Privacy Policy

1. Who We Are

The data controller responsible for your personal data is:

Malkovich MB
Krokuvos g. 13, LT-09314 Vilnius, Lithuania
Company code: 307088162
VAT code: LT100018643518
Contact for privacy matters: support@awarda.eu.

2. Scope

Awarda is a B2B SaaS platform that monitors public procurement notices across the 27 EU member states and Norway, matches them to a subscriber's company profile, and provides AI-assisted analysis (translation, summarization, fit-scoring) to help small and mid-sized businesses find and prepare for tenders. This policy covers the personal data of our subscribers, their team members, and website visitors. It does not govern the public procurement data itself (buyer names, notice content, CPV codes, etc.), which we ingest from official sources such as Tenders Electronic Daily (TED) and national procurement portals and which is already public information published by contracting authorities.

3. Information We Collect

3.1 Account and identity data
When you sign up, our authentication provider (Clerk) collects your name, email address, password (hashed, never visible to us), and basic session/device information needed to keep you signed in securely.

3.2 Company profile data
On first sign-in, and to use most features, we ask you to complete a company profile. If you select "Company," this includes: company legal name, legal address and country, VAT code (optional — left blank if you are not VAT-liable), sectors and CPV codes of interest, certifications, references, insurance details, and tender value preferences (minimum/maximum, exclusions). If you select "Private individual," we collect the equivalent identity and address information for you personally instead of a company.

3.3 Billing data
Subscription and payment details — including your billing name, billing address, VAT/tax ID, selected plan, and invoice history — are processed by Stripe, our payment processor. We use Stripe Tax to automatically validate VAT numbers and determine the correct tax treatment. We never receive or store your full card number; Stripe handles card data directly under its own PCI-DSS certified systems.

3.4 Tender and usage data
We record which tenders you view, save, generate AI summaries for, download, or export, along with general usage and analytics data (pages visited, features used, timestamps) and technical data (IP address, browser and device type, approximate location derived from IP) needed to operate, secure, and improve the Service.

3.5 Communications
If you contact support, or if we send you transactional email (such as your daily tender-match digest, billing receipts, or account notifications), we retain that correspondence and delivery data.

3.6 Cookies and similar technologies
We use strictly necessary cookies to keep you signed in and to remember your language and display preferences. See Section 11 for details.

4. How We Use Your Information

We process your data for the following purposes and legal bases under the EU General Data Protection Regulation (GDPR):

• To provide the Service — matching tenders to your profile, generating AI summaries, and enabling downloads/exports (performance of our contract with you).
• To process payments, calculate applicable VAT, and issue invoices (performance of our contract with you, and compliance with our legal/tax obligations).
• To send you the tenders you have asked to be alerted about, and essential account/service notifications (performance of our contract with you).
• To maintain the security, integrity, and reliability of the Service, including fraud and abuse prevention (our legitimate interest).
• To improve and develop the Service, including understanding which features are used (our legitimate interest, balanced against your rights).
• To communicate with you about product updates or optional offers, where you have opted in (consent, which you may withdraw at any time).
• To comply with Lithuanian and EU legal obligations, including accounting, tax, and invoicing requirements (legal obligation).

5. AI Processing and Automated Features

Awarda uses AI (via Microsoft Azure OpenAI Service, hosted in EU data centers) to translate, deduplicate, classify, and summarize public tender notices, and to score how well a tender fits your company profile. These outputs are decision-support information intended to help you evaluate opportunities — they do not, by themselves, produce any legal or similarly significant effect on you, and no purchasing, eligibility, or enforcement decision is made automatically about you as a data subject. You always remain in control of whether and how to act on an AI-generated summary or fit score.

6. Who We Share Your Information With

We do not sell your personal data. We share it only with service providers ("processors") who help us run Awarda, under written data processing agreements that require them to protect your data and use it only for the purposes we specify, and — where you choose to enable an integration — with third parties you direct us to send data to.

Data is disclosed to these providers only via encrypted connections (HTTPS/TLS) through their APIs — never by email, spreadsheet export, or other unsecured means. We may also disclose information where required by law, to enforce our terms, or to protect the rights, property, or safety of Malkovich MB, our users, or others.

7. International Data Transfers

Wherever possible we have chosen EU-region processing — for example, our AI provider runs exclusively in EU data centers so tender and profile data processed for AI features does not leave the EEA. Some of our service providers (see Section 6) are headquartered outside the EEA. Where personal data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses or another legally recognized transfer mechanism, and we require these providers to maintain safeguards equivalent to GDPR standards.

