Data processing agreement

GDPR Article 28. Part of the terms of use for every customer; if your procurement needs a signed copy, write to hello@tenderscreen.com.

1. Subject and duration. SIA "EBDS" (the Processor) processes personal data for the customer (the Controller) only to provide TenderScreen under these terms of use, for as long as the Controller's account exists, plus the deletion periods in clause 9.
2. Nature and purpose. Storing, displaying and analysing (including by AI) the tender documents, answers, assignments and uploads the Controller enters, and keeping backups of them.
3. Data subjects and data. The Controller's staff and contacts named in the account (names, roles, e-mail addresses, assignments, statuses, check marks) and any personal data in documents the Controller uploads. Special categories of personal data are not intended; the Controller does not upload them.
4. Instructions. The Processor acts only on the Controller's documented instructions: these terms, this agreement and the Controller's use of the product's functions. The Processor tells the Controller if an instruction in its view infringes data protection law.
5. Confidentiality. Persons authorised to process the data are bound to confidentiality.
6. Security (Art. 32). At least: encrypted connections (HTTPS); passwords stored as salted one-way hashes; separation of customer workspaces checked by automated tests; encrypted off-site backups with a monthly restore test; access to production servers by key only, with changes approved by a named person; refusal to analyse documents that carry a national, EU or NATO restriction marking; monitoring with alerts. The Processor may improve these measures but not lower their level.
7. Sub-processors. The Controller authorises: Hetzner Online GmbH (hosting, EU); Anthropic PBC (AI analysis, USA); Resend Inc. (service e-mail, USA/Ireland); Cloudflare, Inc. (forwarding e-mail to our contact address). The Processor imposes equivalent data protection obligations on them and informs the Controller at least 30 days before adding or replacing one; the Controller may object, and if no solution is found, terminate and receive a refund of unused prepaid analyses.
8. Transfers outside the EEA. Transfers to Anthropic rely on the EU standard contractual clauses (Commission Implementing Decision (EU) 2021/914) in Anthropic's data processing addendum; transfers to Resend on its certification under the EU-US Data Privacy Framework; transfers to Cloudflare on the standard contractual clauses in its data processing addendum.
9. Deletion and return. When the Controller deletes the account or the contract ends, the Processor deletes the Controller's data from the live system at once; it disappears from backups within 6 months. Before that, the Controller can ask for an export of its data by e-mail. Records the Processor must keep by law (invoices, purchase records) are kept without personal e-mail addresses.
10. Assistance and breaches. The Processor helps the Controller answer data subject requests and with its duties under Art. 32 to 36 as far as reasonable, and reports a personal data breach affecting the Controller's data without undue delay and at most within 48 hours after becoming aware of it, with the information it has.
11. Audits. The Processor makes available the information needed to show compliance (this agreement, the measures in clause 6, the list of sub-processors) and allows audits by the Controller or its auditor with reasonable notice, at the Controller's cost, at most once a year unless a breach occurred.
12. Liability and law. As in the terms of use. Latvian law applies; the courts of Riga decide disputes.

Processor: SIA "EBDS", registration number 42103100012, Riga, Latvia. Last changed 21.10.2026.