1.Where data is stored
- Website: hosted on Vercel. Public pages may be cached on Vercel's network close to visitors; these copies contain no personal data.
- Fonts and images: self-hosted on reblys.com, so no visitor data is sent to Google or other content providers.
- Email: subscriber lists and digest emails are handled by Brevo. Our own mailboxes (hello@, digest@) are hosted by Zoho.
2.Our providers (subprocessors)
| Provider | Purpose | Data location |
|---|---|---|
| Vercel Inc. | Website hosting and delivery, anonymous visit and download counts | EU (Frankfurt) |
| Google (Google Analytics 4) | Anonymous visit counts and traffic sources, without cookies (consent denied) | United States |
| Microsoft Corporation (Clarity) | Anonymous page-use analytics (clicks, scrolling, session replays with form input masked), without cookies | United States |
| Brevo (Sendinblue SAS, France) | Sign-up confirmations and the weekly digest emails; stores subscriber email addresses and list choices | EU |
| Zoho Corporation | Our mailboxes: replies to you, sign-up notifications, outreach emails | United States |
| Smartlead | Sending and warming up our outreach mailbox (business contacts only) | United States |
| Anthropic PBC | AI reading, translation and summaries of public tender notices. Receives tender text, not subscriber data. | United States |
Every provider is bound by a data processing agreement, and providers headquartered outside the EU are bound by the EU Standard Contractual Clauses.
3.Our role
Reblys Tender Management is the data controller for the personal data of visitors, subscribers and customers, as described in our Privacy Policy. Where a customer asks us to process personal data on its behalf, we act as data processor under a data processing agreement, available on request.
4.How we protect data
- Encryption in transit (HTTPS) on all pages, and encryption at rest by our providers.
- Access to personal data limited to people who need it to run the service.
- Multi-factor authentication on all administrative accounts.
- Data minimisation: we only ask for what we need to match tenders to your products.
5.Personal data in public tenders
Public tender notices can include names and contact details of procurement officers. We process these only as part of the notice and do not build profiles of individuals. If your details appear in a notice and you want to object to our processing, email us.
6.Exercising your rights
To access, correct, delete or export your data, or to object to its processing, email hello@reblys.com. We reply within one month, as required by the GDPR.
7.If something goes wrong
If a personal data breach occurs, we will notify the Danish Data Protection Agency within 72 hours where required, and inform affected people without undue delay when there is a high risk to them.