Privacy Policy

1. Controller and contact

The data controller is Rhics Ltd, registered in England and Wales, with registered office at 150 City Road, London EC1V 2NX. For any privacy matter, or to make a request under UK GDPR, please write to laura@contracttenders.com.

2. Personal data we collect

Depending on your interaction with us, we may collect:

• Account data: name, work email address, workspace name, role, language preference, hashed password or single sign-on identifier.
• Organisation profile data: company details you enter to personalise the Service (for example experience, sectors, references).
• Uploaded content: knowledge base documents, tender responses, proposal drafts, CVs, and other files you upload to your Workspace, which may contain personal data of your staff, associates, or contacts.
• Usage data: pages viewed, features used, errors, timestamps, device type, browser, operating system, and IP address (typically truncated).
• Communications: messages you send us, support tickets, feedback.
• Payment data: billing name and address, VAT number, transaction identifiers. Card numbers are handled by our payment processor and never stored by us.

3. Where we collect data from

• Directly from you when you register, upload content, subscribe, or contact us.
• From cookies and similar technologies (see our Cookie Policy).
• From authentication providers if you use single sign-on.
• From public procurement portals and open-data sources when producing intelligence about opportunities you research (this may occasionally include contact points named in published notices).

4. Purposes and lawful bases

5. How we use AI and LLMs on your data

The Service uses large language models to summarise, classify, extract, score, and draft content based on your Workspace data. We route these calls through vetted enterprise gateways whose contractual terms prohibit the use of your inputs and outputs to train their foundation models. Prompts and outputs may be transiently processed on the model provider's infrastructure, in most cases in the EU or the United Kingdom, for the sole purpose of returning the response. See our Use of AI and LLMs policy and our Sub-processors list.

6. Sharing your data

We share personal data only with:

• Our staff and contractors on a need-to-know basis under confidentiality obligations.
• Sub-processors that host, run, or secure the Service, listed on our Sub-processors page. All are engaged under written data processing agreements that impose UK GDPR Article 28 obligations.
• Professional advisers such as auditors and lawyers, under duties of confidence.
• Competent authorities where we are legally required to disclose.
• An acquirer or successor in the event of a merger, acquisition, or reorganisation, subject to equivalent protections.

We do not sell personal data.

7. International transfers

We aim to store customer data primarily in the United Kingdom or European Economic Area. Where any transfer outside the UK is necessary (for example to a support engineer or a model provider region), we rely on adequacy decisions where available, or on the UK International Data Transfer Agreement or the EU Standard Contractual Clauses supplemented by the UK Addendum, together with a transfer risk assessment and appropriate technical measures such as encryption.

8. Retention

We retain personal data only for as long as necessary for the purposes above. Typical retention periods:

• Account and Workspace data: for the duration of your Subscription and 30 days after termination, then deleted or anonymised.
• Uploaded content and Outputs: as configured by you in your Workspace, and otherwise for the duration of your Subscription plus 30 days.
• Billing and tax records: 6 years, to meet HMRC record-keeping obligations.
• Security logs: up to 24 months.
• Marketing contacts: until opt-out, or 24 months of inactivity, whichever comes first.

9. Security

We apply organisational and technical measures appropriate to the risk, including tenant isolation with row-level security, encryption in transit (TLS 1.2+) and at rest (AES-256), multi-factor authentication on privileged actions, least-privilege access, vulnerability scanning, and continuous monitoring. See our Security page for further detail.

10. Your rights

Under UK GDPR you have the right to:

• Access your personal data.
• Have inaccurate data corrected.
• Have your data erased in certain circumstances.
• Restrict or object to processing based on legitimate interests.
• Data portability where processing is by automated means and based on contract or consent.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk.

To exercise a right, write to laura@contracttenders.com. We will respond within one month, extendable by up to two months for complex requests.

11. Automated decision-making

Certain features of the Service include automated scoring or ranking of opportunities. These scores are decision-support signals only and do not produce a legal or similarly significant effect on any data subject within the meaning of Article 22 UK GDPR. A human user in your organisation makes the final decision on any bid or submission.

12. Children

The Service is not intended for individuals under 18 and we do not knowingly collect their personal data.

13. Changes to this policy

We will publish any updates on this page and, where the change is material, notify affected users by email or in-product notification.

Questions about this document? Please write to laura@contracttenders.com. Contract Tenders is a service of Rhics Ltd, 150 City Road, London EC1V 2NX, United Kingdom.