1.EU data residency
- Website: hosted on Vercel with our deployment region set to Frankfurt, Germany. Public pages may be cached on Vercel's network close to visitors; these copies contain no personal data.
- Fonts and images: self-hosted on reblys.com, so no visitor data is sent to Google or other content providers.
2.Our providers (subprocessors)
| Provider | Purpose | Data location |
|---|---|---|
| Vercel Inc. | Website hosting and delivery | EU (Frankfurt) |
We will add the providers for email and the weekly digest to this list before we start using them. Every provider is bound by a data processing agreement, and providers headquartered outside the EU are bound by the EU Standard Contractual Clauses.
3.Our role
Reblys Tender Management is the data controller for the personal data of visitors, subscribers and customers, as described in our Privacy Policy. Where a customer asks us to process personal data on its behalf, we act as data processor under a data processing agreement, available on request.
4.How we protect data
- Encryption in transit (HTTPS) on all pages, and encryption at rest by our providers.
- Access to personal data limited to people who need it to run the service.
- Multi-factor authentication on all administrative accounts.
- Data minimisation: we only ask for what we need to match tenders to your products.
5.Personal data in public tenders
Public tender notices can include names and contact details of procurement officers. We process these only as part of the notice and do not build profiles of individuals. If your details appear in a notice and you want to object to our processing, email us.
6.Exercising your rights
To access, correct, delete or export your data, or to object to its processing, email hello@reblys.com. We reply within one month, as required by the GDPR.
7.If something goes wrong
If a personal data breach occurs, we will notify the Danish Data Protection Agency within 72 hours where required, and inform affected people without undue delay when there is a high risk to them.