Privacy Policy

Memik Inel Eisenacher Straße 41 10781 Berlin Germany

General enquiries: value@valuespoc.com Data protection enquiries: privacy@valuespoc.com

We process personal data of business users, platform administrators, and website visitors in accordance with the General Data Protection Regulation (GDPR) and applicable national law.

Personal data means any information relating to an identified or identifiable natural person. Processing includes collection, storage, use, and deletion.

Depending on the context, we rely on:

• Art. 6(1)(b) GDPR: performance of a contract or pre-contractual steps
• Art. 6(1)(f) GDPR: legitimate interests such as security and product improvement, where not overridden by your interests
• Art. 6(1)(a) GDPR: consent, for example for optional analytics or marketing cookies
• Art. 6(1)(c) GDPR: compliance with legal obligations

Where special categories of data are processed, additional requirements apply.

The public websites and the platform run on servers of IONOS SE in Germany that we operate ourselves, database, authentication and file storage included. The stack is open source and involves no proprietary cloud services.

On each request the web server processes log data (IP address, timestamp, page requested, user agent) to ensure availability, security and abuse prevention. We also use those same logs to count how often each page is read. The IP address is shortened before anything is counted. No script runs in your browser for this and no data goes to a third party. The legal basis is Art. 6(1)(f) GDPR. Server logs are rotated automatically and kept no longer than error analysis and security monitoring require.

The public-sector offering at gov.valuespoc.com carries a privacy statement of its own.

The public websites (www.valuespoc.com and gov.valuespoc.com) embed no third-party analytics, tracking, or advertising services. What is stored on your device is limited to what the sites need in order to work: your cookie decision itself, plus the selected language and display settings in your browser's local storage.

On your first visit a banner asks for consent to the optional categories. Nothing optional is pre-selected, and you can change your decision at any time via „Cookie settings“ in the footer. The complete inventory of what is stored, with purpose and retention per entry, is in our Cookie Policy.

Inside the application, that is after signing in, only strictly necessary cookies for authentication, session management, and security are used.

The contact form sends us your name, business email address, organisation, the topic you picked and your message. We process these details to answer your enquiry and to arrange demos or pilots. The legal basis is your consent under Art. 6(1)(a) GDPR. You give it by submitting the form and can withdraw it at any time at privacy@valuespoc.com.

Alongside the enquiry we record the moment of your consent, the user agent and a check value derived from your IP address. That value is produced with a secret key, cannot be turned back into an IP address and serves only to limit automated bulk submissions.

The data is kept only as long as the enquiry and its follow-up require, unless statutory retention obligations apply.

If you book an appointment through the website, we process your name, email address, optionally your organisation and what you tell us about your enquiry, in order to arrange and hold the appointment. The legal basis is Art. 6(1)(b) GDPR, as the processing happens at your request and to take steps prior to a contract. We also store a salted hash of your IP address to prevent abuse of the booking function; the legal basis for that is our legitimate interest in a functioning service under Art. 6(1)(f) GDPR. The data is deleted once the appointment is held or cancelled and no longer needed for traceability, at the latest after six months. You can cancel a booked appointment at any time using the link in the confirmation email.

Registered users provide organization and profile data to use the marketplace: account credentials, roles, tender and bid content, documents, communication metadata, and audit events.

Processing is necessary to operate the B2B sourcing workflow, enforce access controls, and maintain an auditable record of award-related decisions.

We use no third-party analytics service on the public websites, neither Google Analytics nor Matomo, Plausible or a comparable product, and no advertising networks.

Inside the signed-in application we record usage statistics (pages visited, time spent, load times) to detect errors and bottlenecks and to improve the application (Art. 6(1)(f) GDPR). This data is processed in our own platform database, stays scoped to the organisation it belongs to, and is not passed to analytics vendors.

The „Analytics“ category in the consent banner already exists so that any future measurement sits behind consent from day one. On the public websites it governs no active processing today.

With your consent or where permitted for existing B2B relationships, we may send product updates, event invitations, or onboarding content. You can opt out at any time via the unsubscribe link or by contacting privacy@valuespoc.com.

We do not sell personal data to third parties for their independent marketing.

We use service providers under data processing agreements pursuant to Art. 28 GDPR. These are currently:

• IONOS SE, Germany: servers for the websites, the application, the database and file storage, and the mail server that delivers system and notification email
• Language-model providers for the AI features: Anthropic, OpenAI, Mistral AI, DeepSeek, Google or IONOS depending on configuration. One provider is set up per installation, and an individual organisation can select a provider of its own within it. Personal data is pseudonymised before transmission

Other marketplace participants may receive data you submit in tenders, bids or Q&A when your workflow requires sharing. Invited providers see published RfX content, for example.

The platform is operated entirely in Germany. A transfer to a third country arises only where a language model outside the European Union is configured for the AI features.

We base such transfers on the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR, supported by technical and organisational measures. Personal data is pseudonymised beforehand.

We name the providers configured for a specific installation on request. Where a language model at IONOS SE in Germany is set up, no transfer outside the EU arises. The platform can therefore be operated entirely within the European Union.

We retain personal data only as long as necessary for the purposes described or as required by law. Typical periods include:

• Account and contract data: duration of the relationship plus statutory limitation periods
• Tender and award records: as needed for audit, billing reconciliation, and legal claims
• Marketing consents: until withdrawal
• Server logs: short-term, then deletion or anonymization

Subject to legal conditions, you have the right to access, rectification, erasure, restriction of processing, data portability, and objection. Where processing is based on consent, you may withdraw consent at any time without affecting prior lawful processing.

Contact privacy@valuespoc.com to exercise your rights. You also have the right to lodge a complaint with a supervisory authority.

We may update this Privacy Policy when our services, legal requirements, or subprocessors change. Material changes will be communicated via the website or, where appropriate, by email to registered users.

The valid-from date at the top indicates the current version.