Updated 4 August 2026
Personal Data Processing Policy
How Tendy.by collects, uses, stores, and protects users’ personal data. All documents
1. General provisions
1.1. Publication of this Personal Data Processing Policy (the Policy) is one of the personal data protection measures required by Article 17 of the Republic of Belarus Law No. 99-З of 7 May 2021 “On Personal Data Protection” (the Law).
1.2. The Policy was developed by ООО «ДЕФАЙНТ», UNP 291880617 (the Operator), and explains to data subjects how, for what purposes, and on what legal basis their personal data is collected, used, or otherwise processed, and what rights they have and how to exercise them.
1.3. The Policy applies to personal data processing on tendy.by, in user accounts, when using Tendy AI, and in related services. Cookie processing is covered separately by the Cookie Policy.
1.4. The Policy does not apply to personal data processing in employment relationships with the Operator’s employees.
1.5. Operator contact details: name — ООО «ДЕФАЙНТ»; UNP — 291880617; location — Республика Беларусь, Брестская область, Ленинский район, г. Брест, ул. Интернациональная, дом 17, пом. 9-п; website — https://tendy.by; general email — hello@tendy.by; email for personal data inquiries — privacy@tendy.by.
1.6. Person responsible for organizing personal data processing: Хазеев Айдар Вилевич, Director. For personal data processing questions, contact privacy@tendy.by.
1.7. Terms in this Policy have the meanings defined by the Law. Abbreviations: full name — surname, given name, and patronymic (if any); individual — a natural person; legal entity — a legal person; individual entrepreneur — an entrepreneur acting as a natural person; Consent — consent to personal data processing.
2. Personal data processing procedures and conditions
2.1. Personal data is processed by automated means through collection, recording, systematization, storage, modification, use, transfer (provision or dissemination), anonymization, blocking, and deletion.
2.2. Processing purposes, data subject categories, personal data, legal bases, and retention periods are set out in the table below.
2.3. The Operator does not disseminate users’ personal data within the meaning of the Law, except where a user publishes information in the Service or dissemination is expressly required by law.
2.4. Procurement cards may display information about buyers and contact persons obtained from open official sources. The Operator seeks to minimize such data and uses it only to provide procurement information.
2.5. When analyzing procurement documents with Tendy AI, the Operator uses minimized text: original files and raw extracted text remain within the internal infrastructure and are not transferred to language model providers. Detected contact and identifying data is automatically removed before context is sent.
| Processing purpose | Data subjects | Personal data | Legal basis | Retention period |
|---|---|---|---|---|
| Registration, creation, and use of an account | Users: individuals and individual entrepreneurs; representatives of legal entities | Email; password hash; name or organization name (if provided); account settings; technical session identifiers | Contract (paragraph 15, Article 6 of the Law): Terms of Use and acceptance at registration; Consent where no contract exists | For the lifetime of the account and up to 3 years after the last sign-in, or until Consent is withdrawn |
| Service features: procurement search, saved tenders, templates, notifications, and settings | Service users | Account data; saved procurements; filter templates; notification settings; activity history in the Service | Contract (paragraph 15, Article 6 of the Law) | For the lifetime of the account and up to 3 years after use of the Service ends |
| Tendy AI: responding to queries and analyzing procurement cards and documents | Users of AI features | Query and response text; selected procurement context; minimized procurement document excerpts; chat identifier; technical request metadata | Contract (paragraph 15, Article 6 of the Law) for query processing and responses within a paid plan after the User explicitly enables the feature in privacy settings; Consent for cross-border transfers to language model providers (Article 9(1) of the Law) | For the lifetime of the account and up to 1 year after the last chat message, unless longer retention is needed for support |
| User support and inquiry handling | Users who submit inquiries | Email; name; inquiry content; other data included in correspondence | Contract (paragraph 15, Article 6 of the Law), or Consent where the inquiry is unrelated to Service use | 3 years after correspondence ends |
| Service security and prevention of misuse | Users and website visitors | IP address; browser and device information; security event logs; session identifiers | Contract (paragraph 15, Article 6 of the Law); paragraph 20, Article 6 of the Law where necessary to comply with information protection obligations | Up to 1 year, unless a longer period is required by law |
| Plan billing, payment records, and access to paid features | Paid plan users; representatives of legal entities | Full name or organization name; email; plan, payment, and access information; details required for accounting | Contract (paragraph 15, Article 6 of the Law); paragraph 20, Article 6 of the Law: accounting legislation | 3 years after a tax authority audit, or, if no audit took place, 10 years after the contract ends |
| Service updates, news, and special offers by email | Mailing list subscribers | Email; name (if provided) | Consent | Until Consent is withdrawn, but no longer than 3 years after the subscriber’s last activity |
| Product usage analytics through optional cookies and similar technologies | Website visitors and users | Anonymized or pseudonymized page and feature usage information; cookie identifiers | Consent | Until Consent is withdrawn or cookies are deleted, unless otherwise stated in the Cookie Policy |
| Displaying procurement information from open sources | Buyer contact persons named in official publications; representatives of buying organizations | Full name, job title, phone, and email, only as published in the source | Paragraph 20, Article 6 of the Law: procurement legislation; processing is limited to providing procurement information | While the procurement remains relevant and up to 2 years after completion, unless another period is required by law |
3. Authorized processors
3.1. The Operator engages authorized processors to process personal data to the extent necessary for Service operation. Personal data processing agreements are concluded with them under Article 7 of the Law.
