Privacy policy for ReBid

1Controller and contact details

ReBid AB, organisation number 559492-1610, Vasagatan 12, 111 20 Stockholm, Sweden, is responsible for the processing of personal data for which we determine the purposes and means. Data protection enquiries: gdpr@rebid.se. Other enquiries: info@rebid.se. Website: www.rebid.se. This policy applies to visitors, users, customer and supplier contacts, prospective customers and individuals who appear in procurement and company information. It describes our processing under the GDPR and supplementary Swedish law.

We are the controller for, among other things, customer administration, sales, security and the procurement information that we collect for our own service purposes. For personal data in documents and other material that we process solely on the customer's instructions, we are a processor. In such cases, the processing is governed by data processing agreements. For questions concerning rights in relation to such material, please contact the customer in the first instance; we assist the customer.

2Personal data we process

• Contact and account: name, work email and telephone number, company, job title, login credentials and access rights.
• Contract and payment: subscriptions, orders, invoicing details, invoice contact and payment status. Under the current payment arrangements, payment is made against invoice.
• Communication: email, support tickets, meeting notes and, where recording takes place, audio, video and transcription.
• Technical and usage data: IP address, device and browser information, login and security logs, feature usage, errors and performance.
• Procurement information: work-related contact details, representatives and referees in tender notices, contract awards and references. Data concerning sole traders may constitute personal data.
• Prospecting: name, professional role, employer, work contact details and relevant publicly available professional information.
• Customer material: uploaded or connected documents, company profiles, references, questions, answers and analyses that may contain personal data.

Company data is not always personal data. It is covered by this policy when it can be linked to a living person. We do not request sensitive personal data or data relating to criminal offences for the normal use of the service. Such content must not be added without a specific agreement and a legal basis.

3Sources and information to data subjects

We obtain data from you, from your employer or principal, through use of the service and from systems that the customer chooses to connect. Under the current policy, procurement data is obtained primarily from TED and supplementary Swedish tender notices. Contract award decisions may also be added manually.

Company and professional data may come from the Swedish Companies Registration Office (Bolagsverket), the websites of public authorities and companies, business information services and public professional profiles. Public availability does not mean that all re-use is permitted. We limit collection to relevant data and permitted sources.

Where data is collected from someone other than you, we provide information within the time required by the GDPR, normally within one month at the latest, and earlier at the time of first contact or disclosure if that occurs before then. Exemptions are applied only following a documented assessment in the individual case. Where providing information individually is impossible or would involve disproportionate effort, we take appropriate measures, including making the information publicly available. This policy does not constitute a general exemption from the obligation to provide information.

4Purposes and legal basis

Accounts, customer administration and support: our legitimate interest in providing and administering the service to the customer's organisation. Where you yourself are a party to the contract and the processing is necessary for the performance of that contract, Article 6(1)(b) GDPR applies.

Invoicing and bookkeeping: legal obligation in respect of statutory accounting, and legitimate interest in respect of payment administration and debt collection.

Procurement information and matching: our and our customers' legitimate interest in identifying relevant business opportunities, analysing tenders and finding professional channels of contact. Personal identity numbers are processed only where this is clearly justified under Swedish law, for example for the secure identification of a sole trader.

Security, operations and limited product analytics: legitimate interest in preventing misuse, troubleshooting and improving functionality and performance. Customer documents and prompt content are not automatically treated as technical statistics. Consent is obtained where rules on cookies or similar technologies so require.

Prospecting and marketing: legitimate interest in relevant business-to-business sales, or consent where required. Electronic marketing to natural persons requires, as a general rule, prior consent. The exemption for existing customers is relied on only where all statutory conditions are met, including that the marketing concerns our own similar services and that there is a simple, free-of-charge means of opting out. A professional role does not in itself constitute an exemption from these rules.

Recording and transcription: legitimate interest in accurate documentation and follow-up, subject to an assessment of necessity and a balancing of interests. We provide information before the recording and offer contact without recording. Legal claims: legitimate interest in establishing, exercising or defending claims.

You may object to processing based on legitimate interest and request information about the balancing of interests. You may always object to direct marketing. Consent may be withdrawn without affecting the lawfulness of processing carried out before its withdrawal.

5AI and use of customer material

ReBid uses AI for search, summaries, matching, analysis and answers. The material required may be processed by an AI provider on our behalf. Questions, document extracts, answers and search indexes may contain personal data and are then subject to the same requirements as other material containing personal data.

We do not use customer material to train shared or general-purpose AI models. Under our agreements, our AI providers may not use the material for their own model training. Customer-specific search and analysis within the material is not the same as model training.

Any future training would require a separate explicit agreement, a legal basis and information to the data subjects concerned; acceptance of the Terms of Use is not sufficient.

We use technical usage statistics for operations and improvement. Pseudonymised data is still personal data. Statistics fall outside the scope of the GDPR only when individuals cannot reasonably be identified. Customers' confidential bids, pricing information and estimates are not used for shared benchmarking without a separate agreement.

You are communicating with an AI system when you use the AI assistant. Answers may be incorrect or incomplete. The matching concerns business opportunities for companies and serves as decision support. ReBid does not make decisions about you that are based solely on automated processing and that produce legal effects or similarly significant effects.

6Integrations and external assistants

When an integration is activated, its function and the permissions granted determine what data is transferred. Under the current policy, Teams notifications send matched tenders to the channel chosen by the customer and do not read the channel's content. Other integrations are covered only if they have actually been activated and described to the customer.

