Privacy Policy

1. Controller and personal data

The controller within the meaning of the GDPR is HeyQQ GmbH (company register no. FN 572680b, Commercial Court of Vienna, VAT ID ATU77744201), Wasagasse 23, 1090 Vienna, Austria, reachable for data protection matters at privacy@polytender.com. Polytender is a product of Run Labs, the product studio of HeyQQ GmbH based in Vienna. Managing directors: Dmitrij Rubanov, MA and Mag. Matthias Neumayer, BA.

Personal data is any information relating to an identified or identifiable natural person (Art. 4(1) GDPR), such as name, email address, phone number or IP address. We only process it where there is a legal basis under the GDPR; the overview in section 4d shows which one applies.

2. Access and deletion

As a data subject you have the right at any time to obtain information about your stored personal data, its origin and recipients and the purpose of processing, as well as the right to rectification, erasure, restriction of processing, data portability and objection. Please let us know of any changes to your personal data.

You have the right to withdraw any consent given at any time. Requests for access, deletion, rectification, objection and/or data portability can be sent to the contact details listed in section 10 of this policy.

If you believe that our processing of your personal data violates applicable data protection law or otherwise infringes your rights, you may lodge a complaint with the competent supervisory authority. In Austria this is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna.

Right to object (Art. 21 GDPR)

Where we process your personal data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You can object to processing for direct marketing purposes at any time without giving reasons. An informal objection to privacy@polytender.com is sufficient.

3. Data security

Your personal data is protected through appropriate organisational and technical measures. These measures relate in particular to protection against unauthorised, unlawful or accidental access, processing, loss, use and manipulation.

4. Use of data

We do not process the data provided to us for purposes other than those covered by your request, your consent or a provision in line with the GDPR. Specifically, we use your details to match public tenders against your company's activity, show you relevant tenders and contact you about your matches by email and, where you have consented, by phone. This does not apply to use for statistical purposes where the data has been anonymised.

We process the data provided via the form (first name, last name, email address, phone number, company website, optional industry) to handle your enquiry: we match public tenders against your company and get back to you with the results. These are steps you requested yourself before a possible contract. Providing the data is voluntary, but without it we cannot handle your enquiry.

Phone contact

Under section 174(1) of the Austrian Telecommunications Act 2021, calls for advertising purposes require your prior consent, including calls to businesses. We therefore only call you if you have consented via the relevant checkbox in the form. You can withdraw this consent at any time with effect for the future, for example by email to privacy@polytender.com. We will still handle your enquiry, but only contact you by email.

Newsletter (double opt-in)

If you tick the separate, voluntary newsletter checkbox in the form, we use your email address to send you information about relevant tenders and product news. Sign-up uses the double opt-in procedure: after you sign up we first send you a confirmation email, and your address is only added to the newsletter list once you click the confirmation link it contains. For this we store your email address, your name and the times of sign-up and confirmation. The newsletter sign-up is independent of the rest of the form processing and is not required to use the service. You can unsubscribe at any time (via the unsubscribe link in every email or by contacting us) and thereby withdraw your consent with effect for the future. To send the confirmation email and the newsletter we use Lettermint B.V., Willemsvaart 16, 8019 AB Zwolle, the Netherlands, as a processor; processing takes place within the EU.

4a. Polytender account, AI features and AI assistant connections

Account data

When you create a Polytender account, we process your account data (name, email address, organisation and role) and the content you create, such as search profiles, company websites, favourites, notes, ratings of matches and team invitations (including the email addresses of the people you invite). We process this data to provide the service we have agreed with you. Name, email address and password or sign-in link are required for registration; without them we cannot create an account. All other details are voluntary. For each sign-in session we store your IP address and browser identifier (user agent) to secure the session and detect misuse. Service emails, for example sign-in links, invitations and daily matches, are sent via Lettermint (see section 4).

AI features and uploaded content

When you use AI features, such as analyses of tender documents or drafts of bid content, we process the content you enter or upload for them (for example company profile, references, CVs, cost calculations and documents), the results generated from it and your consumption of credits. The content is transmitted to the AI providers named in section 8.2.2 for this purpose, which may not use it for training, and is stored in your account until you delete it or your account. The results are suggestions; you decide how to use them.

To train and improve our own AI models, we use exclusively anonymised usage data and your ratings, such as whether a match fits. We do not use content you enter or upload, or generated results, for this purpose. Anonymised data no longer allows any conclusions about you, your organisation or other persons and is not passed on to third parties. You or your organisation may object to this at any time (see section 2); we then no longer use your usage data and ratings for this purpose.

Where your content contains personal data of other people, such as employees' CVs or contact details of referees, we process it as a processor on behalf of your organisation (Art. 28 GDPR). Your organisation is the controller for this data; it needs a legal basis and informs the people concerned. We forward requests from these people to your organisation.

Setup questions

When you set up your account, we ask you a few voluntary questions: your role, the size of your team, your goals with Polytender, the countries relevant to you and how you heard about us. Every question can be skipped. We store your answers with your account and copy them as properties of your user and organisation profile to PostHog (see section 8.2.1), to understand who uses Polytender, tailor our offering accordingly and evaluate how customers find us.

AI assistant connections

You can connect Polytender to an AI assistant such as ChatGPT (OpenAI), Claude (Anthropic) or Microsoft Copilot, using OAuth sign-in or a personal API key. The assistant then receives the results of the actions you ask it to perform and processes them under its provider's own privacy policy. We do not receive your chat history; our server only receives the inputs the assistant sends for each action. We log each action, including the tool used, time, user, organisation and assistant, for security and to enforce usage limits.

Your controls

You can disconnect an AI assistant at polytender.com/app/connector, revoke API keys at polytender.com/app/api-keys and delete your account at polytender.com/app/profile. For any other data protection request, contact privacy@polytender.com.

Product analytics for customers

To operate, bill and improve the service, we record certain usage events of your account on our servers, such as actions performed through AI assistants, billing events (for example the start, change or end of a subscription) and the sending and use of the daily match email. These events are linked to your user ID and organisation and analysed in PostHog (see section 8.2.1). This involves no access to your device. You may object to this analysis at any time (see section 2).

4b. Personal data in tender notices

The notices we take over from public procurement portals (for example TED and national and regional portals) may contain personal data, in particular names, email addresses and phone numbers of contact persons at contracting authorities, and names of sole traders and freelancers in contract award notices. We do not collect this data from you but from these publicly accessible sources (Art. 14 GDPR).

We store and process this data unchanged as part of the notice in order to make it available to our users in searchable form (platform, email, programming interface and AI assistant connections) and to match notices against company profiles; for this it may also be transmitted to the AI providers listed in section 8.2.2. We keep notices available after their deadline as an archive of past procurements, because users research contracting authorities, awards and market prices from it. The legal basis and retention period are set out in the overview in section 4d.

Notifying each data subject individually would involve disproportionate effort (Art. 14(5)(b) GDPR), so this information is made publicly available here. Data subjects may in particular request access and object to the processing (see section 2). In that case we remove or hide their details in the notices concerned. Please send requests to privacy@polytender.com.

4c. Feedback

You can give us feedback voluntarily in several places. We process the following data:

• Feedback button in the app: the form sends your message, your name and email address (prefilled from your account and editable), the page you are on and technical details about your browser and operating system to Sentry (see section 8.2.7). You can optionally attach a screenshot, which you take through your browser and can annotate or partly black out before sending. It contains everything visible in the window you select.
• Rating of product updates ("What's new"): your rating and optional comment are stored in our database, linked to your account.
• "Was this page helpful?" in the documentation: your rating, optional comment, the page and the language are sent to PostHog as an event (see section 8.2.1). We do not store them in our database.

4d. Overview: purposes, legal bases and retention

The overview assigns a legal basis, retention period and recipients to each purpose; the data we process is described in the section referred to. Legal bases under Art. 6(1) GDPR: (a) consent, (b) contract or pre-contractual steps, (c) legal obligation, (f) legitimate interest (the interest is stated). We store all data with Hetzner in Germany (section 8.2.3); the recipients column lists additional recipients, and details on the providers are set out in section 8.2.

You can withdraw any consent at any time with effect for the future. Where we rely on a legitimate interest, you may object to the processing (section 2). Statutory retention obligations remain unaffected; once the purpose has ceased, we delete data as soon as no such obligation applies.

5. Transfer of data to third parties

We only pass data on to the recipients listed in section 8.2, and only on the legal bases set out in section 4d. Most of them act as processors on our instructions (Art. 28 GDPR). Meta and LinkedIn are joint controllers with us (Art. 26 GDPR, sections 8.2.4 and 8.2.6); Stripe is an independent controller for certain purposes (section 8.2.8).

Some of these recipients process personal data outside Austria. The level of data protection in other countries may not correspond to that in Austria. We only transfer your personal data to countries for which the EU Commission has determined an adequate level of protection (adequacy decision pursuant to Art. 45 GDPR, for example the EU-US Data Privacy Framework), or we use appropriate safeguards, in particular standard contractual clauses pursuant to Art. 46 GDPR.

Payment processing

We use the payment service provider Stripe to process payments for paid subscriptions. You enter your payment details directly with Stripe; we do not receive or store complete card or account numbers. Details of the data processed and Stripe's role are set out in section 8.2.8.

Processing using artificial intelligence (LLM)

To match tenders against your company, to translate tenders, for semantic search and for AI features such as analyses of tender documents and bid drafts, we process certain content automatically using large language models and embedding models. For this we only use AI providers whose models run on servers within the EU or EEA: Cortecs GmbH in Vienna and Google Cloud (Vertex AI) in a European processing region. Details are set out in section 8.2.2.

Processing takes place exclusively for the purposes described in this policy and not for independent use or model training by the provider. The data is processed on servers within the EU or EEA.

The AI-based matching only assesses how well a tender fits a company; analyses and drafts are suggestions. Neither leads to any decision that produces legal effects concerning you or similarly significantly affects you; no automated individual decision-making within the meaning of Art. 22 GDPR takes place. Whether you take part in a procurement procedure is solely your decision.

6. Notification of data breaches

We report data breaches to the Data Protection Authority in accordance with Art. 33 GDPR. Where a breach is likely to result in a high risk to your rights and freedoms, we notify you without undue delay in accordance with Art. 34 GDPR.

7. Retention of data

We do not retain data longer than necessary to fulfil our contractual or legal obligations and to defend against potential liability claims. The retention period for each purpose is set out in the overview in section 4d. Statutory retention periods remain unaffected.

8. Cookies, local storage and consent management

We use cookies and similar technologies, in particular your browser's local storage (localStorage and sessionStorage), to provide this website and analyse its use. Without your consent we only store or read information on your device where this is strictly necessary to provide a service you have explicitly requested (section 165(3) of the Austrian Telecommunications Act 2021); otherwise only with your consent.

8.1 Categories and overview

• Essential cookies: Technically required to display the website correctly and provide basic functions such as signing in. They are used without consent.
• Functional cookies and storage entries: Store settings you make (for example the language) or continue a process you started. They are used without consent and contain no identifiers for analytics or advertising.
• Analytics cookies: Provide statistical information about usage. On the website they are only set with your consent, in the app always (see section 8.2.1).
• Marketing cookies: Used to measure advertising success (conversions) and optimise our advertising campaigns. They are only set with your consent.

We store your choice in the cookie banner in the essential cookie cookie_consent (lifetime 12 months). If you withdraw your consent to the marketing category, we delete the related cookies in your browser.

The following overview lists the cookies and storage entries used (cookies, localStorage, sessionStorage) by provider and category; the names in brackets are examples. For cookies in the embedded cal.com booking window, see section 8.2.10.

Third-party cookies are additionally subject to the providers' own policies: Meta https://www.facebook.com/privacy/policy/, Google https://policies.google.com/privacy, LinkedIn https://www.linkedin.com/legal/cookie-policy, PostHog https://posthog.com/privacy, Stripe https://stripe.com/cookies-policy/legal.

You can also delete or block cookies and locally stored data at any time in your browser settings. If you also block essential cookies, you will no longer be able to sign in to the app.

Separately from this, we carry out cookieless audience measurement: even without your consent we evaluate page views on a purely statistical basis (page requested, referrer, approximate location at country level, device and browser type, time). No cookies are set or read and no persistent device or user identifiers are stored; attribution uses a daily rotating checksum computed on the server, which rules out recognition beyond the day. We store nothing on your device and read no information stored on it. You may object to this evaluation at any time using the contact details in section 10.

We load advertising tags in the browser (Meta Pixel, LinkedIn Insight Tag, Google tag) only after your explicit consent to the marketing category. Without this consent, we store no related identifiers (for example click parameters) on your device and send no data to advertising services, neither from your browser nor from our servers. With your consent, our servers additionally report contact form enquiries, the sign-up, the completion of the setup (onboarding) and the first payment of a subscription to Meta and LinkedIn via their Conversions API, and the first payment to Google (see sections 8.2.4 to 8.2.6).

Campaign attribution without storage: if you reach our website through an advertised link, the address contains campaign parameters (for example utm_source, utm_campaign). If you have not consented to the marketing category, we store nothing on your device for this. Instead, we append these campaign parameters and the type of page you are coming from (for example "home page") to the sign-up links, so we can tell which campaign and which page a sign-up came from. Click identifiers of the advertising networks (for example gclid, fbclid) are never passed on. Only with your consent to the marketing category do we store the campaign details in first-party cookies (pt_attr, pt_attr_last, 90-day lifetime) and evaluate them across sessions. You may object to this evaluation at any time (see section 2).

8.2 Services and cookies used

The legal basis and retention period of each processing operation are set out in the overview in section 4d.

8.2.1 PostHog (analytics)

• Provider: PostHog Inc., 965 Mission Street, San Francisco, CA 94103, USA.
• Purpose: Product analytics, usage statistics and aggregated evaluation of site usage.
• Category: Analytics.
• Place of processing: Data is captured via PostHog's EU ingestion endpoint (eu.i.posthog.com) and stored in the EU (Frankfurt). PostHog acts as a processor pursuant to Art. 28 GDPR. Where access from the USA occurs in individual cases, for example in the course of support, it takes place on the basis of the EU-US Data Privacy Framework and, additionally, the standard contractual clauses pursuant to Art. 46 GDPR.
• Cookies and local storage: ph_* as a cookie and in localStorage and sessionStorage for session and usage tracking (1-year lifetime, on the website only after consent to the analytics category), plus pt_attr / pt_attr_last for campaign attribution (90-day lifetime, only after consent to the marketing category).
• Without consent: cookieless audience measurement (see section 8.1). No cookies are set or read and no persistent identifiers are stored; no user profiles and no session recordings are created.
• After consent: additionally cross-session analysis using the cookies listed above.
• In the signed-in area (app): product analytics with the ph_* cookies is always active there, to operate and improve the service. Advertising cookies and conversion measurement (sections 8.2.4 to 8.2.6) still only take place with your consent, which you can change at any time via "Cookie settings" in the user menu.

8.2.2 AI providers (processing in the EU or EEA)

• Cortecs: Cortecs GmbH, Althanstrasse 4, 1090 Vienna, Austria. Through the Cortecs platform we use language models run by European data centre operators. Cortecs forwards requests to the inference providers we have enabled, which act as sub-processors of Cortecs and process the data within the EU or EEA. The current list of these sub-processors is in the Cortecs data processing agreement at https://cortecs.ai/dpa.
• Google Cloud (Vertex AI): Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). We use the Gemini model family and a multilingual embedding model, exclusively in a European processing region.
• Purpose: Automated analysis and matching of tenders against your company profile, translation of tenders, semantic search and AI features such as analyses of tender documents and bid drafts, using language and embedding models.
• Data processed: the company website you provide (its publicly accessible content), tender texts, search queries you enter in Polytender or through a connected AI assistant, and content you enter or upload for AI features, in each case as far as required for the function. Your contact data from the account (name, email address, phone number) is not transmitted to the AI providers. Tender texts and your uploaded content may, however, contain personal data (see sections 4a and 4b).
• Place of processing and processing on our behalf: Cortecs and Google act as processors pursuant to Art. 28 GDPR, and the inference providers used by Cortecs as its sub-processors. The data is processed on servers within the EU or EEA. For providers whose parent company is based in the USA, such as Google, access from the USA cannot be ruled out in individual cases, for example for maintenance and support. Such access takes place on the basis of the EU-US Data Privacy Framework and, additionally, the standard contractual clauses pursuant to Art. 46 GDPR.

8.2.3 Hetzner (hosting and database)

• Provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.
• Purpose: Provision of the technical infrastructure, server hosting and operation of the database in which, among other things, your form data is stored.
• Place of processing: Servers in Germany or within the EU.
• Note: Hetzner acts as a processor and does not use the data for its own purposes.

8.2.4 Meta Pixel & Conversions API

• Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (parent company: Meta Platforms, Inc., USA).
• Purpose: Measuring advertising success (conversions) and optimising our advertising campaigns on Meta platforms (for example Facebook, Instagram).
• Category: Marketing. We only use the Meta Pixel and the Conversions API after your consent.
• Meta Pixel (client-side): After your consent, the Meta Pixel (JavaScript from connect.facebook.net) is loaded in your browser. It sets Meta cookies (_fbp/_fbc), records page views and booked calls (section 8.2.10) and enables the building of retargeting audiences.
• Conversions API (server-side): Only with your consent to the marketing category do our servers report contact form enquiries, the sign-up of a Polytender account, the completion of the setup and the first payment of a subscription directly to Meta. The data sent is your email address, name, user ID and, for enquiries, phone number in hashed (pseudonymised) form, your IP address, your browser identifier (user agent), the Meta cookies _fbp/_fbc, the type and time of the event and, for payments, the amount and currency. Meta matches the data against user accounts on its platforms to measure and optimise the success of our advertising.
• Joint controllership: We and Meta Platforms Ireland Limited are joint controllers for the collection of the data on our website or by our servers and its transmission to Meta (Art. 26 GDPR). Essence of the arrangement (Meta Controller Addendum, https://www.facebook.com/legal/controller_addendum): we are responsible for informing you about this processing and for obtaining valid consent; Meta is responsible for the security of the data, for handling data subject requests concerning the data stored by Meta, and for Meta's subsequent processing, for which Meta is an independent controller. You can exercise your rights both against us and against Meta.
• Data transfer: Any transfer to the USA takes place on the basis of the EU-US Data Privacy Framework and, additionally, the standard contractual clauses.

8.2.5 Google Ads

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).
• Purpose: Measuring advertising success (conversions) and optimising our Google Ads campaigns.
• Category: Marketing (only after consent).
• Processing: The Google tag (gtag) is only loaded after you consent to the marketing category (Google Consent Mode v2 in basic mode). Without consent the tag is not loaded and no data is transmitted to Google. After your consent, Google sets cookies (for example _gcl_*, 90-day lifetime) and page views and conversion events are transmitted, including your IP address and browser information; the Google click identifier (gclid) and, where enabled, a pseudonymised (hashed) email address, phone number and name (Enhanced Conversions) are used for matching.
• Server-side reporting of the first payment (Data Manager API): Only if you consented to the marketing category when starting checkout does our server report the first payment of a subscription directly to Google. The data sent is your email address in hashed form, the Google click identifier (gclid) where available, a transaction ID, the time, amount and currency. This way Google counts the payment exactly once, even if the Google tag in the browser does not capture it.
• Data transfer: Any transfer to the USA takes place on the basis of the EU-US Data Privacy Framework and, additionally, the standard contractual clauses.

8.2.6 LinkedIn Insight Tag & Conversions API

• Provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (parent company: LinkedIn Corporation, USA).
• Purpose: Measuring advertising success (conversions) and optimising our LinkedIn advertising campaigns.
• Category: Marketing. We only use the Insight Tag and the Conversions API after your consent.
• LinkedIn Insight Tag (client-side): After your consent, the LinkedIn Insight Tag (JavaScript from snap.licdn.com) is loaded in your browser. It sets LinkedIn cookies, records page views and serves to build retargeting audiences and anonymised website statistics (demographics).
• Conversions API (server-side): Only with your consent to the marketing category do our servers report contact form enquiries, the sign-up of a Polytender account, the completion of the setup and the first payment of a subscription directly to LinkedIn. The data sent is your email address in hashed form, your IP address, the LinkedIn identifier li_fat_id, the type and time of the event and, for payments, the amount and currency. We do not send your name. LinkedIn matches the data against member accounts to measure the success of our advertising.
• Joint controllership: We and LinkedIn Ireland Unlimited Company are joint controllers for the collection of the data on our website or by our servers and its transmission to LinkedIn (Art. 26 GDPR). We are responsible for informing you about this processing and for obtaining valid consent; LinkedIn is an independent controller for its subsequent processing. You can exercise your rights both against us and against LinkedIn. More information: https://www.linkedin.com/legal/privacy-policy.
• Data transfer: Any transfer to the USA takes place on the basis of the EU-US Data Privacy Framework and, additionally, the standard contractual clauses.

8.2.7 Sentry (error monitoring)

• Provider: Functional Software, Inc. d/b/a Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA.
• Purpose: Detecting, analysing and fixing technical errors, measuring the stability and loading times of our application (operational and data security, quality assurance) and receiving feedback from the app (see section 4c).
• Cookies: No cookies are set and no session recordings (session replay) are created.
• Place of processing: Sentry's EU data region (data centres in Germany). Where an exceptional transfer to the USA occurs in the course of support, it takes place on the basis of the standard contractual clauses pursuant to Art. 46 GDPR.
• Data processed (errors): in the event of an error, the technical error message including the call path through the program code, the page called up, the time, browser type and version and operating system.
• Data processed (performance): for a random sample of about 10% of page views and server requests, we send performance data even when no error occurs, namely the page or endpoint called, the duration of individual processing steps, the time, browser and operating system.
• Attribution in the app: once you are signed in to the app, error and performance reports from your browser carry your email address and name, so we can see who is affected by an error and contact you if needed.
• Feedback: messages you send via the feedback button in the app, including name, email address and optional screenshot (see section 4c).
• Data minimisation: The automatic transmission of additional personal data is disabled. Form contents, request bodies and headers are not transmitted. Reports from the browser are also routed via our own domain, so Sentry does not receive your IP address.
• Processing on our behalf: Sentry acts as a processor pursuant to Art. 28 GDPR and does not use the data for its own purposes.

8.2.8 Stripe (payment processing)

• Provider: Stripe Payments Europe, Limited, The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland (parent company: Stripe, LLC, 354 Oyster Point Boulevard, South San Francisco, CA 94080, USA).
• Purpose: Processing of payments for paid subscriptions, in particular checkout, recurring charges, management of the payment method, calculation of VAT, issuing of invoices and payment receipts, and fraud prevention in connection with payment transactions.
• Data processed: company name and billing address, VAT identification number, name of a contact person (optional), email address of the account holder, payment details (for example card details or bank account details for SEPA direct debit), transaction data (plan, billing period, amounts, taxes, invoices and payment status) and technical data from the payment process such as IP address, device and browser information.
• Payment details: You enter your payment details directly into forms provided by Stripe; they are transmitted to Stripe in encrypted form. We do not receive or store complete card or account numbers. We only receive details such as the card brand, the last four digits and the expiry date from Stripe so that we can show you the payment method on file.
• Our own records: In our database we store the Stripe customer and subscription identifiers, the plan, billing period, number of seats and search profiles, the status of the subscription and a record of the billing events sent to us by Stripe (for example a completed checkout or a paid or failed invoice).
• Data for conversion measurement: the first payment is only confirmed after checkout is complete. So that we can report it to the advertising services (sections 8.2.4 to 8.2.6), at checkout, and only if you have consented to the marketing category, we store your user ID, IP address and browser identifier (user agent) and the click and cookie identifiers of the advertising services (gclid, _fbp, _fbc, li_fat_id) in the metadata of your subscription at Stripe.
• Stripe.js and cookies: The payment forms are embedded on our billing page (/app/billing) using Stripe.js. Stripe sets cookies there (in particular __stripe_mid with a lifetime of one year and __stripe_sid with a lifetime of 30 minutes) that are required for fraud prevention and the secure processing of the payment. They are only used on pages with payment functions and are strictly necessary for the service you have expressly requested (section 165(3) of the Austrian Telecommunications Act 2021); no consent is required for them.
• Disclosure during the payment process: To carry out a payment, Stripe transmits the necessary data to the payment service providers involved (for example card networks and your bank). They may use the data to authenticate the payment (strong customer authentication, such as 3-D Secure).
• Role of Stripe: Stripe processes payment data as our processor on the basis of a data processing agreement pursuant to Art. 28 GDPR. For its own purposes, in particular to detect and prevent fraud, to ensure security and to comply with legal obligations (for example anti-money laundering and identity verification requirements), Stripe acts as an independent controller. If you use Link, Stripe's service for saving payment details, during checkout, Stripe is also an independent controller for that service. For more information, please see Stripe's privacy policy at https://stripe.com/privacy.
• Data transfer: Stripe operates internationally. Where personal data is transferred to Stripe, LLC in the USA or to other Stripe group companies outside the EEA, this takes place on the basis of the EU-US Data Privacy Framework, under which Stripe, LLC is certified, and additionally the European Commission's standard contractual clauses pursuant to Art. 46 GDPR.

8.2.9 Lettermint (email delivery)

• Provider: Lettermint B.V., Willemsvaart 16, 8019 AB Zwolle, the Netherlands.
• Purpose: Sending our emails, in particular sign-in links, invitations, daily match emails, billing and service messages, and confirmation and newsletter emails.
• Data processed: email address, name, email content and technical delivery data (for example time, delivery status).
• Place of processing: within the EU.
• Processing on our behalf: Lettermint acts as a processor pursuant to Art. 28 GDPR and does not use the data for its own purposes.

8.2.10 Cal.com (booking calls)

• Provider: Cal.com, Inc., USA.
• Purpose: booking a call with us on the /demo page and in the app.
• Embedding: We only load the cal.com booking window once you open the booking. Your browser then connects to cal.com's servers and transmits your IP address and browser information. Cookies that cal.com sets in the embedded window are governed by cal.com's privacy policy (https://cal.com/privacy).
• Data processed: name and email address (prefilled from your enquiry or account and editable), on the /demo page the company website you provided, the slot you choose and any optional details. Cal.com sends the booking confirmation by email.
• Evaluation: We record that a call was booked in PostHog (section 8.2.1) and, only with your consent to the marketing category, on the /demo page via the Meta Pixel (section 8.2.4).
• Processing on our behalf and transfers: Cal.com acts as a processor pursuant to Art. 28 GDPR. Transfers to the USA take place on the basis of the standard contractual clauses pursuant to Art. 46 GDPR.

8.3 Data collected

Personal data from the contact or enquiry form (first name, last name, email address, phone number and the company website provided) is stored in our database. We transmit to the analytics service (PostHog) the fact that the form was submitted, with your email address as identifier, together with the selected industry and the page and campaign the enquiry came from, so we can evaluate the number and origin of enquiries; name and website only if you have consented to the analytics category. Phone numbers are not transmitted to PostHog. Where you have consented to the marketing category, individual details are transmitted to the advertising services listed in sections 8.2.4 to 8.2.6 for conversion measurement: email address, phone number and name in hashed form (to LinkedIn, only the hashed email address), plus your IP address and browser identifier. To attribute conversions, after your consent we also set our own first-party cookies (pt_fbp, pt_fbc, pt_li_fat_id) that store the respective click identifier.

8.4 Manage cookie settings

You can adjust your consent to analytics and marketing cookies or withdraw it with effect for the future at any time.

Open cookie settings

9. Server log files

When you access our website and application, our servers automatically store information that your browser transmits (server log files) in order to ensure secure and stable operation, analyse errors and defend against attacks. This includes your IP address, browser and language settings, operating system, referrer URL, your internet service provider and the date and time of access.

This data is not merged with other sources of personal data. We reserve the right to review this data retrospectively if we become aware of concrete indications of unlawful use.

Our servers are operated by Hetzner in Germany (section 8.2.3).

10. Our contact details

Protecting your data is particularly important to us. For data protection questions or to withdraw consent you can reach us at: HeyQQ GmbH, Wasagasse 23, 1090 Vienna, Austria, privacy@polytender.com (general enquiries: hello@polytender.com). Managing directors: Dmitrij Rubanov, MA and Mag. Matthias Neumayer, BA. Company register no. FN 572680b, Commercial Court of Vienna, VAT ID ATU77744201.

11. Right to make changes

We reserve the right to adapt this privacy policy if the legal situation, the services used or technical processes change. You can always find the current version on this website.