Privacy policy

Version of [A COMPLETER : date of entry into force].

Controller

XiwiX SRL, Rue Jules Borbouse 42, 5170 Profondeville, Belgium, VAT BE 0698.895.985, which operates the XiwiX service.

Contact for any question about your data: contact@xiwix.be.

Data processed

• Account: company name, business email address and name of each user, role (account holder or member), dates of creation and of last sign-in.
• Monitoring profiles: description of the business, included and excluded keywords, départements followed, and the history of their changes.
• Alerts and feedback: notices sent, "relevant" or "not relevant" ratings and comments left on the alerts.
• Company identification: company number (SIREN, SIRET, Belgian BCE/KBO number or VAT number), requested at sign-up to check that the service is reserved for businesses and to issue invoices, and the optional answer to “How did you hear about us?”.
• Measurement of service use: notice pages opened, clicks to the official notice and to the procurement documents, feedback and sorting, declared participations, profile changes, unsubscriptions and cancellations (see “Measurement of service use”).
• Bid files: information and documents provided to write a technical proposal. They may contain data about your staff (for example references or career histories): only send what the file needs. Uploaded documents are stored encrypted, outside the database.
• Payment: customer identifier at Stripe, subscription status, orders and invoices. Card numbers are entered directly with Stripe and never reach us.
• Emails sent: full copy of the messages the service sends you (sign-in links, alerts, billing notices). A copy of a sign-in email therefore contains the link as it was sent; that link can no longer be used to sign in once it has been used, nor after 20 minutes.
• Technical logs: IP address, date and time, page requested. The sign-in links sent to customers appear masked in them.
• Cookies: only cookies needed for the site to work: session (30 days at most, deleted when you sign out), form protection (one year), “langue” (the language chosen for the site, one year), authenticator app code step after opening a sign-in link (15 minutes), sign-up link opened (7 days at most, until the account is created) and “Open your inbox” page after sign-up (the address entered, one hour). Details in the legal notice.

The public procurement notices themselves are public data from the BOAMP and from TED.

Purposes and legal bases

• Providing the service (account, sign-in, alerts, summaries, bid files): performance of the contract.
• Invoicing and keeping the accounts: legal obligation.
• Improving the relevance of your alerts from your feedback: performance of the contract.
• Tuning your company's profiles from your use of the service (measurement of use): performance of the contract.
• Ensuring the security of the service, preventing abuse and keeping the technical logs: legitimate interest.
• Checking, at sign-up, that the company is not on our refusal list (for example after abuse): legitimate interest.

[A COMPLETER si une lettre d'information gratuite est proposée : legal basis (consent or legitimate interest for business-to-business prospecting), one-click unsubscription in every mailing.]

Retention periods

• Sign-in links: valid for 20 minutes, single use. To check a link, we store a fingerprint from which it cannot be rebuilt; the daily clean-up deletes it within two days after the link expires. The link itself remains in the copy of the email that carried it (see "Copies of emails sent").
• Sessions: 30 days at most for a customer.
• Account, profiles, alerts and feedback: for as long as the account exists, then [A VALIDER : 3 years] after it is closed to handle any disputes.
• User removed from an account: their user data is deleted; their feedback on alerts is kept without any link to them.
• Measurement of service use: 24 months, then anonymous totals per month, per type and per profile.
• Account created through online sign-up and never confirmed (no sign-in through the link received): deleted 7 days after sign-up, including the copies of the emails sent to it.
• Documents and information provided for a bid file, and what is derived from them (extracts, draft, checks): 30 days after the file is delivered or cancelled or, for a file never delivered, after the tender deadline; the delivered proposal remains available to you with your account.
• Invoices and accounting records: 10 years, the period required by accounting law.
• Copies of emails sent: [A VALIDER : 12 months].
• Technical logs: [A VALIDER : 6 months].

Recipients and processors

Your data is neither sold nor rented. It is accessible to the provider's staff who need it and to the following processors, within the limits of their task:

• Stripe (online payment, invoicing, subscription management portal);
• the host of the site and the data: Combell nv (server in Amsterdam, Netherlands, European Union; DX75 of 20 October 2026, replaces Hetzner) *[à valider par l'avocat]*;
• the email sending provider: Scaleway (European Union);
• off-server storage of backups, encrypted before sending: Scaleway (European Union);
• Anthropic, provider of the language model, if the automatic writing service is enabled: the description of your business to generate a profile, the text of notices to summarise them and, for a bid file, the information you provided for that file.

The deadlines, amounts and criteria shown in the summaries are never produced by the language model: they are extracted from the notice, with their source.

Transfers outside the European Union

Some processors may process data outside the European Union, in particular in the United States. [A COMPLETER : safeguards applicable to each transfer, for example standard contractual clauses of the European Commission or certification under the EU-US Data Privacy Framework.]

Measurement of service use

So that your alerts improve, the service records your use: opening of notice pages; clicks to the official notice and to the procurement documents, through a redirect link that sets no cookie and no pixel; your feedback and sorting (relevant or not, interesting or not) and their history; the participations you declare (interested, bid submitted with its amount, contract won, lost or abandoned); changes to your profiles; unsubscriptions and cancellations, with their reason.

This data is used only to tune your company's profiles (performance of the contract). It is not used to improve the service for all customers unless you have first been informed of that use. It is kept for 24 months, then replaced by anonymous totals per month, per type and per profile.

Automated decisions

The indicative score is calculated automatically. It is a decision aid: it produces no legal effect and the decision to bid for a contract is yours.

Security

Password-free sign-in with a single-use link or code valid for 20 minutes, followed by the code from the authenticator app at every sign-in; a sign-in stays open for 30 days at most and is never extended by use. The check is made on a fingerprint of the link; the stored copy of the sign-in email contains the link, which no longer works once used or expired. No bank card data on our servers. [A COMPLETER : encryption of exchanges (HTTPS) and backups, once the hosting has been chosen.]

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data. The account holder can export all of the company's data and request its erasure themselves, from the “My data” page of their customer area. You can also write to contact@xiwix.be; we reply within one month.

You may also lodge a complaint with the Data Protection Authority (Belgium, www.dataprotectionauthority.be) or with the supervisory authority of your country, for example the CNIL in France (www.cnil.fr).