Tender Melvin Privacy Policy
Last updated: 18 October 2026
This policy explains what personal data Tender Melvin processes, why, and what rights you have. The controller is Mango Group OÜ, registry code 17595240, Sepapaja tn 6, Tallinn 15551, Estonia, [email protected]. The service is meant for businesses; the personal data we hold is mostly that of the people who use an account.
1. What we process and why
| Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|
| Account: e-mail address, name, password (stored only as a salted hash), confirmation and reset links | Create and secure your account, sign you in, contact you about the service | Contract (1)(b) |
| Company profile: company name, website, country, size, sectors, turnover, certificates, reference projects, operating countries, documents you upload and the text we read from them | Match tenders to your company and assess eligibility | Contract (1)(b) |
| Monitors, subscriptions, your feedback on tenders, which tenders were sent to you | Deliver and improve the matching, avoid sending the same tender twice | Contract (1)(b); legitimate interest (1)(f) |
| Billing: Stripe customer and subscription identifiers, plan, amounts, dates. Card details are handled by Stripe only | Charge for the service, issue invoices, keep accounting records | Contract (1)(b); legal obligation (1)(c) |
| E-mails we send you and their delivery status (subject, number of items, success) | Provide the daily digest and service messages, find delivery problems | Contract (1)(b); legitimate interest (1)(f) |
| Technical data: IP address, browser, requested pages in server logs (kept 14 days); short-lived counters used to limit repeated sign-in or reset attempts | Operate and protect the service, prevent abuse | Legitimate interest (1)(f) |
Public tender data. We also process publicly available procurement notices. Such a notice can contain the name and contact details of a person at the contracting authority. We keep only what the notice publishes and use it only to show you the tender (legitimate interest).
We do not sell personal data, and we do not use it for advertising.
2. Who receives it
We use these providers (processors) to run the service:
- Rackforest Zrt.: hosting of our application server. We run our own database and our own mail server for service e-mails.
- Cloudflare: network protection and delivery of our websites (it sees the traffic to them).
- Stripe: payments and subscriptions.
- Google (Google Analytics, website only, only with your consent): visit statistics - pages viewed, device and browser type, approximate location; Google does not store IP addresses in Google Analytics 4.
- Anthropic (AI): reads tender texts to classify them and, when you use the onboarding or certificate reading, the company website text and documents you provide.
- OpenAI (AI): turns tender texts and your monitor profile text into numerical embeddings used for matching.
The AI providers process the content only to answer our requests, under their business/API terms that do not allow them to train their models on it. Providers outside the EEA (for example in the United States) receive data under the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. We disclose data to authorities where the law requires it.
3. How long we keep it
- Account and company data: as long as your account exists. When you delete the account, they are deleted at once; copies in our daily backups disappear when the backups rotate.
- Invoices and accounting records: as long as accounting law requires; they stay with Stripe and us.
- Server logs: 14 days.
4. Your rights
You have the right to access, correct, delete, restrict and object to the processing of your personal data, and to receive it in a portable form.
- Download your data and delete your account yourself on the Account page of the portal.
- For anything else, write to [email protected]; we answer within one month.
- You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or to the authority of your own country.
5. Security
Traffic is encrypted (TLS), passwords are stored hashed, sign-in and reset attempts are rate-limited, access to the servers is restricted and the database is backed up daily. No system is perfectly secure; if a breach affects you we will notify you and the authority as the law requires.
6. Cookies
See our Cookie notice: one cookie keeps you signed in to the portal; on the website we use Google Analytics only if you accept it (your consent; you can withdraw it at any time).
7. Changes
If we change this policy in a material way we will tell you by e-mail before it applies. The date above shows the current version.