Privacy Policy

1. Controller and scope

The responsible legal entity, privacy contact, representative or data-protection officer where required, applicable jurisdictions, effective date, and services covered by this policy must be inserted before publication.

2. Information Bidora may process

• Account information such as name, email address, verification state, linked sign-in method, and account classification.
• Organization, membership, role, permission, invitation, and account-security records.
• Tender and bid-preparation information supplied by authorized users, which may contain personal information selected by the customer.
• Authentication and security records such as password verifiers, opaque session records, MFA state, recovery events, audit evidence, and privacy-minimized abuse-prevention scopes.
• Technical and service records needed for reliability, security, diagnostics, usage limits, and support.
• Communications and delivery evidence, excluding message content where it is not needed.

3. Sources

Information may come from you, an organization that invites or administers you, authorized users uploading tender material, configured identity or service providers, and technical interactions with Bidora. The final policy must identify any approved public-source or third-party collection.

4. Purposes

• Create, verify, secure, and administer accounts and sessions.
• Apply memberships, permissions, organization isolation, and service limits.
• Provide tender-management, document, collaboration, notification, and requested AI-assistance features.
• Detect abuse, investigate incidents, preserve audit evidence, and meet legal obligations.
• Operate, troubleshoot, support, and improve the service using minimized information.

5. Legal bases

The final policy must map each purpose to the legal bases available in the approved jurisdictions, which may include performance of a contract, legitimate interests, legal obligations, and consent where appropriate. This draft does not select a legal basis or treat registration consent as consent for every processing purpose.

6. Sharing and subprocessors

Information may be disclosed only as needed to authorized organization members, contracted infrastructure or service providers, professional advisers, transaction counterparties where approved, and authorities where legally required. A reviewed subprocessor list, locations, purposes, safeguards, and change-notice process must be published before approval.

7. International transfers

Hosting regions, transfer destinations, transfer mechanisms, supplementary safeguards, and any localization commitments remain to be selected and documented. No transfer representation should be inferred from this draft.

8. Retention and deletion

Bidora should retain information only for approved operational, contractual, security, audit, procurement-integrity, and legal periods. The final schedule must distinguish account data, session and security evidence, invitations, tender documents, AI artifacts, communications, backups, legal holds, and customer-directed deletion or export.

9. Security

Bidora is designed to use access controls, organization isolation, encryption in transit, credential hashing, session protection, audit evidence, bounded provider access, and security monitoring appropriate to the deployment. No system is completely secure; the final policy must include an approved incident-contact and notification process without disclosing controls that would increase risk.

10. Cookies and similar technologies

Bidora uses strictly necessary browser cookies for sessions, CSRF protection, and authentication transactions. Any analytics, preference, advertising, or non-essential technology must be separately inventoried and governed before use.

11. Your rights

Depending on applicable law, people may have rights to access, correct, delete, restrict, object, port information, withdraw consent, or complain to a regulator. The final policy must identify available rights, exceptions, identity-verification steps, response channels, and applicable supervisory authorities.

12. Children and sensitive information

The intended minimum user age and process for handling children’s information require legal approval. Users should not upload sensitive or special-category information unless authorized and necessary for an approved purpose.

13. Automated assistance

AI-assisted outputs are proposals requiring human review. The final policy must disclose approved model providers, data categories, retention controls, training restrictions, regional processing, human-decision boundaries, and available objections or alternatives where legally required.

14. Changes and contact

The final policy must provide privacy and complaint contacts, material-change notice, effective dates, archived versions, and any required re-acknowledgement process.

Items required before approval

• Controller identity, contacts, jurisdictions and supervisory authority.
• Purpose-by-purpose legal bases and a reviewed retention schedule.
• Approved subprocessors, processing locations and transfer safeguards.
• Rights-request, incident, children’s-data and complaint procedures.
• Effective date and immutable publication identifier.