Privacy
Where things stand
TenderBrief is a prototype. This preview site collects no personal data: the waitlist form is not connected to anything, so nothing you type into it is sent or stored. The rest of this page describes what will happen once the waitlist is switched on, and, in the parts marked as planned, once the paid service exists.
Who is responsible
monocube AB (org. no. 556924-8668, VAT SE556924866801), Elbevägen 48, 141 32 Huddinge, Sweden, is the controller of the personal data described here. Contact for anything about your data: contact@tenderbrief.eu.
What we collect
Waitlist
- Your email address (stored in lower case).
- The time you signed up, and the version of the consent wording you saw.
- An internal label for the brief topic (currently
it-digital). You do not enter it. - Whether you have confirmed, and when.
- For the confirmation link: a hash (SHA-256) of the random token in the link, not the token itself, and the times the token was created and the last confirmation email was sent.
We do not store your IP address, browser details or any cookie in the waitlist database. Your email address is required to join; the waitlist is voluntary.
How it works: signing up stores your address as unconfirmed and sends one email with a confirmation link. You are on the list only after you open the link and press the confirm button. The link stops working after 48 hours. If you sign up again while unconfirmed, you may get a new confirmation email, at most one per hour. An unconfirmed address is never sent anything else, and is not counted.
Messages to contact@tenderbrief.eu
If you write to us, we receive your email address, your message and any details you include. The address is handled by Cloudflare Email Routing, which forwards messages to our mailbox [mailbox provider: to be confirmed].
Paying customers [planned, to be confirmed]
[Not offered yet. Expected: your email address, name and company, billing address, VAT number and country, and payment status. Payment details such as card numbers are handled by a payment provider acting as merchant of record, not by us. Provider and exact data: to be confirmed.]
Tender data
Briefs are generated from public notices on TED. Notices can contain business contact details of buyers; briefs do not republish contact persons' names, emails or phone numbers.
Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Send you the confirmation email and, once you have confirmed, one notice about whether and when the service launches. We do not use the list for anything else. | Your consent, Art. 6(1)(a), given by ticking the box and confirming by link (double opt-in). |
| [Planned] Provide the paid daily brief, manage your subscription and send invoices. | [Contract, Art. 6(1)(b).] |
| [Planned] Keep accounting records. | [Legal obligation, Art. 6(1)(c): Swedish bookkeeping rules.] |
| Keep the waitlist and site secure and limit abuse: a hidden form field that filters bots, a limit of one confirmation email per hour per address, expiring links, hashed tokens. | Our legitimate interest, Art. 6(1)(f), in protecting the service and not mailing people who did not ask. You can object (see below). |
| Answer messages you send to contact@tenderbrief.eu. | Our legitimate interest, Art. 6(1)(f), in answering you. |
There is no automated decision-making or profiling. We do not sell your data or use it for advertising.
How long we keep it
- Unconfirmed waitlist addresses: deleted automatically 7 days after your last signup attempt. A daily job in our software does this.
- Confirmed waitlist addresses: until you withdraw. If the service has not launched within 12 months after you confirmed, we delete your address. [This 12-month rule is a policy, not yet automated: to be confirmed.]
- Messages to contact@tenderbrief.eu: [to be confirmed, for example 12 months after the last message].
- Paying customers: [planned: while the subscription runs; accounting records for the period Swedish law requires, currently believed to be 7 years: to be confirmed].
- Backups: our database provider keeps a point-in-time history. A deleted address can remain in it for up to 7 days on Cloudflare's Free plan, or 30 days on its Paid plan [which plan applies: to be confirmed].
- Email routing metadata: Cloudflare Email Routing keeps delivery metadata (such as sender, recipient and subject) for up to 31 days under its own terms [to be verified].
Who receives it, and transfers outside the EU/EEA
These providers process data on our behalf (processors). We sell nothing and share nothing for advertising.
- Cloudflare, Inc. (United States): website hosting, the database that holds the waitlist, the Worker that runs the waitlist and the daily job, and Email Routing for contact@tenderbrief.eu. [Planned: not all of this is switched on yet.]
- GitHub, Inc. (United States): hosts our private source-code repository and runs scheduled jobs. The jobs fetch public tender notices. The waitlist and customer data are not stored in the repository and are not sent to GitHub by the current software. [Scheduled jobs: planned.]
- Our email sending provider [to be confirmed: not yet chosen]: will send the confirmation email, and later the briefs, so it will receive recipients' email addresses and message content.
- Our payment provider / merchant of record [to be confirmed: not yet chosen; planned for paying customers only].
Cloudflare and GitHub are US companies. Both state that they are certified under the EU–US Data Privacy Framework and that their data processing terms include the EU Standard Contractual Clauses as a fallback [to be verified against the Data Privacy Framework list and the signed terms before launch]. Where the database is physically located [to be confirmed]. For the email and payment providers: [transfer basis to be stated once chosen].
Cookies and tracking
This site sets no cookies, uses no analytics and loads no third-party scripts, fonts or trackers. The pages contain one small script of our own that sends the waitlist form. The confirmation page also sets no cookies. Like any web host, Cloudflare receives your IP address and request details when your browser fetches a page, in order to deliver and protect the site; we do not store them. If we add analytics later, we will update this page first.
Your rights
You can ask us for access to your data, correction, deletion, restriction, and a copy in a portable format. You can object to processing based on our legitimate interest. You can withdraw consent at any time; this does not affect what we did before. Write to contact@tenderbrief.eu; we will answer within one month.
You can complain to the Swedish data protection authority, Integritetsskyddsmyndigheten (IMY), imy.se, or to the authority in the country where you live or work.
Unsubscribe and withdraw consent
Today: email contact@tenderbrief.eu from the address you signed up with, and we delete it. [Planned before any email other than the confirmation email is sent: an unsubscribe link in every email.]
Children
TenderBrief is a business service and is not aimed at children. We do not knowingly collect data from children. If you think a child has signed up, write to us and we will delete it.
Changes
We change this page when what we do changes. The date at the top shows the last update. [Commitment, to be confirmed: if a change affects what we do with the data of confirmed waitlist members or customers, we email them before it takes effect, and ask again where consent is needed.]