BIDWAY.si privacy and cookie policy
Version: 12 October 2026.
1. Controller and contact
The controller is BIDWAY spółka z ograniczoną odpowiedzialnością, ul. Świeradowska 47, 02-662 Warszawa, Polska; KRS 0001264414, NIP 5214178927. Contact kontakt@bidway.eu or the postal address above about data and your rights.
2. Data and sources
We process email addresses, account identifiers, password hashes, acceptance records, company profiles, uploaded documents, form answers, analysis results, drafts, checklists, allowance usage and billing identifiers/status. Profiles may contain company names, addresses, tax numbers, representatives, activities, CPV codes, experience and resources. The server receives IP addresses, request times and URLs, browser, session and error information.
Data comes from users, their companies, service providers and public TED notices. Users may upload permitted documents from PJN, e-JN or other sources. Public documents may identify staff and business contacts. We do not automatically collect the complete national procurement database. We do not receive full card numbers or CVC codes; these are entered with the payment provider.
3. Purposes, bases and retention
Accounts, profiles, analysis and documents are processed to perform a contract or take pre-contractual steps (GDPR Article 6(1)(b)). Business representative contact, necessary public business information, security and claims use legitimate interests (Article 6(1)(f)). Accounting, tax and other mandatory records use legal obligations (Article 6(1)(c)).
Account data and results are kept while the account exists. On termination we return or delete them, apart from necessary legal and claims records. Subscription expiry does not itself delete an account. Request deletion by email and download needed results first. Accounting records follow the Polish provider's applicable statutory periods, generally five years, with the start and extensions depending on the obligation. Security logs are retained according to purpose and incident investigation. Daily server backups normally remain for up to eight days. Unnecessary data is removed or anonymised.
Required fields are necessary for the account or requested operation; other information is optional. Accepting terms is not marketing consent.
4. Providers and recipients
- Hetzner Online GmbH: hosting, database and files in Nuremberg, Germany. Hetzner privacy.
- nazwa.pl: bidway.si domain registration and DNS. The contact@bidway.eu mailbox remains within BIDWAY's existing infrastructure.
- Resend: transactional messages, recipient addresses, message contents and necessary metadata. Password emails contain confidential links. Resend privacy.
- Stripe: payment, payer identification, fraud prevention and billing; it may act as an independent controller for its own legal duties. Stripe privacy.
- OpenAI: when AI is requested, necessary profile information, source documents and answers are sent through its API. Account passwords and card details are not sent. Requests use store=false, which does not mean zero retention. API data is not used for training by default without separate opt-in; safety logs may normally be retained for up to 30 days, subject to documented exceptions. OpenAI API data information.
Authorised support, IT, accounting and advisory personnel and competent authorities may receive necessary data. We do not sell personal data. This installation has no Google Analytics or Meta advertising pixel.
5. Transfers outside the EEA
OpenAI, Stripe and Resend may process data outside the EEA, including the US. Transfers require a GDPR Chapter V basis: a valid adequacy decision where applicable to the recipient and transfer, or standard contractual clauses and appropriate additional safeguards. Contact the controller for details and safeguard information. European hosting does not exclude every international transfer.
6. Other people's data and AI
Upload only necessary data you may lawfully provide. Remove unnecessary identification numbers, private contacts, health information and criminal conviction data. The platform is not intended for classified information or special categories of personal data. Obtain official certificates from the competent issuer; AI does not issue them.
Matching uses activities, CPV and profile information and may amount to profiling where it relates to an identifiable person. Results assist your own decision. The platform makes no solely automated decisions with legal or similarly significant effects, and does not sign or submit bids.
7. Cookies
Necessary WordPress cookies support login and security. Login normally lasts two days, or 14 with Remember me. Admin preferences may last up to a year. bw_cookie_notice remembers notice dismissal for 180 days and contains no account identifier. This installation includes no analytics or advertising trackers. Dismissing the notice is not marketing consent. Reopen details in the footer. Browser controls allow deletion; blocking necessary cookies may prevent login. Stripe provides its own information on its pages.
8. Your rights
Subject to law, you may access and copy, rectify, erase, restrict or port data and object to legitimate-interest processing. Consent can be withdrawn without affecting prior lawfulness. Contact kontakt@bidway.eu. We may verify identity and normally respond within one month, explaining any permitted extension. You may complain to a supervisory authority, including Slovenia's Information Commissioner or Poland's UODO. Deletion does not override mandatory record retention.
9. Changes
We publish a dated version when services, providers or rules change and notify account holders of material changes before application. New trackers requiring consent will only operate after an appropriate user choice.