Data Processing Agreement

1. Parties and roles

This agreement is between Alto Perfis Pultrudidos Lda, registered under NIF 503609013, at Zona Industrial da Maia I, Sector I, R. de Raimundo Durães Magalhães lote 20, 4475-189 Maia (Portugal) — the Processor — and the business that holds a Tenderloop account — the Controller.

You are the Controller of everything that arrives in the mailbox you connect: the emails your customers send you, the personal data in them, and the quotes produced from them. You decide why that data is processed. We process it only to run the service for you.

We are an independent Controller for your own account data — your company details, your users' login credentials, and your billing records. That processing is governed by our Privacy Policy, not by this agreement.

This agreement forms part of the Terms of Service. Where they conflict on the processing of personal data, this agreement prevails.

2. Subject matter, duration, nature and purpose

Subject matter: the personal data contained in request-for-quote emails received by a mailbox you connect, and in the quotes generated in reply.

Duration: for as long as you hold an account, plus the retention periods in section 9.

Nature and purpose: receiving and classifying incoming email; extracting the products and quantities requested; matching them against a price list you supply; computing prices from that price list; rendering a quote document; and sending it as a reply from your mailbox.

Annex I sets out the categories of data subject and personal data in full.

3. Our instructions come from you

We process personal data only on your documented instructions, including on transfers to a third country. Your use of the service — connecting a mailbox, uploading a price list, enabling automatic sending — constitutes those instructions, together with this agreement and the Terms of Service.

If we believe an instruction infringes the GDPR or other EU or Member State data protection law, we will tell you and may suspend that processing until it is resolved.

We will not use the personal data you entrust to us for any purpose of our own. In particular we do not sell it, do not use it to build profiles, and do not use it to train machine learning models — see section 5.

4. Confidentiality

Everyone we authorise to process personal data under this agreement is bound by an obligation of confidentiality, whether contractual or statutory, and that obligation survives the end of their engagement.

Access to production data is limited to the personnel who need it to operate and support the service.

5. Automated processing and machine learning

Reading a request requires a language model. The subject line and body of each incoming email, together with your product catalogue, are sent to the Azure OpenAI Service running inside our own Azure resource, in the European Union.

Your data is not used to train any model. Under the Azure OpenAI Service terms, prompts and completions are not available to other customers, are not available to OpenAI, and are not used to train, retrain or improve any Microsoft or OpenAI model. We do not use the OpenAI public API and we send this data to no other model provider.

No price is ever taken from the model. Every line's price is recomputed on our servers from your validated price list; anything that cannot be confidently matched is flagged for human review rather than priced. This is a data-integrity control as well as a commercial one.

The service does not carry out automated decision-making producing legal or similarly significant effects on a data subject within the meaning of Art. 22.

6. Security

We implement the technical and organisational measures set out in Annex II, appropriate to the risk under Art. 32. We may change them, provided the level of protection is not reduced.

7. Subprocessors

You give general authorisation for us to engage the subprocessors listed in Annex III.

Before adding or replacing a subprocessor we will give you at least 30 days' notice by email to your account address. If you object on reasonable data protection grounds within that period, we will work with you to find a solution; if none is found, you may terminate the affected part of the service and receive a pro-rata refund of fees paid in advance for it.

Every subprocessor is bound by written terms imposing data protection obligations no less protective than those in this agreement. We remain fully liable to you for their performance.

8. Assisting you with data subject requests

Taking account of the nature of the processing, we assist you by appropriate technical and organisational measures in meeting your obligations to respond to requests under Chapter III of the GDPR.

Two of these are built into the product, so you can act without contacting us at all: the portal produces a complete machine-readable export of everything we hold for you, and it will erase everything one identified sender wrote across all of your quotes.

If a data subject contacts us directly about data we process for you, we will not respond substantively on your behalf. We will tell them to contact you, and pass the request to you without undue delay.

9. Retention, deletion and return

The text of incoming request emails — subject, body, sender address and the sender's name and company — is automatically deleted 24 months after the quote was created. This runs on a schedule and records the date it acted.

What survives that deletion is the commercial record: the quote's reference, its line items, totals and status. Those are your business records. The quote row is also what prevents the same email being quoted and answered a second time, which is why the content is redacted rather than the row deleted.

On termination, and at your choice, we delete or return all personal data processed for you. Closing your account from the portal deletes it — database records and stored files alike — and cannot be undone; export what you need first. We retain data only where EU or Member State law requires us to, and for no longer than that requires.

10. Personal data breaches

We notify you without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting personal data we process for you.

The notification describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Where we cannot provide all of it at once, we provide it in phases without undue further delay.

You remain responsible for notifying your supervisory authority and, where required, the affected data subjects. We assist you in doing so.

11. Impact assessments and prior consultation

Taking into account the nature of the processing and the information available to us, we assist you with data protection impact assessments under Art. 35 and with prior consultation of a supervisory authority under Art. 36.

12. Audits and information

We make available to you all information necessary to demonstrate compliance with Art. 28 and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate.

In practice we will first offer our documentation — this agreement, its annexes, and our security documentation — which is normally sufficient. Where it is not, an on-site audit may be conducted at reasonable intervals (ordinarily no more than once in any twelve months, unless a supervisory authority requires otherwise or following a breach), on at least 30 days' written notice, during business hours, without unreasonably disrupting the service, and subject to confidentiality. We may charge our reasonable costs for an audit going beyond our documentation.

13. International transfers

Processing takes place in the European Union. The database, file storage, application servers, document rendering and model inference are all in the EU.

Certain subprocessors identified in Annex III may process data outside the EEA in the course of their own operations. Those transfers are covered by the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. We do not otherwise transfer personal data outside the EEA without a valid transfer mechanism.

14. Liability, term and law

This agreement takes effect when you open an account and continues until we no longer process personal data for you. Sections 4, 9, 10 and 12 survive its termination as far as necessary.

Liability under this agreement is subject to the limitations in the Terms of Service, except where the GDPR does not permit that limitation.

This agreement is governed by the law of Portugal, and the courts of Portugal have exclusive jurisdiction. Nothing in it limits a data subject's rights under the GDPR.

For a countersigned copy, or with any question about this agreement, write to hello@tender-loop.com.

Annex I — Details of the processing

Categories of data subject: the people who send request-for-quote emails to your connected mailbox — typically employees of your business customers or prospects — and any individual named in the body of such an email.

Categories of personal data: email address; name; employer or company name; job-related contact details where stated in the email; the subject line and full body text of the email; the products and quantities requested; and the resulting quote, its line items and its total.

Special categories of data (Art. 9): none are required by the service and none are knowingly processed. The service reads whatever a third party chooses to write in an email, so you should not enable it on a mailbox that routinely receives special-category data.

Frequency: continuous, for as long as a mailbox is connected.

Problem reports. If one of your users reports a problem from inside the portal, they may attach a screenshot of the page they were on, which can contain the personal data listed above as it appeared on screen. That screenshot reaches our support mailbox and is used only to diagnose the problem reported. It is shown to the user before anything is sent and may be removed by them.

Attachments, on some plans. During the free trial and on the Pro and Enterprise plans, the service also reads the text of PDF, Word (.docx) and Excel (.xlsx) attachments; on the Starter plan, and for any other file type (including images and scans), attachments are not read. The text extracted is processed like the email body: it is kept with the request and deleted with it after 24 months (section 9), and the files themselves are not stored.

Annex II — Technical and organisational measures

The measures below are in place under Art. 32.

Annex III — Authorised subprocessors

As at the date at the top of this document.