Draft for legal review. Customers who process personal data through EU Tenders can request a signed copy after launch.

Data processing agreement

This agreement applies when you, the customer, use EU Tenders to process personal data as a controller and EU Tenders processes it on your behalf.

Scope

EU Tenders processes the data described in the privacy policy: account and key records, usage counts, watchlist filters and matches, and digest email addresses. The public datasets EU Tenders serves (tender notices, award notices, company filings) are published by public authorities and are not processed on your behalf.

Commitments

• Process customer data only to provide the service and on your documented instructions.
• Store customer data in the EU as described on the data location page, and list every sub-processor there.
• Give notice before adding or replacing a sub-processor.
• Keep access limited to people who need it and bound by confidentiality.
• Report a personal data breach without undue delay.
• Help you answer data subject requests.
• Delete or return customer data when the contract ends.

Security measures

• API keys and passwords are stored only as hashes.
• Each customer's state lives in its own storage object, created inside the EU jurisdiction.
• Service-to-service calls are authenticated with a shared secret compared in constant time.
• Database queries use bound parameters only.
• Daily database snapshots are kept for 14 days, and restores are rehearsed.