Log in

Legal / GDPR compliance

Active policy

Privacy Policy

Last updated: 2026-09-19

•

Domain: tenders.space

•

Regulation: EU GDPR (2016/679)

This Privacy Policy sets out the rules for collecting, processing, and protecting personal data of Users using the website and the B2B SaaS platform tenders.space.

1. Data Controller

The Data Controller responsible for processing your personal data within the tenders.space platform is:

Duobit sp. z o.o.

ul. Solec 81B lok. A-51, 00-382 Warszawa, Poland

Tax Identification Number (NIP/VAT ID): PL7011237198

Commercial Register Number (KRS/REGON): KRS 0001143658 / REGON 540404707

For any matters concerning personal data protection or exercising your statutory rights, you can contact us:

  • • E-mail: hello@duobit.pl
  • • Mailing Address: ul. Solec 81B lok. A-51, 00-382 Warszawa, Poland

2. What Data We Collect and For What Purpose

We process personal data depending on the scope of your interactions with our SaaS platform and website:

A. Account Registration and Service Provision (SaaS)

  • Scope of data: First name and last name, business email address, phone number, company/employer name, job title, encrypted password, billing details (address, VAT ID).
  • Purpose: Electronic service provision, account creation, user authentication, subscription billing, customer success, and technical support.
  • Legal basis: Art. 6(1)(b) GDPR (performance of a contract or taking pre-contractual steps).

B. Contact Forms and Product Demos

  • Scope of data: Name, business email address, phone number, company name, message content, scheduled time.
  • Purpose: Handling inquiries, scheduling product walkthroughs, and conducting B2B commercial consultations.
  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest – building client relationships and answering inquiries).

C. Newsletter and Marketing Updates

  • Scope of data: Email address, first name, industry interest preferences.
  • Purpose: Delivering platform product updates, public procurement reports, tender analysis insights, and promotional offers.
  • Legal basis: Art. 6(1)(a) GDPR (explicit consent) or Art. 6(1)(f) GDPR (legitimate interest regarding existing clients).

D. Automatically Collected Data (Cookies and Server Logs)

  • Scope of data: IP address, browser type, operating system, cookie IDs, page request logs, clickstream analysis.
  • Purpose: Platform security, session maintenance, performance telemetry, DDoS mitigation, and usability optimization.
  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest in security and stability) & Art. 6(1)(a) GDPR (cookie consent).

E. AI-Powered Analysis Features

The tenders.space platform utilizes machine learning algorithms and language models to parse tender announcements, terms of reference (RFP/RFQ documents), and match tender criteria with client profiles.

• AI Guarantee: Documents and custom query data uploaded by Users for analysis are processed solely to execute requested operations and are NEVER used to train public foundation models without your explicit written consent.

3. Data Recipients

To provide our platform services, we share data with trusted third-party processors operating strictly under binding Data Processing Agreements (DPAs):

  1. Cloud & Infrastructure Hosting: High-security cloud hosts and server infrastructure providers (e.g., AWS Europe, Google Cloud EEA, Hetzner Online).
  2. Analytics & CRM Systems: User behavior telemetry and customer support tools (e.g., HubSpot, PostHog, Google Analytics with IP anonymization).
  3. Payment Gateway Processors: PCI-DSS compliant secure payment handling (e.g., Stripe, PayU).
  4. AI Model Providers: Enterprise API partners adhering to GDPR-compliant data processing agreements and zero-data-retention for training.
  5. Authorized Authorities: Competent public or judicial bodies when strictly mandated by applicable laws.

4. International Data Transfers (Outside EEA)

We prioritize storing and processing data within the European Economic Area (EEA). If data is transferred outside the EEA, we ensure appropriate safeguards in accordance with Chapter V of the GDPR:

  • EU Commission Adequacy Decisions (including the EU-U.S. Data Privacy Framework).
  • Standard Contractual Clauses (SCCs) approved by the European Commission, combined with supplemental technical and organizational security measures.

5. Data Retention Period

Personal data will be stored only for as long as necessary to fulfill the purposes outlined in this Policy:

User Account DataActive subscription duration + statutory limitation period for legal claims (3 to 6 years post-termination).
Accounting & Invoices5 years from the end of the calendar year in which the tax obligation arose (as required by tax laws).
Consent-Based DataUntil the consent is withdrawn or unsubscribed by the user via email or profile settings.
System Logs & TelemetryTypically 30 to 180 days for security analysis, unless an incident investigation requires extension.

6. User Rights

Under the General Data Protection Regulation (GDPR), you possess full control over your personal data:

1. Right of Access: Obtain confirmation and copies of your data.
2. Right to Rectification: Request correction of inaccurate information.
3. Right to Erasure: Demand data deletion where applicable.
4. Right to Restrict Processing: Pause processing operations under disputed cases.
5. Right to Data Portability: Receive data in structured, machine-readable JSON/CSV format.
6. Right to Object: Object to processing based on legitimate interest or direct marketing.

To exercise any of these rights, please contact us at privacy@tenders.space. You also have the right to lodge a complaint with a supervisory authority (In Poland: UODO - Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, Warsaw).

7. Cookies and Tracking Technologies

We use cookie files and similar technologies to ensure seamless operation:

  • Strictly Necessary Cookies: Required for secure login, CSRF protection, and session persistence.
  • Analytical & Performance Cookies: Help us measure platform usage, response speeds, and feature engagement.
  • Marketing Cookies: Allow tailored feature notifications and ad campaign measurement.

You can adjust or revoke your cookie preferences at any time via the cookie banner in our page footer or directly in your browser preferences.

8. Data Security Architecture

We employ state-of-the-art administrative, physical, and technical safeguards to prevent unauthorized access, disclosure, or alteration:

✓ End-to-end transport encryption via TLS 1.3 / SSL (HTTPS).

✓ AES-256 database encryption at rest & hashed password credentials.

✓ Strict Role-Based Access Control (RBAC) and mandatory 2FA for operators.

✓ Continuous vulnerability monitoring, automated threat detection, and regular code audits.

9. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy to reflect changes in platform features, legislation, or operational best practices. Any material changes will be communicated at least 14 days in advance via registered email or prominent in-app banners.