Privacy policy

1. Data controller

Ahlquist Productions AB, company registration number 559520-7423, Kungsportsavenyn 10, 411 36 Göteborg, hej@bidline.se. We have not appointed a data protection officer because we are not required to do so.

2. When we act as a processor

When you upload procurement documents, we process the personal data in them on behalf of your company, as a processor under our terms. Do not upload unnecessary personal data, such as CVs or personal identity numbers.

3. Data we process, purposes and legal bases

Accounts and orders (name, company, email, phone, company registration number): to provide the service and invoice. Legal bases: contract (Art. 6(1)(b)) and legal obligation for accounting (Art. 6(1)(c)).

Enquiries, bookings and contact forms: to respond to you. Legal basis: legitimate interests (Art. 6(1)(f)).

Free analysis eligibility record (company registration number and email address): to prevent repeated use of the free analysis. Legal basis: legitimate interests. For sole traders, the company registration number may be a personal identity number; we therefore store the eligibility record in encrypted (hashed) form.

Contact with prospective customers (name, job title, company and work-related contact details): we obtain information about businesses participating in public procurement from public sources, such as published procurement and award notices, and contact them in their professional capacity. Legal basis: legitimate interests. You may decline contact at any time; we then stop contacting you and delete the data, except for a suppression record to prevent future contact.

Visitor statistics: only after consent in the cookie banner. Legal basis: consent (Art. 6(1)(a)).

4. Subprocessors and recipients

Lovable (Lovable Labs Incorporated / Lovable AB under Lovable’s agreements) for the website, AI service and operations; Supabase for the database and file storage; OpenAI or another AI provider used by Lovable AI for text analysis; Google (Google Workspace) for email. Uploaded files are automatically checked for file type, size and format and stored privately. Malware scanning is temporarily disabled. Some providers may process data outside the EU/EEA, including in the USA. Such transfers rely on the European Commission’s Standard Contractual Clauses or the EU-US Data Privacy Framework under each provider’s terms. We never sell personal data.

5. AI in the service

Text from uploaded documents is sent to an AI model to identify requirements and dates. According to the provider, the content of these requests is not retained. A person at Bidline reviews every analysis before delivery.

6. Retention periods

Documents and analyses: 12 months after delivery (or less if you delete them); unfinished requests: 3 months; accounts: until deleted; enquiries, bookings and contact with prospective customers: 24 months after last contact; Free analysis eligibility records: 36 months; visitor statistics: 13 months; accounting records: 7 years under the Swedish Bookkeeping Act.

7. Security

Private storage, customer-specific access restrictions, encrypted transfer and logging of administrative access. We report personal data breaches to the Swedish Authority for Privacy Protection (IMY) within 72 hours when required by law.

8. Your rights

Access, rectification, erasure, restriction, data portability and the right to object to processing based on legitimate interests. Contact hej@bidline.se or Ahlquist Productions AB, Kungsportsavenyn 10, 411 36 Göteborg; we respond within one month. You may complain to IMY at imy.se.

9. Changes

We update the policy when processing changes and state the date at the top.