PAP — Privacy Notice
Effective date: 31 August 2026 Last updated: 31 August 2026
1. Who is responsible for your personal data
The data controller is Tetiana Nosenko, who provides services under the name PAP — Proposal Audit & Pre-evaluation (“PAP”).
For privacy questions or to exercise your rights, contact:
PAP operates from Ukraine. This Notice applies to personal data processed through papaudit.com, the initial intake form, email communications, and the delivery of PAP‑1, PAP‑2, and PAP‑3 services.
2. Personal data we may process
Depending on how you interact with PAP, we may process the following categories:
- Contact data: name, professional email address, telephone number, or another contact method you provide.
- Professional and organisational data: job title, project role, organisation, country, and membership of a project team or consortium.
- Initial enquiry data: funding programme or call, deadline, proposal stage, requested service, and description of your needs.
- Assignment materials: concept note, proposal, work plan, budget, annexes, evaluator comments, earlier versions, and other documents agreed for the audit.
- Contractual and administrative data: confirmed scope, timelines, correspondence, payment and accounting information where needed to arrange the service.
- Technical data: IP address, browser or device type, request date and time, security logs, and other technical information that hosting and form providers may process automatically.
We obtain data directly from you, from a person or organisation you have authorised, and automatically through the website’s technical infrastructure.
If you provide PAP with personal data about team members, partners, or other people, you must have an appropriate basis for doing so and provide them with the necessary information about the processing.
3. Data you should not send
Do not upload the full proposal or other confidential documents through the initial intake form. PAP first screens the request and agrees the scope, confidentiality terms, an NDA where required, and the secure file-transfer method.
Unless specifically requested in writing, do not send:
- passport details, national identification numbers, or copies of identity documents;
- private bank details of individuals;
- health, biometric, political, religious, or other special-category personal data;
- personal data relating to children;
- full CVs where shortened professional information is sufficient;
- personal contact details of third parties that are unnecessary for the proposal review.
Before transferring materials, remove or replace unnecessary personal data where they do not affect the evaluation of the proposal.
4. Why we process data and our legal bases
| Purpose | Typical legal basis |
|---|---|
| Reviewing an initial enquiry and determining the appropriate service, timeline, and fee | Steps taken at your request before entering into a contract |
| Checking competence, availability, and a potential conflict of interest | Pre-contractual steps; PAP’s legitimate interest in accepting only suitable assignments |
| Delivering PAP‑1, PAP‑2, or PAP‑3 and preparing and explaining the report | Performance of a contract or agreed assignment |
| Communicating, arranging file transfer, and supporting the client | Pre-contractual steps and performance of a contract |
| Protecting systems, preventing misuse, and investigating incidents | Legitimate interest in service security and integrity |
| Accounting and compliance with tax or other mandatory requirements | Compliance with a legal obligation |
| Establishing, exercising, or defending legal claims | Legitimate interests and applicable legal grounds |
| Publishing a testimonial or case study, or using materials for research, testing, or marketing | Separate, voluntary, informed consent or a separate written agreement only |
PAP does not use contact details for unsolicited mass marketing and does not sell personal data.
Contact details and minimum enquiry information are necessary for PAP to consider a request. You are not legally required to provide them, but without them we may be unable to respond or provide the service.
5. Confidential materials and secondary use
Proposal materials are used only for the agreed audit and related professional communications.
PAP does not use a proposal, its excerpts, audit findings, or team data for:
- publication as a case study or example;
- marketing;
- training or testing its methodology on external materials;
- scientific research;
- benchmarking or dataset creation;
- training public general-purpose AI models,
unless the client has given separate, voluntary, written consent or the use is governed by a separate agreement. Refusing such consent does not affect access to the audit service.
Anonymised quality indicators may be retained for internal quality control only under agreed rules. Confidential proposal text is not included in such material without a separate agreement.
6. Use of artificial intelligence
PAP may use approved AI tools for technical version comparison, structured checks, table construction, and the detection of possible inconsistencies.
AI does not make the final decision on:
- accepting or declining an assignment;
- the materiality of a weakness;
- proposal-readiness conclusions;
- repair priorities;
- the content of the final report.
All material findings are reviewed by a human expert. PAP does not carry out solely automated decision-making or profiling that produces legal or similarly significant effects on a person.
Confidential materials are not entered into unapproved public AI services. Where an external AI provider is used for an assignment, PAP uses only an agreed environment and settings under which client materials are not used to train public general-purpose models, unless the client has explicitly and separately agreed otherwise.
