Tendios

GDPR overview

GDPR implementation is documented rather than merely asserted. Clause 11.3 of the terms sets out a full processor agreement: Tendios is the data processor, the customer the controller, and Regulation (EU) 2016/679 is defined by name. Tendios undertakes to disclose at any time where data is held, to document adequate safeguards for international transfers, and to maintain a consultable list of sub-processors with seven days' notice before any change. The security policy of 12 September 2025 sets compliance with the GDPR, the Spanish LOPDGDD and Law 10/2021 as objectives, and is aligned with ISO/IEC 27001 and the ENS. AENOR has certified the systems at ENS High category, reference ENS-2026/0101, valid until 14 July 2028. No data protection officer is named, and no Article 27 representative is required since the publisher is established in Spain.

Who owns the data?

The terms are unambiguous on this point: the customer and its authorised users remain the sole owners of the information they supply to Tendios or store in the service, and no title, licence or right of use beyond running the platform is transferred to the vendor. Tendios acts as data processor, the customer as controller. Intellectual property in the software itself, and in any extension or improvement derived from it, stays with Tendios, which also forbids reverse engineering, resale and sublicensing. Users can update, amend or delete their own information from their account settings or by writing to the company.

Reuse rights

Because ownership stays with the customer, a company may reuse its own tender data, uploaded documents and generated outputs freely, without asking Tendios for permission. The vendor's own processing is framed narrowly by the privacy policy: running and maintaining the service, managing the account, performing the contract, contacting the user, sending information about similar services that the user can decline, handling requests, business transfers, and analysing usage trends. Data may be shared with service providers, affiliates, business partners, and with other users where information is posted in public areas. Reverse engineering, resale and the publication of benchmarks about the software are all prohibited. No document on the site states whether customer data feeds AI model training; the comparison page describes a retrieval-augmented architecture over a vector database rather than a trained model.

Data retention & training

Hosting summary

Hosting is European throughout. The AENOR certificate, the most precise source the company publishes, names two external data centres: Hetzner in the EU-Central region, at Nuremberg and Helsinki, and DigitalOcean in Frankfurt. The certified activities themselves are carried out from the company's Barcelona premises on Placa del Doctor Letamendi. A DNS lookup on the domain is consistent with this, resolving to a Hetzner Online address in Falkenstein, Germany. The comparison page markets compliance, protection and security of European data as a differentiator against generalist assistants. Contractually, the terms oblige Tendios to disclose at any time where customer information and personal data are held, and to supply documentation of adequate safeguards for any international transfer. The privacy policy is far less precise: written from a generic template, it notes only that information may be transferred to and held on computers outside the user's own jurisdiction, and names no country. Germany and Finland are therefore the two hosting countries evidenced by a published first-party document.