Privacy Policy

Draft for legal review. This policy explains how discover.az OÜ (Estonia), the data controller, processes personal data under the EU General Data Protection Regulation (GDPR).

Data we collect

• Account data: name, email, password (stored only as a one-way hash), language and currency preferences, two-factor settings.
• Business profile: company name, domain, industry, size bands, job title, phone and LinkedIn URL (optional).
• Requests and tenders: project details, budget and timeline bands, decision-maker contact details and documents you upload.
• Vendor data: company profile, products, billing details and verification documents.
• Technical data: hashed IP address (for fraud prevention), session and security logs.

Why we use it (legal bases)

• To provide the Platform (contract).
• To share a request with vendors (your consent, recorded with date and version; you can withdraw it for future sharing).
• To prevent fraud, secure accounts and keep audit logs (legitimate interests; legal obligations).
• To bill vendors and keep accounting records (legal obligation).
• To send promotional emails (consent — you can opt out at any time).

Security

Sensitive company and contact data is encrypted at rest. Access to lead contact details is limited to vendors who unlock a request and is logged. Payment card data is handled entirely by Stripe; we never store card numbers.

Who we share data with

• Vendors you choose or are matched with (for quotation purposes only).
• Processors: hosting (Namecheap), network security and bot protection (Cloudflare), payments (Stripe), email delivery.
• Authorities where required by law.

Some processors may process data outside the EEA under appropriate safeguards such as Standard Contractual Clauses.

Retention

• Account data: until you delete your account.
• Invoices and accounting records: as required by law (typically 7 years), with personal details removed where possible.
• Audit and access logs: up to 7 years.
• Data export files: deleted after 24 hours.

Your rights

You can access and download your data (Account → Privacy → Download my data), correct it, delete your account, object to processing and withdraw consent. You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local authority.