Who we are
TenderFlow is run by ESC Support Ltd (registered in England and Wales, company number 16718827, registered office 02 Honey Street, Manchester, England, M8 8RG), which is the controller of your personal data. For any privacy question or request, email support@escsupportltd.co.uk.
What we collect and why
| Data | Why we use it | Lawful basis |
|---|---|---|
| Your email address and password (stored only as a secure hash) | To create your account, sign you in, verify your address and send password resets | Contract |
| Your alert preferences: industries, delivery regions, keywords, value range, time zone and delivery times | To match opportunities to you and send the alerts you ask for | Contract |
| Tenders you save, bid stages, notes and deadlines, and companies you track | To provide your bid tracker and company monitoring | Contract |
| Copies of the alert emails we send you and their delivery status | To avoid sending the same opportunity twice and to fix delivery problems | Contract |
| Subscription details: your Stripe customer reference, plan status, renewal date and any promo code you redeem | To give Pro subscribers access and manage billing | Contract |
| Payment records and invoices | To keep accounting and tax records | Legal obligation |
| What you send through our contact form: name, email, phone, company and message | To answer your enquiry | Legitimate interests |
| Your IP address, browser details and the pages you request, in server logs; a one-way hash of your IP address for rate limits | To keep the service secure, stop abuse such as repeated sign-in attempts, and fix faults | Legitimate interests |
We do not see or store your card details. You enter them directly with Stripe, our payment provider.
We do not use your data for advertising, sell it, or make decisions about you that have legal or similarly significant effects using automated processing alone. Matching opportunities to your preferences is automated, but it only decides which tenders to show or send you.
Information in tender notices
TenderFlow republishes procurement notices from official UK public sources such as Find a Tender. Some notices include the names or contact details of public-sector officials, or the names of suppliers who are individuals, as published by the buying organisation. We keep the notices as published so the information stays accurate and traceable to its source, based on our legitimate interest in providing a complete tender search service. We do not use these details to contact anyone. If you are named in a notice and want to ask about it, email us.
Who we share it with
We use these service providers, who handle personal data only to provide their service to us:
- Hostinger: hosts the server and database that run TenderFlow, and our business email inbox.
- Resend: sends our emails (verification, password reset and alerts). It receives your email address and the content of each email.
- Stripe: takes subscription payments, stores your card details and provides invoices and the billing portal. Stripe is also responsible for some payment data in its own right, for example for fraud prevention and financial regulation. See Stripe's privacy policy.
We may also share data where the law requires it, for example with HMRC or in response to a valid legal request.
International transfers
Some of these providers process data outside the UK, including in the United States. Where they do, the transfer is covered by UK adequacy regulations (such as the UK Extension to the EU-US Data Privacy Framework) or by contractual safeguards approved under UK law, such as the International Data Transfer Addendum.
How long we keep it
- Contact form messages: up to 2 years after we last reply, then deleted from our inbox.
- Account data (email, preferences, saved tenders, tracked companies, sent alert copies): until you delete your account. Deleting it removes this data straight away.
- Backups: our daily database backups are deleted after 30 days, so deleted data is gone from backups within 30 days.
- Payment records and invoices: 6 years from the end of the financial year they relate to, as UK tax law requires. Stripe holds these on our behalf.
- Server logs: overwritten automatically as new entries are written, normally within a few weeks.
- Rate-limit records (hashed IP addresses): deleted within a day of expiring.
Cookies
We use only cookies that are strictly necessary for the site to work: a session cookie that keeps you signed in, and a security cookie that protects forms against cross-site request forgery. We do not use analytics, advertising or tracking cookies, so we do not ask for cookie consent. Stripe sets its own cookies on its checkout and billing pages to process payments and prevent fraud.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of your personal data;
- correct data that is wrong or incomplete;
- delete your data;
- restrict how we use it, or object to our use of it where we rely on legitimate interests;
- give you the data you provided in a portable format.
You can update your preferences, unsubscribe from alerts or delete your account yourself at any time from your preferences. For anything else, email support@escsupportltd.co.uk. We will reply within one month. These requests are free.
Complaints
If you are unhappy with how we handle your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.
Children
TenderFlow is a business service and is not intended for anyone under 18.
Changes to this notice
If we change how we use your personal data, we will update this page and its date. If a change significantly affects you, we will also email account holders before it takes effect.