Legal
Privacy notice
How BU2IQ Technologies handles personal data on bid-smart.com. Written to be read, not to be impenetrable — if anything here is unclear, ask us and we will explain it.
Last updated 25 July 2026
1. Who is responsible
The controller for the processing described here is:
Anand Sengupta, trading as BU2IQ Technologies
91052 Erlangen, Germany
Email: privacy-nr@bu2iq.com
Telephone: +49 152 21926388
BU2IQ Technologies is a sole proprietorship (Einzelunternehmen) and is not entered in the commercial register, so it has no register number or company legal form. No VAT is shown on our invoices. As a small business within the meaning of §19 UStG (Kleinunternehmerregelung) we do not charge value added tax.
We have not appointed a Data Protection Officer, as we do not meet the thresholds in Art. 37 GDPR / §38 BDSG. Privacy questions go to the address above and are answered by us directly.
2. What we collect, and why
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Email address and account identifier | To create your account, sign you in, and send the briefs you asked for. | Contract (Art. 6(1)(b)) | While your account exists, then deleted |
| Your capability profile — company name, contact name, sectors, codes, certifications, keywords, target buyers, chosen market | This is the input to the matching. Without it we cannot tell you which tenders fit. | Contract (Art. 6(1)(b)) | While your account exists |
| What you shortlisted or dismissed | So your dashboard and briefs stop showing what you already rejected. | Contract (Art. 6(1)(b)) | While your account exists |
| Subscription and payment status — customer and subscription identifiers, billing market | To take payment, manage renewals, and meet tax record-keeping duties. | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for records | Payment records retained as required by German tax law |
| Record of briefs and emails sent to you | So we never send the same brief twice and can prove what was sent. | Contract (Art. 6(1)(b)) | 24 months |
| Server logs — IP address, page requested, timestamp, browser | Security, abuse prevention, and diagnosing faults. | Legitimate interests (Art. 6(1)(f)) — running the service securely | 30 days |
| Analytics and advertising measurement — see section 4 | To understand how the site is found and used. | Consent (Art. 6(1)(a)) | Per section 4 |
Searching public tenders needs no account and no personal data. You only give us the above if you choose to sign up.
3. Tender data is not personal data
The tenders on this site come from official public procurement sources — SAM.gov (United States), PhilGEPS (Philippines), AusTender (Australia) and GETS (New Zealand). They concern public bodies and their purchasing, not private individuals. Where a notice happens to name a contact person, that name was published by the buying authority, not by us.
4. Cookies and measurement
Nothing optional runs before you agree to it. On your first visit you are asked, and until you choose, no analytics or advertising script is loaded at all — not loaded-but-restricted, genuinely not loaded.
- Strictly necessary — a sign-in session cookie, set only if you log in. No consent is required for these and they carry no tracking.
- Analytics (consent) — Google Analytics 4, to see which pages people reach and which searches bring them here.
- Marketing (consent) — Meta Pixel, to measure whether an advert led to a sign-up.
You can change or withdraw your choice at any time, as easily as you gave it: — or clear this site's data in your browser. Withdrawing does not affect processing that already happened lawfully.
5. Who else processes your data
We keep this list short on purpose. Each of these acts on our instructions under a data processing agreement.
| Who | For | Where |
|---|---|---|
| Hetzner Online GmbH | Hosting the application and its database | Germany / EU |
| Google (Firebase Authentication) | Sign-in and session security | EU and USA |
| Stripe | Payments and subscription management | EU and USA |
| Resend | Sending your brief and account emails | EU (eu-west-1) |
| Google (Analytics 4) | Site analytics — only with your consent | EU and USA |
| Meta | Advertising measurement — only with your consent | EU and USA |
Transfers outside the EU. Where a provider processes data in the United States, that transfer relies on the provider's certification under the EU–US Data Privacy Framework and, where applicable, the European Commission's Standard Contractual Clauses.
We do not sell personal data, and we do not share it with anyone for their own purposes.
6. Automated scoring, and where the AI runs
Bid-Smart scores each tender against your profile and ranks them. That is profiling in the sense of Art. 4(4) GDPR, so it is worth being precise about what it does and does not do: it decides the order of a list we show you. It makes no decision about you, produces no legal or similarly significant effect, and nothing about your account changes as a result. Every score is broken down into its components on screen, so you can see why something ranked where it did.
The language model that writes the plain-English summaries runs on our own hardware. Your profile is not sent to a third-party AI provider to generate them.
7. Business outreach
We sometimes contact companies that bid for public contracts to introduce Bid-Smart, using business contact details from public sources. This is business-to-business contact based on our legitimate interests (Art. 6(1)(f)). Every message is reviewed by a person before it is sent, says who it is from, and offers a one-click way to never hear from us again. If you object, we stop — and we keep only the minimum needed to remember not to contact you again.
8. Your rights
Under the GDPR you can ask us to give you a copy of your data (Art. 15), correct it (Art. 16), delete it (Art. 17), restrict what we do with it (Art. 18), hand it over in a portable form (Art. 20), or object to processing we base on legitimate interests (Art. 21). Where we rely on consent, you can withdraw it at any time.
Write to privacy-nr@bu2iq.com. We will respond within one month. We will not charge you and will not make you explain why.
You can also complain to a supervisory authority. As we are established in Erlangen, Bavaria, ours is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) in Ansbach, which supervises the private sector in Bavaria. You may equally complain to the authority where you live or work.
9. Changes
If we change how we handle personal data we will update this page and move the date at the top. If a change is significant, we will tell account holders by email rather than relying on you to notice.