Your data at Adjudica

Who is responsible

The controller of your data is:

• Adjudica
• Email: contacto@adjudica.eu

For any request about your data, write to contacto@adjudica.eu.

Visit statistics

We count views and clicks on public links to understand which pages help people discover the service. We keep only counts per day, page, destination and category of origin (for example Google or direct access with no referrer), for 90 days.

On our server we also count the pages viewed on the website and in the application: the page (without parameters), the day, the domain you came from (for example google.pt) or the campaign indicated in the link, the country reported by the network, the type of device and whether you were signed in, without saying which account. We do not store your IP address. To count distinct visitors in a day we use a code calculated from the IP address and the browser with a random key that changes every day and is deleted the following day: from then on, that code can no longer be linked to you. These records are kept for 90 days; after that only daily totals remain (legal basis: legitimate interest in improving the service).

We respect the Do Not Track and Global Privacy Control signals: when they are switched on, we do not count your visits. These counts do not prove the origin of a sign-up.

Product analytics

To understand where the website and the application help and where people get lost, we use a product analytics tool hosted in the European Union, in Germany. The IP address is discarded on arrival and we never send your email, the NIF or your name.

• On the public pages we do not identify you and we store nothing in your browser (no cookies and no other storage): we count the pages viewed and the clicks on creating an account and on choosing a plan, with the page where they happened, without parameters. There are no session recordings on the public pages.
• Inside the application, when you are signed in, the main actions (for example creating an account, searching, saving a tender, following a public body, subscribing) are linked to an internal code for your account and to the plan. Here too we store nothing in your browser.
• Session recordings, only inside the application: in some visits we record clicks, movement on the page and screen changes, so that we can see where the application fails. All text on the screen and everything you type is masked in the recording: we do not see names, numbers, searches or the content of fields.

Legal basis: legitimate interest in improving the service. You may object by writing to contacto@adjudica.eu; with Do Not Track or Global Privacy Control switched on in your browser, none of this is collected.

What data we process

The legal basis is shown in brackets: contract means the performance of the Terms you accept when you create an account (RGPD (the GDPR), art. 6(1)(b)); legitimate interest means point (f) of the same article, and you may object to it.

• Your email, so that you can sign in (with your Google account or with a password) and receive the alerts (contract).
• Your password, only if you use one, stored encrypted: not even we can read it (contract).
• The NIF of the company you choose for the account, to work out the matching tenders and the reference price (contract).
• The decisions you mark on tenders, such as "I will bid", and the questions you ask about the tender documents, with the answers (contract).
• The company file, if you use it (Pro): the files you upload (certificates, licence, accounts, quality certificates, team CVs), the access codes and the data extracted from them. The files and the codes are kept encrypted, separated by account and by company; only you can see them (on the Business and Enterprise plans, also the people on the plan who work for that company) and each access is logged with who and when (contract).
• The alert sending records: the day and the tenders sent, so that we do not repeat them or send twice on the same day (contract).
• The actions you take in the app, linked to your account, for support and to improve the service (legitimate interest).
• A copy of the emails we send you (alerts, account confirmation, support replies), for 12 months, so that we can help you when something goes wrong. Links containing access codes are not stored (legitimate interest: support).
• The IP address of each attempt to sign in, create an account or reset the password, only to limit abusive requests, deleted after 24 hours (legitimate interest: security).

Viewing a company's public report does not require an account and we store nothing about you. The hosting provider logs, like any web server, technical data for each request, including the IP address, for a short period (legitimate interest: security and diagnostics).

Public contract data

The reports and profiles use public contracts from Portal BASE (the Portuguese public contracts portal), which public bodies publish by legal obligation (Código dos Contratos Públicos (the Public Contracts Code), art. 465.º) and which the State makes available on dados.gov.pt under an open data licence. These contracts include names and NIFs of companies and public bodies. We keep these contracts with no time limit, because they are public data published by legal obligation.

NIFs of natural persons, sole traders and estates do not generate public pages, do not appear in searches and cannot be the company on an account. If you find an error or wish to request the correction or removal of data about you, write to contacto@adjudica.eu.

Who helps us process the data

We use providers in these categories (processors), each one only for its own part:

• Hosting and database: the app and the data, on servers in the European Union.
• Email delivery: the app emails (alerts, account confirmation, password reset, support replies) and, separately, the commercial emails (see below), with the address and the text of each email.
• Payments, through Stripe: card details are entered and stored only at Stripe; we receive the subscription status and the billing email.
• Automatic reading of documents by artificial intelligence: the public tender documents you save on Pro (programme, specifications, clarifications, downloaded from the public platform) and the questions you ask about them. Only public documents and the text of the question are sent, never your email or data about your company; we keep the summary with the quotations, not the files. From the company file, only the pages the AI needs to extract the data (turnover, licence classes, dates) are sent, always to a paid service that does not use the data to train models; for tenders we use only the extracted data, never the file.
• Scheduled tasks: the daily load of contracts and the sending of alerts.
• Product analytics: as described above, under «Product analytics».

If you choose to sign in with your Google account, Google is the authentication provider: it confirms who you are and sends us only your email (already verified by Google). We do not receive your Google password or access your contacts, files or emails. What Google processes on its side is governed by Google's privacy policy.