8. Data Retention

We retain your account and company profile data for as long as your account is active, and for a reasonable period afterward in case you wish to reactivate it. Billing and invoice records are retained for as long as required under Lithuanian accounting and tax law. Usage logs and technical data are retained for a limited period for security and operational purposes and then deleted or anonymized. If you close your account, we will delete or anonymize your personal data except where we are legally required to keep it (for example, tax records).

9. Security Measures

We apply technical and organizational measures appropriate to the risk, including:

• Encryption of data in transit (TLS/HTTPS across the Service and all API connections to processors) and encryption of data at rest in our databases.
• Access controls limiting who at Malkovich MB and our processors can access personal data, on a least-privilege basis.
• Secure authentication and session management via our identity provider.
• Card and payment data handled entirely by Stripe under its own PCI-DSS certified infrastructure — we never see or store full card numbers.
• Written data processing agreements with every processor listed in Section 6.
• Ongoing review of our infrastructure configuration (headers, hosting, access policies) as part of regular security maintenance.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security, but we work to continuously improve our safeguards.

10. Your Rights Under GDPR

If you are located in the EEA (or otherwise protected by GDPR), you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten"), subject to our legal retention obligations.
• Restrict or object to certain processing, including processing based on legitimate interest.
• Receive your data in a portable, machine-readable format.
• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint with a supervisory authority — in Lithuania, the State Data Protection Inspectorate (Valstybine duomenu apsaugos inspekcija, VDAI), or the data protection authority in your own EU country of residence.

To exercise any of these rights, contact us at support@awarda.eu. We will respond within the timeframes required by GDPR.

11. Cookies and Tracking Technologies

Strictly necessary cookies
We use strictly necessary cookies for authentication (keeping you signed in) and to remember your selected display language. These cookies are required for the Service to function and do not require consent under applicable e-privacy rules.

Analytics cookies — Google Analytics 4 (optional, consent-based)
We use Google Analytics 4, loaded through Google Tag Manager (container GTM-TQHBFTZ8), to understand how visitors use the Awarda website. GA4 collects anonymised usage data — pages viewed, time on site, approximate geographic region (country/city), device type, and interaction events. The legal basis for this processing is your consent (Article 6(1)(a) GDPR). No advertising or remarketing features are enabled.

You can choose your cookie preferences when you first visit the site, or at any time by clicking "Cookie settings" in the website footer. Withdrawing consent does not affect the lawfulness of any processing carried out before withdrawal.

Analytics data retention
Analytics event data is retained by Google for up to 14 months (as configured in the GA4 property). We do not receive or store this data in our own systems.

Google as a service provider
Google Analytics and Google Tag Manager are services of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Data collected by GA4 is transferred to Google servers in the United States under Standard Contractual Clauses. For further information see Google's privacy policy at https://policies.google.com/privacy.

PostHog product analytics (optional, consent-based)
We use PostHog product analytics, loaded only on www.awarda.eu after you give analytics consent, through PostHog's EU endpoint at https://eu.i.posthog.com. It helps us understand how pages and features are used and improve the Service. PostHog may process page views, interaction events, browser and device metadata, approximate location, and a pseudonymous identifier. Person profiles are created only for identified users. Collection stops when you withdraw your consent. For more information, see PostHog's privacy policy. The legal basis for this processing is your consent (Article 6(1)(a) GDPR). PostHog uses first-party cookies and browser local storage for a pseudonymous distinct ID and session ID; these are disabled and cleared when you withdraw analytics consent. Awarda retains PostHog event data for 12 months.

Microsoft Clarity (optional, consent-based)
We use Microsoft Clarity, loaded only after you grant analytics consent, to understand how visitors use the Awarda website through anonymised usage analytics and session recordings. Clarity may collect interaction data, device and browser information, approximate location, and pseudonymous identifiers. The legal basis for this processing is your consent (Article 6(1)(a) GDPR). Microsoft processes this data in the United States under applicable transfer safeguards. For more information, see Microsoft's Privacy Statement.

12. Children's Privacy

Awarda is a business-to-business service intended for use by companies and professionals. It is not directed at, and we do not knowingly collect personal data from, individuals under the age of 18.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our service providers, or applicable law. We will post the updated version on this page with a revised effective date, and where changes are material, we will notify you by email or through the Service.

14. Contact Us

If you have questions about this Privacy Policy or how we handle your data, contact:

Malkovich MB
Krokuvos g. 13, LT-09314 Vilnius, Lithuania
Email: support@awarda.eu