This English version is a convenience translation. In case of discrepancies, the German version ("Datenschutzhinweise für Lieferanten") prevails.
This notice applies to you if you have been invited via the catego platform to a procurement request (e.g. a tender or request for quotation) or if you submit offers and documents in the supplier portal.
The controller within the meaning of the GDPR for the processing of your data in the context of the procurement request is the inviting company (the buyer) named in the invitation and in the supplier portal. It listed you as the contact person and decides on the purposes and means of the processing.
Catego Technologies UG (haftungsbeschränkt), Hafenweg 16, 48155 Münster, Germany, email: info@catego.org, operates the platform and sends the messages on behalf of the buyer as a processor (Art. 28 GDPR). A data processing agreement is in place between the buyer and catego.
Your contact details were entered into the platform by the inviting company (Art. 14 GDPR). catego does not collect your data from any other source.
The processing serves the conduct of the procurement request: invitation, communication, answering queries, submission and evaluation of offers, and documentation of the procedure. On the buyer's side, the legal basis is usually the initiation of a contract (Art. 6 (1) (b) GDPR) or the legitimate interest in an orderly procurement process (Art. 6 (1) (f) GDPR). The privacy information of the respective buyer prevails.
Your data is accessible to the buyer's staff involved in the procurement process and to catego as processor. For operating the platform, catego uses IT service providers as further processors: hosting with Microsoft Azure (Microsoft Ireland Operations Ltd., Dublin) in data centres in Germany, and Microsoft 365 (Microsoft Ireland Operations Ltd.) for sending emails. No data is transferred to third countries outside the EU/EEA.
Your data is stored for the duration of the procurement request and thereafter for as long as the buyer's documentation and retention obligations require. After the end of the contract between the buyer and catego, the data is returned as instructed by the buyer and deleted no later than six months after the end of the contract.
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21 GDPR). Please address your request to the buyer as controller. You may also contact catego (info@catego.org); we will forward your request to the buyer and support them in responding. You also have the right to lodge a complaint with a data protection supervisory authority.
Independently of the buyer's instructions, catego processes technical log data (e.g. IP address, time of access) as a controller in its own right for the secure operation of the platform and the prevention of abuse (Art. 6 (1) (f) GDPR). This data is stored only for a limited period. For questions about this, please contact info@catego.org. Further information about catego can be found in the website's Imprint and Privacy Policy.
September 2026.
