Privacy policy

1. Who we are

The controller is Thorgate Digital OÜ, registry code 14376128, Mäealuse 2/1, 12618 Tallinn, Estonia (“we”, “us”).

Contact for data protection questions: [email protected]. We have not appointed a data protection officer.

2. Our role and the buyer’s role

TendoGate is used by buyer organisations under a licence agreement with us, and by the suppliers they invite. Suppliers do not need a licence agreement.

We are the controller for user accounts, security and activity records, the company data we obtain from the Estonian e-Business Register, and error monitoring.

For the data a buyer enters about its own procurement — supplier contacts it adds or imports, the invitations it sends, its tender documents and its evaluation notes — and for the bids it receives, the buyer decides why the data is processed, and we process it on the buyer’s behalf. For that data the buyer’s own privacy notice applies.

3. What personal data we process

We process the following categories of personal data.

• Account data: your name, email address, preferred email language, a one-way hash of your password (never the password itself), when the account was created, when you confirmed your email address, and whether the account is active. For buyer staff also the organisation, role (administrator, buyer or viewer) and organisational unit.
• Company and contact data: company name, registry code, legal address, website and registry status; the contact email address and phone number the Estonian e-Business Register holds for the company; contact persons a buyer adds for a supplier (name, email address, phone number); and the buyer’s own notes and category tags for that supplier. Company data is personal data where it relates to an identifiable person, for example a sole trader or a named contact.
• Tenders and invitations: the name and email address a supplier was invited under, as they were at the time of the invitation; invitation status and sending time; and the buyer’s contact person for a tender (name, email address, phone number) and the users responsible for it.
• Bids: the contact person’s name, email address and phone number given on a bid, the price, comment and bid files, every earlier version of a bid (kept when a bid is changed or withdrawn), and clarification requests and replies about a bid.
• Questions and answers: questions suppliers ask about a tender, the buyer’s answers, and every earlier version of an edited answer together with who gave it.
• Activity records: an append-only audit trail recording who did what and when, including the old and new values of changed fields (for example an invited email address); a record of every view and download of a bid after bids are opened; and, when an invitation link is opened, the time, IP address and browser identifier (user agent), plus the account email address when the invited person first uses the invitation with their account.
• Email delivery records: recipient address, message type, the content needed to send the message, delivery status, number of attempts and the reason for any failure.
• Technical data: IP addresses, used to limit repeated sign-in attempts and recorded in server logs; and error reports (see “Service providers”).

4. Where the data comes from

We obtain personal data:

• from you, when you create an account, fill in a form or submit a bid;
• from the buyer that invites you or adds you as a supplier contact, including supplier lists a buyer provides to us for import;
• from the Estonian e-Business Register (Äriregister), maintained by the Centre of Registers and Information Systems (RIK): company details and, where the register holds them, the company’s contact email address and phone number;
• from TendoGate itself, as records of how it is used;

5. Why we process it and on what basis

We process personal data for the following purposes and on the following legal bases under the General Data Protection Regulation (GDPR):

• Providing TendoGate: user accounts, sign-in, running tenders, sending invitations and tender notices, receiving and opening bids. Where the buyer or supplier is itself a natural person (a sole trader), the basis is performance of a contract with them (Article 6(1)(b)); for the staff and representatives who use TendoGate on an organisation’s behalf, it is the legitimate interest of that organisation and of us in operating the procurement (Article 6(1)(f)).
• Keeping an audit trail and records of access to bids, so that the course of each tender can be verified afterwards and legal claims can be established or defended — legitimate interest (Article 6(1)(f)).
• Keeping TendoGate secure and working: limiting repeated sign-in attempts, investigating errors and preventing misuse — legitimate interest (Article 6(1)(f)).
• Identifying companies accurately using the Estonian e-Business Register — legitimate interest (Article 6(1)(f)).
• Meeting legal obligations, such as accounting for licence fees and responding to lawful requests from authorities — legal obligation (Article 6(1)(c)).

Giving your name and email address is necessary to have an account and take part in a tender; without them you cannot use TendoGate. It is not a statutory requirement.

TendoGate sends only messages needed to run tenders and accounts. We do not use your personal data for marketing, we do not sell it, and we do not make decisions about you by automated means that have legal or similarly significant effects.

6. Who sees and receives personal data

Within TendoGate, personal data is visible only to the people who need it for a tender:

• The buyer sees the suppliers it has invited and the contact details it holds for them, and the questions they ask. It can see the content of bids only after it has opened them, and the opening is logged.
• A supplier sees its own invitations and bids. Suppliers do not see which other suppliers were invited or have bid. When a buyer publishes an answer to a question, other suppliers see the question and answer but not who asked. After a tender is closed and the buyer sends the result, suppliers see their own outcome, the total number of bids and the number of successful bidders, and the buyer’s result announcement. TendoGate never adds the successful bidder’s name or bid prices to it; the announcement is sent exactly as the buyer wrote it.
• A buyer can export a tender, including participant and bid data, to a spreadsheet. The exported file is then under the buyer’s control.
• We disclose personal data to authorities only where the law requires it.

7. Service providers

We use the following service providers to run TendoGate. They process personal data on our behalf and on our instructions.

Cloudflare, Inc. (United States) — network delivery and security

All traffic between your browser and TendoGate passes through Cloudflare’s network. Cloudflare terminates the encrypted (TLS) connection, so it processes the full content of requests and responses, including everything you enter and every file you upload or download, before passing it to our server over an encrypted tunnel. Cloudflare operates a global network, so this processing may take place outside the European Economic Area.

Amazon Web Services — file storage

Stores the files uploaded to TendoGate — tender documents, bid files and clarification files. Files are kept in the AWS eu-north-1 region (Stockholm, Sweden), in private storage with server-side encryption. The service is provided by Amazon Web Services EMEA SARL (Luxembourg).

SparkPost — email delivery

Delivers TendoGate’s emails: invitations, tender notices and account messages. It processes the recipient’s address and the content of each message. SparkPost is operated by Bird.com Inc., Bethesda, Maryland, United States, and our configuration uses its US-region endpoint.

Sentry — error monitoring

Collects error reports from TendoGate. We host Sentry ourselves at sentry.thorgate.eu, on a DigitalOcean server in Frankfurt, Germany; it is not the sentry.io cloud service. An error report can include your account ID and email address, IP address, browser and device details, the page or request involved, and technical details of the error. Passwords, access tokens and invitation codes are removed before a report is sent, but a report can include other data submitted in the failing request — for example the price or comment of a bid. Error reports are kept for up to two months.

Sentry also records a replay of how the page was used (clicks, navigation and page structure) for a quarter of browser sessions, and for any session in which an error occurs. Text, form fields and images are masked in these recordings. No replay is recorded on pages whose address contains an invitation code.

DigitalOcean (United States) — server hosting

The application, its database and its cache run on a DigitalOcean server in Frankfurt, Germany. DigitalOcean also hosts our Sentry server (see above). The service is provided by DigitalOcean LLC, Broomfield, Colorado, United States.

Cloudflare, and SparkPost with its US-region endpoint, process personal data outside the European Economic Area or may do so. DigitalOcean stores our data in Germany but is a US company.

8. How long we keep personal data

This is how long we keep personal data:

• User accounts are not deleted. When an administrator removes a user, the account is deactivated — it can no longer sign in — but its data is kept.
• Supplier contact persons are deactivated, not deleted, when a buyer removes them. Company data is kept indefinitely.
• Tenders, invitations, bids — including every earlier version and every withdrawn bid — questions and answers, and clarifications are kept indefinitely. The exception is a tender that was never published or cancelled (a draft or a scheduled tender): we may delete it.
• Files are never deleted from file storage. A tender document the buyer withdraws is kept, marked as withdrawn, as evidence of what was tendered. When a supplier removes a file from a bid, or a file from a clarification reply before sending it, the record of the file is deleted but the stored file itself remains in file storage.
• The audit trail and the records of access to bids are append-only: they cannot be changed or deleted in TendoGate and are kept indefinitely. When an invitation link is opened, we record the time, the IP address and browser details (an opening within 30 minutes of the previous record is not recorded again). When the invited person first uses the invitation with their user account, we keep a record with the same details and that account’s email address. An automatic job that runs every night erases the IP address, the browser details and the email address stored on these records once a record is more than 365 days old. The time is kept, and the record stays linked to its invitation, which keeps the invited email address and, where one was given, a name.
• Email delivery records — the recipient where there is one, the time and the outcome — are kept indefinitely. An automatic job that runs every night erases the stored content of an email (its subject, text and HTML version) once the record is more than 90 days old and the email has been sent or will no longer be sent. If a draft or scheduled tender is deleted, the email records about that tender are deleted with it.
• Sign-in sessions end after 8 hours without activity and after 24 hours at most. Application log files are rotated weekly and the last 52 are kept (about one year). Backups are kept and are not deleted automatically.

These are the retention periods that apply now. To ask for your personal data to be erased, see “Your rights”.

9. Cookies and browser storage

TendoGate stores the following in your browser. Apart from the error-monitoring item, each is needed for TendoGate to work or remembers a choice you made. There are no advertising or analytics cookies.

• Sign-in cookies, which keep you signed in and protect the sign-in form from forgery. They can be set on any visit and expire when you close the browser or when your sign-in session ends.
• Your light or dark display choice, in local storage.
• A copy of the interface text in your language, in local storage, refreshed after an hour.
• For buyer staff, an automatically saved draft of a tender being created, in local storage, until the tender is saved.
• The Sentry replay recorder keeps an identifier for the current browser session in session storage (see “Service providers”).
• Session and security cookies for the administration interface, used only by Thorgate’s administrators.

10. Your rights

Under the GDPR you have the right to:

• get confirmation of whether we process your personal data, and a copy of it;
• have inaccurate personal data corrected;
• have your personal data erased where there is no longer a lawful reason to keep it;
• have processing restricted, for example while the accuracy of the data is being checked;
• object to processing based on legitimate interest;
• receive data you have provided in a machine-readable format and have it transferred, where the processing is based on your consent or on a contract with you and is carried out by automated means;

Some records may have to be kept even after a request to erase them, because they are evidence of how a tender was conducted — for example the audit trail and the bids submitted in it (Article 17(3)(e)). A file removed from a bid is currently kept in file storage in a way that does not let us find and delete it on request.

To exercise your rights, contact us using the details in “Who we are”. We may need to confirm your identity first, and will reply within one month. Where we process the data on behalf of a buyer, we will pass your request on to that buyer and help it respond.

You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, www.aki.ee.

11. How we protect personal data

Connections to TendoGate are encrypted. Passwords are stored only as one-way hashes. Files are held in private storage with server-side encryption and are only served to users who are allowed to see them. Buyers cannot open bids before the bid submission deadline has passed, and this is enforced on the server, not only in the user interface.

Thorgate’s technical administrators can access the data in TendoGate, including the content of bids before they are opened, through an administration interface used for support and operation. Every view of a bid’s content there is logged.

12. Changes to this policy

We will update this policy when the processing it describes changes, and will tell registered users about material changes by email before they take effect. The version and date of this policy are shown at the top of the page.