Data processing information

Roles

For workspace content you are the controller and BidServe is the processor, acting on your documented instructions. For account, billing and marketing data BidServe is the controller.

Subject matter and duration

Processing runs for the duration of the subscription plus any agreed retention period, and covers tender discovery, assessment, bid preparation, notification and reporting.

Categories of data subject

• Your users and administrators
• Individuals named in uploaded evidence, such as staff CVs and references
• Buyer contacts published in tender notices

Security measures

• Authentication with optional multifactor, and role-based access control
• Row level security so tenants cannot read each other's records
• Encryption in transit, and at rest where the platform supports it
• Signed, time-limited document URLs and malware scanning on upload
• Rate limiting, input validation, session management and login history
• Audit logging, incident logging, backup and recovery procedures

Sub-processors

Hosting, database, storage, email, messaging, payment and AI processing providers are engaged under written terms. A current list is available on request, and we give notice of material changes.

International transfers

Where data leaves the UK or EEA, transfers rely on adequacy regulations or approved safeguards such as standard contractual clauses.

Assistance and deletion

We assist with data subject requests, impact assessments and audits, and on termination we export or delete workspace data according to your configured retention policy.