Privacy notice
Last updated: 19 October 2026
This notice explains how [COMPANY NAME] Ltd ("we") uses personal data. We are the controller of the data described here. ICO registration: [ICO REGISTRATION NUMBER]. Contact: [email protected], [REGISTERED OFFICE ADDRESS].
1. Customers and people who sign up
| What we collect | Why | Lawful basis |
|---|---|---|
| Work email, company name, trades, areas, largest contract size and whether you want product news | To set up your account and send the alerts you ask for | Contract (or steps before a contract) |
| Documents you upload and drafts we produce | To draft bid answers for you | Contract |
| Billing details (handled by our payment provider; we do not see full card numbers) | To take payment | Contract; legal obligation for tax records |
| How you use the service, device and log data | To keep the service secure, fix problems and improve it | Legitimate interests |
| Product news and tips | Marketing, only if you opt in (or, for limited companies, under business marketing rules with an easy opt-out) | Consent, or legitimate interests |
2. People named in public procurement data
Our public pages are built from official notices published on Find a Tender and Contracts Finder. These mainly contain information about organisations. We take out email addresses, phone numbers and named contacts found in notices before we display them, and link to the official notice instead. Suppliers without a Companies House number, who may be individuals, are shown as "a small supplier" rather than by name.
Where some personal data remains (for example, a company name that includes a person's name), we rely on legitimate interests: helping businesses find public contracts, using information the public sector has chosen to publish. You can object at any time by emailing us; we will remove or anonymise the item unless the law requires otherwise.
3. Business contacts we email
We may email named contacts at limited companies and LLPs that have won public contracts in the trades we serve, using details from public sources (the contract award notices themselves and the company's own website), to tell them about BidTrowel. We never buy email lists. We do this under legitimate interests and UK rules on business-to-business marketing. Every email says who we are and includes a one-click way to opt out, which we honour permanently. We do not send marketing emails to sole traders or individuals without their consent.
4. Who we share data with
We use trusted providers to run the service, under contracts that protect your data: Cloudflare (website hosting and sign-up data), Render (the bid drafting app and the documents you upload), Resend (alert and account email delivery), Google Workspace (our own business email, including emails to businesses that have won public contracts), Stripe (payments), Google Fonts (web fonts, which receives your IP address when pages load) and Anthropic (the AI model that writes summaries and drafts). Anthropic's commercial terms do not allow it to train models on our customers' content. We do not sell personal data.
Some providers are based outside the UK. Where data leaves the UK we use UK adequacy decisions or the UK International Data Transfer Agreement or Addendum.
5. How long we keep data
- Account data and documents: while your account is open, then deleted within 90 days of closure (you can export first).
- Billing records: 6 years, for tax.
- Marketing suppression list: kept so we never email someone who opted out.
- Logs: up to 12 months.
6. Your rights
You can ask to see, correct, delete, restrict or move your data, and object to processing based on legitimate interests, including all direct marketing. Email [email protected]. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.
7. Cookies
See our cookies page.