Privacy notice

This site is run by Federico Giudici, a private individual established in France, who is the controller of the personal data described here. It is a personal project, not a company or a public body.

For anything about your data, write to feedback@fgiudici.com. That address reaches Federico directly.

• No advertising, no tracking cookies, no profiles, no data sold or shared for marketing.
• No cookie banner, because the site stores nothing on your device unless you ask it to — the one exception is the light/dark setting, and only if you choose one.
• Visitors do not have accounts. Only a handful of staff accounts exist, created by hand.
• The site’s own code never stores your IP address.
• The procurement records behind the prices name the companies — and sometimes the individual traders — that won public contracts. Those names come from official public registers. See People named in procurement records.

• Page-view statistics (Vercel Web Analytics). Counts of which pages are visited, from which country and on what kind of device, reported in aggregate. No cookie is set and no identifier is stored on your device. Collection began on 14 September 2026.
• Speed measurements (Vercel Speed Insights). How fast pages load and respond (Core Web Vitals), with the type of page — for example “an item page”, not which item. No cookie, nothing stored on your device. Collection began on 17 September 2026.
• Delivering the page. Like every website, the hosting provider has to process your IP address and browser details to send you the page. This site’s own code does not store your IP address anywhere: there is no IP field in its database.
• Language. On your first visit the site picks English or Spanish from the language your browser announces. Nothing is stored; the language is then part of the page address.
• Light or dark theme. If you use the theme switch, your choice is saved in your own browser (local storage, key pbw-theme) so the next page opens the same way. It never leaves your device and is never sent to the site. If you never touch the switch, nothing is saved. You can clear it at any time by clearing this site’s data in your browser.

• Email. Messages to feedback@fgiudici.com are forwarded to Federico’s own mailbox. We see what any email carries: your address, your name if your mail program sends it, and what you wrote.
• The feedback form is a Google Form. It does not collect your email address or require a Google account; it records only what you type, including an email address if you choose to give one. Google processes the answers on our behalf.

The review and market-research areas need a sign-in. There is no public sign-up: accounts are created by hand for the few people who review data. For those people the site keeps an email address, an optional name, a role, and a password stored only as a salted hash. It also keeps a record of each sign-in session (a hash of the session token, when it was created and last used) and an audit log of the review actions each account takes, because every published figure must be traceable to who approved it.

Signing in sets one cookie, pbw_session. It is strictly necessary for the sign-in to work, cannot be read by page scripts, is sent only over HTTPS, and expires after 7 days. Public visitors never receive it.

To slow down password guessing, the number of sign-in attempts is counted for a few minutes, in memory only, and never written to the database.

Every price on this site comes from contract records that government procurement authorities publish as open data (the full list is on the methodology page). Those records name the buying organisation and the supplier that won each award. Most suppliers are companies, but some are individuals trading under their own name, and their name is personal data.

We keep the supplier name with each record because it is part of the audit trail: it lets anyone trace a price back to the exact award it came from. The site does not currently display supplier names, and no figure is calculated from them.

We did not collect these names from the people concerned, and the records carry no contact details, so writing to each person individually is not possible. As the GDPR allows in that case (Article 14(5)(b)), this page is how we tell them instead.

If you are named in a record and object, write to feedback@fgiudici.com. Removing a supplier name changes no published price, because benchmarks are grouped by item, currency and tax basis, never by supplier.

Some features use an AI model to translate item descriptions or check unusual prices. What is sent is the item description and price data, not supplier names.

The legal basis for everything on this page is legitimate interest (GDPR Article 6(1)(f)). Nothing here relies on consent, and nothing here is a contract with you.

• Procurement records: the interest is public price transparency — helping buyers and citizens see what the public sector pays. The names are already published by the state registers they come from, are limited to business activity, and are not shown on this site. Keeping them adds no new exposure, while removing them would break the link between a price and its source. Anyone who objects can have their name removed at no cost to the figures.
• Statistics and speed measurements: knowing which pages are used and whether they work, collected without cookies or identifiers.
• Feedback: reading and answering what you send.
• Staff accounts: keeping the review area secure and every approval accountable.

These providers process data on our behalf, only for the purpose given:

• Vercel — hosts the site and provides the page-view statistics and speed measurements.
• Neon — hosts the database (procurement records, staff accounts, audit log).
• GitHub — runs the monthly job that downloads and processes the procurement records.
• Google — hosts the feedback form and its answers.
• Porkbun — forwards email sent to the feedback address.
• Anthropic — provides the AI model described above; it receives item descriptions and prices, not personal data.

Several of these companies are based in the United States, so data may be processed there. Those transfers rely on the safeguards each provider offers under the GDPR, such as the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

• Procurement records, supplier names included: for as long as the benchmark data set exists, or until a name is removed on request.
• Page-view statistics and speed measurements: for the period Vercel’s service keeps them; they contain no identifier that links them to you.
• Feedback email and form answers: for as long as they are useful to follow up on what you reported, and deleted on request.
• Staff accounts, their session records and their audit log: while the account exists. The sign-in cookie itself expires after 7 days.
• The theme setting: in your browser until you clear it.

You can ask to see the personal data we hold about you, have it corrected or erased, restrict its use, or object to it being processed. Because everything here rests on legitimate interest, you can object at any time, and for supplier names an objection is simply honoured.

Write to feedback@fgiudici.com. We reply within one month. We may ask for enough information to find the record — for a supplier name, the country and the contract or award concerned.

If you think your data is being handled unlawfully, you can complain to the French data protection authority, the CNIL, or to the authority in the EU country where you live or work. We would appreciate the chance to put it right first, at feedback@fgiudici.com.