3.2. The Operator periodically checks authorized processors’ compliance with personal data protection measures and does not permit engagement of subprocessors without its prior written approval.
- ООО «Надежные программы» (Hoster.by), 220006, г. Минск, ул. Аранская, д. 8, блок 1, 4 этаж: an authorized processor providing infrastructure for hosting the Tendy.by information system, web application, server routes, storage, and background tasks.
- ООО «ДЕФАЙНТ» (Republic of Belarus): the Service operator, which determines processing purposes, manages access and information system operation, and is responsible for personal data processing. It is not an authorized processor within the meaning of Article 7 of the Law.
- OpenRouter and connected language model providers: processing Tendy AI queries. Model processing may take place on servers outside the Republic of Belarus.
- Payment and settlement organizations: accepting payments and settling paid plans when the corresponding services are connected.
- PostHog Inc. (PostHog EU Cloud): product analytics with the User’s consent to analytics cookies, online support chat, and inquiry history storage.
- Email notification delivery providers: as connected, to the extent necessary for Service operation.
- Probo Inc. (trust.tendy.by): cookie consent management and consent log storage; hosted and processed on ООО «Надежные программы» (Hoster.by) infrastructure in the Republic of Belarus.
4. Cross-border transfers of personal data
4.1. The Tendy.by information system, web application, server routes, storage, and background tasks are hosted on ООО «Надежные программы» (Hoster.by) infrastructure in the Republic of Belarus. Storage and processing of personal data on this infrastructure in Belarus are not cross-border transfers. The processing legal basis is specified for each purpose in this Policy.
4.2. ООО «Надежные программы» (Hoster.by) is engaged as an authorized processor to host and maintain infrastructure to the extent necessary for Service operation.
4.3. When Tendy AI is used, queries may be transferred to OpenRouter and language model providers whose servers may be located in foreign countries, including the USA, EU, and other jurisdictions that do not ensure an adequate level of protection of data subjects’ rights. The current list of providers and processing countries is published at https://trust.tendy.by/subprocessors. Transferred data includes query text, procurement context, minimized procurement document excerpts, and technical metadata. Original files and raw extracted document text are not transferred to AI providers. The legal basis for cross-border transfer is the User’s Consent (Article 9(1) of the Law); query processing within a paid plan is based on a contract (paragraph 15, Article 6 of the Law).
4.4. In connection with transfers to AI providers, the Operator informs users of possible risks: differences in personal data law; a limited set of data subject rights; absence of, or limited powers of, a personal data protection authority in certain countries; and other risks of processing outside the Republic of Belarus.
5. Data subject rights
5.1. Data subjects have the rights provided by the Law, including obtaining information about processing of their personal data, requesting changes, obtaining information about provision of data to third parties, withdrawing Consent, requesting cessation of processing and/or deletion, and challenging the Operator’s actions or omissions.
5.2. To exercise these rights, a data subject must send a request to privacy@tendy.by or the Operator’s postal address. The request must include their full name, a contact for the response, the requested action, and information identifying their account, such as their registration email. If the data subject cannot be identified, the Operator may request additional information.
5.3. The Operator reviews and responds to a request within no more than 15 days of receipt, unless another period is required by law. Where information needs clarification, the period may be extended within the limits permitted by the Law.
5.4. A data subject who considers their rights infringed by personal data processing may contact the National Personal Data Protection Centre of the Republic of Belarus (cpd.by) or a court.
6. Personal data protection measures
- Role-based and need-based restrictions on access to information systems and user data.
- Secure communication channels (HTTPS/TLS) for data transfers between the client, web application, and API.
- Storage of credentials as cryptographic hashes; passwords are not stored in plain text.
- Database row level security policies for user data.
- Separation of raw and minimized procurement document text; only automatically minimized excerpts are sent to Tendy AI providers.
- Regular software updates, data backups, and security incident monitoring.
- Appointment of a person responsible for organizing personal data processing.
7. Security breach notification
7.1. If a personal data protection breach causes unlawful or accidental dissemination or provision of personal data, the Operator takes steps to address the consequences and reduce risks for data subjects.
7.2. The Operator notifies the National Personal Data Protection Centre and, where necessary, data subjects, following the procedures and deadlines established by the laws of the Republic of Belarus.
8. Changes to the Policy
8.1. The Operator may amend this Policy and notifies users of significant changes through the Service or by email. A new version takes effect no earlier than 10 calendar days after publication on the website, unless the text specifies another date.
8.2. The current Policy is always available at tendy.by/legal/privacy.
9. Contact details
For personal data processing, exercise of data subject rights, and withdrawal of Consent: privacy@tendy.by.
For general Service questions: hello@tendy.by.