Privacy Policy & UK GDPR Compliance

1. Information We Collect

We collect and process the following categories of personal data:

2. Our Use of Artificial Intelligence (The "Velo" Engine)

Speedy Tender relies on an advanced internal automation component named Velo to scan, summarise, and extract requirements from project files.

• Data Isolation: All data processed by Velo is handled securely via the Firebase Vertex AI integration and remains securely isolated inside our dedicated production infrastructure in London, United Kingdom (europe-west2).
• Strict Training Opt-Out: We have explicitly opted out of large language model learning and feedback loops. Your corporate text, uploaded tender documents, bids, and queries are never used by Google or any third party to train public or foundational artificial intelligence models. Your data belongs exclusively to your organisation.

3. Lawful Bases for Processing

Under Data Protection Law, we only process your account data if we have a valid legal basis to do so:

• Contractual Necessity (Article 6(1)(b)): To create your profile, authenticate your access, host your project data, and deliver the essential bidding tools you subscribe to.
• Legal Obligation (Article 6(1)(c)): To maintain accurate business records, comply with UK corporate tax laws, and handle statutory data requests.
• Legitimate Interests (Article 6(1)(f)): To monitor network security, prevent fraudulent use of our billing systems, track critical application errors, and evaluate high-level user performance metrics.

4. How We Share and Disclose Data

We do not sell, rent, or distribute your personal data to third parties for marketing purposes. We share data only with trusted infrastructure sub-processors essential to delivering the Platform:

• Google Cloud Platform / Firebase: For core database storage (Cloud Firestore), user profile authentication (Firebase Auth), application log management, and isolated file hosting within the UK (London region).
• Stripe, Inc.: For secure, PCI-compliant B2B subscription billing, corporate payment collection, and automated UK VAT invoice generation.

5. Data Minimisation and Deletion

We adhere strictly to the principle of data minimisation:

• Active Subscriptions: Your account profile, subscription records, and uploaded project files are retained for the active duration of your commercial subscription agreement.
• Manual Data Purges: The Platform provides built-in tools allowing your authorised administrative users to manually and instantly purge sensitive project files, document extractions, and tender records from our active storage buckets at any point during your subscription.
• Post-Subscription Retention: If a subscription lapses or is cancelled, all underlying customer profile data, user logs, and associated project assets are permanently and irreversibly deleted exactly one (1) year following the final date of the subscription end-date, unless statutory legal or tax frameworks require a longer structural record.

6. International Data Transfers

All primary data storage, database queries, and AI analysis operations are localised within the United Kingdom (London region). If any technical telemetry or sub-processor data crosses international boundaries into the European Economic Area (EEA) or the United States, such transfers are strictly protected by standard contractual clauses (SCCs) and the UK Extension to the EU-U.S. Data Privacy Framework to guarantee an equivalent level of security.

7. Your Statutory Rights

Under UK and EU Data Protection Law, you possess clear statutory rights regarding your personal data:

• Right of Access: The right to request copies of the personal records we hold about you.
• Right to Rectification: The right to compel us to correct any inaccurate or incomplete profiles.
• Right to Erasure ("Right to be Forgotten"): The right to request that we delete your personal account data under certain legal criteria.
• Right to Restrict Processing: The right to limit how we query your personal records.
• Right to Data Portability: The right to receive a structured, machine-readable export of your personal information.
• Right to Object: The right to oppose processing based entirely on our legitimate corporate interests.

To exercise any of these rights, please contact our data response team at support@speedytender.co.uk. In compliance with updated UK guidelines, we may pause processing timelines to request reasonable verification of your identity before releasing corporate records.

8. Statutory Complaints Procedure

If you have a concern regarding how your information is handled, you have the legal right to submit a formal data protection complaint directly to us. In accordance with the UK Data (Use and Access) Act, we operate an internal dispute procedure:

1. Please submit your complaint in writing to support@speedytender.co.uk.
2. We will officially acknowledge receipt of your complaint within 30 days.
3. We will promptly investigate the matter without undue delay, take appropriate steps to resolve it, keep you informed of our progress, and provide a comprehensive written explanation of our final findings.

If you remain unsatisfied with our internal resolution, you maintain the statutory right to escalate the matter to the national supervisory authority:

• United Kingdom: The Information Commissioner’s Office (ICO) — www.ico.org.uk
• European Union: Your local national Data Protection Authority (DPA).

9. Updates to This Policy

We may update this Privacy Policy occasionally to reflect technical changes in the Velo engine or shifting legislative standards. Any updates will be posted transparently on this page with a revised "Last Updated" date.

10. Contact Us

If you have questions, feedback, or require assistance regarding this policy, please reach out to us at: