01 Data Controller
The data controller for personal data processed through the TenderGuru Platform is:
TenderGuru OÜ (Estonian entity, upon registration) / MakeIT SRL (Moldovan entity, prior to Estonian registration)
Email: privacy@tenderguru.io
Website: tenderguru.io
If your organisation has signed an Enterprise Agreement with TenderGuru, please refer to the Data Processing Agreement (DPA) annexed to that contract, which governs processing of your organisation's data and supersedes this Policy to the extent of any conflict.
02 What We Collect
2.1 Account & Registration Data
- Name, email address, job title, organisation name
- Billing address, VAT/tax number (for invoicing)
- Login credentials (password stored as bcrypt hash; we never store plaintext passwords)
2.2 User Content (uploaded by you)
- Expert/consultant CVs — name, professional history, education, skills, regions, languages, certifications
- Company profiles — sector expertise, past projects, geographic reach, staff bios
- Tender documents — ToR files, methodology drafts, LOIs, ESPDs uploaded for AI processing
- Other documents — work samples, reference letters, certificates uploaded for scoring improvement
2.3 Platform Usage Data
- Tender searches, saved filters, alert subscriptions
- AI operations performed (scoring runs, document generations) — used for billing and feature improvement
- Document approval actions (who approved, when) — required for audit trail
- IP address, browser type, device information — collected at login for security
- Session data and access logs — retained for security monitoring
2.4 Communications
- Emails and messages sent to our support team
- Survey responses and feedback you provide voluntarily
03 How We Use Your Data
| Purpose | Data Used |
|---|---|
| Providing the Services (scoring, generation, matching, monitoring) | User Content, account data, usage data |
| Billing and payment processing | Account data, usage data (coins/operations count) |
| Security and fraud prevention | IP address, login logs, access patterns |
| Platform improvement and bug fixing | Usage data, anonymised error logs |
| Customer support | Account data, content you share in support tickets |
| Legal compliance | Account data, billing records |
| Transactional emails (invoices, alerts, security notices) | Email address |
We do not: sell personal data to third parties, use User Content to train AI models, process data for advertising profiling, or share data with tendering authorities without your explicit instruction.
04 Legal Basis for Processing (GDPR)
| Processing Activity | Legal Basis (GDPR Art.) |
|---|---|
| Providing the Services under a contract with you | Art. 6(1)(b) — Performance of contract |
| Billing, invoicing, legal compliance | Art. 6(1)(c) — Legal obligation |
| Security monitoring, fraud prevention | Art. 6(1)(f) — Legitimate interests |
| Platform improvement (aggregated, anonymised) | Art. 6(1)(f) — Legitimate interests |
| Marketing emails (optional, opt-in) | Art. 6(1)(a) — Consent |
| Processing expert CVs on instruction of Customer | Art. 6(1)(b) + Art. 28 (Processor relationship) |
Where TenderGuru processes personal data contained in expert CVs and professional profiles on your instruction, TenderGuru acts as a data processor and you (the Customer organisation) act as data controller for that data. The Data Processing Agreement (Schedule C of the Enterprise Agreement or available on request) governs this relationship.
05 AI Processing Modes: BYOK vs TG Key
TenderGuru offers two modes for AI processing. The mode you select determines how your data is routed for AI operations:
| BYOK Mode | TG Key Mode | |
|---|---|---|
| Who provides the API key | You (Customer) | TenderGuru |
| Where data goes for AI processing | Directly to Anthropic under your own account and API agreement | To Anthropic via TenderGuru's API key |
| TenderGuru's role for AI data | TenderGuru does not receive or store AI input/output; your Anthropic ToS governs | TenderGuru is processor; data temporarily processed, not retained for training |
| Data sovereignty | Maximum — you control the Anthropic relationship directly | Standard — TenderGuru DPA applies |
| Billing | Direct Anthropic billing; TenderGuru flat subscription fee | TG Coins deducted per operation |
07 International Data Transfers
If your data is transferred outside the European Economic Area (EEA), TenderGuru ensures appropriate safeguards are in place:
- Transfers to the US (Anthropic, cloud infrastructure providers) are covered by Standard Contractual Clauses (EU SCC Module 2, Controller-to-Processor) as approved by the European Commission.
- Enterprise on-premise clients: no international transfer occurs — data stays within client infrastructure.
You may request a copy of the applicable transfer mechanism by emailing privacy@tenderguru.io.
08 Data Retention
| Data Category | Retention Period |
|---|---|
| Account data (active accounts) | Duration of account + 90 days after closure |
| User Content (CVs, documents) | Duration of account + 30-day export window + deletion within 90 days of account closure |
| Billing records and invoices | 7 years (legal / tax obligation) |
| Usage logs (AI operations, approvals) | 2 years (audit purposes) |
| Security logs (access, IP) | 12 months |
| Support communications | 3 years from last interaction |
| Marketing consent records | Until withdrawal + 3 years |
You may request early deletion of your data at any time (see Section 10 — Your Rights), subject to legal retention obligations.
09 Security
TenderGuru implements industry-standard security measures, including:
- Encryption in transit (TLS 1.3) and at rest (AES-256)
- Bcrypt password hashing (passwords never stored in plaintext)
- Role-based access controls limiting who can access User Content within TenderGuru
- Regular automated backups with tested restore procedures
- Security monitoring and access logging
- Responsible disclosure policy for security vulnerability reports
In the event of a personal data breach likely to result in a risk to individuals, TenderGuru will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, and affected data subjects without undue delay, in accordance with GDPR Article 33–34.
10 Your Rights (GDPR)
If you are in the EEA or otherwise covered by GDPR, you have the following rights:
Request a copy of the personal data we hold about you (Art. 15).
Request correction of inaccurate or incomplete data (Art. 16).
Request deletion of your data ("right to be forgotten") where no legal basis persists (Art. 17).
Receive your data in a structured, machine-readable format (Art. 20).
Request restriction of processing in certain circumstances (Art. 18).
Object to processing based on legitimate interests (Art. 21).
Withdraw consent at any time for consent-based processing (e.g., marketing emails).
Lodge a complaint with your local data protection authority (e.g., Estonian Inspectorate: aki.ee).
To exercise any right, email privacy@tenderguru.io with "Data Rights Request" in the subject line. We will respond within 30 days. We may need to verify your identity before processing the request.
12 Children's Privacy
The Platform is intended for professional use by adults (18+). TenderGuru does not knowingly collect personal data from individuals under 18. If you believe a minor has provided us with personal data, contact privacy@tenderguru.io and we will delete it promptly.
13 Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or applicable law. Material changes will be notified by email at least 30 days before taking effect. The "Effective date" at the top of this document reflects the most recent revision.
14 Contact & DPA
For privacy-related enquiries, data rights requests, or to obtain a copy of our Data Processing Agreement:
- Email: privacy@tenderguru.io
- General: support@tenderguru.io
- Website: tenderguru.io
Enterprise clients may request a countersigned DPA (covering EU SCCs, sub-processor list, breach notification, and audit rights) by emailing legal@tenderguru.io.
TenderGuru OÜ / MakeIT SRL · tenderguru.io
This Policy was last updated on [EFFECTIVE DATE].