1. Parties

This Data Processing Agreement ("DPA") is entered into between:

Controller: The customer ("you" or "Customer") who has accepted the Tender Analyzer Terms of Service and uses the Service to process tender documents
Processor: Tender Analyzer ("we," "us," or "Processor"), the entity operating https://www.tender-analyzer.com and https://app.tender-analyzer.com

This DPA supplements and forms part of the Terms of Service. In the event of a conflict between this DPA and the Terms of Service, this DPA shall prevail with respect to data processing matters.

2. Definitions

Personal Data: Any information relating to an identified or identifiable natural person, as defined in Article 4(1) of the GDPR
Processing: Any operation performed on Personal Data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, erasure, or destruction
Data Subject: An identified or identifiable natural person whose Personal Data is processed
Sub-processor: Any third party engaged by the Processor to process Personal Data on behalf of the Controller
Supervisory Authority: An independent public authority established by an EU Member State pursuant to Article 51 of the GDPR

3. Scope of Processing

3.1 Purpose

The Processor processes Personal Data solely to provide the Tender Analyzer service, which includes:

Document analysis of uploaded tender files (PDF, Excel, DOCX, CAD)
Extraction of technical specifications and structured data from documents
Temporary storage of documents for the duration of processing
Generation and storage of extraction results

3.2 Types of Personal Data

Personal Data processed may include names, contact details, and business information contained within uploaded tender documents. The Processor does not intentionally collect or extract Personal Data from documents; any Personal Data present is incidental to the technical specification extraction.

3.3 Data Subjects

Data Subjects may include the Controller’s employees, clients, partners, and any individuals referenced within uploaded tender documents.

4. Sub-processors

The Controller authorizes the Processor to engage the following Sub-processors. The Processor shall notify the Controller of any intended changes to this list at least 30 days in advance.

Sub-processor	Purpose	Location
Hetzner Online GmbH	Cloud hosting and infrastructure	Germany (EU)
OpenRouter / Together AI	LLM inference for document analysis (API-only, no data retention)	United States
SMTP provider	Transactional email delivery (verification, notifications)	EU / United States

LLM inference providers process document content via API calls only. They do not store, retain, or use submitted data for model training. All API calls are encrypted in transit via TLS.

5. Data Retention

The Processor retains Personal Data only as long as necessary to provide the Service:

Uploaded documents: Deleted 90 days after analysis completion
Account data: Retained until the Controller deletes their account
Usage logs: Retained for 12 months for security monitoring and service improvement
Extraction results: Retained until deleted by the Controller or upon account closure

Upon termination of the Service agreement, the Processor shall delete or return all Personal Data within 30 days, unless retention is required by applicable law.

6. Security Measures

The Processor implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

Encryption in transit: All data transmitted using TLS 1.3
Encryption at rest: AES-256 encryption for stored documents and data
Access control: Row-Level Security (RLS) database policies ensuring strict tenant isolation
Authentication: JWT-based access control with short-lived tokens
Rate limiting: Protection against abuse and denial-of-service attacks across all endpoints
Infrastructure isolation: Dedicated server environment with containerized services
Automated backups: Daily encrypted database backups

7. Data Subject Rights

The Processor shall assist the Controller in fulfilling its obligations to respond to Data Subject requests under Chapter III of the GDPR, including:

Right of access (Article 15) — obtain a copy of Personal Data being processed
Right to rectification (Article 16) — correct inaccurate Personal Data
Right to erasure (Article 17) — request deletion of Personal Data
Right to restriction (Article 18) — restrict the processing of Personal Data
Right to data portability (Article 20) — receive Personal Data in a structured, machine-readable format
Right to object (Article 21) — object to processing of Personal Data

The Processor shall respond to Data Subject requests forwarded by the Controller without undue delay and within 30 days at the latest.

8. Breach Notification

In the event of a Personal Data breach, the Processor shall:

Notify the Controller without undue delay and no later than 72 hours after becoming aware of the breach, in accordance with GDPR Article 33
Provide the Controller with sufficient information to meet its obligation to report the breach to the relevant Supervisory Authority
Cooperate with the Controller and take reasonable steps to assist in the investigation, mitigation, and remediation of the breach
Document all breaches, including the facts relating to the breach, its effects, and the remedial actions taken

9. International Transfers

The Processor stores all primary data within the European Union (Hetzner, Germany).

Where document content is transmitted to LLM inference providers located outside the EU (OpenRouter, Together AI), such transfers are made via encrypted API calls. These providers process data in real-time and do not retain submitted content. The Processor ensures that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) where required under Chapter V of the GDPR.

The Controller acknowledges that document content is transmitted to LLM providers for the sole purpose of AI-powered extraction and that no Personal Data is intentionally included in these transmissions.

10. Audit Rights

The Controller, or an independent third-party auditor appointed by the Controller, may audit the Processor’s compliance with this DPA, subject to the following conditions:

The Controller shall provide at least 30 days’ written notice before any audit
Audits shall be conducted during normal business hours and shall not unreasonably disrupt the Processor’s operations
The Controller shall bear the costs of any audit, unless the audit reveals a material breach by the Processor
The Processor shall make available all information necessary to demonstrate compliance with the obligations set out in this DPA

11. Governing Law

This DPA is governed by and construed in accordance with the laws of the European Union and the applicable laws of the Member State where the Controller is established. Any disputes arising under this DPA shall be subject to the exclusive jurisdiction of the competent courts of that Member State.

12. Contact

For questions regarding this Data Processing Agreement or to exercise any rights under this agreement, contact us at:

Legal: [email protected]
Privacy: [email protected]
Website: https://www.tender-analyzer.com