Privacy Policy

1. Introduction

PASTORIA PROJECT, S.L. ("we", "us", or "our") operates the Mid2Bid platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service, in compliance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and Spanish Organic Law 3/2018 on Personal Data Protection and Digital Rights (LOPDGDD).

2. Information We Collect

2.1 Personal Data You Provide

• Account information: name, email address, company name, country
• Profile information: job title, phone number, professional interests
• Payment information: processed securely through Stripe (we do not store card details)
• Communications: messages, feedback, and support inquiries

2.2 Automatically Collected Data

• Device information: browser type, operating system, device identifiers
• Usage data: pages visited, features used, time spent on the Service
• Log data: IP address, access times, referring URLs
• Cookies and similar technologies (see our Cookie Policy)

3. Legal Basis for Processing (GDPR Art. 6)

We process your personal data based on:

• Contract performance (Art. 6(1)(b)): To provide and maintain our Service, process subscriptions, and deliver market intelligence features.
• Legitimate interests (Art. 6(1)(f)): To improve our Service, analyze usage patterns, prevent fraud, and ensure security.
• Consent (Art. 6(1)(a)): For marketing communications, non-essential cookies, and specific data processing activities where we request your explicit consent.
• Legal obligation (Art. 6(1)(c)): To comply with applicable laws, regulations, and legal processes.

4. How We Use Your Information

• Provide, operate, and maintain the Mid2Bid platform
• Process transactions and send related information
• Send administrative information, updates, and security alerts
• Respond to inquiries and provide customer support
• Analyze usage to improve our Service and user experience
• Develop new products, services, features, and functionality
• Detect, prevent, and address technical issues and fraudulent activities
• Comply with legal obligations and enforce our terms

5. Data Sharing and Disclosure

We may share your information with:

• Service providers: the providers named in the table below, each for the purpose shown. The current list is also published on our sub-processors page.
• Business transfers: In connection with any merger, acquisition, or sale of assets
• Legal requirements: When required by law, court order, or governmental authority
• Consent: With your explicit consent for other specific purposes

We do not sell your personal data to third parties. All third-party service providers are contractually bound to protect your data and process it only for specified purposes.

Company customers: when your company stores contacts and opportunities in the MID2BID CRM, we process them on your company’s behalf under our Data Processing Agreement, available on request and, on request, as a signed copy.

If you publish projects, companies, news or tenders on MID2BID, they are visible to other users. You are responsible for having the right to publish any personal data they contain. We may remove published content on request or on our own judgment.

6. International Data Transfers

MID2BID is operated from Spain. Our servers are in the United States, and some providers may also process data in the European Union and India. When personal data leaves the European Economic Area, we rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s standard contractual clauses. MID2BID does not currently host data in any GCC state and has not set a date for doing so.

Users in Saudi Arabia. Saudi Arabia’s Personal Data Protection Law applies to personal data of people in the Kingdom. You have the rights that law gives you, including to be informed, to access and correct your data, and to ask for its destruction. You may contact us at info@mid2bid.com and you may complain to the Saudi Data and Artificial Intelligence Authority (SDAIA). Company customers who need the SDAIA standard contractual clauses can request them from us.

Users in other GCC states have the rights their national law gives them, and can exercise them through the same address. Users in the Dubai International Financial Centre (DIFC), the Abu Dhabi Global Market (ADGM) or the Qatar Financial Centre (QFC) are covered by those zones’ own data protection laws and can use the same contact address.

7. Data Retention

We keep personal data only as long as we need it:

• Account data (name, e-mail, company, plan, usage): while your account is open, and deleted within 90 days after it closes.
• Billing and tax records (invoices, billing address, VAT number, card country, evidence of your location): six years from the end of the year of the sale, because Spanish commercial and tax law requires it.
• Support correspondence: until the request is resolved, and at most 24 months.
• Chat assistant conversations: 90 days.
• CRM data your company enters: we hold it on your company’s behalf and delete it within 30 days after the account closes, as set out in our Data Processing Agreement. Backup copies are overwritten within a further 35 days.

Tax records. When you buy a paid plan, we keep your billing address, the country of your payment card (never the card number, which is held by our payment provider), the IP address from which you bought, your tax registration number, the result of our check of that number with the tax authority, and your acceptance of these Terms. We keep this information because Spanish tax and commercial law requires us to keep evidence of our sales (legal basis: compliance with a legal obligation, article 6.1.c of the General Data Protection Regulation, and the equivalent basis under the laws of your country, including Saudi Arabia’s Personal Data Protection Law). We keep it for six years from the end of the year of the sale, and then delete it.

8. Your Rights Under GDPR

Under the GDPR, you have the following rights:

• Right of access (Art. 15): Request a copy of your personal data
• Right to rectification (Art. 16): Request correction of inaccurate data
• Right to erasure (Art. 17): Request deletion of your data ("right to be forgotten")
• Right to restriction (Art. 18): Request limitation of processing
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to object (Art. 21): Object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent (Art. 7): Withdraw consent at any time where processing is based on consent

To exercise these rights, contact us at info@mid2bid.com. We will respond within one month as required by GDPR. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

9. Security

We protect personal data with measures appropriate to the risk. All traffic between you and MID2BID is encrypted (TLS). Our database provider encrypts all stored data and backups on its disks. Passwords are stored only as a one-way hash that nobody, including us, can read. Card data is handled entirely by Stripe and never reaches our systems. Each customer’s data is separated from every other customer’s, and access inside a company account follows the roles the company sets. MID2BID staff see customers’ CRM records masked, and access them only when needed for support, security or legal reasons. We have a procedure for detecting and responding to security incidents. MID2BID does not currently hold an ISO 27001 or SOC 2 certification; our hosting and database providers hold their own.

10. AI features and chat assistants

MID2BID uses OpenAI to summarise and translate news and tender texts, and to power our chat assistants. When you use a chat assistant, what you type is sent to OpenAI in the United States to generate the answer. OpenAI does not use data received through its API to train its models, and may keep it for up to 30 days to detect abuse. We keep chat conversations for 90 days. You are always told when you are talking to an AI assistant. Please do not enter personal data about other people or confidential information in the chat. The CRM records your company keeps in MID2BID are not sent to OpenAI.

11. Information from public sources

Our tender, project, news and company information comes from public sources such as government procurement portals, company registers and published news. It may include the names and professional roles of people connected with those records. We use it, on the basis of our legitimate interest in providing business information about public markets, only in its professional context. If you appear in MID2BID and want your data corrected or removed, write to info@mid2bid.com; we will answer within one month.

12. Children’s Privacy

Our Service is not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us immediately.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we will provide notice via email or through the Service.

Previous version: Privacy Policy of 8 March 2026.

14. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: