Privacy Policy
How your data is collected, used and protected.
Last updated: 2026-10-08
1. Scope of This Policy
This policy explains how TenderZoom (https://tenderzoom.com) processes your personal data when you use the service. It is written with the EU and UK General Data Protection Regulation (GDPR / UK GDPR), Brazil's LGPD, US state privacy laws and Turkish Law No. 6698 (KVKK) in mind.
This is an information notice, not an agreement you accept. Using the site does NOT mean you have agreed to this policy or to any non-essential processing. Where processing requires consent, that consent is collected separately, per category, and can be withdrawn.
- Name / legal name
- Sefa Tayfun Yalçın
- Registered address
- Büyükesat Mah. Koza 1 Cad. Sev Apt. No: 153 İç Kapı No: 8 Çankaya / Ankara
- Tax office
- Cumhuriyet Vergi Dairesi
- [email protected]
- Website
- tenderzoom.com
If you are in Türkiye, our KVKK information notice is published separately.
2. What We Process, and Why
| Category | Contents | Purpose |
|---|---|---|
| Account and identity data | Email address, name, account preferences and plan. | Creating your account, signing you in and managing your access to the service. |
| Company profile | Company name, sector/activity, capacity and qualification details. | Matching tenders to your company profile and producing eligibility assessments. |
| Saved tenders and workspace | Tenders you saved, watchlists and your pipeline records. | Providing the tracking and workspace features you requested. |
| Alert and notification preferences | Tender alerts you configured, filter criteria and email notification preferences. | Sending you notifications for tenders matching the criteria you set. |
| Opportunity scores | Fit scores computed between your company profile and tenders. | Prioritising the tenders that fit you best. |
| Organisation membership data | Your membership and role, if you belong to an organisation account. | Managing team access and authorisation. |
| Market access checks | Market/country readiness checks and status notes you saved. | Providing the market-entry readiness tracking you requested. |
| Contact and analysis form data | Name, email, phone, company name and the message/request content; any other details you add to your request. | Receiving and assessing your request and replying to you. Your submission is also kept in the business's own request-management records so the request can be followed up. |
| Technical and security data | Session data, security-related server logs and strictly necessary cookies. Analytics data is NOT included here; it is collected only with your explicit consent. | Operating the service securely, preventing abuse and diagnosing faults. |
| Analytics data (only with explicit consent) | Microsoft Clarity session replay and heatmap data. Without your consent this technology is never loaded and no data is collected. | Identifying usability problems and improving the product. |
No payment provider is currently integrated, so we process no card or payment data. Integration with the payment institution iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.) is planned for paid subscription payments. Once live, your card details will not be sent to TenderZoom but taken on the payment institution's own secure page; payment data will be subject to that institution's own privacy notice, and this text will be updated.
We do not collect special-category data and the service is not directed at children under 16.
3. Sharing and International Transfers
We rely on the following processors and recipient groups to run the service. Their infrastructure or head office may be outside your country, in which case your data is transferred internationally. Where the processing location is verified it is stated:
- Supabase — Database, authentication and session management. Database infrastructure: Frankfurt, Germany.
- Microsoft Clarity — Analytics: session replay and heatmaps (only with your explicit consent).
- Güzel Hosting (SMTP) — Transactional email delivery (notifications and digest emails).
- Hosting and network infrastructure providers (Cloudflare, Netcup) — Hosting the site, content delivery and network security; requests to the site (including the IP address) pass through this infrastructure.
- Form notification email service (Web3Forms) — Delivering contact and analysis form submissions to our team by email.
- Google (only when “Sign in with Google” is chosen) — Authentication with your Google account.
- Rate-limiting service (Upstash; when configured) — IP-address-based request counters to prevent abuse.
- Flag image content delivery service — Loading country-flag images; your IP address and browser details are sent to this service when an image is requested.
No data reaches the analytics provider unless you give explicit consent — without it, the technology is never loaded in your browser. We may also disclose data to public authorities where legally required. We do not sell or rent your data, and we do not share it with third parties for advertising.
4. Cookies and Browser Storage
Non-essential cookies and similar technologies are not loaded until you allow them. You can change your preferences or withdraw consent at any time — withdrawing is as easy as giving.
If your browser sends a Global Privacy Control (GPC) signal, we treat it as a valid opt-out request.
5. Retention
- Account and service data: kept while your account is open.
- When you delete your account: the "Delete my account" action on the Account page permanently removes the records linked to your account.
- Contact and analysis form submissions: kept for as long as needed to handle and answer your request. They are not linked to your account, so they are not covered by "Delete my account" or "Download my data"; use the KVKK request channel for them.
- Free-trial entitlement record: to prevent the free trial from being used again, your email address (lowercased) is kept after your account is deleted.
- Strictly necessary cookies and session records: for the durations stated in the Cookie Policy.
- Consent record (tz_consent cookie): 180 days; you are asked again when it expires or the policy version changes.
- Analytics data: collected only while you consent; its retention is governed by Microsoft Clarity's own policy.
6. Security
7. Your Rights
| GDPR | Right |
|---|---|
| Art. 15 | Right of access — obtain a copy of your data |
| Art. 16 | Rectification — correct inaccurate or incomplete data |
| Art. 17 | Erasure ("right to be forgotten") |
| Art. 18 | Restriction of processing |
| Art. 20 | Data portability — receive your data in a machine-readable format |
| Art. 21 | Object to processing based on legitimate interests |
| Art. 22 | Not be subject to decisions based solely on automated processing |
| Art. 7(3) | Withdraw consent — as easily as it was given |
| Art. 77 | Lodge a complaint with a supervisory authority |
You can exercise access and portability directly with "Download my data" on the Account page, and erasure with "Delete my account". For other requests write to [email protected]; we respond within 30 days.
We do not discriminate against you for exercising a right.
If you are in the EU/EEA or the UK you may complain to your local data protection authority; in Türkiye, to the Personal Data Protection Authority (KVKK).
8. Third-Party Links
The platform links out to the official sites of tender sources. Their privacy practices are outside our control; we recommend reviewing their own policies before visiting.
9. Updates to This Policy
We may update this policy from time to time; the current version is always published on this page. When a change materially affects consent-based processing we raise the consent version and ask you again — continued use is not treated as agreement.
Questions?
Get in touch with any question about this policy or your data.
Related pages