Updated 28 September 2026
Data Processing Policy for the “Tendy: тендеры и закупки Беларуси” Bitrix24 app
The data the “Tendy: тендеры и закупки Беларуси” app receives from Bitrix24, its purposes, and retention periods. All documents
1. General provisions
1.1. This policy supplements the Tendy.by Personal Data Processing Policy (https://tendy.by/legal/privacy), referred to as the Service Policy, and describes data processing by “Tendy: тендеры и закупки Беларуси” (the App) when installed on a Bitrix24 portal (the Portal). The Service Policy applies to matters not covered here.
1.2. The Operator is ООО «ДЕФАЙНТ», UNP 291880617, Республика Беларусь, Брестская область, Ленинский район, г. Брест, ул. Интернациональная, дом 17, пом. 9-п. Personal data inquiries: privacy@tendy.by.
1.3. Data is processed and stored on servers in the Republic of Belarus (ООО «Надежные программы» (Hoster.by)).
2. Data received by the App
| Data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Portal address and identifier; OAuth access keys (stored encrypted) | App operation in the Portal: creating deals and companies, status synchronization, and CRM tabs | Contract (license agreement; paragraph 15, Article 6 of Law No. 99-З) | Until App uninstallation; keys are deleted on uninstallation |
| Portal user identifier, name, email, and administrator flag | Signing in to the Service from the Portal and linking a Portal user to their Tendy account | Contract | Link retained until revoked, account deletion, or App uninstallation; sign-in sessions: up to 1 hour (technical sign-in flags: up to 30 days) |
| Identifiers and stages of deals created by the App | Synchronizing Tendy application statuses and deal stages | Contract | Until deletion of the application, organization, or App |
| Portal API request log: method, result, time, and request parameters without access keys | Diagnostics and Bitrix24 Market logging requirements | The Operator’s legitimate interest in ensuring operation and security | 14 days |
3. Data written to the Portal
3.1. Following user actions and organization settings, the App creates CRM deals with procurement title, amount, deadline, links, and supplier requirements, and buyer companies with requisites (name, UNP, and legal address). This information comes from open sources: electronic marketplaces and the State Register of Payers of the Ministry of Taxes and Duties of the Republic of Belarus.
3.2. If the Licensee’s organization enables “Создавать контакты заказчика” (Create buyer contacts), which is disabled by default, creating a deal also transfers buyer contact persons’ information published by the buyer in the procurement notice to the Portal CRM: surname, given name, patronymic, job title, business phone, and email. No other sources are used to supplement the information. Existing Portal contacts are found by phone number or email address and surname; a new contact is linked to the deal and buyer company. When the setting is disabled, contact persons’ personal data is not transferred to the Portal.
3.3. The Licensee determines and is responsible for enabling the setting, the purposes of further processing in the Portal (for example, contacting a buyer regarding procurement), and compliance with personal data law in the Portal.
3.4. Data written to the Portal is stored there under Bitrix24 and Licensee rules; the Operator is not its owner.
4. Data transfers
4.1. The Operator does not transfer data received from the Portal to third parties except processors listed in the Service Policy and cases provided by law.
4.2. Data is exchanged with the Portal over HTTPS using the Bitrix24 API. The App does not request Bitrix24 usernames or passwords.
5. Data subject rights and deletion
5.1. Data subject rights and how to exercise them are described in the Service Policy. Requests should be sent to privacy@tendy.by.
5.2. On App uninstallation, the Operator deletes Portal access keys and stops accessing the Portal. The links between the Portal and the organization, and between Portal users and Tendy accounts, are retained for reinstallation and deleted on request.