Privacy

This page explains what personal data TenderDesk handles, why, and the choices you have. The company named above is the controller of that data. For anything about your data, write to the address above.

What we collect

• Account: your email address and, if you give it, your name. Sign-in works with a one-time link sent to your email; we do not store passwords.
• Firm: the firm's name, country, website, email domain, VAT or registry number, and the result of the VAT check against the EU's VIES service.
• Profile: what your firm publishes: offices, people (names, roles, experience, languages, short bios), projects and images, and CVs uploaded to the firm's private files.
• Workspaces: files, sections, tasks, requests, invitations (including the email address of the person invited) and a log of who did what.
• Preferences: your shortlist, saved searches and email settings.
• Billing: payments are handled by Stripe. We receive and keep the customer and subscription reference, the plan status and the billing period; we never see full card details.
• Technical: our hosting providers keep short-lived logs (such as IP address, browser and time of request) for security and troubleshooting.

Why we use it

• To provide the service you signed up for: your account, your firm, workspaces, alerts and billing (performance of a contract).
• To check that a firm is real and that a person belongs to it, and to keep the service secure (our legitimate interest in a trustworthy directory and in preventing abuse).
• To send the emails you can control in your workspace: deadline and task reminders, saved-search matches and the weekly digest. Invitations are sent at the request of the person inviting.
• To meet legal obligations, such as keeping invoices.

We do not sell personal data, show advertising, or use tracking or analytics cookies.

Who can see it

• The public parts of a firm profile, including the people and projects the firm chooses to show, are visible to anyone.
• Workspace content is visible only to that workspace's members: the lead firm, accepted partner firms and invited guests.
• Service providers process data for us under contract: Supabase (database, sign-in and file storage), Vercel (hosting), Resend (email delivery) and Stripe (payments). Where a provider transfers data outside the European Economic Area, the transfer is covered by the European Commission's standard contractual clauses or an adequacy decision.
• If we add AI features (for example, summarising tender documents), we will say which provider processes the text and update this page before turning them on.

How long we keep it

• Account and firm data: while the account is active, and deleted within 60 days after you ask us or the firm closes its account.
• Workspace content: kept for the lead firm until it deletes it or closes its account.
• Billing records: as long as tax law requires (in Portugal, ten years).
• Email logs: what was sent to whom, to avoid duplicates, for up to two years.

Your rights

You can ask for a copy of your data, its correction or deletion, to restrict or object to its use, and to receive it in a portable format. You can change your email settings yourself in your workspace. If you think we have not handled your data properly, you can complain to the Portuguese data protection authority (CNPD) or the authority where you live.

Cookies

TenderDesk only uses the cookies needed to keep you signed in. They are not used for tracking and do not need consent.

Changes

If we change how we handle personal data, we will update this page and, for important changes, tell account holders by email.