Some of these providers are in the USA or have their parent company there. Transfers of data outside the European Union are made under the standard contractual clauses approved by the European Commission.

For businesses, we have a data processing agreement (RGPD, art. 28.º).

How we protect the data

Account data is kept on servers in the European Union, access to it is restricted to those who need it to provide the service, we make backups every day and passwords are stored encrypted, so that no one can read them.

If you find a security flaw, write to contacto@adjudica.eu; we will fix it as quickly as possible.

News and offers for account holders

When you create an account, we tell you that we will send you news and offers from Adjudica by email: new features, tips to get more out of the service and offers on our plans. We do not ask you to tick any box: the law allows these emails to account holders, about our own services, provided that we tell you at sign-up and that you can always refuse them, free of charge (Lei n.º 41/2004 (the Portuguese law on privacy in electronic communications), art. 13.º-A(3); for businesses, also paragraph 2 of the same article). For this we use only your email, on the basis of our legitimate interest (RGPD, art. 6(1)(f)).

You can switch them off whenever you wish, with one click on the link in each of those emails or in Your account. Anyone who switches them off will not receive them again, unless they switch them back on in the account. These emails are not part of the Terms: receiving news is not a condition for using Adjudica or for getting the 30 free days.

The tender alerts you set up and the account emails (confirmation, password, invoices, notices about the subscription) are a different matter: they are part of the service and do not depend on this choice.

Commercial emails to businesses

We may send emails about Adjudica to businesses (legal persons only, never sole traders), to the company's contact address, on the basis of Lei n.º 41/2004, art. 13.º-B (which allows commercial communications to legal persons without prior consent, provided that they can refuse them at any time). Each email has a link to stop receiving them in a single click; anyone who opts out is added to a suppression list and never again receives commercial emails from us.

When the address identifies a person (for example, an employee's email), we process it on the basis of our legitimate interest in presenting the service to the company (RGPD, art. 6(1)(f)), only for commercial emails addressed to the company, and you may object at any time through the link in the email or by writing to contacto@adjudica.eu.

Where the contacts come from: from accounts registered on Adjudica with the company's NIF, from contacts our team adds by hand, from lists imported by us and from contacts published by the company itself (on its website or in public lists, such as the list of members of a trade association). We always record the specific origin of each contact (for example, the public list of members we took it from), and the footer of each email states in one sentence why you are receiving it and where your contact came from, with that origin. We do not buy contact lists.

We keep the email sent and whether anyone clicked on the links (each link passes through an address of ours that records the click and then goes on to the page). We do not use open-tracking pixels or cookies for this.

For how long

• Account (email, encrypted password, company, decisions, questions, actions in the app and sending records): until you delete the account (30 days after you request it, in case you deleted it by mistake). If you create an account and do not confirm the email, we delete it once the link expires (24 hours).
• Company file: while you have Pro (or a higher plan); we delete it 12 months after you leave, or as soon as you delete it in Your account or delete the account.
• Confirmation and reset links: 24 hours and 1 hour, and they stop working as soon as they are used.
• Copies of the emails we send you: 12 months, or until you delete the account, if earlier.
• Commercial emails sent to businesses (the content, the address and the clicks): 24 months.
• Business contacts: deleted after 24 months without any email sent or click.
• Collected business contacts (email, telephone and address published by the company): deleted after 24 months without any interaction (email sent, click or reply). Emails of individuals that we do not use are deleted after 12 months.
• Suppression list (those who asked not to receive emails): permanently, with only the email, the date and the reason (opt-out request, bounced email or complaint), so that we never write again to anyone who asked us not to.
• Session: 30 days; after that you sign in again.
• Campaign cookie: 30 days.
• IP address of sign-in attempts: 24 hours.
• Product analytics: session recordings 30 days; pages viewed and actions up to 12 months.
• Public contracts: no time limit, because they are public data published by legal obligation.

Your rights

You may, at any time:

• access your data and rectify it;
• erase it: the "Delete account" button in Your account closes the account immediately (you can no longer sign in) and, after 30 days, deletes it permanently with everything linked to it, including the copies of the emails; during those 30 days you may ask us to restore it, if it was a mistake;
• request portability (a copy in a machine-readable format);
• object to processing based on legitimate interest or request its restriction;
• stop receiving Adjudica's alerts and news, through the link in each email or in your account.

For anything that does not have a button, write to contacto@adjudica.eu; we reply within one month. If you believe we have not handled your data properly, you may lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD, the Portuguese data protection authority, cnpd.pt).

Cookies

We only use essential cookies: the session cookie, created when you sign in and needed for the account to work, and, only during a sign-in with Google, a 10-minute cookie that protects that request against forgery. Anyone who arrives through a link from one of our campaigns also receives a campaign cookie, with an opaque code (no email, NIF or other personal data), kept for 30 days only so that we know which campaign brought each sign-up; it is not shared with anyone. We do not use analytics or advertising cookies (product analytics stores nothing in your browser), so there is no cookie banner.

Changes

If we change this policy in a relevant way, we will notify account holders by email before the change takes effect.