Politika privatnosti
Njemački jezik je autoritativan.
1. Controller
The controller within the meaning of Art. 4 No. 7 GDPR for the processing of personal data in connection with Tendova is:
AAA BW GmbH
Robert-Koch-Weg 3, 72555 Metzingen, Deutschland
Email: [email protected]
2. Data we process
We process the following categories of personal data:
- Account and registration data: name, business email address, company affiliation, password (hashed), language preference.
- Usage data: search queries, saved searches, interactions with tenders, log data (IP address, timestamps, pages accessed) to provide and secure the service.
- Billing data: billing address, VAT ID, payment status, and transaction history. Payment details themselves (e.g. card data) are processed exclusively by our payment provider, Stripe, and never pass through our own servers.
3. Purposes and legal bases of processing
We process personal data to perform the usage agreement with you (providing the account, search, matching, alerts, billing) on the basis of Art. 6 (1)(b) GDPR. We also process data to safeguard legitimate interests (Art. 6 (1)(f) GDPR), in particular to ensure IT security, analyze errors, further develop the service, and prevent fraud.
4. Processors and recipients
To provide our service, we use carefully selected service providers (processors within the meaning of Art. 28 GDPR). Data processing agreements are or will be in place with all processors; details and the full processing terms are set out in our Data Processing Agreement (DPA).
| Provider | Purpose | Location | Transfer basis (third country) |
|---|---|---|---|
| Hetzner Online GmbH | Hosting and server infrastructure | Germany (EU) | No third-country transfer |
| Cloudflare, Inc. | CDN, DNS, and web application firewall | EU / USA | EU-US Data Privacy Framework (DPF) and Standard Contractual Clauses (SCC) |
| OpenRouter, Inc. | AI model routing — forwards requests for processing to the AI providers listed below | USA | Standard Contractual Clauses (SCC) pursuant to Art. 46 GDPR |
| Anthropic PBC (via OpenRouter) | AI-assisted text processing — summaries and document analysis | USA | Standard Contractual Clauses (SCC) pursuant to Art. 46 GDPR |
| OpenAI LLC (via OpenRouter) | Generation of text embeddings for semantic search | USA | Standard Contractual Clauses (SCC) pursuant to Art. 46 GDPR |
| Mistral AI (via OpenRouter) | AI-assisted automated translation | France (EU) | No third-country transfer |
| Migadu Mail | Transactional email delivery (e.g. alerts, account confirmations) | Switzerland | EU Commission adequacy decision (Art. 45 GDPR) |
| Stripe Payments Europe, Ltd. | Payment processing and invoicing | Ireland (EU) | No third-country transfer |
Stripe Payments Europe, Ltd. becomes operative as a processor only upon activation of paid subscriptions on tendova.eu.
5. Signing in via Google or Apple (social login)
You can optionally sign in to Tendova via Google or Apple ("social login"). Unlike the service providers listed in section 4, these are not processors within the meaning of Art. 28 GDPR: Google and Apple provide their respective sign-in service as independent controllers within the meaning of Art. 4 No. 7 GDPR and may also process the data arising from the sign-in for their own purposes (e.g. fraud prevention, account security). Please refer to Google's privacy notice (policies.google.com/privacy) and Apple's privacy notice (apple.com/legal/privacy) for further information.
If you choose to sign in via Google or Apple, the respective provider additionally sends us the following data, which we process: name, email address, the provider-side account ID, and – where provided by Google as part of the sign-in – a profile picture (image URL). The sole purpose is authentication; the legal basis is Art. 6 (1)(b) GDPR (performance of the usage agreement). This processing only takes place if you actively choose that sign-in option. The providers are Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland.
If the verified email address sent by Google or Apple matches an account that already exists with Tendova (for example, because you previously registered via magic link), your Google or Apple sign-in is automatically linked to that existing account instead of creating a new, separate account. If you choose Apple's "Hide My Email" option, you instead receive an Apple-generated, forwarding email address (@privaterelay.appleid.com); in that case, no automatic linking to an existing account takes place, and a separate account is created instead.
6. Retention period
We retain personal data only as long as necessary for the respective purposes or as required by statutory retention obligations (in particular commercial and tax retention periods of up to ten years for billing data under §§ 257 HGB, 147 AO). Account data is deleted after termination of the usage agreement, unless a statutory retention obligation applies.
7. Cookies
Tendova does not use cookies for tracking or marketing purposes. Strictly necessary cookies (e.g. for the login session) are used solely to provide the service.
8. Your rights
Subject to the statutory requirements, you have the following rights:
- Right to access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object (Art. 21 GDPR)
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work, or the place of the alleged infringement. The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart.
9. Contact for data protection inquiries
For data protection inquiries, please contact: [email protected]