Data processing addendum
Last updated: 19 October 2026
This data processing addendum forms part of the terms between Alex Quinney, trading as BidTrowel ("we"), and a customer using the bid drafting service ("you"). It applies where documents you upload contain personal data, for example staff CVs or names in past bids.
1. Roles
You are the controller of personal data in documents you upload. We process it as your processor, only to provide the drafting service and on your documented instructions (these terms and your use of the service).
2. Our commitments
- Process the data only to provide the service, and tell you if we believe an instruction breaks data protection law.
- Make sure staff with access are bound by confidentiality.
- Keep it secure: encryption in transit, access limited to your workspace, and backups protected.
- Use only the sub-processors listed below, tell you before adding one, and let you object.
- Help you respond to requests from people exercising their rights, and with data protection impact assessments where needed.
- Tell you without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting your data.
- Delete your documents within 30 days when you remove them or close your account, unless the law requires us to keep them.
- Make available the information needed to show we meet these commitments.
3. Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Render | Hosting the drafting app and stored documents | EU (Frankfurt) |
| Anthropic | AI model that drafts answers from the passages relevant to each question | USA (UK International Data Transfer Addendum) |
Anthropic's commercial terms do not allow it to train models on customer content.