Connecting to document storage or to an external AI assistant, for example via MCP, may mean that selected documents, questions, answers or procurement data are shared. The customer must restrict permissions and check recipients and access. Providers engaged by the customer itself process the data in accordance with the customer's agreement with them. If the provider instead acts on ReBid's behalf, we are responsible for the applicable processor arrangements.

Disconnecting stops future access through the connection but does not automatically delete data previously transferred to the external service.

7Recipients

Authorised staff and suppliers are given access where necessary for their tasks. We engage suppliers for cloud hosting, storage and search, AI, customer relationship management, email, meetings and transcription, support, product development, finance and, subject to applicable consent, analytics and advertising. Processors are bound by data processing agreements.

Users in the customer's organisation can see data in accordance with their access rights. Work-related contact details in procurement information are made available to the service's customers. Banks, advisers and public authorities may be independent controllers for their own purposes. In the event of an investment or a transfer, necessary data may be shared subject to confidentiality and with restricted access.

We do not sell personal data for third parties' own marketing. Contact gdpr@rebid.se for further information about recipients. The customer's approval of, and information about, sub-processors are governed by the data processing agreement.

8Countries of processing and security

According to the current description of operations, platform data is stored with Amazon Web Services within the EU. Storage within the EU does not mean that all processing takes place there. Suppliers and subcontractors may process or access data outside the EU/EEA, including in the United States.

Transfers take place only on an applicable basis under the GDPR, for example a valid adequacy decision or the European Commission's Standard Contractual Clauses together with the necessary assessments and supplementary measures. For the United States, the EU–U.S. Data Privacy Framework may be relied on where the recipient and the processing are covered by valid certification and decisions. Contact us for information about the countries concerned, the safeguards and a copy of the relevant safeguards.

We take risk-based technical and organisational measures, including access control, encryption, logging and backups. Where we act as a processor, we notify the customer of personal data breaches without undue delay. Where we are the controller, we notify the Swedish Authority for Privacy Protection (IMY) within 72 hours of becoming aware of a breach where required, and inform the data subjects concerned without undue delay where the breach is likely to result in a high risk.

9Retention and erasure

We do not keep data for longer than the purpose requires. The maximum periods below apply unless earlier erasure is required, the customer instructs us in accordance with the data processing agreement, or a specific legal obligation or a concrete legal claim justifies continued retention. Where data is retained in this way, access and use are restricted.

• Account data: for the duration of the customer relationship and no more than 90 days after the subscription ends. Trial accounts: no more than six months after the trial period.
• Support tickets: no more than 24 months after closure. Security and operational logs: no more than 12 months. Usage statistics linked to individuals: no more than 13 months.
• Prospects and marketing contacts: no more than 24 months after the most recent relevant contact, with ongoing review of relevance. A minimal suppression record may be kept for as long as it is needed to respect a refusal to receive mailings.
• Recordings and transcriptions: no more than 12 months. Relevant contract and customer notes are assessed separately on the basis of the customer relationship and any claims.
• Procurement information containing personal data: no more than five years after the contract award decision or publication, with earlier rectification or erasure where there are grounds to do so.
• Customer material: in accordance with the data processing agreement, normally erasure from active systems no later than 90 days after termination of the agreement. Periods for data export and switching under the Terms of Use must be respected. Erasure also covers associated search indexes and cached copies.
• Backups: rotating retention for no more than 35 days. Erased data may therefore remain, in isolated form, during this period and must not be restored to ordinary use.
• Accounting records: until the end of the seventh year after the end of the calendar year in which the financial year ended.

Deleting a user account does not automatically mean that the organisation's subscription is terminated or that all customer material is erased. Requests for erasure are assessed in accordance with the GDPR; we make no general promise that all data will be erased within 24 hours.

10Your rights

You may request access to and a copy of your personal data, rectification, erasure and restriction of processing where the conditions are met. You may object to processing based on legitimate interest. We must then cease the processing unless we can demonstrate overriding grounds or need the data for legal claims. Direct marketing always ceases upon objection.

You have the right to data portability for data that you have provided, where the processing is carried out by automated means and is based on consent or on a contract with you. This right does not entail an unlimited right to all analyses or to other individuals' data. You may withdraw any consent you have given at any time.

Email gdpr@rebid.se. We respond without undue delay and within one month at the latest. Where necessary, this period may be extended by a further two months in accordance with the GDPR; in that case we will inform you within the first month and state the reasons. We may need to verify your identity in a proportionate manner. Requests are normally free of charge. For manifestly unfounded or excessive requests, the specific rules of the GDPR apply.

You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), www.imy.se, and to use the remedies available to you under the law. The dispute resolution provisions of the Terms of Use do not limit your rights as a data subject.

11Cookies and advertising

Necessary technologies are used for purposes such as login and security. Other storage of, or access to, information on your device for statistics, personalisation, advertising or conversion tracking takes place only after valid consent, where such consent is required. This also applies to pixels and similar technologies.

You must be able to decline as easily as you accept, and to withdraw your choice via the website's cookie settings. More detailed information about the technologies used, providers, purposes and lifespans is to be provided where consent is given. The fact that a statistics provider describes the data as aggregated does not in itself exempt the collection from the consent requirement.

12Required data and changes

Contact and account details are needed to give you access, and the necessary invoicing details are needed to administer the order. If they are not provided, we cannot deliver the relevant parts of the service. Data for voluntary marketing does not need to be provided in order to use the service. ReBid is aimed at businesses and not at children.

We update this policy when the processing changes and provide clear information about material changes. If a new purpose requires consent, it will be obtained separately. Continued use of the service does not constitute consent for data protection purposes.