Privacy Notice – e-Tender Zrt.
1. Controller
e-Tender Zrt.
Registered seat: H-1026 Budapest, Szilágyi Erzsébet fasor 17-21. 3/2, Hungary
Company registration no.: 01-10-049190, registered by the Metropolitan Court of Budapest (Fővárosi Törvényszék Cégbírósága) · Hungarian tax no.: 25864379-2-41 · EU VAT ID: HU25864379
Represented by: dr. Gábor Madarász, Chief Executive Officer
Phone: +36 1 380-5522 · E-mail: iroda@etenderzrt.hu · Website: etenderzrt.hu
Responsible accredited public procurement consultant (felelős akkreditált közbeszerzési szaktanácsadó): dr. Gergely Ákos Kuczora, registration no. 01071, supervisory body: Hungarian Public Procurement Authority (Közbeszerzési Hatóság)
Hosting provider: Tárhely.Eu Szolgáltató Kft., H-1097 Budapest, Könyves Kálmán körút 12-14., Hungary, e-mail: support@tarhely.eu
e-Tender Zrt. is not required to appoint a data protection officer under Article 37 GDPR; data protection matters are handled by the Chief Executive Officer at the contact details above.
2. Purpose and legal framework of this notice
This notice describes what personal data e-Tender Zrt. processes, for what purposes, on what legal basis and for how long, to whom it is disclosed, and what rights data subjects have. It is based on Regulation (EU) 2016/679 (GDPR), Hungarian Act CXII of 2011 on the right to informational self-determination and freedom of information (Infotv.), and the sector-specific legislation applicable to the company's activities (in particular Hungarian Act C of 2000 on accounting, Hungarian Act CXLIII of 2015 on public procurement, and the relevant provisions of German public procurement law – GWB, VgV, UVgO).
3. The nature of our activity: controller or processor?
e-Tender Zrt. provides bidder-side services to its clients in German and Hungarian public procurement procedures (preparation and submission of tenders and requests to participate, representation). In doing so it processes personal data in two roles:
As controller with regard to its own client, partner, supplier and employee relationships, the operation of the website, invoicing and its own legal claims (section 5 of this notice applies to these).
As processor (Article 28 GDPR) on behalf of the client, when it processes personal data provided by the client – data of the client's managers, professionals, subcontractors and reference persons (CVs, qualifications, declarations on exclusion grounds, criminal record certificates, specimen signatures) – for the purpose of preparing and submitting the tender. Such data is governed by the client's own privacy notice as controller and by the data processing agreement concluded with the client; e-Tender Zrt. uses it solely on the client's instructions and for the purpose of the engagement.
4. Principles
e-Tender Zrt. processes personal data lawfully, fairly and transparently, only for specified purposes, to the extent and for the period necessary, and ensures its accuracy and security (Article 5 GDPR). As controller it does not process special categories of personal data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR); where such data arises in a procurement procedure (e.g. criminal record certificates), it processes it solely as processor, on the client's instructions and to the extent required by procurement law.
5. Processing activities
| Purpose | Data subjects | Data processed | Legal basis (Art. 6(1) GDPR) | Retention period |
|---|---|---|---|---|
| Website visits, technical operation, security | website visitors | IP address, browser and device data, time of visit, pages viewed (server logs) | (f) – legitimate interest in the secure operation of the website | logs: 30 days |
| Contact (e-mail, phone, form), requests for quotes | enquirers, representatives of prospective clients | name, company, position, e-mail, phone, content of the enquiry | (b) – pre-contractual steps; for company representatives (f) – legitimate interest | if no contract is concluded, 1 year from the last contact |
| Client relationship, performance of the engagement contract | clients' contact persons, managers, signatories | name, position, e-mail, phone, signature, proof of authority, correspondence | (b) – performance of contract; for contact persons (f) | 5 years from termination of the contract (limitation period under the Hungarian Civil Code), accounting records 8 years |
| Preparation and submission of tenders and requests to participate on behalf of clients | the client's employees, professionals, subcontractors, reference persons | see section 3 – as processor, on the client's instructions | the client's legal basis; data processing agreement (Art. 28) | until the engagement and the procedure are closed or as instructed by the client, taking review and limitation periods into account |
| Communication with contracting authorities, procurement platforms, public bodies | officers of contracting authorities and public bodies | name, position, official contact details, correspondence | (f) – legitimate interest in performing the engagement; (c) – legal obligation (Hungarian Public Procurement Act, GWB/VgV) | 5 years from the close of the procedure |
| Invoicing, accounting | representatives of clients and suppliers | billing name and address, tax number, contact name, bank account number | (c) – legal obligation (s. 169 Hungarian Accounting Act, Hungarian VAT Act) | 8 years from the date of the record |
| Suppliers, subcontractors, partners | partners' representatives and contact persons | name, position, contact details, contract data | (b), for contact persons (f) | 5 years from termination of the contract, records 8 years |
| Job applications | applicants | CV, qualifications, contact details, content of the application | (a) – consent; (b) – pre-contractual steps | 6 months after the position is filled; longer storage only with separate consent |
| Establishing, exercising or defending legal claims | representatives of clients, partners, former clients | data required for the dispute, correspondence, contracts | (f) – legitimate interest in enforcing claims | until the claim is time-barred; where proceedings are pending, until their final conclusion |
e-Tender Zrt. has documented a balancing test for processing based on legitimate interest, which is available on request. For processing based on contract or legal obligation, providing the data is a condition of concluding the contract or fulfilling the legal obligation; without it, e-Tender Zrt. cannot provide the service. e-Tender Zrt. does not send newsletters and does not carry out automated decision-making or profiling.
