Privacy Policy
Last updated: April 2025
Bookmarks are stored only in this browser. Usage counters aggregate actions by day and store no search text or persistent visitor identifiers. Restricted access retains security usage records.
Data Controller
Open Tender Watch is an open-source civic transparency project. For data protection queries, contact us via the project's GitHub repository.
Purpose & Scope
This platform processes publicly available procurement data from Portuguese and European public databases (Portal BASE, SNS, TED) to detect corruption risk patterns. Personal data processed is limited to names and tax identifiers (NIFs) of company directors and officers, sourced from the Registo Comercial (publicacoes.mj.pt) — a public register.
Legal Basis
Processing is based on Article 6(1)(e) GDPR — task carried out in the public interest (anti-corruption monitoring and journalistic research) and Article 6(1)(f) — legitimate interest in public accountability of entities receiving public funds. A Legitimate Interest Assessment (LIA) has been conducted. The Portuguese Lei n.° 58/2019 (RGPD implementation) and Lei n.° 26/2016 (access to public information) further support this processing.
Data Processed
Contract metadata (object, price, dates, procedure type, CPV codes), entity identifiers (NIF/NIPC, names), and director/officer names and roles sourced from public commercial registers. No special categories of data (Art. 9 GDPR) are processed.
Pseudonymisation
Director and officer names are pseudonymised by default for public visitors. Only authenticated journalists and auditors with a valid access token can view full personal data. Pseudonymised identifiers are deterministic (same person always maps to the same code) but cannot be reversed without access to the application secret.
Graph Visualizations
Network graphs are provided for corruption-risk triage, not accusation. Public graph mode shows only entity-to-entity links. Authenticated users may enable anonymized individual nodes sourced from public registers; these remain pseudonymized and must not be used for re-identification attempts.
Your Rights
Under GDPR Articles 15–22, data subjects have the right to access, rectification, erasure, restriction, and objection. To exercise these rights, contact us via the project's GitHub repository. Note that the right to erasure may be limited under Article 17(3)(a) (freedom of expression and information) and Article 17(3)(d) (archiving in the public interest). We will respond within 30 days.
Retention
Personal data is retained for as long as the underlying public register records remain publicly available. Access token usage logs are retained for 12 months.
Contact
For data protection queries, submit an issue on the project's GitHub repository: github.com/bit-of-a-shambles/open-tender-watch