Privacy notice

Controller

The controller within the meaning of Art. 4(7) GDPR is Loistava Holding UG (haftungsbeschränkt), Asternring 9, 15732 Schulzendorf, Deutschland. Full provider details are in the imprint.

Please send data protection enquiries to kontakt@awantia.com. No data protection officer has been appointed; the thresholds of § 38 BDSG are not met.

What this is about

Awantia analyses European procurement notices. The vast majority of what we publish concerns legal persons — public buyers and companies — and therefore falls outside the GDPR, which protects natural persons only.

We process personal data in exactly three places:

• when you request a page (server logs),
• for audience measurement (no cookies, nothing stored on your device),
• when you subscribe to the newsletter (only if you do so yourself).

One special case exists inside the published corpus: where a supplier is a sole trader or a self-employed professional, the company name may also be a person's name. See “Published procurement data” below.

Visiting the site and server logs

The site is hosted by Vercel Inc. and served from their edge network. Requesting a page produces technically necessary log data: IP address, date and time, requested URL, referrer, user agent, HTTP status code and the volume of data transferred.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is delivering the site, keeping it stable and defending it against attacks. We do not combine these logs with other data and build no profiles from them. Retention follows the short-term retention of the hosting provider.

Audience measurement

We measure reach with PostHog, deliberately configured so that nothing is stored on your device. Specifically:

• No cookies are set and nothing is written to local storage (cookieless mode; state lives only in the page’s volatile memory).
• We record page views and page leaves, together with the details your browser sends anyway: URL, referrer, coarse region, device type and browser.
• Returning visits are not recognised through any persistent identifier. Unique visitors are counted server-side from a hash rebuilt daily with a rotating random salt, which therefore cannot be traced back to you.
• Autocapture (automatic click tracking) and session replay are switched off.
• If no analytics credential is configured, the script is not loaded at all.

Because no information is stored on, or read from, your terminal equipment, the consent requirement of § 25(1) TDDDG (formerly TTDSG) does not apply — which is why there is no cookie banner. The processing rests on Art. 6(1)(f) GDPR; our legitimate interest is measuring the reach of our content in aggregate. There is no person-level analysis, no cross-session recognition and no individual funnel tracking.

The provider is PostHog Inc.; processing takes place in the service's EU instance (Frankfurt am Main). You can object to audience measurement at any time — informally to kontakt@awantia.com, or technically by blocking the script in your browser.

Newsletter

The newsletter uses double opt-in. On sign-up we store your email address, the language you chose, a confirmation token, the page you signed up from and the time of sign-up.

Your sign-up stays unconfirmed until you follow the confirmation link. No newsletter is sent to an unconfirmed address. While no sending provider is configured, no email leaves our system at all and the sign-up simply sits unused in the database.

The legal basis is your consent under Art. 6(1)(a) GDPR. You may withdraw it at any time with effect for the future (Art. 7(3) GDPR), via the unsubscribe link or a message to kontakt@awantia.com. After you unsubscribe we keep the address on a suppression list so that a later re-subscription cannot resurrect it; the legal basis for that is Art. 6(1)(f) GDPR. You may also request deletion of that entry.

Published procurement data

The procurement data published on Awantia comes from Tenders Electronic Daily (TED), the notice database of the Publications Office of the European Union. Reuse of these documents, including for commercial purposes, is expressly permitted by Commission Decision 2011/833/EU on the reuse of Commission documents.

From each notice we extract organisation-level information only: the name and identifier of the organisation, its postal address, and the subject matter, value, award date, contract term, CPV code and region of the contract. Contact details of natural persons contained in notices — contact persons, email addresses, telephone numbers — are not parsed and appear on no page. We retain the original notice unchanged as evidence for every figure we publish; only the fields listed above are published from it.

Personal data can nevertheless arise where a supplier is a sole trader or a self-employed professional whose business name contains their own name. The legal basis is then Art. 6(1)(f) GDPR. Our legitimate interest, and the public interest, lie in making the use of public money traceable. In weighing that interest it matters that the information was published by the contracting authority itself in fulfilment of a statutory publication duty (Directive 2014/24/EU), relates to professional activity, and contains no special categories of data under Art. 9 GDPR.

This data does not come from you but from that public source (Art. 14 GDPR). Notifying every data subject individually across tens of thousands of notices would involve disproportionate effort, so this notice takes the place of individual notification under Art. 14(5)(b) GDPR. The original source is linked from every award page.

Recipients and processors

We do not share personal data for advertising purposes and we do not sell it. We use only processors acting on our instructions, with data processing agreements under Art. 28 GDPR in place:

• Vercel Inc. — hosting and delivery of the website.
• Supabase — database operation, data centre region Frankfurt am Main (eu-central-1).
• PostHog Inc. — audience measurement, EU instance.

We disclose data to authorities only where we are legally obliged to do so.

Transfers to third countries

Processing takes place in the European Union as a matter of principle. Where delivery of the site or support by the providers named above involves processing in the United States, we base it on standard contractual clauses under Art. 46(2)(c) GDPR or — for certified recipients — on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR).

Retention

• Server logs: short-term, per the hosting provider’s retention.
• Audience measurement: aggregate only, with no personal reference.
• Newsletter: until you withdraw; unsubscribed addresses remain on the suppression list.
• Procurement data: indefinitely, because the value of the corpus lies precisely in the historical series — subject to a valid objection.

Your rights

You have the following rights against us:

• access to the data we process about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdrawal of consent with effect for the future (Art. 7(3) GDPR),
• complaint to a supervisory authority (Art. 77 GDPR) — the competent authority is the one at the controller’s seat.

An informal message to kontakt@awantia.com is enough for any of these.

Right to object under Art. 21 GDPR

Where we process data on the basis of a legitimate interest (Art. 6(1)(f) GDPR) — audience measurement, server logs and the published procurement data — you have the right to object at any time on grounds relating to your particular situation. We will then stop processing the data concerned unless we can demonstrate compelling legitimate grounds that override your interests.

Correcting or removing a record

If a record is wrong, or you consider its publication unlawful, write to kontakt@awantia.com with the address of the page and a short explanation. We check the entry against the original notice and correct or remove it.

Two limits we state rather than hide: corrections are carried forward rather than deleted retroactively, so it stays traceable what was published when. And we cannot change the original notice on TED — it remains public there whatever we do.

No automated decision-making

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR. We do compute derived facts — for example a likely contract end date where the notice states none. Those computations are about contracts, not people, and are labelled as estimates on the page where they appear.

Changes to this notice

If the processing changes, this notice changes. The version published here, with the revision date below, is the one that applies.