Bandara — Privacy Policy
Last updated: 13 July 2026
1. Data controller
Bandara is operated by Hendeka Orchestra, an independent project run by a private individual (sole trader) established in Spain (the "Operator"). The Operator acts as the data controller under the GDPR. Contact: bandara@hendekaorchestra.com.
2. What we process
- Account data: name, email; via Google sign-in: Google email, display name, profile image (never your password).
- Company profile: sector, location, size, capabilities, certifications, exclusions, target regions.
- Service data: report email address, generated matches, reports, feedback, delivery logs.
- Billing data (paid plans): processed by Stripe; we never store full card details.
- Technical data: IP, browser/device — security and anti-abuse.
- Opportunity/tender data comes from public third-party sources and is not personal data about you; it is matched against your company profile.
3. Legal bases (Art. 6 GDPR)
| Basis | Purpose |
|---|---|
| Contract (6(1)(b)) | Account, profile matching, report delivery, billing |
| Legitimate interest (6(1)(f)) | Security, anti-abuse, service improvement (aggregate) |
| Consent (6(1)(a)) | Marketing email beyond service reports; any non-essential cookies |
| Legal obligation (6(1)(c)) | Accounting/tax records for paid plans |
4. Cookies
Bandara uses a strictly necessary session cookie for authentication (no consent required), and — only with your explicit consent — analytics and advertising cookies (Google Analytics 4 and Google Ads conversion measurement) under Consent Mode v2: all analytics/advertising storage is denied by default and remains disabled unless you accept the banner. You can decline and use the whole site normally. See the Cookie Policy for details and withdrawal.
5. Processors and recipients
- Stripe — payments (paid plans).
- Google — authentication (if chosen); GA4 and Google Ads only with consent (Consent Mode v2).
- An EU-based hosting provider — infrastructure.
- An email delivery provider — reports and account messages.
No sale of personal data; no sharing beyond these providers except as required by law.
6. International transfers
Primary data stored in the EU. Providers processing outside the EU/EEA are covered by adequacy decisions and/or Standard Contractual Clauses (SCCs).
7. Retention
- Account/profile data: while active; deleted within 30 days of closure.
- Accounting/billing records: 6 years, as required by Spanish commercial law (Código de Comercio).
- Server/delivery logs: up to 90 days.
8. Your rights (Art. 15–22, 77 GDPR)
Access, rectification, erasure, restriction, portability, objection; no solely automated decisions with legal effects (scores rank tenders, not people). Complaints: AEPD or your local authority. Contact: bandara@hendekaorchestra.com.
9. Changes
Material changes notified by email and on this page.