make decisions that produce legal or similarly significant effects about you by solely automated means, within the meaning of Article 22 GDPR.
16. Changes to This Policy
We may update this Policy from time to time. When we do, we will update the “Last Updated” date at the top of this page and, where the changes are material, we will notify you through the Platform, by email, or through a prominent notice on scmple.com before the changes take effect. We preserve superseded versions internally and can provide a prior version on written request.
17. Contact Us
For any question about this Policy, to exercise any of the rights described above, or to request information about our sub-processors or transfer safeguards, contact us at:
End of Privacy Policy.