Privacy Policy
Last updated: 16/06/2026This policy explains what personal data TenderEase Ltd collects, why, how long we keep it, who we share it with, and the rights you have. It is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
TenderEase is a tender-analysis service for businesses. Most of the personal data we handle is the contact details of the people who buy and use the Service. We also process, on our customers’ behalf and under contract, any personal data that happens to sit inside the tender documents they upload. This policy explains both.
If you have any questions, or want to exercise your rights, contact us at support@tenderease.co.uk
1. Who we are
TenderEase Ltd (“TenderEase”, “we”, “us”, “our”) is a company registered in England and Wales.
Company number: 17282896
Registered office: 66 Paul Street, London, England, EC2A 4NA.
Data-protection contact: support@tenderease.co.uk
We are the “controller” of the personal data described in section 4 of this policy. For the personal data inside an uploaded tender pack, we act as a “processor” on behalf of our customer (see section 3).
2. The quick version
• We collect the contact details you give us to quote for and provide the Service.
• We process your uploaded tender documents only to produce your analysis.
• We never use your tender documents or your analysis to train any AI model.
• We host your data in the UK (and the EU). AI analysis is performed by Anthropic and may be processed in the US under appropriate safeguards.
• We keep your tender pack and dashboard for 12 months, then delete them, or sooner if you ask.
• We only send marketing if you opt in, and you can opt out at any time.
• You have rights over your data, and you can complain to the ICO.
The rest of this policy is the detail.
3. Two roles: controller and processor
We handle personal data in two distinct capacities.
3.1As controller. For the personal data of the people who interact with us, your name, work contact details, the calculator submissions you make, your billing details, and your marketing preferences, we decide why and how the data is processed. That data is covered by this policy.
3.2As processor. Tender documents often contain personal data about third parties, for example the names and contact details of a client’s design team, project managers, or supply-chain contacts. When you upload a tender pack, we process that personal data only on your instructions and only to produce your analysis. For that data, you are the controller and we are the processor. The terms of that processing are set out in our Data Processing Agreement (“DPA”), available at [DPA URL], which forms part of our contract with you.
This policy describes how we handle that data in practice, but the DPA is the governing document for our processor obligations.
4. The personal data we collect, and where it comes from
4.1From the price calculator and order form. When you use our calculator and place an order, we collect:
• your name;
• your email address;
• your phone number;
• your company name;
• the project name you give the tender;
• the calculator inputs (number of files, number of pages, your role), and the price we quote;
• optionally, your brand colours and uploaded logo, if you choose to white-label the report;
• optionally, a discount code, if you use one;
• optionally, your marketing opt-in choice.
4.2From payment. Payment is taken by Stripe. Stripe collects your card or payment details directly, and those details never reach our servers. We receive from Stripe confirmation of payment and limited billing information (such as your name, billing address, the amount, and a transaction reference) so we can issue receipts and meet our accounting obligations.
4.3From the tender pack you upload. The documents you upload may contain personal data about third parties. We process that data as processor (see section 3.2) and the DPA.
4.4From your use of the Service. We collect basic technical and usage information when you use the dashboard, for example which sections are viewed, to operate and support the Service.
4.5From our website. We use Plausible Analytics, a cookie-less, privacy-focused analytics tool, to understand aggregate website usage (such as page views and referral sources). Plausible does not use cookies, does not track you across other websites, and does not collect data that identifies you as an individual.
We do not knowingly collect special-category data (such as health, ethnicity or political opinions). Please do not upload tender documents that contain special-category data unless it is genuinely necessary for the tender; if you do, you confirm you have a lawful basis to share it with us as your processor.
5. Why we use your data, and our legal basis
We rely on the following legal bases under UK GDPR Article 6.
5.1 To quote for and provide the Service, including processing your upload, performing the analysis, delivering the dashboard, and providing operational support by email or phone.
Legal basis: performance of a contract with you (and taking steps at your request before entering into a contract).
5.2 To take payment and keep accounting records.
Legal basis: performance of a contract (taking payment) and compliance with a legal obligation (keeping accounting records, and VAT records once we are registered for VAT).
5.3 For account management and customer-care follow-up, for example contacting you by phone or email to check the analysis met your needs, to help you get the most from it, or to discuss repeat or higher-volume use.
Legal basis: our legitimate interests in supporting customers and improving our service. These are service and relationship calls to existing customers, not cold sales calls. Where any call includes promoting other services, we treat it as marketing: we screen the number against the Telephone Preference Service (TPS) register and respect any opt-out. You can ask us to stop contacting you at any time.
5.4 To send you marketing updates about TenderEase, but only if you have opted in.
Legal basis: your consent. Opting in is entirely optional and is never a condition of using a discount code, getting a quote, or any other benefit. You can withdraw consent at any time using the unsubscribe link in every marketing email or by emailing us.
5.5 To operate, secure, support and improve the Service, including using aggregated, non-identifying usage information and cookie-less website analytics.
Legal basis: our legitimate interests in running a secure, reliable and well-understood service. We have balanced these interests against your rights and use the least intrusive data that achieves the purpose.
5.6 To comply with law and to establish, exercise or defend legal claims.
Legal basis: compliance with a legal obligation and our legitimate interests in protecting our rights.
Where we rely on legitimate interests, you have the right to object (see section 11).
6. AI analysis and your tender documents
This section matters, so we have set it out plainly.
