Privacy Policy

Version of 2026-04-30. This English text is a working draft; the Russian version is authoritative pending legal review.

1. Controller

The data controller within the meaning of Art. 4(7) GDPR and the Azerbaijani Personal Data Law is EM Consulting, Baden-Baden, Germany (see Impressum).

2. What data we process

• Public tender data — names, estimated values, CPV codes and deadlines. Sources: etender.gov.az, OCDS publishers, open government registers.
• Bidder data (legal entities) — VÖEN, legal name, address, beneficial owners. This is commercial, not personal, data.
• Platform operator data — email, name, role (ADMIN/AUDITOR/OPERATOR), action log. Kept for identification and audit-trail purposes.

3. Legal basis

Art. 6(1)(b) GDPR (performance of a contract with a regulator/SOE client) and Art. 6(1)(c) (compliance with Azerbaijan's AI Strategy 2025–2030 and AI Act Art. 12 record-keeping for EU clients).

4. Retention

Audit logs are immutable and retained for at least 7 years in line with a SOX-equivalent process. Other data is kept for the term of the contract + 30 days.

5. Your rights (GDPR + AZ Personal Data Law)

Right of access, rectification, erasure (limited for audit logs via crypto-shredding of the key), portability and objection. Requests: privacy@aztender.ai.

6. Third-party transfers

Hosting — Hetzner Online GmbH (DE). No transfers to third countries. No advertising trackers.

⚠ This document is a working draft. Before production launch it must be reviewed by a lawyer specialising in GDPR and the AZ Personal Data Law.