Privacy notice

Controller

The controller within the meaning of Art. 4(7) GDPR is Loistava Holding UG (haftungsbeschränkt), Asternring 9, 15732 Schulzendorf, Deutschland. Full provider details are in the imprint.

Please send data protection enquiries to contact@adjudera.com. No data protection officer has been appointed; the thresholds of § 38 BDSG are not met.

What this is about

Adjudera analyses European procurement notices. The vast majority of what we publish concerns legal persons — public buyers and companies — and therefore falls outside the GDPR, which protects natural persons only.

We process personal data in these places:

• when you request a page (server logs),
• for audience measurement (no cookies, nothing stored on your device),
• when you subscribe to the newsletter (only if you do so yourself),
• when you create an account and use its watchlist or saved-search email alerts,
• when you take out a paid subscription (payment handled by Stripe).

One special case exists inside the published corpus: where a supplier is a sole trader or a self-employed professional, the company name may also be a person's name. See “Published procurement data” below.

Visiting the site and server logs

The website, its database and the sign-in service run on our own server, rented from Hetzner Online GmbH (Gunzenhausen, Germany) in its data centre in Helsinki, Finland. The site is delivered through the network of Cloudflare, Inc., which caches pages and fends off attacks. Requesting a page produces technically necessary log data: IP address, date and time, requested URL, referrer, user agent, HTTP status code and the volume of data transferred.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is delivering the site, keeping it stable and defending it against attacks. We do not combine these logs with other data and build no profiles from them. The server logs on our server are deleted after 14 days at the latest.

Audience measurement

We measure reach with PostHog, deliberately configured so that nothing is stored on your device. Specifically:

• No cookies are set and nothing is written to local storage (cookieless mode; state lives only in the page’s volatile memory).
• We record page views and page leaves, together with the details your browser sends anyway: URL, referrer, coarse region, device type and browser.
• We also record a short, closed list of deliberate actions, so that we can tell whether the product works: a search that was run (with the number of results, never your search term), opening the pricing page, submitting the newsletter form, requesting a sign-in link, adding a watch, creating a saved search, being shown the plan limit, and the start and completion of a payment. No email addresses and no search terms are sent.
• Returning visits are not recognised through any persistent identifier. Unique visitors are counted server-side from a hash of the calendar day, the IP address and the browser string under a secret, rotating salt; it is not reversible, it changes daily, and it is not stored.
• Autocapture (automatic click tracking) and session replay are switched off.
• If no analytics credential is configured, the script is not loaded at all.

Because no information is stored on, or read from, your terminal equipment, the consent requirement of § 25(1) TDDDG (formerly TTDSG) does not apply — which is why there is no cookie banner. The processing rests on Art. 6(1)(f) GDPR; our legitimate interest is measuring the reach and the usability of what we publish. For visitors who are not signed in there is no person-level analysis, no recognition beyond the day, and no individual funnel tracking.

Inside the signed-in area (/app) this differs, so we say so plainly: there the events listed above carry your account identifier (the same UUID as account.id, not your email address), along with your plan and your language. It is the only way we can see whether signed-in customers can actually use the product — two of seven registered people had never managed to sign in, and we had no way to find that out. The legal basis is Art. 6(1)(f) GDPR (improving a service for its own registered users); nothing is stored on your device here either. You may object at any time, informally (see below), and we will delete the association.

The provider is PostHog Inc.; processing takes place in the service's EU instance (Frankfurt am Main). You can object to audience measurement at any time — informally to contact@adjudera.com, or technically by blocking the script in your browser.

Newsletter

The newsletter, the weekly procurement report, uses double opt-in. On sign-up we store your email address, the language you chose, a confirmation token, the page you signed up from and the time of sign-up.

We first send the address only an email with the confirmation link. You receive the newsletter only after you have clicked it; without confirmation the address is not used any further.

The procurement report comes out weekly, on Thursdays. It contains the largest awards of the week, contracts entering their final twelve months, and one figure on competition, for the market of your language (in English: all countries covered). We store when an issue was last sent to you. We do not analyse opens or clicks. The sending provider is Resend, Inc.; mail is sent through its EU region (Ireland).

The legal basis is your consent under Art. 6(1)(a) GDPR. You may withdraw it at any time with effect for the future (Art. 7(3) GDPR): with one click on the unsubscribe link in every issue, through your email client's unsubscribe function, or by a message to contact@adjudera.com. After you unsubscribe we keep the address on a suppression list so that a later re-subscription cannot resurrect it; the legal basis for that is Art. 6(1)(f) GDPR. You may also request deletion of that entry.

Account, watchlist and saved searches

You create an account with your email address; you sign in without a password, through a link we email to you. We store your email address, your chosen language, your plan, when you signed in and, for each session, the IP address and browser identifier. We also store what you create in the account yourself — watchlist entries and notes, saved searches. For saved searches with alerts we record which awards have already been sent to you, so none arrives twice.

While you are signed in we set a session cookie. It is strictly necessary for the sign-in you asked for (§ 25(2) no. 2 TDDDG) and is not set unless you sign in. Sign-in links and alerts are sent through Resend, Inc. (EU region, Ireland); we run the sign-in service ourselves on our own server.

