Privacy Policy

1. Data Controller

The data controller for this website is: ,
Email: info@bidpilot24.com

2. Principles and Data Sources

We process personal data only for the purposes described in this policy, on the legal basis stated in each case, and only for as long as required by the purpose or a statutory retention obligation. We obtain data directly from you and from your use of the platform. Tender content originates from publicly available announcements of the connected procurement sources; contact details of contact persons contained therein may constitute personal data — public availability does not exclude a personal reference.

3. Server Access and Security

When you visit the website we process the technically required connection data (IP address, date and time, requested address, browser type and version, and referrer address). The purpose is delivering the pages, diagnosing errors and preventing abuse. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure operation) and, for requested functions, Art. 6(1)(b) GDPR. We operate the platform on infrastructure we manage, hosted by a hosting provider in Germany.

4. Registration, Account and Organisations

At registration we process your email address, optionally a username, your password (stored as a cryptographic hash only), the language setting, and sign-in times and IP addresses. For your organisation we store the organisation name, membership roles, and the plan and subscription status. The purpose is account creation, sign-in, platform operation and contractual performance. The legal basis is Art. 6(1)(b) GDPR; for security and abuse logs additionally Art. 6(1)(f) GDPR.

5. Search Profiles and Tender Data

We store your search profiles (profile name, search and exclusion keywords, regions and settings), retrieved tender content, match and evaluation results, and your processing states, to the extent you use these features. Tender texts may contain personal data of third parties (e.g. names and contact details of contact persons at the contracting authorities); we process these solely as part of the publicly available tender content. The legal basis is Art. 6(1)(b) GDPR.

6. AI-powered Features

When you use an AI feature (e.g. the profile assistant, match evaluation, matching explanations), the content required for it is transmitted to the configured AI provider: for the profile assistant your freely entered description, otherwise search profile details and the title, description, contracting authority, deadlines and structured details of the relevant tender. This content may unintentionally contain personal data. AI results are automated assistance, not a binding professional or legal decision; always verify the original tender and its deadlines.

Currently configured AI providers:

• Opper (EU)

The provider processes the data on the basis of the respective processing or service agreement; for providers outside the EEA the safeguards agreed there (e.g. EU Standard Contractual Clauses) apply. When a model hosted on our own infrastructure is used, the data remains with us.

7. Payment Processing

For paid plans, we use Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA) for payment processing, billing and invoicing. When BidPilot creates a Stripe customer, it sends the organisation name, the organisation owner's email address and internal organisation identifiers (ID/slug). For Checkout and subscription API requests, we send the Stripe customer ID, plan metadata and, where applicable, a coupon code. The payer enters the billing address and any VAT ID directly on Stripe's hosted Checkout page; Stripe collects these details and updates its customer profile. Stripe sends Checkout, subscription and payment events to our webhook endpoint. A completed Checkout event may include an entered VAT ID in its session details; our handler uses status, identifiers and metadata but does not store the billing address or VAT ID in BidPilot's database. We receive and store Stripe-generated customer and subscription IDs for contract administration; the customer ID is reused in later API requests to Stripe. Card details are entered directly with Stripe; full card numbers are not stored in our application. The legal basis is Art. 6(1)(b) GDPR and, for tax retention obligations, Art. 6(1)(c) GDPR. Transfers to the USA rely on EU Standard Contractual Clauses.

8. Electronic Withdrawal Function

For an electronic contract withdrawal declaration we store the name, linked organization and customer number, owner email used for the acknowledgment, receipt time, reference, identification method and verification status. The electronic form resolves a customer number or owner email to an organization and sends the acknowledgment to the registered owner email. For an informal declaration received by email or post, the internal team records the sender's name, available contact details, contract information, receipt time and any supporting document, even if the organization cannot be identified immediately. The sender's contact details are not treated as proof of organization ownership. A hashed key derived from the IP address is temporarily cached to limit repeated electronic form attempts and expires after one hour. The purpose is to receive, document, limit abuse of and process declarations. The legal basis is Art. 6(1)(b) GDPR and, where applicable, Art. 6(1)(c); point (f) may apply where necessary to establish, exercise or defend legal claims. Verified or manually recorded declarations are retained under the current rule for up to six years after the end of the calendar year of receipt; unverified electronic submissions are deleted after 14 months.

For an informal withdrawal received by e-mail or post, the internal team may optionally attach a scan or photo of the letter or a printout of the e-mail (PDF or image) to the record as evidence. The file may contain personal data in the declaration and details of third parties named in it. It is deleted with the withdrawal record on the same schedule: verified or manually recorded declarations under the current rule after up to six years from the end of the calendar year of receipt; unverified electronic submissions after 14 months.

9. Email Communication

For account confirmations, password resets, team invitations, match digests and subscription-related notices we send emails via our own mail server; no data is transmitted to an external email delivery provider. Processed are the recipient address and the content required for the message in each case. The legal basis is Art. 6(1)(b) GDPR.

10. Cookies and Consent Management

Technically required are the session cookie (authentication and session state), which is deleted when you close your browser, and — only when the “Stay signed in” option is activated — a sign-in cookie with a lifetime of two weeks. The legal basis is § 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(b) GDPR.

For audience measurement we use a self-hosted Matomo instance on our own infrastructure; no data is transmitted to third parties. The analytics script is only loaded after you have consented to the analytics category in the cookie banner. Once consent is given, Matomo sets its own recognition cookies (visitor ID, session and consent status; lifetimes up to 13 months). The visitor location is approximated from the IP address; only the anonymized address is stored. We record your consent in a consent record and also store your choice in your browser storage (localStorage, key “cookie_consent”); you can change or withdraw it at any time via the cookie settings in the footer. The legal basis is § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.

