Privacy notice
What we collect, why, and what you can do about it. Written to be read, not to be survived.
Who is responsible
Bidsight is operated by EMT Technology SRL (BE 0718.916.290, Rue Emile Marcq 16, 1474 Genappe, Belgium), which is the controller of the data described here. For anything on this page, write to info@emtt.be.
What we collect
- Account details you give us: username, email address, company name and VAT number.
- A description of what your business does, which you write or we read from your website. This is what tenders are matched against.
- How you use the service: which searches ran, which tenders were shown, and the decisions your team recorded.
We do not use analytics or advertising trackers, we do not profile you, and we do not sell or share data for anyone else's marketing.
Why we are allowed to
- To provide the service you signed up for — running your searches and sending you results (contract).
- To keep the service secure and stop the free trial being taken repeatedly by the same company (legitimate interest).
- To send occasional product news, only if you switch it on (consent, withdrawable at any time).
- To keep invoices for seven years (legal obligation under Belgian bookkeeping law).
How the matching works
Tender notices are read and scored by a language model running on our own hardware in Belgium. Nothing about you or your business is sent to a third-party AI provider, and the model is not trained or fine-tuned on your data — it is given your description at the moment a notice is screened, and nothing is retained by it afterwards. The scoring decides which public tenders you are shown; it produces no legal effect concerning any individual, and every result carries the reason it matched and a link to the official notice so you can check it.
Who else sees it
| Recipient | What they do | Where |
|---|---|---|
| Hosting (self-managed server) | Runs the application and the database. All of it. | Belgium |
| SMTP provider | Delivers result emails, invitations and password resets. Email address, name, the contents of the message. | EU |
| Google (Drive) | Stores the off-site backup of the database. The whole database, encrypted before it leaves our machine with a key Google never receives. | EU/US - Data Privacy Framework |
| Stripe | Takes payment. Billing name, email, VAT number, payment details. Card numbers never reach us. | EU/US - Data Privacy Framework |
| VIES (European Commission) | Confirms a VAT number is real. The VAT number only, sent at signup. We keep it on your account; the free-trial register holds only a hash of it. | EU |
| TED (EU Publications Office) | Source of tender notices. Search queries only: sector codes, countries and dates, nothing that identifies a customer. We read tender notices from it. | EU |
How long we keep it
Account data for as long as you have an account, and in backups for up to 18 months after that. Search results while the tender is open to bids and for seven days after its deadline, and a year at most; tenders you saved or moved to a stage stay with the account. Sessions, invitations and reset links expire in hours or days. An account whose owner has not signed in for two years is deleted. Invoices are kept for seven years because the law requires it.
Your rights
You can get a copy of your data and take it elsewhere, correct your email address and company name, and delete your data, all from your account page without asking us and with immediate effect. The account owner can also pause our processing there. For anything else, such as correcting your VAT number or objecting to our processing, write to us and we answer within one month.
How it is protected
Passwords are stored as scrypt hashes and can never be recovered, only replaced. Invitation and reset links are stored hashed, so a stolen backup contains no working links. Changing your password signs out every other session. Data is separated by account at every point where it is read.
If you are not happy
You can complain to the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels.
This notice describes what the software actually does.