Privacy notice
What we collect, why, and what you can do about it. Written to be read, not to be survived.
Who is responsible
Bidsight is operated by EMT Technology SRL (BE 0718.916.290, Rue Emile Marcq 16, 1474 Genappe, Belgium), which is the controller of the data described here. For anything on this page, write to info@emtt.be.
What we collect
- Account details you give us: username, email address, company name and VAT number.
- A description of what your business does, which you write or we read from your website. This is what tenders are matched against.
- How you use the service: which searches ran, which tenders were shown, and the decisions your team recorded.
We do not use analytics or advertising trackers and we do not profile you. We do not sell your data. Business contact data of third parties (public tender notices, winning contractors, companies in the public register) is shown to subscribers for their own prospecting, as described below, and never to anyone else.
Why we are allowed to
- To provide the service you signed up for — running your searches and sending you results (contract).
- To keep the service secure and stop the free trial being taken repeatedly by the same company (legitimate interest).
- To send occasional product news, only if you switch it on (consent, withdrawable at any time).
- To keep invoices for seven years (legal obligation under Belgian bookkeeping law).
How the matching works
Tender notices are read and scored by a language model running on our own hardware in Belgium. Nothing about you or your business is sent to a third-party AI provider, and the model is not trained or fine-tuned on your data — it is given your description at the moment a notice is screened, and nothing is retained by it afterwards. The scoring decides which public tenders you are shown; it produces no legal effect concerning any individual, and every result carries the reason it matched and a link to the official notice so you can check it. The same model also serves the Private Sector: Leads tab: it derives from your description which kinds of clients a search looks for (you review them on the form), and it scores each company the register shortlists, from its registered name, legal form, registered office and activity codes; the score concerns a legal person’s public registration, never a natural person.
Reach-out plans and e-mails sent for customers
At a customer's request, the model drafts a plan and a first message for approaching an organisation: the buyer of a tender, a contractor that won public work, the buyer of a contract that is ending, or a contact the customer enters. If a user of that account confirms the exact message, Bidsight sends it by e-mail on their behalf, from its own address, with the customer's address as the reply address.
- Sources: the public notices (TED and Belgium's e-Procurement), the customer's own description of their business, and what the customer types about a contact. A named person's address found in a notice is never used; the model is only told whether a company mailbox is on record.
- Purpose: to help one business approach another about public work. Nobody is profiled.
- Basis: the customer's legitimate interest in business-to-business prospecting (GDPR art. 6(1)(f)). A named person is only e-mailed with their consent or as the customer's existing customer (Code of Economic Law, art. XII.13).
- Retention: a plan 180 days, and sooner when the notice it was written for is removed; the record of a sent e-mail 365 days; the block list for as long as the objection stands.
- Objection: every e-mail carries a one-click link to stop further messages, and anyone can block their address or enterprise number here, without an account: Do not contact me through Bidsight.
Companies listed as private leads
The Private Sector: Leads tab lists legal persons recently registered in Belgium whose activity fits the clients a subscriber targets. This is company data, and here is how we handle it.
- Source: the open data of the Crossroads Bank for Enterprises (FPS Economy), under its open data licence. Legal persons only: a natural person’s business is dropped before anything is stored. We keep the registered name, registered office, activity codes, legal form, start date, website, and an e-mail address only when it is a company mailbox; no director, no phone number.
- Purpose: to show subscribers which newly registered companies could need their services, so they can approach them for business. There is no resale, bulk download or API of this list; a subscriber’s own account export contains only the companies matched for that account.
- Basis: our and our subscribers’ legitimate interest in business-to-business prospecting (Art. 6(1)(f)), weighed against the interests of the people behind those companies; the data is already public and strictly professional.
- Retention: a company is listed for 180 days, or 365 days once a subscriber marks it as contacted; the register mirror keeps 18 months and is rebuilt from the source.
- Your right to object: any company can ask never to be listed or contacted through Bidsight, without an account, by giving its enterprise number or address here: Do not contact me through Bidsight.
Who else sees it
| Recipient | What they do | Where |
|---|---|---|
| Hosting (self-managed server) | Runs the application and the database. All of it. | Belgium |
| SMTP provider | Delivers result emails, invitations and password resets. Email address, name, the contents of the message. | EU |
| Google (Drive) | Stores the off-site backup of the database. The whole database, encrypted before it leaves our machine with a key Google never receives. | EU/US - Data Privacy Framework |
| Stripe | Takes payment. Billing name, email, VAT number, payment details. Card numbers never reach us. | EU/US - Data Privacy Framework |
| VIES (European Commission) | Confirms a VAT number is real. The VAT number only, sent at signup. We keep it on your account; the free-trial register holds only a hash of it. | EU |
| TED (EU Publications Office) | Source of tender notices. Search queries only: sector codes, countries and dates, nothing that identifies a customer. We read tender notices from it. | EU |
| FPS Economy (Crossroads Bank for Enterprises, open data) | Source of the companies listed as private leads. None. We load its published files; we send it nothing about our customers. | Belgium |
| FPS Justice (Belgian Official Gazette) | Linked from each private lead for the company’s publications. None. The customer opens the link themselves; we read nothing from it. | Belgium |
How long we keep it
Account data for as long as you have an account, and in backups for up to 18 months after that. Search results while the tender is open to bids and for seven days after its deadline, and a year at most; results you selected or moved to a stage stay with the account. Sessions, invitations and reset links expire in hours or days. An account whose owner has not signed in for two years is deleted. Invoices are kept for seven years because the law requires it.
Your rights
You can get a copy of your data and take it elsewhere, correct your email address and company name, and delete your data, all from the Your data page without asking us and with immediate effect. The account owner can also pause our processing there. For anything else, such as correcting your VAT number or objecting to our processing, write to us and we answer within one month.
How it is protected
Passwords are stored as scrypt hashes and can never be recovered, only replaced. Invitation and reset links are stored hashed, so a stolen backup contains no working links. Changing your password signs out every other session. Data is separated by account at every point where it is read.
If you are not happy
You can complain to the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels.
This notice describes what the software actually does.