6.1 We use third-party large language models (currently Anthropic’s Claude models, accessed through Anthropic’s API) to analyse your tender documents. The contents of your tender pack are sent to Anthropic only as input for that analysis.
6.2 We do not use your tender documents or your analysis outputs to train, fine-tune or improve any AI model, and we do not allow them to be used for that purpose. Anthropic, whose models perform the analysis, states that by default it does not use inputs or outputs from its commercial products (including the Anthropic API) to train its models.
6.3 The analysis is automated, but it does not make decisions that produce legal or similarly significant effects about any individual. It summarises documents; it does not, for example, decide anything about a person’s employment, finances or rights. UK GDPR Article 22 (automated decision-making about individuals) therefore does not apply.
7. Who we share your data with
We do not sell your personal data. We share it only with the service providers (“sub-processors”) we rely on to deliver TenderEase, each of which is bound by contract to protect it and to use it only as needed:
• Anthropic, PBC: provides the AI models that perform the analysis. Processing may take place in the United States under standard contractual clauses (see section 8).
• Amazon Web Services EMEA SARL: provides cloud storage. Storage region: eu-west-2 (London, United Kingdom).
• Fly.io Inc.: provides cloud hosting for the calculator, the analysis engine and the dashboard portal. Region: United Kingdom / European Union.
• Stripe Payments Europe, Ltd: provides payment processing. Stripe is the controller of your payment-card data under its own privacy policy.
• Plausible Insights OÜ: provides cookie-less website analytics. No personal data is collected through this provider.
We may also disclose personal data where required by law, regulation, court order or a competent authority, or to establish, exercise or defend legal claims, or in connection with a sale, merger or reorganisation of our business (in which case we will tell you and the recipient will be bound to protect your data to at least the standard in this policy).
8. International transfers
Your data is stored at rest in the United Kingdom and the European Union.
The AI analysis is performed by Anthropic, whose processing may take place in the United States. Where personal data is transferred outside the UK, we rely on appropriate safeguards, specifically the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the UK Addendum, as incorporated into our agreement with Anthropic. You can ask us for more information about these safeguards using the contact details in section 16.
9. How long we keep your data
Data Retention
Tender pack and dashboard (paid orders)
12 months from the date the dashboard is published, then deleted. Sooner on request.
Uploaded tender pack where payment was not completed
24 hours from upload, then permanently deleted.
Calculator submissions and quote history
24 months from submission.
Billing and accounting records (invoice, amount, any VAT, name, billing address, transaction reference)
6 years from the end of the relevant accounting period (legal obligation: HMRC and Companies Act).
Marketing list (opt-in only)
Until you withdraw consent.
Website analytics (Plausible)
Aggregated and cookie-less; no personal data retained.
You can ask us to delete your tender pack and dashboard at any time before the 12-month window lapses (see section 11). We cannot shorten the 6-year retention of billing records, which is required by law.
10. How we protect your data
We use technical and organisational measures appropriate to the sensitivity of tender information, including:
• encryption of data in transit (TLS);
• encryption of stored data at rest (server-side encryption on AWS S3);
• password-gated access to each dashboard, with one project per link;
• signed-cookie sessions for portal access;
• access controls that limit our sub-processors to the data they need to deliver their part of the Service;
• automatic deletion of unpaid uploads after 24 hours.
No system can be guaranteed perfectly secure, but we take these measures seriously and review them as the Service grows. We do not currently hold formal certifications such as ISO 27001 or SOC 2; if that changes we will update this policy.
11. Your rights
Under UK data protection law you have the right to:
• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased (subject to legal retention obligations, such as the 6-year billing record);
• restrict or object to our processing, including objecting to processing based on legitimate interests and to any direct marketing;
• data portability, where processing is based on consent or contract and carried out by automated means;
• withdraw consent at any time, where we rely on consent (this does not affect processing already carried out).
To exercise any of these rights, email support@tenderease.co.uk. For tender-pack contents where we act as processor, we will act on your instructions as controller and, where a request relates to your own client’s or supply chain’s data, direct it to you.
We will respond within one month. To protect your data we may need to verify your identity, usually by confirming you control the email address used to place the order.
There is no charge for exercising your rights unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to act, and will explain why.
12. Cookies and analytics
12.1 Our website uses Plausible Analytics, which is cookie-less and does not track you across websites. It does not set advertising or tracking cookies.
12.2 The dashboard portal uses a single, strictly necessary session cookie to keep you signed in to your password-gated dashboard. This cookie is essential to the Service and is not used for analytics or marketing.
12.3 Because we use only a strictly necessary session cookie and cookie-less analytics, we do not show a cookie consent banner. If we ever introduce non-essential cookies, we will ask for your consent first.
13. Children
TenderEase is a business service and is not directed at children. We do not knowingly collect personal data relating to children.
14. Changes to this policy
We may update this policy from time to time, for example if we add a sub-processor, change a retention period, or launch new features such as subscription plans. The current version is always on our website with a “last updated” date. If we make a material change, we will take reasonable steps to tell affected customers, for example by email.
15. How to complain
If you have a concern about how we handle your personal data, please contact us first at [DATA PROTECTION EMAIL] so we can try to put it right.
You also have the right to complain to the UK supervisory authority:
Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
16. Contact us
Data-protection enquiries: support@tenderease.co.uk
General enquiries: sales@tenderease.co.uk
Post: TenderEase Ltd, [REGISTERED ADDRESS]
End of Privacy Policy