Adatfeldolgozási szerződés (DPA)

§ 1 Parties and scope

The controller within the meaning of Art. 4 No. 7 GDPR is the respective customer (“Controller”). The processor within the meaning of Art. 4 No. 8 GDPR is:

AAA BW GmbH
Robert-Koch-Weg 3, 72555 Metzingen, Deutschland
Register court: Amtsgericht Stuttgart, register number: HRB 806390
Email: [email protected]

This DPA specifies the parties' data-protection obligations in connection with the use of the Tendova platform and supplements the General Terms and Conditions (“AGB”). In the event of any conflict between this DPA and the AGB, this DPA takes precedence on data-protection matters.

§ 2 Subject matter, duration, and nature of processing

The subject matter of the processing is the provision of a tender-intelligence service (search, matching, alerts, AI-assisted summaries, and document analysis) based on the Tendova platform. The duration of processing corresponds to the term of the usage agreement (subscription) between the parties, plus the retention periods set out in § 10. The nature and purpose of processing follow from the plan booked and the features the controller actively uses, in particular uploading tender documents for AI-assisted analysis.

§ 3 Categories of data and data subjects

The following categories of data are processed under this DPA:

• Account and profile data (name, business email address, company affiliation)
• Tender documents uploaded by the controller's users and their contents
• Usage and log data (search queries, interactions, IP address, timestamps)
• Contract and billing data of the controller (billing address, contact person, VAT ID, payment status; payment instruments themselves remain with the payment provider)

Data subjects are the employees and other users the controller has authorized to use the platform, as well as, where applicable, natural persons whose data is contained in uploaded tender documents.

§ 4 Processing on instructions

The processor processes personal data solely on the controller's documented instructions, unless required to do otherwise by European Union or member state law. The controller's configuration and use of the platform (e.g. uploading documents, activating AI features) constitutes an instruction within the meaning of this clause.

If the processor is of the opinion that an instruction infringes the GDPR or other Union or member state data protection provisions, it informs the controller without undue delay (Art. 28(3) sentence 3 GDPR). It may suspend implementation of the instruction concerned until the controller confirms or amends it.

§ 5 Confidentiality

The processor ensures that all persons authorized to process personal data have committed themselves to confidentiality or are subject to an appropriate statutory obligation of confidentiality.

§ 6 Technical and organizational measures

The processor implements the technical and organizational measures required to protect personal data within the meaning of Art. 32 GDPR and keeps them in line with the state of the art. Currently implemented measures include in particular:

Confidentiality and access control

• Encrypted data transmission (TLS) for all client-server connections and for the connections to the services listed in § 7
• Primary infrastructure operated on dedicated servers in data centers in Germany (§ 8); access to production systems restricted to authorized administrators
• Tenant isolation: every data access by the platform is technically bound to the controller's organization
• Passwordless sign-in via email login links or Google (OAuth); no customer passwords are stored
• Role-based permissions within the controller's organization, limited to what is necessary
• Web application firewall and DDoS protection in front of the platform (Cloudflare)

Integrity and availability

• Daily database backups with a limited retention period and a documented restore procedure
• Logging of security-relevant events to detect anomalies
• Service availability monitoring with automatic restart of failed components

Procedures for regular review

• Self-service data export and full deletion (§ 9, § 10), so data subject rights are fulfilled without manual intervention
• Regular updates of the software components used and review of the measures for effectiveness (Art. 32(1)(d) GDPR)

§ 7 Sub-processors

The controller grants the processor a general authorization to engage the sub-processors listed below. The processor will notify the controller of any intended changes (addition or replacement of sub-processors) in advance by email or via the platform; the controller may object to such changes within 14 days on reasonable data-protection grounds.

The processor imposes on each sub-processor, by way of a contract, the same data protection obligations as set out in this DPA, in particular sufficient guarantees to implement appropriate technical and organizational measures (Art. 28(4) GDPR). Where a sub-processor fails to fulfil its data protection obligations, the processor remains fully liable to the controller for the performance of that sub-processor's obligations.

Stripe Payments Europe, Ltd. becomes operative as a sub-processor only upon activation of paid subscriptions on tendova.eu.

AI requests are routed via OpenRouter with a fixed provider assignment exclusively to the provider named in the table for each model; falling back to other hosting providers of the same model is technically excluded. Automated translation processes only public tender texts from TED, never the controller's data.

§ 8 Third-country transfers, AI processing, and data residency

Primary data storage and processing take place on dedicated Hetzner Online GmbH servers in Germany. Where the controller actively uses AI-assisted features (e.g. summaries, document Q&A), the relevant tender text or excerpts from uploaded documents are transmitted for processing to the AI providers listed in § 7. The controller's data — in particular the contents of uploaded documents — is transmitted to AI providers only when a user of the controller actively triggers the relevant AI feature (e.g. requests a summary or asks a question about a document). Automatically generated AI content (e.g. the market note in the weekly digest) is based solely on aggregated figures and public tender data, not on the controller's personal data. Anyone wishing to avoid any transmission to AI providers simply does not use the relevant AI features. Under the terms and data processing agreements of the AI providers used, customer data submitted through the platform is not used to train AI models.

§ 9 Assistance with data subject rights and impact assessments

The processor assists the controller, to the extent reasonable, with appropriate technical and organizational measures in fulfilling requests from data subjects (Art. 15 to 22 GDPR). Self-service data access and export are available to the controller at any time via Account Settings → Privacy.

Taking into account the nature of processing and the information available to it, the processor further assists the controller in ensuring compliance with the obligations under Art. 32 to 36 GDPR, in particular in carrying out data protection impact assessments and any prior consultation of the supervisory authority (Art. 35, 36 GDPR).

§ 10 Deletion and return upon termination

The controller can export or fully delete organization data at any time via Account Settings → Privacy. Upon termination of the usage agreement, the processor deletes all personal data processed on the controller's behalf, unless statutory retention obligations (e.g. commercial and tax retention periods for billing data) require otherwise.

§ 11 Audit and inspection rights

On request, the processor provides the controller with the information necessary to demonstrate compliance with the obligations set out in Art. 28 GDPR and permits audits, including inspections, conducted by the controller or an auditor mandated by the controller, to the extent economically reasonable and subject to reasonable advance notice.

§ 12 Data breach notification

The processor notifies the controller without undue delay upon becoming aware of a personal data breach within the meaning of Art. 4 No. 12 GDPR affecting data processed under this DPA, and assists the controller in fulfilling any notification obligations toward supervisory authorities and data subjects.

§ 13 Liability and final provisions

The parties' liability in connection with this DPA is governed by the liability provisions of the AGB and the mandatory requirements of the GDPR. Should individual provisions of this DPA be or become invalid, the validity of the remaining provisions shall remain unaffected.