For the evaluation of advertising campaigns we use — only after you have consented to the marketing category in the cookie banner — the Meta Pixel provided by Meta Platforms Ireland Ltd. The script is loaded only after consent has been given; connections to Meta servers are then established and Meta sets its own cookies (“_fbp”, “_fbc”) that allow Meta to recognise your browser. A transfer to third countries (in particular the USA) cannot be ruled out. The legal basis is § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR; you may withdraw your consent at any time via the cookie settings in the footer.

11. Marketing and Performance Measurement with Meta

With your prior consent we use technologies provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”) on our website. This includes in particular the Meta Pixel, which allows us to measure the effectiveness of our advertisements on Facebook and Instagram, to analyse how our website is used after an advertisement has been viewed, and to optimise our advertising campaigns.

Where corresponding features are used, the collected information may also be used to build audiences for personalised advertising (retargeting).

When these technologies are used, in particular your IP address, browser and device information, pages viewed, referrer URLs, the times of page views, cookie identifiers and information about certain actions on our website may be processed and transmitted to Meta; this includes page views (PageView), clicks on offer buttons (Lead, Contact), the start of an ordering process (InitiateCheckout), completed registrations (CompleteRegistration), the start of a trial period (StartTrial) and completed subscription orders (Subscribe). Meta may link this information to existing Facebook or Instagram accounts.

Processing takes place exclusively on the basis of your prior consent pursuant to Art. 6(1)(a) GDPR and, where applicable, § 25(1) TDDDG. Without your consent we do not activate any marketing technologies requiring consent; the Meta Pixel script is only loaded after you have consented to the marketing category in the cookie banner. You may withdraw or change your consent at any time with effect for the future via the cookie settings in the footer.

Where we jointly determine with Meta the purposes and means of the collection and transmission of personal data, joint controllership within the meaning of Art. 26 GDPR applies. The details are set out in the corresponding agreement with Meta:

https://www.facebook.com/legal/controller_addendum

In the course of processing, personal data may also be transferred to recipients outside the European Economic Area, in particular to the USA. Such transfers are made on the basis of the applicable requirements of Chapter V GDPR, in particular an adequacy decision pursuant to Art. 45 GDPR or appropriate safeguards pursuant to Art. 46 GDPR. Which safeguards Meta applies is governed by Meta’s current contractual terms.

Once you have given your consent, Meta sets its own cookies to recognise your browser, in particular “_fbp” (browser identifier) and “_fbc” (click identifier relating to an advertisement); according to Meta each of these has a lifetime of up to 90 days. These cookies are deleted by our website when you withdraw your consent.

Further information on the processing of personal data by Meta can be found in Meta’s privacy policy:

https://www.facebook.com/privacy/policy/

12. Voice Input

When you voluntarily use the voice input feature, the audio is processed by the speech recognition built into your browser. Depending on your browser, this may create a connection to the browser vendor (e.g. Google, Apple, Microsoft). Audio data is neither stored nor further processed by us.

13. Error Monitoring

For error diagnostics we use Sentry (Functional Software, Inc., USA). On an error, technical event data is transmitted; the IP address, request headers, cookies and the user identity are filtered out before transmission, and only a limited share of events is sent (sampling). The purpose is error analysis and stable operation; the legal basis is Art. 6(1)(f) GDPR (legitimate interest). Transfers to the USA rely on EU Standard Contractual Clauses.

14. Recipients and Third-country Transfers

Processors receive personal data only on the basis of suitable contracts and our instructions. Recipient categories include a hosting provider in Germany, payment processing (Stripe), AI providers (see section 6) and error monitoring (Sentry). File storage uses a self-managed Garage instance in Germany; Kopia backups are stored via the rclone backend with a storage provider in Germany. Email delivery and audience measurement run on our own infrastructure. For transfers to third countries (currently the USA for Stripe and Sentry) we rely on EU Standard Contractual Clauses.

If the Meta Pixel is enabled and you have consented to the marketing category, Meta Platforms Ireland Ltd. (Ireland) also receives tracking data; a transfer to the USA cannot be ruled out. Further information can be found in the section “Marketing and Performance Measurement with Meta”.

15. Retention Period

We delete or anonymise personal data as soon as the respective purpose ceases to apply and no statutory retention obligation or necessary legal defence stands in the way. Account data is removed when you delete your account. Organisation data is not physically removed on deletion but marked as deleted; it remains stored as evidence of existing contractual and billing relationships while no longer being accessible for regular use. Withdrawal declarations are retained for up to six years after the end of the calendar year of receipt; unverified submissions are automatically deleted after 14 months. Billing and invoice data is subject to the statutory retention periods under tax and commercial law (§ 147 AO, § 257 HGB). Kopia backup copies of the database and file store are kept with a storage provider in Germany for up to 1,095 daily restore points (about three years) for recovery purposes. Data already deleted from live systems may remain in those copies until rotation expires. Before restored systems return to normal use, applicable deletions due since the snapshot must be applied again.

16. Your Rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing and data portability, as well as — where processing is based on legitimate interests — the right to object. You may withdraw a given consent at any time with effect for the future. You also have the right to lodge a complaint with the competent data protection supervisory authority.

Please direct privacy requests to: info@bidpilot24.com

17. Automated Decisions

BidPilot produces AI-based match and relevance assessments as decision support. Whether you pursue a tender and submit a bid is decided exclusively by you; no automated decision with legal or similarly significant effect on a natural person within the meaning of Art. 22 GDPR takes place.

18. Changes to this Policy

The current version of this privacy policy is published on this page with its date of issue. We will inform you of material changes before they take effect, where legally required.