6. Recipients of data, processors
Personal data is accessible to e-Tender Zrt. staff to the extent required for their duties. e-Tender Zrt. uses the following processors:
| Processor | Activity | Seat |
|---|---|---|
| Tárhely.Eu Szolgáltató Kft. (Tárhely.eu) | website hosting, server operation | Hungary |
| Google Ireland Limited (Google Workspace) | e-mail (Gmail), document storage (Drive), calendar, office applications | Ireland |
| Nagy Jánosné, sole trader | bookkeeping, payroll | Hungary |
| Uzonyi Gábor, sole trader | IT maintenance, backups | Hungary |
| Kuczora Law Office (Kuczora Ügyvédi Iroda) | legal advice, representation | Hungary |
Processors process data solely on documented instructions from e-Tender Zrt. under a contract compliant with Article 28 GDPR.
The following receive data as independent controllers: German and Hungarian contracting authorities and the electronic procurement platforms they use (e.g. Deutsches Vergabeportal, subreport, e-Vergabe, EKR), the Hungarian Public Procurement Authority and the German procurement chambers (Vergabekammern) or the Hungarian Public Procurement Arbitration Board in review proceedings, the Hungarian tax authority (NAV) and other public bodies where required by law, and courts and enforcement bodies in the event of a dispute.
7. Transfers abroad
By the nature of its business, e-Tender Zrt. regularly transfers personal data to Germany (to contracting authorities, procurement platforms and German partners). These are transfers within the European Union, to which the GDPR applies directly and uniformly; no additional safeguards are required.
e-Tender Zrt. runs its e-mail and document storage on Google Workspace, contracted with Google Ireland Limited, which is established in the EU. In accordance with e-Tender Zrt.'s data region setting, data stored in Google Workspace is held in data centres located in the European Union. In the course of certain processing and support operations, data may be transferred to the United States; the legal basis for this is Commission Implementing Decision (EU) 2023/1795 (EU–US Data Privacy Framework), of which Google LLC is a certified participant, supplemented by the standard contractual clauses under Article 46 GDPR on the basis of the Google Workspace Cloud Data Processing Addendum. No transfers to other third countries take place.
8. Data security
e-Tender Zrt. protects data under Article 32 GDPR through technical and organisational measures appropriate to the risk: access rights management and individual accounts, multi-factor authentication, encrypted data transmission, regular backups, up-to-date anti-malware protection, and confidentiality obligations and training for staff. Procurement-related documents – given their nature as trade secrets – are stored separately with restricted access. In the event of a personal data breach, e-Tender Zrt. proceeds in accordance with Articles 33–34 GDPR and informs the data subjects where the breach is likely to result in a high risk.
9. Cookies
The website uses only strictly necessary (session and security) cookies, for which no consent is required; they expire when the browser is closed. The website does not set statistical or marketing cookies.
10. Rights of data subjects
Data subjects may exercise the following rights by contacting e-Tender Zrt. at the details given in section 1:
access to the data processed about them (Art. 15);
rectification of their data (Art. 16);
erasure, where the purpose has ceased, consent has been withdrawn or the processing is unlawful (Art. 17) – unless processing is required to comply with a legal obligation or to establish, exercise or defend legal claims;
restriction of processing (Art. 18);
data portability for automated processing based on consent or contract (Art. 20);
objection to processing based on legitimate interest (Art. 21); e-Tender Zrt. will then continue processing only on compelling legitimate grounds;
withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
e-Tender Zrt. responds to requests without undue delay and at the latest within one month of receipt, or gives reasons for refusal; this period may be extended by two months where justified. Requests are handled free of charge, except where they are manifestly unfounded or excessive. To protect the data, e-Tender Zrt. may verify the identity of the person making the request.
For data processed as processor (section 3), data subjects should exercise their rights with the client as controller; e-Tender Zrt. forwards any request it receives to the client and assists in handling it.
11. Right to lodge a complaint
Data subjects who consider that the processing of their data infringes the GDPR may lodge a complaint with the supervisory authority:
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH – Hungarian National Authority for Data Protection and Freedom of Information)
H-1055 Budapest, Falk Miksa utca 9-11. · Postal address: H-1363 Budapest, Pf. 9.
Phone: +36 1 391-1400 · E-mail: ugyfelszolgalat@naih.hu · Website: naih.hu
Data subjects residing in another EU Member State may also complain to the supervisory authority of their place of residence. Data subjects may also bring proceedings before the courts. e-Tender Zrt. asks data subjects to raise any complaint with the company first, so that it can be resolved directly.
12. Changes to this notice
e-Tender Zrt. updates this notice when the law or its processing practices change; the current version is always available on the website, and clients are also informed of material changes by e-mail. This notice is available in Hungarian, English and German; in the event of any discrepancy, the Hungarian version prevails.
Effective from: 21 October 2026