Privacy Policy

In brief

Most of this website is delivered as pre-rendered static pages. Four features — the pilot request form, the GAEB-Check tool, the “Helpful” button and blog comments — are handled by server functions we operate ourselves. The site sets no cookies, stores nothing on your device, and builds no advertising or cross-site profiles. It uses privacy-friendly, cookieless web analytics that measure aggregate page views only.

Pilot request form

When you request a pilot we process the company name, your name, your work email address, and — only if you provide them — your role, the number of tenders you answer per month, the file formats you receive, and your message. We use these details solely to reply to you and to prepare the pilot conversation. Legal basis: Art. 6 (1) (b) GDPR (steps prior to entering into a contract).

The request is stored in our database (see Hosting) and forwarded to our mailbox by email. To detect abuse we also store a one-way hash of your IP address for up to 30 days. Requests are deleted once the inquiry is fully resolved, at the latest 12 months after submission, unless a pilot or contract follows.

GAEB-Check

When you use the GAEB-Check tool, the file you select is transmitted over TLS to a server function we operate on Vercel in the Frankfurt region, parsed in memory by our open-source library pyGAEB, and discarded as soon as the result has been sent back to your browser. The file is not written to disk, not logged, not stored and not used for any other purpose. Legal basis: Art. 6 (1) (b) GDPR (performance of the service you requested).

For each check we keep an anonymous statistics record — exchange phase, DA XML version, number of positions, whether the file was priced, the file size, the language of the page, and counts describing the result: the quality sub-scores, how many findings there were per severity, how many position numbers occurred more than once, how many positions there were of each type, and how many titles the file contained. These are numbers only; no position numbers, descriptions or other content from your file are stored. To detect abuse we also keep a one-way hash of your IP address for up to 30 days. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in operating and improving the tool, in publishing aggregate statistics about the state of GAEB files, and in defending the tool against abuse).

If you enter an email address to save the check as a PDF or to request a pilot, we process the email address, the company name if you provide it, and the summary figures shown on screen (phase, version, position counts, totals, quality score, number of findings). The file itself is never included. These details are handled exactly like a pilot request (see above): stored in our database, forwarded to our mailbox, and deleted at the latest 12 months after submission unless a pilot or contract follows. Legal basis: Art. 6 (1) (b) GDPR.

Web analytics

We use Vercel Web Analytics to understand aggregate traffic — which pages are visited and roughly where visitors come from. It is cookieless and uses no fingerprinting or cross-site tracking; no data is used to identify you personally or to build a profile. Data is processed by Vercel on our behalf (Art. 28 GDPR). Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in understanding and improving how the site is used).

The site also loads Google Tag Manager, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which we use to manage measurement tags. It runs in Google’s Consent Mode with every storage type set to “denied” by default: no cookies are set and no identifiers are stored on your device unless you give consent through a consent dialog on this site. Without consent, tags loaded through it may send only cookieless, aggregated signals. Your browser transmits your IP address to Google when the container loads; Google may process data in the USA under the EU–US Data Privacy Framework and the EU Standard Contractual Clauses. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in aggregate measurement) and, once given, your consent under Art. 6 (1) (a) GDPR and § 25 TDDDG.

Blog comments

When you submit a comment we process the name you enter, the comment text, the time of submission, and — only if you choose to provide it — your email address. Your name and comment text are published beneath the article once we have reviewed them; no comment is publicly visible before that review. Your email address is never published and is used solely to contact you about your comment.

To detect spam and abuse we also store a one-way hash of your IP address for up to 30 days. The IP address itself is not stored and the hash cannot be reversed. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in reader discussion and in defending against spam and abuse).

You may object to this processing at any time and request deletion of your comment by writing to hello@datumos.build. Comments awaiting review are deleted after 30 days if not approved; rejected comments are deleted within 7 days; published comments remain until you request deletion or the article is withdrawn.

“Helpful” button

To count each reader only once per day, we compute a one-way hash from your IP address, the article, the date, and a secret key that stays with us. Only this hash is stored, and it is deleted after 24 hours. Your IP address is never stored and the hash cannot be traced back to you.

No cookie is set and nothing is stored on your device. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a meaningful, non-manipulable feedback signal).

Hosting and server logs

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you visit the site, Vercel processes technical access data (IP address, time of request, user agent) in server logs to deliver the site securely and to defend against attacks. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the secure, reliable provision of the site).

Vercel operates a global edge network, so access data may be processed outside the EU. Processing takes place on our behalf under a data processing agreement (Art. 28 GDPR) including the EU Standard Contractual Clauses (Art. 46 GDPR). Log data is retained only as long as needed for the purposes above.

Pilot requests, GAEB-Check statistics and leads, likes and comments are stored in a Postgres database operated by Neon Inc. (USA), hosted in the AWS eu-central-1 region (Frankfurt, Germany). Neon processes this data on our behalf under a data processing agreement (Art. 28 GDPR) including the EU Standard Contractual Clauses (Art. 46 GDPR).

Contact by email

If you contact us at hello@datumos.build, we process the data you provide solely to handle your inquiry. Legal basis: Art. 6 (1) (b) or (f) GDPR. We delete correspondence once your inquiry is fully resolved, unless statutory retention duties apply.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection under the GDPR, and the right to lodge a complaint with a supervisory authority.

Note

Controller: [Legal name of the operator — company or natural person], [Street and number], [Postal code, city], India. This policy will be legally reviewed before commercial launch.