RU EN
www.
Technical audit · 16.06.2026

tenderned.nl

Dutch public procurement tendering platform
NL

Tenderned.nl is the official Dutch platform for public tenders: publication of government procurement and submission of bids for state contracts. Homepage scan: 36 requests, 3 domains. The configuration is exemplary. The platform runs its web statistics on its own Matomo engine, deployed on government infrastructure, and not a single cookie was set during the session. Additionally, a functional help chatbot runs. The scan shows no Google Analytics, no Facebook, no advertising, no session recording, and no third-party commercial trackers. No violations were recorded.

Request timeline

533 ms · own Matomo statistics
The site's own Matomo statistics engine loads, deployed on government infrastructure. No cookie is set in the process.
564 ms · help chatbot
The help-chatbot launcher loads — a functional tool for visitor questions.
1067 ms · chat operator availability check
The chatbot checks operator availability. This is functional preparation of the support tool.
cookieless statistics, no consent required
The statistics are deployed on the site's own infrastructure, and not a single cookie was set during the session. This is consistent with an anonymized mode exempt from consent.

Declared versus actual

✓ Matomo (statistics) — declared
✓ Chatbot — declared

Detected trackers

Context

www.tenderned.nl is the official Dutch public tendering platform (TenderNed): publication of government procurement, tender search, and submission of bids for state contracts. The data controller is the platform’s government operator. The site is service-oriented.

Scan: 36 requests to 3 domains, homepage, captured in a clean Edge browser without a VPN or ad blocker. The technical stack is minimal.

Who receives the data

There are no third-party commercial recipients.

The platform runs its web statistics on its own Matomo engine, deployed on government infrastructure. Additionally, a functional help chatbot runs. The scan shows no Google Analytics, no advertising networks, no social media pixels, and no session recording.

A full banner for the statistics is not required here: it is deployed on the site’s own infrastructure, and not a single cookie was set during the session. This is consistent with an anonymized mode exempt from consent. The chatbot is a functional help tool.

It’s worth separately noting a good practice: screen sharing with a support operator, per policy, is only enabled with the user’s explicit permission during a call, rather than loading on the page by default.

Only in-house statistics and a functional chatbot. Before any interaction, the in-house statistics engine on government infrastructure and the help chatbot with an operator availability check load. The scan contains no Google analytics, no advertising domains, no social plugins, and no session recording.

Conclusion

Tenderned.nl is a model of a restrained configuration for a government procurement platform. Web statistics run on the site’s own engine on government infrastructure and without cookies, and aside from that, only a functional help chatbot runs. There is no third-party advertising, no Google analytics, no social media pixels, and no session recording whatsoever. It’s also worth noting that screen sharing is only enabled with explicit permission during a support call. The key takeaway for the reader: a government procurement platform can manage with its own statistics on its own infrastructure, and here that is achieved without a single third-party commercial tracker and without a single cookie. No violations were recorded.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: nl/tenderned-nl-2026-06-16.har
SHA-256: 158649c12e46d37767f9c070ab1f5246b1152132f51725c7e95208f5094ffe9a
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — tenderned.nl

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website tenderned.nl.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date.

2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/nl-tenderned-nl/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]