7. Who may receive the data
Access may be provided only to the extent necessary for the relevant purpose:
- Tetiana Nosenko as the individual providing PAP services;
- a separately engaged subject-matter expert where their involvement is necessary, agreed with the client, and protected by a confidentiality obligation;
- providers of website hosting, forms, email, cloud storage, communications, and approved AI tools;
- professional advisers where necessary for a legal, tax, or security matter;
- public authorities or other recipients where disclosure is required by law.
As of the date of this Notice, PAP uses or may use OpenAI services for website hosting and agreed AI-assisted processes, and Google services for the initial form, email, and material storage. Each provider processes data under its applicable terms and privacy documentation.
PAP does not disclose materials to the applicant’s potential competitors, other applicants, call evaluators, or external organisations for their own purposes.
8. Retention and deletion
PAP applies the following standard periods unless a different period is agreed in writing or required by law:
| Category | Standard period |
|---|---|
| Initial enquiries that do not become assignments | 90 days after the last substantive contact |
| Full proposal, annexes, earlier versions, and working copies | Active copies deleted within 30 days after completion of the assignment |
| Residual copies in provider backups or deletion queues | Up to 90 days after deletion of the active copy where immediate removal is not technically possible |
| Final report, scope confirmation, material correspondence, and records needed to handle claims | 3 years after completion of the assignment |
| Payment, tax, and other mandatory records | For the period required by applicable law |
| Data processed on the basis of separate consent | Until consent is withdrawn or the stated purpose ends, whichever occurs first |
For PAP‑3, completion means delivery of the final consolidated report after the re-audit, unless another completion date is agreed in writing.
Where data are required to comply with a legal obligation, investigate an incident, or defend a legal claim, the relevant data may be retained longer only to the necessary extent.
9. International data transfers
PAP operates from Ukraine, while some digital service providers may process data in the European Economic Area, the United States, or other countries.
Where applicable law requires specific safeguards for an international transfer, PAP uses the contractual or other legal mechanism available for the relevant provider and processing operation. Information about applicable safeguards may be requested at contact@papaudit.com.
Do not transfer confidential materials until the agreed channel and processing conditions have been confirmed.
10. Security
PAP applies organisational and technical measures proportionate to the nature of the materials, including access controls, separation of initial intake from confidential file transfer, audit-version locking, use of agreed service providers, confidentiality commitments, and deletion controls.
No electronic transmission or storage method can guarantee absolute security. If an incident occurs, PAP will act in accordance with applicable law and notify affected individuals where notification is required.
11. Your rights
Depending on the applicable law, you may have the right to:
- receive information about the processing and access your personal data;
- correct inaccurate or complete incomplete data;
- request erasure;
- request restriction of processing;
- object to processing based on legitimate interests;
- receive data you provided in a structured, machine-readable format where the right to portability applies;
- withdraw consent without affecting the lawfulness of earlier processing;
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects;
- lodge a complaint with a competent data-protection authority.
To exercise your rights, email contact@papaudit.com. PAP may request only the additional information necessary to verify your identity and protect other people’s data.
In Ukraine, personal-data matters fall within the competence of the Ukrainian Parliament Commissioner for Human Rights. Where the GDPR applies, you may also complain to the supervisory authority in the EU or EEA country where you live, work, or believe an infringement occurred.
12. Cookies, technical logs, and external services
As of the date of this Notice, PAP does not use its own advertising cookies, advertising pixels, profiling system, or marketing analytics tools.
The hosting provider may process necessary technical logs or use strictly necessary local storage to operate and protect the website. When you follow a link to Google Forms, LinkedIn, or another external service, that service processes data under its own privacy documentation and settings.
If PAP later introduces optional analytics, advertising technology, or other non-essential cookies, this Notice will be updated and a consent mechanism will be added where required.
13. Children’s data
PAP services are intended for adult representatives of applicants and project teams. PAP does not knowingly collect children’s personal data through the website or initial form. If such data have been submitted accidentally, contact us so that they can be deleted.
14. Changes to this Notice
PAP may update this Notice when its services, providers, technologies, or legal requirements change. The last-updated date will always appear on this page. Where a material change affects an active assignment, PAP will notify the relevant client directly where necessary.
15. Contact
Send privacy questions, rights requests, or reports of a possible incident to: