Privacy policy

1. Controller

DefAgora / Elmir Catic, praktiva e.U.
Ödhofstraße 9
3300 Amstetten
Austria

Email: [email protected]
Web: https://defagora.com

For all questions regarding data protection, please contact us directly at the email address given above.

2. Overview: what data we process

DefAgora is a B2B SaaS platform for public procurement intelligence. We process the following categories of data:

a) Personal data of registered users

• First name and surname
• Email address
• Company affiliation and company name
• Login credentials (hashed password)
• Usage log (log data: IP address, timestamp, endpoints accessed) for security and operational purposes

b) Company profiles (company data)

• Company name, industry, main areas of activity, fields of competence
• These data are entered by the users themselves and are used for semantic matching with tenders.

c) Public tender data

• Tenders from TED (Tenders Electronic Daily) and national procurement platforms (eForms)
• These data are subject to mandatory publication under BVergG 2018 (Federal Procurement Act 2018, Austria) and the corresponding EU procurement directives and generally contain no personal data. Where, exceptionally, contact persons of contracting authorities are named, these are business contact details that were disclosed under the official publication obligation.

3. Purposes and legal bases of processing

3.1 Performance of a contract - provision of the platform (Art. 6(1)(b) of the General Data Protection Regulation (GDPR))

We process name, email address and company data in order to:

• create and manage a user account,
• enable access to the platform,
• calculate and display personalised tender recommendations based on your company profile,
• send transactional emails (account activation, password reset, tender alerts).

Legal basis: Processing for the performance of a contract to which the data subject is party (Art. 6(1)(b) GDPR). Without these data, the contractual relationship cannot be established or performed.

3.2 Legitimate interest - operation, security and improvement (Art. 6(1)(f) GDPR)

We process technical log data (IP address, timestamp, HTTP status codes) for the purpose of:

• ensuring the technical stability and security of the platform,
• detecting and preventing misuse, unauthorised access and attacks,
• anonymised usage analysis for the further development of the platform.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR). Our interest in secure and stable operation outweighs the interests of the data subjects, as the processing is limited to the technically necessary minimum and no evaluation of the content of individual user profiles takes place.

3.3 Legitimate interest - aggregation of public tender data (Art. 6(1)(f) GDPR)

Every day we aggregate tenders from TED/eForms and other public procurement platforms, normalise them and make them available in searchable form.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR). The tender data processed are publicly accessible by virtue of a statutory publication obligation (BVergG 2018, EU Directives 2014/24/EU and 2014/25/EU). The re-use and structuring of these data as part of an information service is compatible with the purpose of the original publication. Where tenders contain business contact details of employees of contracting authorities, these are displayed exclusively in the context of the respective tender and are not further processed for other purposes.

3.4 Legal obligation (Art. 6(1)(c) GDPR)

We may be obliged to retain or disclose certain data where this is required by law (e.g. retention obligations under tax law, obligations to provide information to authorities).

4. Recipients and processors

We use the following processors, with whom data processing agreements pursuant to Art. 28 GDPR have been concluded:

Data are not passed on to any further third parties unless we are legally obliged to do so or you have expressly consented.

5. Processing within the EU

Our hosting provider Hetzner Online GmbH has its registered office in Germany and processes all data exclusively within the European Union. To that extent, no transfer to a third country takes place.

The processor Brevo (Sendinblue SAS) named in section 4 has its registered office in France and processes the data required for sending emails (email address, name) within the European Union. Data processing agreements pursuant to Art. 28 GDPR are in place with both processors. No personal data are transferred to a third country.

On request, we will provide you with copies of the relevant safeguards. To do so, please contact [email protected].

6. Storage period and deletion periods

After the respective storage period has expired, data are routinely deleted or anonymised in such a way that they can no longer be related to a person. You can request the deletion of your account at any time via [email protected].

7. Your rights as a data subject

You have the following rights towards us with regard to your personal data:

7.1 Right of access (Art. 15 GDPR)

You have the right to request information on whether and which personal data we process about you, and to receive a copy of these data free of charge.

7.2 Right to rectification (Art. 16 GDPR)

You have the right to request the rectification of inaccurate personal data without undue delay, or the completion of incomplete personal data.

7.3 Right to erasure (Art. 17 GDPR)

You have the right to request the erasure of your personal data, provided that the statutory requirements are met (e.g. no statutory retention obligation, the purpose of the processing no longer applies).

7.4 Right to restriction of processing (Art. 18 GDPR)

Under certain conditions, you have the right to request the restriction of the processing of your data (e.g. if you contest the accuracy of the data or object to the processing).

7.5 Right to data portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format and to transmit those data to another controller, provided that the processing is based on a contract or on consent and is carried out by automated means.

7.6 Right to object (Art. 21 GDPR)

You have the right to object to the processing of your personal data where it is based on Art. 6(1)(f) GDPR (legitimate interest). We will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests.

7.7 Right to withdraw consent (Art. 7(3) GDPR)

Where processing is based on your consent (which is currently not the case at DefAgora, as all processing is based on contract or legitimate interest), you have the right to withdraw this consent at any time with effect for the future. The lawfulness of the processing carried out before the withdrawal remains unaffected.

To exercise your rights, please contact us in writing or by email at: [email protected]

We generally respond to requests within 30 days. In the case of complex requests or a large number of requests, this period may be extended by a further two months; in that case, we will inform you in good time.

8. Right to lodge a complaint with the Datenschutzbehörde (Austrian Data Protection Authority)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the competent supervisory authority if you consider that the processing of your personal data infringes the GDPR.

The competent data protection authority in Austria is:

Österreichische Datenschutzbehörde (DSB)
Barichgasse 40-42
1030 Wien
Austria

Telephone: +43 1 52 152-0
Email: [email protected]
Web: https://www.dsb.gv.at

9. Cookies and session management

DefAgora uses only strictly necessary session cookies, which are essential for the operation of the platform. These cookies serve to maintain your logged-in session and are deleted automatically at the end of the browser session or after a defined timeout.

We do not:

• use tracking cookies,
• use analytics tools that set cookies or store data on your device,
• set advertising or retargeting cookies,
• transmit data to advertising networks.

As only strictly necessary cookies are used, no prior consent of users is required pursuant to § 165(3) TKG 2021 (Austrian Telecommunications Act). Accordingly, no cookie banner is displayed.

For audience measurement on our public pages, we use a service provider that processes data within the European Union. The measurement is cookieless, without storage on your device and without identification of individual persons; no audience measurement takes place in the logged-in area. The legal basis is our legitimate interest in improving our services (Art. 6(1)(f) GDPR); you can object to the processing at any time via [email protected].

10. Public tender data - origin and legal basis

DefAgora aggregates and structures tender data from the following public sources:

• TED (Tenders Electronic Daily): The official supplement to the Official Journal of the European Union, operated by the European Commission. All notices are publicly accessible at https://ted.europa.eu.
• eForms: The standardised EU data standard for procurement notices pursuant to Implementing Regulation (EU) 2019/1780.
• National procurement platforms of the EU Member States.

The publication of these tenders is required by law for contracting authorities, in particular by:

• BVergG 2018 (Federal Procurement Act 2018, Austria),
• Directive 2014/24/EU (classic public contracts),
• Directive 2014/25/EU (utilities),
• GWB (Act against Restraints of Competition, Germany) for tenders published there.

The tender information displayed on DefAgora reproduces the content of the respective official notices. DefAgora gives no guarantee for the timeliness, completeness or accuracy of the tender data; the original notice on the respective official platform is always authoritative. Only the official source is binding for decisions in the procurement procedure.

11. Automated decision-making and profiling

DefAgora uses a semantic matching system that compares your company profile with the characteristics of public tenders and calculates a relevance value (score). On this basis, tenders are displayed to you in a personalised order.

This system does not constitute automated profiling within the meaning of Art. 22 GDPR, because:

1. No legal or similarly significant decision is made: the score serves solely to sort the information on offer.
2. No profiling in the data protection sense: no personality profiles are created. The matching analyses professional company competences, not personal characteristics or behavioural profiles of individual persons.
3. Full human control: users decide on their own responsibility which of the displayed tenders they pursue.

The matching system is purely an information filter and relevance sorter, comparable to an intelligent search engine for tenders.

12. Data security

We take appropriate technical and organisational measures (TOMs) pursuant to Art. 32 GDPR to protect your data against unauthorised access, loss or misuse. These include in particular:

• Encrypted transmission of all data via TLS (HTTPS),
• Encrypted database connections,
• Password hashing in line with the current state of the art (bcrypt/Argon2),
• Access control and authorisation concept based on the principle of least privilege,
• Regular security updates and patch management,
• Data processing agreements with all service providers used.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will inform the competent supervisory authority without undue delay (Art. 33 GDPR) and notify you if there is a high risk (Art. 34 GDPR).

13. Information obligations under Austrian law (§ 5 ECG, TKG 2021)

Pursuant to § 5(1) ECG (E-Commerce Act), DefAgora is obliged to provide the following information:

Service provider:
DefAgora / Elmir Catic, praktiva e.U.
Ödhofstraße 9
3300 Amstetten
Austria

Business purpose: Provision of a SaaS platform for public procurement intelligence

Contact: [email protected]

Supervisory authority (data protection): Österreichische Datenschutzbehörde (DSB), Barichgasse 40-42, 1030 Wien

14. Changes to this privacy policy

We reserve the right to update this privacy policy in the event of changes to the legal situation, the services used or the processing operations. The current version is available at any time at https://defagora.com/en/datenschutz.

In the event of material changes affecting your rights as a data subject, we will inform you by email.

The date of the last update is shown at the beginning of this document.