Last updated: June 2026

Privacy Policy

Information on how your personal data is protected and processed when you use Polytender.

1. Controller and personal data

The controller within the meaning of the GDPR is HeyQQ GmbH (company register no. FN 572680b, Commercial Court of Vienna, VAT ID ATU77744201), Wasagasse 23, 1090 Vienna, Austria, reachable for data protection matters at privacy@polytender.com. Polytender is a product of Run Labs, the product studio of HeyQQ GmbH based in Vienna. Managing directors: Dmitrij Rubanov, MA and Mag. Matthias Neumayer, BA.

We collect, process and use your personal data only with your consent, to provide the service you requested, or where another legal basis under the GDPR applies, while complying with applicable data protection law.

We only collect personal data that is necessary to provide and operate our services or that you have voluntarily given us.

Personal data is any data relating to an identified or identifiable person, for example name, address, email address, phone number and the company website you provide.

2. Access and deletion

As a data subject you have the right at any time to obtain information about your stored personal data, its origin and recipients and the purpose of processing, as well as the right to rectification, data portability, objection, restriction of processing and the blocking or deletion of inaccurate or unlawfully processed data. Please let us know of any changes to your personal data.

You have the right to withdraw any consent given at any time. Requests for access, deletion, rectification, objection and/or data portability can be sent to the contact details listed in section 10 of this policy.

If you believe that our processing of your personal data violates applicable data protection law or otherwise infringes your rights, you may lodge a complaint with the competent supervisory authority. In Austria this is the Austrian Data Protection Authority (Datenschutzbehörde).

3. Data security

Your personal data is protected through appropriate organisational and technical measures. These measures relate in particular to protection against unauthorised, unlawful or accidental access, processing, loss, use and manipulation.

4. Use of data

We do not process the data provided to us for purposes other than those covered by your request, your consent or a provision in line with the GDPR. Specifically, we use your details to match public tenders against your company's activity, show you relevant tenders and - where you have consented - contact you by email or phone about your matches. Use for statistical purposes is excluded unless the data has been anonymised.

The legal basis for processing the data provided via the form (first name, last name, email address, phone number, company website, optional industry) and for contacting you by email or phone is your consent pursuant to Art. 6(1)(a) GDPR, which you give when submitting the form via the relevant checkbox. Providing the data is voluntary but necessary to use our matching service. You can withdraw your consent at any time with effect for the future.

Newsletter (double opt-in)

If you tick the separate, voluntary newsletter checkbox in the form, we use your email address to send you information about relevant tenders and product news. Sign-up uses the double opt-in procedure: after you sign up we first send you a confirmation email, and your address is only added to the newsletter list once you click the confirmation link it contains. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. The newsletter sign-up is independent of the rest of the form processing and is not required to use the service. You can unsubscribe at any time (via the unsubscribe link in every email or by contacting us) and thereby withdraw your consent with effect for the future. To send the confirmation email and the newsletter we use Lettermint B.V., Willemsvaart 16, 8019 AB Zwolle, the Netherlands, as a processor; processing takes place within the EU.

5. Transfer of data to third parties

To provide our service we use carefully selected service providers (processors) to whom we make data available. Any transfer of your data takes place exclusively on the basis of the GDPR, in particular to fulfil your request or based on your prior consent. The specific services used are listed in section 8.2.

Some of these recipients process personal data outside Austria. The level of data protection in other countries may not correspond to that in Austria. We only transfer your personal data to countries for which the EU Commission has determined an adequate level of protection, or we put measures in place to ensure an adequate level of protection, in particular by concluding standard contractual clauses pursuant to Art. 44 et seq. GDPR.

Processing using artificial intelligence (LLM)

To support the matching of tenders against your company, we process certain content automatically using large language models and embedding models. For this we primarily use AI inference providers based in and processing within the EU. In addition, as a fallback, we may use the Vertex AI services of Google Cloud (the Gemini model family and a multilingual embedding model); in that case a European processing region is used exclusively.

Processing takes place exclusively for the purposes described in this policy and not for independent use or model training by the provider. Processing takes place within the EU.

6. Notification of data breaches

We strive to ensure that data breaches are detected early and, where applicable, reported without undue delay to you and/or the competent supervisory authority, including the categories of data affected.

