Privacy Policy

1. Controller and contact

NullLogic s. r. o., IČO 56 906 439, DIČ 2122501667, VAT ID SK2122501667, registered seat Novozámocká 1347/69, 960 01 Zvolen, Slovak Republic, registered in the Commercial Register of the District Court Banská Bystrica, section Sro, file no. 52083/S.

Privacy requests: hello@tendersignal.eu. We have not appointed a data protection officer.

2. What we process and why

Account data - company name, your name if you give it, work e-mail address, a salted hash of your password, account role, time of signup and of acceptance of the Terms. Purpose: to create and secure your account and to conclude the contract. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) where you are the contracting person; legitimate interest in administering the business relationship (Art. 6(1)(f)) for representatives of a corporate Customer.

Billing data - subscription status, Stripe customer and subscription identifiers, invoices. Card details are entered on Stripe's pages and never reach our servers. Purpose: charging the subscription and keeping accounts. Legal basis: contract (Art. 6(1)(b)) and legal obligations in tax and accounting law (Art. 6(1)(c)).

Workspace data - scoring profile (keywords, CPV codes, countries, value band), pursue / skip decisions and notes, digest recipient addresses, digest delivery log. Purpose: providing the Service. Legal basis: contract (Art. 6(1)(b)). Recipient addresses you enter must belong to people in your organisation who expect the digest; you are responsible for informing them.

Technical data - IP address, browser type, requested pages, timestamps, in server logs. Purpose: security, abuse prevention (rate limiting), troubleshooting. Legal basis: legitimate interest (Art. 6(1)(f)) in running a secure service.

Public procurement data - notices and award records published by public authorities may contain names of contact persons at buyers or of sole-trader suppliers. We copy these records from the official sources (TED, NEN, the Czech register, ÚVO and BZP), normalize them and link back to their origin. Legal basis: legitimate interest (Art. 6(1)(f)) in providing procurement intelligence based on information that the law requires to be public. You may object (section 7).

Correspondence - e-mails you send us. Purpose: support. Legal basis: contract and legitimate interest.

Optional measurement data - if you accept analytics and advertising measurement, Google Analytics and Google Ads process a pseudonymous browser identifier, pages viewed, approximate location, device information, referral and campaign data, and the events sign_up, begin_checkout and purchase. We do not send your name, e-mail address, company name, scoring profile or tender decisions to Google. Purpose (separately selectable): understanding product use, measuring registrations and subscriptions, and attributing ad conversions. Legal basis: your consent (Art. 6(1)(a) GDPR). No Google measurement tag is loaded before consent.

We do not use personalised advertising or make solely automated decisions with legal or similarly significant effects about individuals. Tender rankings concern business opportunities. We do not send marketing e-mails without your consent. Service e-mails (digest, billing, security notices) are part of the contract.

3. Recipients and processors

We share personal data only with providers that help us run the Service, under data-processing agreements, and with authorities where the law requires it:

• Stripe Payments Europe, Ltd. (Ireland) - payments, invoices, subscription management. Stripe may transfer data to Stripe, Inc. (USA) under the EU-US Data Privacy Framework and standard contractual clauses.
• netcup GmbH (Karlsruhe, Germany) - hosting of the application and databases (EU data centre).
• Websupport, s.r.o. (Bratislava, Slovakia) - delivery of the digest and account e-mails.
• Websupport, s.r.o. (Slovakia) - domain registration and DNS.
• Google Ireland Limited (Ireland) - optional website analytics and Google Ads conversion measurement, only after consent.

We do not sell personal data.

4. International transfers

Data is stored in the European Union. Where a processor (currently Stripe or, after consent, Google) transfers data outside the EEA, the transfer is covered by an adequacy decision or standard contractual clauses.

5. Retention

• Account and workspace data: for the life of the account and 90 days after the subscription or trial ends, then deleted by daily maintenance. Deleted earlier on request. Recovery snapshots expire after 30 days; account erasure also removes account data from managed recovery copies.
• Billing records and invoices: 10 years, as required by Slovak accounting and tax law.
• Server logs: 30 days.
• Google Analytics event and user-level data: 14 months; aggregated reports may be retained longer.
• Public procurement data: retained as part of the Service's historical dataset; personal data in it is removed on justified objection.
• Support e-mails: 2 years.

6. Security

TLS on every connection, passwords stored only as salted PBKDF2 hashes, one isolated database per customer, application reachable only through the reverse proxy, access to servers restricted to the operator. No system is perfectly secure; tell us immediately if you suspect a breach.

7. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to processing based on legitimate interest, to data portability, and to withdraw any consent you have given. Write to hello@tendersignal.eu; we answer within one month. You may also complain to the Slovak Office for Personal Data Protection (Úrad na ochranu osobných údajov Slovenskej republiky, current contact details at https://dataprotection.gov.sk/sk/kontakt/) or to the supervisory authority of your own EU country.

8. Cookies and browser storage

Necessary storage: signal_session keeps you signed in for up to 30 days; signal_locale remembers your language for up to one year. These are not used for analytics. The localStorage entry ts-google-measurement-consent stores your separate choices for analytics and advertising measurement, the notice version, time, expiry and a random receipt identifier for 180 days. Expired or older-version choices require a new decision. No account ID is linked to this receipt.

Optional purposes are off by default. You may reject all, accept all, or select analytics and advertising measurement separately. No Google tag is loaded before an explicit choice permitting a purpose. Google Analytics measures visits and product use when analytics is permitted; registration, checkout and purchase events are used for permitted measurement purposes. Advertising personalisation and Google signals remain disabled.

With analytics enabled, Google may set _ga and _ga_<container-id> cookies, configured here for a maximum of 180 days without extending on each page view. Advertising measurement may use _gcl_* or _gac_* cookies, normally up to 90 days. After consent only, sessionStorage entries beginning ts-measured- prevent duplicate events during the browser session. We do not store optional events before consent. URLs sent to Google exclude query strings and fragments; profile contents, names and e-mail addresses are not sent.

Cookie settings is available at the bottom of every page with measurement configured. You can change or withdraw consent as easily as giving it. Withdrawal disables measurement, removes first-party Google measurement cookies and the session event markers, and updates other open tabs. It does not affect earlier lawful processing or erase data already held by Google; contact us to exercise your data rights.

We record your selected purposes, notice version, timestamp, expiry and random receipt identifier on our server to demonstrate consent (Art. 6(1)(c), Art. 7(1) GDPR). Receipts expire after 180 days and are removed during subsequent receipt housekeeping. They contain no account details, IP address or browser fingerprint.

How Google uses data from sites and apps that use its services

9. Children

The Service is for businesses and is not directed at persons under 18.

10. Changes

We may update this Policy; the current version is always at /legal/privacy. Material changes are announced by e-mail to account holders.