Privacy Policy
This Privacy Policy explains how Klokk Nettablering ("Tenderax", "we", "us") collects, uses, and protects personal data when you use tenderax.com and the Tenderax application. It is written to comply with the EU General Data Protection Regulation (GDPR).
1. Data controller
Klokk Nettablering, a Norwegian enkeltpersonforetak, is the data controller for personal data processed through the Tenderax website and account system. For data you upload about your own customers or business contacts as part of using the service, you are the controller and Klokk Nettablering acts as processor — see our Data Processing Agreement.
2. What we collect
- Account data: name, work email, company name, password hash, billing details (processed by Stripe, see below).
- Company profile / ICP data: the description of your business, sectors, and criteria used to generate AI relevance scores.
- Uploaded documents: tender documents or company documents you submit for AI analysis ("document grilling").
- Usage data: pages viewed, features used, search and filter activity, log data.
- IP address: collected transiently to detect your country for currency display; not stored beyond a 1-hour cache.
3. Legal basis for processing
- Contract (Art. 6(1)(b) GDPR): account creation, subscription billing, delivering AI scoring and citation features.
- Legitimate interest (Art. 6(1)(f) GDPR): product analytics, fraud prevention, and — where applicable — first-party outreach to inbound leads. Any use of legitimate interest as a basis for direct marketing is supported by a documented Legitimate Interests Assessment; see /legal/lia for the current assessment and jurisdiction routing, including the fact that cold outbound outreach is presently limited to a US test cohort and is not active elsewhere.
- Consent (Art. 6(1)(a) GDPR): non-essential cookies and any marketing communication where consent is the applicable basis under local law.
4. Sub-processors
We use the following sub-processors to deliver the service. Each is bound by a data processing agreement consistent with GDPR Article 28.
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS SES) | Transactional email delivery | EU (eu-north-1, Stockholm) |
| Stripe | Payment processing and billing | United States |
| Anthropic (Claude API) | AI relevance scoring and document analysis | United States |
| ip-api.com | IP-based country detection for currency display (Redis-cached, 1 hour) | United States |
| Hetzner Online GmbH | Application hosting | Germany (EU) |
5. International transfers
Where personal data is transferred to sub-processors located outside the EU/EEA (Stripe, Anthropic, ip-api.com — all United States), the transfer is safeguarded by the European Commission's Standard Contractual Clauses (SCCs), supplemented by additional technical and organisational measures as required. A copy of the applicable transfer safeguards is available on request to [email protected].
6. Retention
Account and billing data is retained for the duration of your subscription plus the period required by Norwegian bookkeeping law (generally 5 years for accounting records). Uploaded documents and AI analysis results are retained until you delete them or close your account, after which they are permanently deleted within 30 days. Usage logs are retained for up to 12 months for security and product-improvement purposes.
7. Your rights
Under GDPR you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate data;
- Erase your data ("right to be forgotten"), subject to legal retention obligations;
- Port your data to another provider in a structured, machine-readable format;
- Object to processing based on legitimate interest, including any marketing use;
- Lodge a complaint with your local data protection authority — in Norway, Datatilsynet.
You can submit a Data Subject Access Request (DSAR) directly from your account settings in the app, or by emailing [email protected]. We respond within 30 days.
8. Cookies
Tenderax uses only essential cookies required for authentication and session management — no advertising or tracking cookies. The application interface loads Google Fonts, which may result in your browser making a request to Google's servers when the page loads; no Tenderax account data is shared with Google as part of this.
9. AI processing transparency
Tender scoring and document analysis are performed by the Anthropic Claude API. Public tender notice data and your company profile are sent to Anthropic solely to generate your results; this data is not used by Anthropic to train its models under our commercial API terms. Full methodology and disclosure under the EU AI Act is published at /legal/ai-transparency.
10. Security
We apply encryption in transit (TLS) and at rest, access controls limiting data access to authorised personnel, and regular review of our infrastructure and sub-processor agreements. No system is completely secure, and we encourage you to use a strong, unique password for your account.
11. Children
Tenderax is a B2B service not directed at or intended for use by individuals under 16. We do not knowingly collect data from children.
12. Changes to this policy
We may update this Privacy Policy to reflect changes in our processing activities or legal requirements. Material changes will be notified by email or in-app notice at least 14 days before taking effect.
13. Contact
Data protection queries can be sent to [email protected].
← Back to Tenderax