Legal Information

1. Data Controller

rTenders is a trading name of rTenders SL, Spanish tax ID B93958387, acting as data controller for users registered through rtenders.com. For privacy matters contact privacy@rtenders.com.

2. What data we collect

• Account data: name, email, company, role.
• Billing data: processed by Stripe (we do not store card numbers).
• Usage data: tenders viewed, AI drafts generated, search queries.
• Technical data: IP address, browser, device, cookies (see Cookies tab).

3. Lawful basis

• Contract (UK GDPR Art. 6(1)(b)): to deliver the service you subscribe to.
• Legitimate interests (Art. 6(1)(f)): product analytics, security, fraud prevention.
• Consent (Art. 6(1)(a)): marketing emails and non-essential cookies.
• Legal obligation (Art. 6(1)(c)): accounting, tax (HMRC), AML.

4. International transfers

Personal data may be processed in the EEA (Supabase EU, Resend EU) and the US (Stripe, OpenAI, Google) under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

5. Your rights

You have the right to access, rectify, erase, restrict, port and object to processing of your personal data, and to withdraw consent at any time. To exercise them email privacy@rtenders.com. You may lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

6. Retention

Account data: while your subscription is active and up to 6 years after closure for tax/legal purposes. Marketing data: until you withdraw consent.

7. Security

Encryption in transit (TLS 1.2+) and at rest, Row Level Security on all customer data, principle of least privilege for staff access, and regular security reviews.