Data controller
BidIndex is operated by Core Engineering Kft. (Budapest, Magyarország). For any data protection request: info@coreeng.eu.
The company is established in the EU, so the GDPR applies directly and no Article 27 representative is required.
What we collect
Account: email address, a bcrypt hash of your password, session token (JWT), and optionally a display name and interface language.
Subscription: plan state and the customer/subscription identifiers returned by our payment provider. We never see or store your card number.
Usage: saved search filters, your watchlist, web push subscription (endpoint + crypto keys), and your CV or company profile if you upload one.
Technical: IP address (short-term, for abuse detection), user-agent, language cookie (NEXT_LOCALE), session cookie.
No analytics — we use no tracking pixels, Google Analytics, or comparable tools.
Why we process (legal basis)
Performance of a contract (GDPR Art. 6(1)(b)): creating your account, running your subscription, saving searches, sending notifications.
Legitimate interest (Art. 6(1)(f)): system security, abuse and fraud detection, keeping the service available.
Consent (Art. 6(1)(a)): web push permission is requested in-browser and can be withdrawn at any time.
Legal obligation (Art. 6(1)(c)): retention of invoices and accounting records under Hungarian law.
How long we keep it
Account data until you delete your account. Deletion completes within 30 days.
Invoices and payment records: 8 years, as required by Hungarian accounting law. This applies even after you delete your account.
Web push subscription: until you or your browser disables it (pruned automatically on HTTP 410).
IP and user-agent technical logs: 30 days.
Any CV or company profile you upload: until you delete it or close your account.
Who we share with (processors)
Hosting: Hetzner Online GmbH — Nuremberg, Germany. Application, database, and queue run on the same machine; data stays within the EU.
Payments: Stripe Payments Europe Ltd. (Ireland) — subscriptions and invoicing. Card data goes directly to Stripe and never reaches our systems.
Email: Resend (transactional mail — verification, password reset, deadline reminders).
AI features: when you summarise a tender or run a CV/company match, the relevant text is sent to Anthropic (Claude API). Anthropic does not use it to train models. If you do not use these features, no text is sent.
Public procurement sources (TED, PLACSP, BOAMP …) are one-way: we ingest from them and send them no personal data.
No advertisers, data brokers, or marketing partners. We do not sell your data.
Your rights
Under GDPR Art. 15–22: access, rectification, erasure, restriction of processing, data portability, and objection.
Send requests to info@coreeng.eu; we respond within 30 days, free of charge.
Supervisory authority: the Hungarian NAIH (naih.hu). You may also lodge a complaint with the data protection authority in your own country.
Cookies
Functional cookies only: language preference (NEXT_LOCALE), session token, and plan state. Sign-in does not work without them.
No analytics or advertising cookies — which is why there is no consent banner.
Security
All connections are TLS-encrypted. Passwords are bcrypt-hashed and never stored in plaintext.
Only the application server reaches the database; administrative access is key-based.
In case of a breach affecting personal data we notify the supervisory authority within 72 hours and inform you directly where the risk is high (GDPR Art. 33–34).
Changes
When this policy changes the date below changes; material changes are announced by email to signed-in users.
Last updated: 2026-08-10