Privacy Policy

Last updated: July 2025

1. Introduction

TenderPro ("we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect your information in accordance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679) and Greek Law 4624/2019.

2. Data Controller

The data controller for the purposes of this policy is:

  • Company: TenderPro
  • Email: info@tenderpro.gr
  • Location: Greece

3. Data We Collect

We collect and process the following categories of personal data:

3.1 Account Data

  • Email address
  • Username
  • Password (stored encrypted)
  • Company/organization name

3.2 Trial Request Data

  • Company name, contact person name, email, phone number (optional)

3.3 Contact Form Data

  • Name, email, subject, message content

3.4 Usage Data

  • Theme and language preferences
  • CPV code selections
  • Tender notes and assignments

3.5 Technical Data

  • IP address, browser type, operating system
  • Access times and pages visited (via server logs)

4. Legal Basis for Processing

We process your data based on the following legal grounds under GDPR Article 6:

  • Contract performance (Art. 6(1)(b)): To provide our platform services
  • Legitimate interests (Art. 6(1)(f)): To improve our services and ensure security
  • Consent (Art. 6(1)(a)): For trial requests and contact form submissions
  • Legal obligation (Art. 6(1)(c)): To comply with applicable laws

5. How We Use Your Data

  • To provide and maintain the TenderPro platform
  • To create and manage your user account
  • To process trial requests and contact inquiries
  • To send service-related communications
  • To improve and optimize our platform
  • To ensure security and prevent fraud

6. Data Storage & Security

Your data is stored on servers located within the European Union (Hetzner Cloud, Germany). We implement appropriate technical and organizational measures to protect your data, including:

  • SSL/TLS encryption for all data in transit
  • Encrypted password storage using bcrypt hashing
  • JWT-based authentication with token expiration
  • Firewall-protected server infrastructure
  • Regular security updates and patches

7. Data Retention

  • Account data: Retained for the duration of your subscription, plus 30 days after account deletion
  • Trial requests: Retained for 12 months
  • Contact messages: Retained for 12 months
  • Server logs: Retained for 90 days

8. Data Sharing

We do not sell, rent, or trade your personal data. We may share data only with:

  • Infrastructure providers: Hetzner Cloud (hosting) — acting as data processors under GDPR
  • Legal authorities: When required by law or court order

9. Your Rights Under GDPR

You have the following rights regarding your personal data:

  • Right of access (Art. 15): Request a copy of your personal data
  • Right to rectification (Art. 16): Correct inaccurate data
  • Right to erasure (Art. 17): Request deletion of your data ("right to be forgotten")
  • Right to restrict processing (Art. 18): Limit how we use your data
  • Right to data portability (Art. 20): Receive your data in a machine-readable format
  • Right to object (Art. 21): Object to processing based on legitimate interests
  • Right to withdraw consent: Withdraw consent at any time without affecting prior processing

To exercise any of these rights, contact us at info@tenderpro.gr. We will respond within 30 days.

10. Cookies

We use only essential cookies required for the platform to function (authentication tokens, theme/language preferences stored in localStorage). We do not use tracking cookies or third-party analytics. See our Cookie Policy for more details.

11. International Data Transfers

All data is processed and stored within the European Economic Area (EEA). We do not transfer data outside the EEA.

12. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to file a complaint with the Hellenic Data Protection Authority (HDPA):

  • Hellenic Data Protection Authority (ΑΠΔΠΧ)
  • Kifisias 1-3, 115 23 Athens, Greece
  • Website: www.dpa.gr

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically.

14. Contact

For questions about this Privacy Policy or your personal data, contact us at: