Privacy policy — BIDWAY.es
Version: 13 October 2026. This information applies to the Spanish BIDWAY platform.
1. Controller and contact
The controller is BIDWAY spółka z ograniczoną odpowiedzialnością, ul. Świeradowska 47, 02-662 Warsaw, Poland, KRS 0001264414, NIP 5214178927. Privacy and service contact: kontakt@bidway.eu.
2. Data and purposes
We process email and account details, company profiles, search criteria, uploaded documents, analyses, document drafts, communications and subscription records. Technical logs may contain IP addresses, timestamps and request information. Processing supports service delivery, security, support and legal obligations. Do not upload personal information unnecessary for the procurement procedure.
3. Legal basis
Where the GDPR applies, processing relies on contract performance and pre-contractual steps (Article 6(1)(b)), legal obligations (Article 6(1)(c)), and legitimate interests in security, support and protecting claims (Article 6(1)(f)). Consent, where necessary, is requested separately and may be withdrawn. Spain’s Organic Law 3/2018 is also considered within its applicable scope.
4. Documents and AI
Relevant document content and necessary company data are sent to the OpenAI API for analysis and drafting. Uploaded content is treated as source material, not platform instructions. The platform does not itself make decisions producing legal effects on individuals: users review outputs and decide whether to participate or submit. Citation checks do not guarantee that every interpretation is correct.
5. Recipients and transfers
This installation uses Hetzner Online GmbH for hosting, database and files in Nuremberg, Germany; nazwa.pl for the domain and DNS; Resend for transactional email; OpenAI for analysis and drafting; and Stripe for card payments. The contact address remains kontakt@bidway.eu. Resend receives recipient addresses, message contents and necessary metadata. BIDWAY does not store full card numbers or CVC codes.
Only necessary profile data and source content are sent to OpenAI for a requested operation. Requests use store=false; this does not mean zero provider retention. OpenAI, Stripe and Resend may process data outside the EEA. Such transfers require an applicable GDPR Chapter V basis, such as an applicable adequacy decision or standard contractual clauses and additional safeguards where required. Contact kontakt@bidway.eu for recipient and safeguard information. See the privacy information of Hetzner, Resend and Stripe. PLACSP, TED and other external sources have their own policies.
6. Retention and security
Account data and results remain while the account exists. Subscription expiry does not itself delete an account. Request deletion at kontakt@bidway.eu; necessary legal and claims records are excepted. Download needed results first. Files are not automatically deleted immediately after analysis. Daily server backups normally remain for up to eight days. Security logs are retained according to their purpose and incident investigation needs. Access is restricted by account and role.
7. Rights
Depending on applicable law, you may request access, correction, erasure, restriction or portability, object to processing or withdraw consent. Identity verification may be required. Erasure may be limited by legal obligations or claims. Complaints may be submitted to the competent authority: the Spanish Data Protection Agency (aepd.es), or Poland’s UODO where competent.
8. Cookies
The package uses necessary WordPress login and security cookies. Login normally lasts 2 days, or 14 days with “Remember me”. The bw_cookie_notice cookie stores notice dismissal for 180 days and contains no account identifier. No advertising or analytics trackers are included. Adding them requires updated disclosures and a consent mechanism before activation where legally required. Cookies can be deleted in your browser.
WordPress admin preferences may remain for up to one year. Dismissing the cookie notice is not marketing consent.