The legal basis is Art. 6(1)(b) GDPR (providing the account you use), and for the session data additionally Art. 6(1)(f) GDPR (protecting the account against misuse). The data is kept until you have the account deleted; a message to contact@adjudera.com is enough. Deleting the account deletes its watchlist, saved searches and alert history with it.

Paid subscriptions and payment

Paid subscriptions are taken out through Stripe Checkout. Stripe Payments Europe, Limited (Dublin, Ireland) collects the company name, name, billing address, email address and payment details. Card numbers and bank details never reach us; Stripe gives us a customer identifier, the plan booked, the status of the subscription and the invoices.

The legal basis is Art. 6(1)(b) GDPR (performing the contract) and, for keeping invoices and accounting records, Art. 6(1)(c) GDPR together with § 147 AO and § 257 HGB. We keep these records for the statutory periods, currently up to ten years. Stripe processes payment data for fraud prevention and to meet its own legal obligations partly as an independent controller; details are in Stripe's privacy policy.

Published procurement data

The procurement data published on Adjudera comes from Tenders Electronic Daily (TED), the notice database of the Publications Office of the European Union. Reuse of these documents, including for commercial purposes, is expressly permitted by Commission Decision 2011/833/EU on the reuse of Commission documents.

From each notice we extract organisation-level information only: the name and identifier of the organisation, its postal address, and the subject matter, value, award date, contract term, CPV code and region of the contract. Contact details of natural persons contained in notices — contact persons, email addresses, telephone numbers — are not parsed and appear on no page. We retain the original notice unchanged as evidence for every figure we publish; only the fields listed above are published from it.

Personal data can nevertheless arise where a supplier is a sole trader or a self-employed professional whose business name contains their own name. The legal basis is then Art. 6(1)(f) GDPR. Our legitimate interest, and the public interest, lie in making the use of public money traceable. In weighing that interest it matters that the information was published by the contracting authority itself in fulfilment of a statutory publication duty (Directive 2014/24/EU), relates to professional activity, and contains no special categories of data under Art. 9 GDPR.

This data does not come from you but from that public source (Art. 14 GDPR). Notifying every data subject individually across tens of thousands of notices would involve disproportionate effort, so this notice takes the place of individual notification under Art. 14(5)(b) GDPR. The original source is linked from every award page.

Recipients and processors

We do not share personal data for advertising purposes and we do not sell it. We use only processors acting on our instructions, with data processing agreements under Art. 28 GDPR in place:

• Hetzner Online GmbH — server for the website, database and sign-in service, Helsinki data centre (Finland).
• Cloudflare, Inc. — delivery of the website and defence against attacks.
• PostHog Inc. — audience measurement, EU instance.
• Resend, Inc. — sending the newsletter, sign-in links and alerts, EU region (Ireland).

For paid subscriptions, Stripe Payments Europe, Limited (Dublin, Ireland) is added as payment provider; see “Paid subscriptions and payment”.

We disclose data to authorities only where we are legally obliged to do so.

Transfers to third countries

Processing takes place in the European Union as a matter of principle. Where delivery of the site or support by the providers named above involves processing in the United States, we base it on standard contractual clauses under Art. 46(2)(c) GDPR or — for certified recipients — on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR).

Retention

• Server logs: 14 days at most.
• Audience measurement: aggregate only, with no personal reference.
• Newsletter: until you withdraw; unsubscribed addresses remain on the suppression list.
• Account, watchlist and saved searches: until the account is deleted.
• Invoices and accounting records for subscriptions: for the statutory retention periods (§ 147 AO, § 257 HGB), currently up to ten years.
• Procurement data: indefinitely, because the value of the corpus lies precisely in the historical series — subject to a valid objection.

Your rights

You have the following rights against us:

• access to the data we process about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdrawal of consent with effect for the future (Art. 7(3) GDPR),
• complaint to a supervisory authority (Art. 77 GDPR) — the competent authority is the one at the controller’s seat.

An informal message to contact@adjudera.com is enough for any of these.

Right to object under Art. 21 GDPR

Where we process data on the basis of a legitimate interest (Art. 6(1)(f) GDPR) — audience measurement, server logs, your account's session data and the published procurement data — you have the right to object at any time on grounds relating to your particular situation. We will then stop processing the data concerned unless we can demonstrate compelling legitimate grounds that override your interests.

Correcting or removing a record

If a record is wrong, or you consider its publication unlawful, write to contact@adjudera.com with the address of the page and a short explanation. We check the entry against the original notice and correct or remove it.

Two limits we state rather than hide: corrections are carried forward rather than deleted retroactively, so it stays traceable what was published when. And we cannot change the original notice on TED — it remains public there whatever we do.

No automated decision-making

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR. We do compute derived facts — for example a likely contract end date where the notice states none. Those computations are about contracts, not people, and are labelled as estimates on the page where they appear.

Changes to this notice

If the processing changes, this notice changes. The version published here, with the revision date below, is the one that applies.