Your data is not the product.

1. Controller and contact

The controller is Gestiona Tech, Nikolausstraße 6, 55120 Mainz, Germany, represented by Nguenkam Charles. Privacy requests: privacy@beatmyvendor.com.

2. Data we process

• Account data: business email, name, locale, authentication identifiers, and workspace membership.
• Business data: organization name, website, country, contacts, vendor profile, and approval state.
• Duel and offer data: software spend, requirements, commercial terms, decisions, and communications submitted through the service.
• Verification data: evidence metadata and private verification files. Vendors never receive those files.
• Transaction data: Stripe checkout, payment, receipt, and refund identifiers. BeatMyVendor does not store full card details.
• Security data: session information, timestamps, audit events, abuse reports, and technical request data.

3. Purposes and legal bases

• Provide accounts, Duels, offers, selections, payments, and introductions: performance of the service agreement.
• Verify buyers and vendors, prevent fraud, enforce marketplace rules, and secure the service: legitimate interests in a trustworthy B2B marketplace.
• Invoices, transaction evidence, regulatory responses, and accounting: legal obligations.
• Publish a verified Win or send optional marketing: explicit, withdrawable consent. Service access is not conditional on this consent.

4. Sharing and international transfers

Data is shared only as needed with infrastructure and authentication providers, Stripe for payments, transactional email providers, professional advisers, and authorities where legally required. Buyer and vendor identities are exchanged only after a paid introduction. Where a provider processes data outside the EEA, we use an applicable adequacy decision or approved transfer safeguards.

5. Retention

• Verification files: scheduled for deletion after 30 days unless an active fraud, dispute, or legal hold requires longer retention.
• Unsuccessful draft or rejected marketplace records: minimized or deleted when no longer operationally necessary.
• Contracts, payments, invoices, and related audit evidence: retained for the applicable statutory period.
• Account and workspace data: retained while active, then deleted or anonymized subject to transaction, dispute, security, and legal-retention requirements.
• Published Wins: remain public until consent is withdrawn or continued publication is no longer justified.

6. Your rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability, or object to processing. You may withdraw consent at any time without affecting earlier lawful processing. You may also lodge a complaint with the competent data-protection supervisory authority.

Export data or request deletion →

7. Security and automated decisions

We use access controls, row-level database policies, private document storage, immutable offer versions, payment webhooks, and administrative audit logs. BeatMyVendor does not make solely automated decisions producing legal or similarly significant effects.

8. Data protection officer

No formal data protection officer has been appointed. Privacy enquiries can be sent directly to privacy@beatmyvendor.com.

9. Supervisory authority

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (LfDI Rheinland-Pfalz), Postfach 30 40, 55020 Mainz; visitor address: Hintere Bleiche 34, 55116 Mainz; telephone: +49 (0) 6131 8920-0; email: poststelle@datenschutz.rlp.de; https://www.datenschutz.rlp.de/

10. Changes

Material changes will be announced in the service. The version date above identifies the notice that applies.