Data Processing Agreement

Processor: Getia AS (org. no. 926 610 198), Møllergata 6, 0179 Oslo, Norway. Controller: the customer that has an account with Tenderen.

We process personal data only to provide the Tenderen service: tender search and alerts, AI analysis and writing, collaboration, document storage, notifications, support and billing.

• Users: name, email address, role, sign-in and usage data.
• Contact persons in documents you upload or write (for example CVs, references and contact details in bids).
• Partners, subcontractors and signers you invite or share work with.
• Billing contacts: name, email and billing details (card data is handled by Stripe, not by us).

• Process personal data only on your documented instructions, which are given through your use of the service and the agreement.
• Ensure that everyone with access is bound by confidentiality.
• Apply the technical and organisational measures described on the security page, including encryption in transit and at rest, least-privilege access and access logging.
• Assist you in answering data subject requests (access, rectification, deletion, portability).
• Notify you without undue delay, and within 72 hours at the latest, after becoming aware of a personal data breach that affects your data.
• Make available the information needed to demonstrate compliance with Article 28.

We use the subprocessors listed on the subprocessors page. Each is bound by a data processing agreement with obligations equivalent to ours. Changes are published on that page.

Personal data is not transferred to countries outside the EU/EEA without a valid transfer mechanism under GDPR Chapter V, such as an adequacy decision or the European Commission's standard contractual clauses.

Content you send to AI features is processed by our AI providers only to produce the result you asked for. Neither we nor our AI providers use your content to train models.

You can delete documents at any time. When the customer relationship ends, we export your data to you on request and delete it from our systems within 60 days, unless law requires us to keep it longer.