Draft – not yet reviewed by a lawyer. This notice describes how we intend to handle your data. It needs legal review, and an EU representative must be appointed, before TenderFlag launches.

Privacy notice

Version 2026-10-23-draft · Last updated 29 October 2026

This notice explains how TenderFlag handles personal data when you sign up for the free tender digest on this website. We collect as little as we can and never sell your data.

1. Who is responsible

The controller is Niels Nielsen, trading as TenderFlag, Sydney, Australia. Contact: aiventure@mail.grokbot.com (placeholder contact address).

Because we are based outside the EU and offer our service to businesses in the EU and EEA, we will appoint a representative in the EU under Article 27 GDPR. EU representative: to be appointed. Their contact details will be added here before launch.

2. What we collect

Your work email address and company name.
Your company's country, the categories and buyer countries you choose, the plan you're interested in and, if you give it, your VAT number.
Your time zone, read from your browser, so the digest arrives at 07:00 your time.
If you came through a partner's link, the partner's referral code from that link (it identifies the partner, not you).
A record of your consent: the date and time, and the version of the consent wording you agreed to.
If you click Relevant or Not relevant under a tender in a digest: your vote, the tender's notice number and the time, linked to your subscriber ID (not your email address). The link carries only a signed subscriber code, the notice number and your vote; it sets no cookie. Only your latest vote per tender is kept.
If you change your categories, buyer countries or specialism (on the preferences page or by signing up again): the old and new choice and the time, so we can tell whether a change helped your digest. These records are deleted together with your sign-up details.

No cookies. We don't use advertising trackers, and we only ever use privacy-friendly, cookieless analytics: if we switch it on, Plausible Analytics (EU-hosted) counts page views without cookies and without storing personal data or IP addresses. Your browser stores your currency choice (for example EUR, DKK, SEK, NOK or RON) locally; it is never sent to us.

3. Why we use it, and our legal basis

We use your details to send you the free tender digest you asked for, matched to your choices, and short service messages about it (for example, if the digest changes). Our legal basis is your consent (Article 6(1)(a) GDPR), which you give by ticking the box on the sign-up form. If you later buy a paid plan, we will process billing details to perform that contract (Article 6(1)(b)) and to meet tax and accounting duties (Article 6(1)(c)).

If you vote on tenders, we use your votes to improve which tenders we show you and to measure whether the digest is useful. Our legal basis is our legitimate interest in improving the service you asked for (Article 6(1)(f) GDPR); voting is optional, and votes are deleted together with your sign-up details.

We won't send you other marketing unless you separately agree to it.

4. Who we share it with

We use a small number of service providers (processors) who act only on our instructions:

Website hosting and form storage: Netlify, Inc. (USA).
Email delivery: Resend (Plus Five Five, Inc., USA).
Website analytics (if enabled): Plausible Insights OÜ (Estonia, EU), cookieless and without personal data.

Where data is transferred outside the EU/EEA, including to Australia and the USA, we will rely on an adequacy decision or the European Commission's standard contractual clauses. To be confirmed in legal review. We don't sell or rent personal data to anyone.

5. How long we keep it

We keep your sign-up details for as long as you receive the digest. If you unsubscribe or withdraw consent, we delete your details within 30 days, except a minimal record of the withdrawal so we don't email you again. Sign-ups that never receive a digest are deleted after 12 months. Billing records for paid plans are kept for as long as tax law requires.

6. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to its use, or send it to you in a portable format. You can withdraw consent at any time using the unsubscribe link in any digest or by emailing us; this doesn't affect processing done before you withdrew. Email aiventure@mail.grokbot.com and we'll reply within one month.

You can also complain to a data protection authority, for example Datatilsynet (Denmark), Integritetsskyddsmyndigheten (Sweden), Datatilsynet (Norway), the Data Protection Ombudsman (Finland), the Hellenic Data Protection Authority (Greece), AZOP (Croatia), ANSPDCP (Romania), the Commission for Personal Data Protection (Bulgaria) or the Information Commissioner (Slovenia), or the authority where you live or work.

7. Security

The site is served over HTTPS only. Access to sign-up data is limited to the people who run TenderFlag, and we review it regularly.

8. Changes

If we change this notice, we'll update the date above and, for important changes, tell you in the digest.