GDPR and data protection

Our role

TenderLab One is provided by TenderLab Ltd, a company registered in England and Wales (company number 17184263), 128 City Road, London, EC1V 2NX. Contact: info@tenderlab.co.uk. We follow the UK General Data Protection Regulation and the Data Protection Act 2018.

• TenderLab Ltd is the controller for account details, billing, security logs, support requests and our own emails to you. We decide why and how that information is used, as set out in the privacy policy.
• Your organisation is the controller for the personal information it puts into its workspace about other people, such as staff names, CVs, training records or case studies in evidence files and bid content. For that information TenderLab Ltd acts as a processor: we process it only to provide the service to your organisation and on its instructions.

What we do as your processor

When we process workspace content for your organisation we:

• use it only to provide, secure and support TenderLab One for you, and not for our own purposes;
• make sure our staff with access are bound by confidentiality;
• protect it with appropriate technical and organisational security measures;
• use only the sub-processors listed below, and tell account owners before adding or replacing one so you can object;
• help you respond to requests from individuals and with any security incident, notifying you without undue delay if we become aware of a personal data breach affecting your content;
• delete or return your content when your account closes, unless the law requires us to keep it;
• give you the information you reasonably need to show compliance.

If your organisation needs a signed data processing agreement, email info@tenderlab.co.uk.

What we ask of you

TenderLab One is a tender workspace, not a care record system. Do not upload health or care records about the people you support. Where an example from practice helps a bid, anonymise it first. Only invite people who need access, give them the lowest role that works, and remove them when they leave.

Sub-processors

• Hosting and infrastructure: our virtual private server provider (Africloud), Vercel (web hosting), Neon (database hosting) and Cloudflare (network security and delivery). They store and serve the service and its data.
• Stripe: card payments, subscriptions, invoices and the billing portal. Stripe holds your card details; we never see them.
• Brevo: tender alert and update emails, where you have signed up for them.
• Resend: account emails such as email confirmation, invitations and password resets.
• Microsoft 365: our shared mailbox, used when we email you or you email us.
• Google: Google Drive, where client files for TenderLab bid writing work are kept and shared, our Google Workspace email, and Google sign-in if you choose to use it.
• Anthropic: the AI model behind ScoreKit and the AI assistant, when those features are switched on for your account.
• Calendly: booking consultations and walkthroughs, if you book one.

Companies House and the Care Quality Commission are public registers we read from; they are not sub-processors and do not receive your workspace content.

Where data is processed

Some sub-processors may process data outside the UK, for example in the United States or the European Economic Area. We rely on UK adequacy regulations or the ICO's International Data Transfer Agreement or Addendum as the transfer safeguard. We do not claim that all data stays in the UK.

AI features

ScoreKit and the AI assistant are only used when they are switched on and you ask them to review something. The text you submit is sent to Anthropic to produce the result and is not used to train its models by default under Anthropic's commercial terms. Results are suggestions for a person to review. No decision with legal or similarly significant effects on an individual is made by automated means.

Security and access

Passwords are hashed, connections are encrypted, people only see the workspace of their own organisation, and the owner and admins control each member's role. Sign-ins and important account changes are recorded in a security log. Items deleted in the portal are held in a recycle bin for 60 days and then removed permanently.

Individual rights requests

Anyone can ask us to access, correct, delete, restrict or transfer their personal information, or object to how it is used. Email info@tenderlab.co.uk. We reply within one month. Where the information sits in a client organisation's workspace, we pass the request to that organisation and help it respond.

Incidents and complaints

Report a suspected data incident to info@tenderlab.co.uk straight away, without including more personal information than necessary. We assess every incident, tell affected client organisations without undue delay, and report to the Information Commissioner's Office within 72 hours where the law requires it.

You can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint. We would appreciate the chance to resolve your concern first.

Certifications

This page describes how we handle data. It is not a certification, and TenderLab One does not currently claim Cyber Essentials, ISO 27001 or similar certification.