Privacy Policy

1. Introduction

TANDOR ("we", "our", "us") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and protect information when you use our EU-organic botanical sourcing broker platform at tandor.eu.

2. Data We Collect

Account Data: Name, email, company name, country, VAT number, phone number when you register.

Transaction Data: RFQ details, quotes, orders, invoices, and messaging content.

Usage Data: Pages visited, referrer, browser and device type, and approximate country/city derived from your IP address by our hosting provider at request time. We do not store your IP address with these page views; they are deleted after 13 months.

3. How We Use Your Data

We use your data to: operate the sourcing platform, facilitate transactions between buyers and suppliers, send notifications about RFQs and orders, improve our platform, and comply with legal obligations.

3.1 Legal bases.

• Account and supplier/buyer profile — contract (Art. 6(1)(b)).

• Purchase requests, quotes and introductions — steps at your request before a contract and performance of our service (Art. 6(1)(b)); for named contacts at companies also our legitimate interest in handling B2B requests (Art. 6(1)(f)).

• Purchase inquiries we send to producers whose business address we found on their website — legitimate interest (Art. 6(1)(f)); see our Legitimate Interest Assessment (/lia). You can object at any time.

• Records of acceptance of our terms — legitimate interest in proving the agreement (Art. 6(1)(f)).

• Cookieless visit statistics on our own servers (page, country, device type; no IP stored) — legitimate interest in running and improving the site (Art. 6(1)(f)).

• Google Analytics cookies and the newsletter — your consent (Art. 6(1)(a)), which you can withdraw at any time.

• Accounting and tax records (where a transaction with us arises) — legal obligation (Art. 6(1)(c)).

4. Data Sharing

We share limited data with: counterparties in transactions (buyer↔supplier company details), service providers (Supabase for database hosting, Vercel for website hosting and cookieless visit statistics, Resend for email, Anthropic for automatic classification of message text, Telegram for internal notifications, and Google Analytics only if you accept analytics cookies), and legal authorities when required by law.

4.2 B2B sourcing outreach (legitimate interest) Where we contact procurement professionals at organisations whose business activity matches the EU-organic botanical raw materials we broker, we rely on legitimate interest under GDPR Article 6(1)(f). The detailed Legitimate Interest Assessment (purpose, necessity, balancing test, jurisdiction safeguards, recipient rights) is published at /lia. Recipients can object at any time via the one-click List-Unsubscribe header, by replying 'unsubscribe', or by emailing info@tandor.eu — removal is permanent and applied within 24 hours.

4.3 Purchase requests (contact form "I want to buy") We collect your name, e-mail, company, the product you need, quantity and unit, delivery country, required certification and your message — to answer your request and look for suppliers who can meet it. Legal basis: steps taken at your request before entering into a contract (GDPR Art. 6(1)(b)); for the name and e-mail of a company contact person, also our legitimate interest in handling B2B requests (Art. 6(1)(f)). We send the product, quantity, delivery country and certification requirement to suppliers without your name, company or contact details, and share your identity with a supplier only after you agree to an introduction. Processors: Supabase (storage), Resend (e-mail), Anthropic (automatic classification of the request text), Telegram (internal notification with a request reference only — no name, e-mail or message). Anthropic processes the text only to classify the request. It deletes inputs and outputs within 30 days and does not use them to train its models. Retention: 24 months after our last exchange with you, then deleted or anonymised; if an introduction leads to a contract, records are kept as accounting law requires.

4.4 Newsletter If you tick the newsletter box on one of our forms, we store your e-mail address, the form, its version, your language, a keyed hash of your IP address and the time, as proof of your consent (Art. 6(1)(a) GDPR). We use the address only to send the newsletter. You can withdraw at any time with the unsubscribe link in every issue or by writing to info@tandor.eu; withdrawal does not affect earlier sending. We keep the consent record for as long as you are subscribed and for 3 years after you unsubscribe, to be able to prove consent.

4.5 TANDOR Intelligence on Substack If you subscribe on tandorintel.substack.com, Substack Inc. (USA) processes your subscription under its own privacy policy, and we as publisher see your e-mail address in the subscriber list. We use it only for that publication.

4.6 Introduction terms acceptance When you accept our introduction terms (checkbox on an offer page, sign-up or price-list form, or by replying "I agree"), we keep a record (e-mail, time, terms version, a keyed hash of your IP address, browser type) to prove the agreement (Art. 6(1)(f) GDPR). We delete it 3 years after our last introduction for you, unless a dispute is pending.

4.7 Transfers outside the EU/EEA. Our databases are hosted in the EU (Supabase, Stockholm and Frankfurt). Some service providers process data in the United States or elsewhere; for each we rely on a safeguard recognised by the GDPR (Art. 45–46):

• Vercel (website hosting, USA): EU–US Data Privacy Framework certification and the European Commission's Standard Contractual Clauses (SCCs).

• Resend (e-mail delivery): e-mails are sent through Amazon Web Services infrastructure in Ireland (EU); Resend (USA) stores message data in the United States. Safeguard: Standard Contractual Clauses in Resend's data processing agreement (and Resend's EU–US Data Privacy Framework participation).

• Anthropic (automatic classification of request text; Anthropic Ireland Ltd for EEA customers): SCCs in its data processing agreement.

• Google (Google Analytics, only if you accept analytics cookies): EU–US Data Privacy Framework and SCCs.

• Supabase (database provider; data stored in the EU): SCCs for any access from outside the EU.

• Substack (only if you subscribe to TANDOR Intelligence there; Substack acts as its own controller): EU–US Data Privacy Framework.

• Telegram (internal notification to our team): we send only a request reference, not your name, e-mail or message.

You can ask us for a copy of the relevant safeguards at info@tandor.eu.

5. Your Rights (GDPR)

Under GDPR, you have the right to: access your data, rectify inaccurate data, erase your data, restrict processing, data portability, and object to processing. Contact info@tandor.eu to exercise these rights. You also have the right to lodge a complaint with a supervisory authority — in Romania the ANSPDCP (www.dataprotection.ro), or the authority of your EU country of residence.

6. Data Retention

We retain account data for as long as your account is active. Transaction data is retained for 7 years for tax and legal compliance. You can request account deletion at any time.

7. Cookies

We use essential cookies for authentication and session management. Analytics cookies (Google Analytics) are only set with your consent.

Vercel Analytics and Speed Insights do not use cookies. You can withdraw consent at any time via "Cookie settings" in the footer; this deletes the Google Analytics cookies.

8. Contact

Controller. TANDOR, Romania, EU. Contact for any privacy request: info@tandor.eu. We reply within one month (Art. 12(3) GDPR).