Privacy policy

Who is responsible for your data

The controller of your data is biddecide, the public-tender intelligence service available at biddecide.com. For any question about this policy, write to [email protected].

Postal address: postal zone 8050, Venezuela.

EU representative (Article 27 GDPR): not yet appointed. Until one is designated, every data-protection request is handled directly at [email protected].

We operate from Venezuela and deliberately offer our services to businesses in the European Union and the United States. That is why the EU General Data Protection Regulation (GDPR) applies to us even though we have no establishment in the EU (Article 3.2), and why US anti-spam law (CAN-SPAM) applies as well. We process personal data of individuals: the fact that the company we contact is a legal entity changes nothing, because a procurement manager's name and work email address are personal data.

What data we process and where it comes from

• Professional contact data: name, job title, company, country and work email of procurement and bid-responsible staff. It comes from public sources: official tender portals, company websites and public professional directories.
• Subscription data: your email address and the minimum details you give us to subscribe to the radar or the newsletter.
• Billing data: name, company, tax identification, country and payment references. We do not store full card details; when card payments are available, they will be handled entirely by the payment processor.
• Usage and security data: radar queries, memos downloaded, technical access logs and aggregate site analytics.
• Correspondence: the emails you exchange with us.

Why we use your data and on what legal basis

• B2B outreach by cold email to professional addresses: legitimate interest (Article 6(1)(f) GDPR). We only contact people in their professional capacity, on a subject tied to their role (public tenders), and every message offers an immediate opt-out.
• Newsletter and product updates: consent (Article 6(1)(a)), which you can withdraw at any time using the unsubscribe link.
• Delivering the service you bought (account, tender radar, decision memos): performance of a contract (Article 6(1)(b)).
• Billing and accounting or tax duties: legal obligation (Article 6(1)(c)).
• Security, abuse prevention and technical logs: legitimate interest.
• Site analytics: legitimate interest where no non-essential cookies are involved; consent where they are.
• Payment processing and basic counterparty checks: performance of a contract and compliance with legal obligations.

We do not profile you and we do not make automated decisions that produce legal effects for you.

Cold email and your immediate right to object

We may email you for the first time at your work address without you having asked us to. We do so because we believe there is a legitimate interest in introducing a service that is useful for your job, and we have weighed that interest against your rights before writing. If you do not want to hear from us again:

• every email carries a one-click unsubscribe link; you can also simply reply with "unsubscribe" or "stop";
• we process opt-outs within 10 business days and keep the opt-out mechanism working for at least 30 days;
• we do not email you again and we do not pass your address to third parties because you opted out; we keep your address only on a suppression list so that we never contact you again;
• in Germany, Austria and other EU countries that require prior consent even for B2B email, we ask for your consent first or do not contact you at all.

If you are in the United States, this notice is our CAN-SPAM compliance statement: our messages clearly identify biddecide as the sender, use a truthful subject line, are labelled as a commercial message, include our physical postal address and offer an opt-out mechanism. CAN-SPAM applies to business-to-business email as well — there is no B2B exception.

Who else can see your data

We do not sell your data. It is handled on our behalf, as processors under a data processing agreement (Article 28 GDPR), by the providers we strictly need:

• Cloudflare: hosts the site (Cloudflare Pages) and provides DNS, security and cookie-free aggregate analytics.
• Our email provider: hosts the mailbox we write from; the server is in Germany.
• Our payment processor: Binance Pay (USDT) for crypto payments. We never see or store your card data, and card payment is not enabled yet.
• Professional advisers (accountants or lawyers) where necessary, and public authorities where we have a legal obligation.

International transfers

Some of these providers are in the United States or process data outside the European Economic Area. In those cases we rely on the Standard Contractual Clauses approved by the European Commission (Article 46 GDPR) and, where the provider is certified, on the EU-US Data Privacy Framework. You can ask us for more detail.

How long we keep data

• B2B prospects: 24 months from the last contact, or until you object, whichever comes first. A professional contact stops being relevant once the person changes role or employer.
• Suppression list for people who opt out: kept without a fixed term, for the sole purpose of not contacting you again.
• Newsletter subscribers: for as long as you are subscribed and 6 months after you unsubscribe, so we can prove the opt-out happened.
• Customers and billing records: for the duration of the relationship and up to 6 years afterwards, to meet accounting and tax obligations.
• Delivered memos: up to 24 months from delivery, so you can revisit them and we can handle any claim.
• Technical and security logs: up to 12 months.
• Aggregate analytics: up to 14 months.

Your rights and how to use them

You can exercise at any time your rights of access, rectification, erasure, objection, portability and restriction, and withdraw any consent you gave, by writing to [email protected]. You do not need to justify an objection to commercial email — simply ask. We reply within one month, extendable by two further months for complex requests, and we will tell you if we extend.

If you believe we have mishandled your data, you have the right to lodge a complaint with a supervisory authority: in the EU/EEA country where you live, where you work, or where the alleged infringement took place. We would appreciate hearing from you first — these matters are usually settled in a few days.

Security

We apply measures that are reasonable and proportionate to the risk: encryption in transit (HTTPS), access control on our systems, strong passwords and reinforced authentication on admin panels, backups and access logging. If a security breach put your rights at risk, we would notify the supervisory authority within 72 hours where required and inform you without undue delay.

Changes to this policy

We will publish any relevant change here and update the date below. Last updated: 16 October 2026.