Last updated: 25 February 2026
Duke is operated by Victoria SRL, a Belgian company. We provide a public procurement intelligence platform for B2G companies. For privacy matters: privacy@duke.yt
Account data. When you create an account we store your email, name, and organisation. Legal basis: contract (Art. 6(1)(b) GDPR).
Usage analytics. With your consent we use Google Analytics 4 to measure how pages are used (pages viewed, session duration). Only anonymised, aggregated data is shared with Google — see section 3 for the full technical detail. Legal basis: consent (Art. 6(1)(a) GDPR).
Procurement data. We process publicly available tender notices from government portals. This data does not contain personal information beyond what is published by contracting authorities.
We use Google Analytics 4 with Google Consent Mode v2. When you decline analytics, all storage signals default to denied: no cookies are set and no persistent identifier is stored. Google Consent Mode v2 still sends a single anonymous technical signal (page URL, browser language, screen size) to Google for aggregate modeling — this signal contains no cookies and no persistent identifier, and cannot be used to identify you. Full usage analytics — session tracking, page views — only begin after you click "accept analytics". We do not use advertising cookies or cookie walls.
Your choice is stored in your browser for 365 days under the key duke_consent_v1. You can clear it at any time from your browser's localStorage.
We use the following third-party services, all contracted under GDPR-compliant Data Processing Agreements:
| Sub-processor | Purpose | Location |
|---|---|---|
| Google Cloud Platform | Infrastructure, database hosting | EU (Belgium) |
| Firebase / Identity Platform | Authentication | EU |
| Google Analytics 4 | Usage analytics (consent-gated) | EU / US (SCC) |
| Google Vertex AI | AI-powered CPV classification | EU |
| Anthropic (via Vertex) | AI document analysis | EU |
Under the GDPR you have the right to access, correct, or erase your personal data; to restrict or object to processing; and to data portability. Email privacy@duke.yt — we respond within 30 days.
You may also lodge a complaint with the Belgian Data Protection Authority (APD/GBA) at dataprotectionauthority.be.
Account data: duration of subscription plus 2 years. Analytics: 14 months (GA4 default). Procurement notice data: indefinitely (public record).
All primary infrastructure runs in the EU (GCP europe-west1, Belgium). Google Analytics may transfer anonymised, aggregated data to the US under Google's Standard Contractual Clauses.
We will update this page when our data practices change and notify active users by email for material changes.