7. Retention of data

We do not retain data longer than necessary to fulfil our contractual or legal obligations and to defend against potential liability claims. Form data in our database is stored until you delete it or the purpose ceases to apply, subject to statutory retention periods.

8. Cookies and consent management

We use cookies and similar technologies to provide this website and analyse its use. Processing takes place on the basis of legitimate interests where technically strictly necessary, and otherwise on the basis of your consent.

8.1 Cookie categories

  • Essential cookies: Technically required to display the website correctly and provide basic functions. They are used without consent.
  • Analytics cookies: Provide statistical information about usage and are only set with your consent.
  • Marketing cookies: Used to measure advertising success (conversions) and optimise our advertising campaigns. They are only set with your consent.

We use marketing and conversion tracking only after your explicit consent to the marketing category. Without this consent, no data is transmitted to the advertising services listed in section 8.2 and no related identifiers (for example click parameters) are stored.

8.2 Services and cookies used

8.2.1 PostHog (analytics)

  • Provider: PostHog Inc., 965 Mission Street, San Francisco, CA 94103, USA.
  • Purpose: Product analytics, usage statistics and aggregated evaluation of site usage.
  • Category: Analytics.
  • Place of processing: Data is captured via PostHog's EU ingestion endpoint (eu.i.posthog.com) and processed in the EU; an occasional transfer to the USA cannot be fully excluded.
  • Cookies: ph_* for session and usage tracking, only after consent.

8.2.2 AI processing (EU inference providers and Google Cloud / Vertex AI as fallback)

  • Providers (primary, processing within the EU): Mistral AI SAS, 15 rue des Halles, 75001 Paris, France; Cortecs GmbH, Althanstrasse 4, 1090 Vienna, Austria; Nebius B.V., Schiphol Boulevard 165, 1118 BG Schiphol, the Netherlands.
  • Provider (fallback): Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), Gemini model family. Where we use Google Vertex AI as a fallback, a European processing region is used exclusively.
  • Purpose: Automated analysis and matching of tenders against your company profile using language and embedding models.
  • Category: Essential technical service (part of the core matching function).
  • Data processed: the company website you provide (its publicly accessible content) and tender texts, as far as required for matching. Personal contact data (name, email address, phone number) is not transmitted to the AI providers.
  • Data transfer: The providers act as processors pursuant to Art. 28 GDPR. Processing takes place within the EU. Should a transfer to Google's US parent company exceptionally occur in fallback operation, it is carried out in a GDPR-compliant manner on the basis of the EU-US Data Privacy Framework and additional standard contractual clauses.
  • Note: The data processed is not used to train AI models for the providers' own purposes. No cookies are set on your device as part of this processing.

8.2.3 Hetzner (hosting and database)

  • Provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.
  • Purpose: Provision of the technical infrastructure, server hosting and operation of the database in which, among other things, your form data is stored.
  • Category: Essential technical service.
  • Place of processing: Servers in Germany or within the EU.
  • Note: Hetzner acts as a processor and does not use the data for its own purposes.

8.2.4 Meta (Pixel and Conversions API)

  • Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (parent company: Meta Platforms, Inc., USA).
  • Purpose: Measuring advertising success (conversions) and optimising our advertising campaigns on Meta platforms (for example Facebook, Instagram).
  • Category: Marketing (only after consent).
  • Processing: Conversion events are transmitted server-side via the Meta Conversions API. Where available, email address, phone number and first and last name are transmitted exclusively in pseudonymised (hashed) form, together with your IP address, the browser identifier (user agent) and Meta identifiers (the _fbp/_fbc cookies or the fbclid click parameter).
  • Meta Pixel (client-side): After your consent, the Meta Pixel (JavaScript from connect.facebook.net) is additionally loaded in your browser. It sets Meta cookies (_fbp/_fbc), records page views and enables the building of retargeting audiences. The lead event is sent from both the client (Pixel) and the server (Conversions API) with a shared event ID and deduplicated by Meta, so it is counted only once.
  • Data transfer: Meta acts as an independent or joint controller for this data. Any transfer to the USA takes place on the basis of the EU-US Data Privacy Framework and, additionally, the standard contractual clauses.
  • Legal basis: Your consent (Art. 6(1)(a) GDPR).

8.2.5 Google Ads

  • Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).
  • Purpose: Measuring advertising success (conversions) and optimising our Google Ads campaigns.
  • Category: Marketing (only after consent).
  • Processing: The Google tag (gtag) runs with Google Consent Mode v2. By default all consent signals are set to 'denied'; in that state only cookieless, anonymous signals without device or user identifiers are transmitted (for statistical modelling), and no cookies are set or read. Only after you consent to the Marketing category does Google set cookies (for example _gcl_*) and transmit full conversion events; the Google click identifier (gclid) and, where enabled, a pseudonymised (hashed) email address, phone number and name (Enhanced Conversions) are then used for matching.
  • Data transfer: Any transfer to the USA takes place on the basis of the EU-US Data Privacy Framework and, additionally, the standard contractual clauses.
  • Legal basis: Your consent (Art. 6(1)(a) GDPR).

8.2.6 LinkedIn (Insight Tag and Conversions API)

  • Provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (parent company: LinkedIn Corporation, USA).
  • Purpose: Measuring advertising success (conversions) and optimising our LinkedIn advertising campaigns.
  • Category: Marketing (only after consent).
  • Processing: Conversion events are transmitted server-side via the LinkedIn Conversions API. Where available, a pseudonymised (hashed) email address and a LinkedIn identifier (li_fat_id) are transmitted.
  • LinkedIn Insight Tag (client-side): After your consent, the LinkedIn Insight Tag (JavaScript from snap.licdn.com) is additionally loaded in your browser. It sets LinkedIn cookies, records page views and serves to build retargeting audiences and anonymised website statistics (demographics). Conversions are not counted via the Insight Tag but exclusively server-side via the Conversions API.
  • Data transfer: Any transfer to the USA takes place on the basis of the EU-US Data Privacy Framework and, additionally, the standard contractual clauses.
  • Legal basis: Your consent (Art. 6(1)(a) GDPR).

8.3 Data collected

Personal data from the contact or enquiry form (first name, last name, email address, phone number and the company website provided) is stored in our database. This form data is not transmitted to the analytics service (PostHog). Where you have consented to the marketing category, individual details (in particular email address, phone number and name) are transmitted to the advertising services listed in section 8.2 for conversion measurement, exclusively in pseudonymised, hashed form. To attribute conversions, after your consent we also set our own first-party cookies (pt_fbp, pt_fbc, pt_li_fat_id) that store the respective click identifier.

For analytics purposes we do not process personal data, or only in aggregated form, for example page views, browser information and shortened IP addresses.

8.4 Retention periods

  • PostHog: configurable; aggregated evaluation by default.
  • Advertising services (Meta, Google Ads, LinkedIn): conversion data is retained according to each provider's terms.
  • Form data in the database: until you delete it or in accordance with statutory retention periods.
  • Cookie settings: for the duration of the respective consent.

8.5 User rights

You can request access, rectification, deletion, restriction of processing, data portability and objection at any time. You can withdraw any consent given at any time with effect for the future. Requests can be made via the contact details in this policy.

8.6 Manage cookie settings

You can adjust your consent to analytics and marketing cookies or withdraw it with effect for the future at any time.

9. Server log files

To optimise this website in terms of system performance and usability, the hosting provider automatically collects and stores information in so-called server log files that your browser automatically transmits. This includes your IP address, browser and language settings, operating system, referrer URL, your internet service provider and the date and time of access.

This data is not merged with other sources of personal data. We reserve the right to review this data retrospectively if we become aware of concrete indications of unlawful use.

The website and database are hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Storage takes place exclusively on servers in Germany or within the EU. Hetzner acts as a processor and does not use the data for its own purposes.

10. Our contact details

Protecting your data is particularly important to us. For data protection questions or to withdraw consent you can reach us at: HeyQQ GmbH, Wasagasse 23, 1090 Vienna, Austria, privacy@polytender.com (general enquiries: hello@polytender.com). Managing directors: Dmitrij Rubanov, MA and Mag. Matthias Neumayer, BA. Company register no. FN 572680b, Commercial Court of Vienna, VAT ID ATU77744201.

Without prejudice to any other legal remedy, every data subject has the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, if they believe that the processing of their personal data violates the GDPR.

11. Right to make changes

We reserve the right to adapt this privacy policy if the legal situation, the services used or technical processes change. You can always find the current version on this website.