Data Processing Addendum
In short: for personal data in your workspace, your organization is the controller and Bidderist is the processor. We act only on your instructions, keep it secure and confidential, use only listed subprocessors, tell you about breaches within 72 hours, and delete it when you ask. This DPA applies automatically; no signature needed.
1. Scope and parties
This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Bidderist (“Processor”) and the Customer (“Controller”). It applies whenever Bidderist processes personal data contained in Customer Data on the Customer’s behalf, and meets the requirements of Article 28 of the EU GDPR and UK GDPR. No signature is required; customers who need a countersigned copy can request one from legal@bidderops.com.
If this DPA conflicts with the Terms on data protection, this DPA prevails.
2. Details of processing
| Subject matter and duration | Provision of BidderOps for the term of the Customer’s use of the Service, plus the deletion period in section 9. |
|---|---|
| Nature and purpose | Hosting, storage, retrieval, display, search, transmission to AI providers chosen by the Controller, email notification, export and deletion, solely to provide the Service. |
| Categories of data subjects | Controller’s users; the Controller’s staff and external experts whose CVs are stored; JV partner personnel; contacts at contracting authorities, funders and clients; individuals named in competitor records or intelligence reports. |
| Types of personal data | Names, business contact details, job titles, professional history, qualifications, education, languages, nationality and country experience in CVs, notes and correspondence, account and usage identifiers. |
| Special categories | Not intended. The Controller should remove special-category data (for example health or photographs revealing ethnicity) from CVs before upload unless it has a lawful basis under Article 9. |
3. Processing on instructions
Bidderist processes personal data only on the Controller’s documented instructions. The Terms, this DPA and the Controller’s configuration and use of the Service (including which features, AI providers and integrations it enables) are the Controller’s complete instructions. Bidderist will tell the Controller if it believes an instruction infringes data protection law, unless the law prohibits it.
4. Confidentiality of personnel
Bidderist ensures that anyone authorised to process personal data is bound by confidentiality obligations and accesses Customer Data only as needed to provide support the Controller requests, keep the Service secure, or comply with law.
5. Security measures
Bidderist maintains technical and organisational measures appropriate to the risk, including:
- Per-organization data isolation enforced in the database with row-level security on every tenant table.
- Role-based access control within each organization, with separate authority for go/no-go and withdrawal decisions.
- Encryption in transit (TLS) and at rest; AI provider credentials encrypted with AES-256-GCM using a key held outside the database.
- Service-role credentials confined to the server and never exposed to browsers.
- Activity and administrative audit logs; request rate limiting and per-role usage caps.
- Managed database backups and restricted production access for Bidderist personnel.
- Security response headers and hardened authentication and OAuth flows.
Bidderist may update these measures provided the overall level of protection is not reduced.
6. Subprocessors
The Controller gives general authorisation for Bidderist to use the subprocessors listed on the Subprocessors page. Bidderist imposes data protection obligations on each subprocessor that are no less protective than this DPA and remains responsible for their performance.
Bidderist will give at least 30 days’ notice before adding or replacing a subprocessor. The Controller may object on reasonable data protection grounds within that period; if we cannot reasonably accommodate the objection, the Controller may terminate the affected Service.
AI model providers, MCP clients and identity providers that the Controller configures with its own accounts are engaged by the Controller directly and are not Bidderist’s subprocessors.
7. Assistance to the Controller
Taking into account the nature of the processing, Bidderist will help the Controller respond to data subject requests (the Service includes self-service editing, export and deletion), and provide reasonable information needed for data protection impact assessments and prior consultations with supervisory authorities. If Bidderist receives a request directly from a data subject about Customer Data, it will forward it to the Controller and will not respond itself except to confirm the referral.
8. Personal data breaches
Bidderist will notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will describe the nature of the breach, the likely consequences, the measures taken or proposed, and a contact point, with further information provided as it becomes available.
9. Return and deletion
The Controller can export its data and delete its organization at any time. On deletion, Bidderist removes Customer Data from live systems immediately; residual copies in encrypted backups are overwritten within 30 days, unless retention is required by law.
10. Information and audits
Bidderist will make available the information reasonably necessary to demonstrate compliance with this DPA and Article 28, including responses to security questionnaires. Where that information is not sufficient, the Controller may, on at least 30 days’ written notice and no more than once a year (unless required by a supervisory authority or following a breach), conduct an audit at its own cost, during business hours, under confidentiality obligations and without access to other customers’ data.
11. International transfers
Where processing involves a transfer of personal data from the EEA, the United Kingdom or Switzerland to a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Decision (EU) 2021/914 (Module 2, controller to processor, and Module 3, processor to processor, as applicable) are incorporated by reference, together with the UK International Data Transfer Addendum and the Swiss amendments as needed. Clause 7 (docking) applies; Clause 9 option 2 (general authorisation) applies with the notice period in section 6; Clause 17 and 18 refer to the law and courts of an EU member state chosen by the Controller or, failing that, Ireland. The details of processing in section 2 and the measures in section 5 complete the Annexes.
12. Liability and term
Each party’s liability under this DPA is subject to the limitations in the Terms, except where the law does not allow them to be limited. This DPA lasts as long as Bidderist processes Customer Data.