Privacy Policy

TenderTracker UK is operated by Simon Carroll and Jake Dickinson, trading in partnership as TenderTracker UK. We are the "data controller" for the personal data described in this policy, which means we decide how and why it is used.

TenderTracker UK is a partnership of the two individuals named above, based in Leicester, England; the partners are jointly the controller. It is not a limited company.

For anything to do with your personal data, including exercising your rights, contact [email protected].

This is version 2.7, effective 5 December 2026. The previous version remains available at /privacy/v2-6.

This policy covers personal data about you as a user or visitor of tendertracker.co.uk.

It does not cover the contract notice data itself. That is published by UK contracting authorities on Find a Tender and Contracts Finder as public information, and can include the names and work contact details of procurement officers. We republish it as provided. If you are named in a published notice and want it changed, the contracting authority that published it is the controller for that data and is the right place to start — but you can also contact us and we will help.

Award notices also name the supplier that won the contract. For a sole trader or a partnership that can be a person’s name, and we show it on the contract and on a supplier page listing their public contracts. We do this in our legitimate interest in making public spending easier to find and follow, using what the government has already published. If you are named as a supplier and want your name removed from TenderTracker, email [email protected] and we will remove it within one month.

Information you give us

• Your name and email address when you register
• Your password, which we store only as a one-way hash and never in readable form
• Your alerts, saved searches, bookmarks and any notes you add
• Anything you send us by email or through the contact form
• Billing details, if you ever choose a paid plan — these go straight to Stripe and we never see or store your card number

Information we collect automatically

• The searches you run and how many results they returned
• Your IP address, used for rate limiting and abuse prevention
• Your browser and device type, and the pages you visit
• Sign-in times, used to show you your own account activity and to spot suspicious access
• How you found us, recorded once when you create an account: the page you signed up from (its address only, not any search you typed), the website that sent you if you arrived directly on the sign-up page, and any campaign tags in the link you followed

Information from third parties

• If you sign in with Google, we receive your name, email address and Google account identifier. We do not receive your Google password and we cannot access anything else in your Google account.

We do not collect special category data (such as health, religion or political opinions), and we ask you not to put any into free-text fields such as bookmark notes.

Under UK GDPR we must have a lawful basis for each purpose. Ours are set out below.

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights, and we have concluded it is not because the processing is limited, expected, and necessary to run a service you chose to use. You can object at any time — see section 10.

Essential cookies keep you signed in, protect forms against cross-site request forgery, and remember display preferences such as list or grid view. These are strictly necessary to provide the service, so they are set without consent and cannot be turned off while you use the site.

Analytics cookies are set by Google Analytics and tell us which pages are used and how people move through the site. These are not set unless you accept them in the cookie banner. If you decline, or ignore the banner, no analytics cookies are set and nothing is sent to Google.

Cookieless analytics. Separately, we run Umami, an open-source analytics tool, on a server we control. It sets no cookies and does not track you across other websites. It records which pages are visited, the referring site, device and browser type, and country, and nothing else: it does not record your clicks, scrolling or what you type, and we do not use session replay or heatmaps. Because no cookies are involved this runs regardless of your cookie choice. If you object to it, contact [email protected] or turn on your browser’s tracking protection or an ad blocker, which will normally stop it.

You can change your choice at any time using the Cookie settings link in the footer. Declining analytics does not reduce your access to any feature.

We do not use advertising cookies, we do not run ad networks, and we do not share analytics data with advertisers.

We do not sell your personal data. We share it only with service providers who process it on our instructions, under a contract that requires them to keep it confidential and secure:

Bid writing support (optional referral). If you use the enquiry form on our tender writing support page, we send your name, company, contact details and the brief you write to Executive Compass, a UK bid writing consultancy, so they can contact you about that support. This happens only when you submit the form and tick the box agreeing to it. Executive Compass handles what you send under its own privacy policy. We keep a copy of the enquiry email so we can track the referral.

We also disclose personal data where we are legally required to — for example in response to a valid court order or a lawful request from a regulator or law enforcement — and where necessary to establish, exercise or defend legal claims.

TenderTracker is currently operated by a partnership of two individuals. We may in future incorporate the business into a company, take on investment, merge with another business, or sell all or part of the business or its assets.

If that happens, personal data held about users would be disclosed to, and transferred to, the prospective or actual buyer or successor as part of the transaction, along with the accounts and data it relates to. We rely on our legitimate interests in being able to sell, restructure or transfer the business as a going concern.

Where that happens:

• Any disclosure to a prospective buyer during due diligence will be the minimum necessary, under a confidentiality agreement, and aggregated or pseudonymised wherever it can be
• The buyer or successor would become the controller of your data and would be bound to handle it in a way that is not materially less protective than this policy
• We will notify you by email, or by a prominent notice in the service, before or as soon as reasonably practicable after the transfer takes effect
• You may object to this processing, or simply delete your account, at any time — before or after a transfer

Some of our providers are based in the United States, as shown in the table in section 6. When personal data is transferred outside the UK, we rely on one of the safeguards permitted by UK data protection law — either a UK adequacy decision for the receiving country, or the UK International Data Transfer Agreement (or the EU Standard Contractual Clauses with the UK Addendum), combined with an assessment of the protections in place.

Our servers, including the database and its backups, are run by Hetzner Online GmbH in Germany. The UK recognises the European Economic Area as providing adequate protection, so no further safeguard is needed for them.

You can ask us for details of the safeguard used for a particular provider by emailing [email protected].

• Account data (name, email, password hash) — for as long as your account exists. When you delete your account, the record is deleted immediately.
• Alerts, saved searches and bookmarks — until you delete them, or until you delete your account, whichever comes first.
• Search history — 90 days, then automatically deleted. It is also deleted when you delete your account.
• Email sending records held by our email provider — in line with that provider’s own retention period, typically a matter of days to weeks.
• Analytics data — retained by Google Analytics for up to 14 months.
• Umami analytics — anonymous page-view counts: they contain no cookies, names, email addresses or anything typed into a form, so they are kept on our analytics server without a fixed deletion date. The session recordings made before 2 November 2026, when we stopped recording, have been deleted.
• Financial records, if you ever make a payment — six years, as required by UK tax law.
• Support correspondence — up to two years after the matter is closed.

Database backups are kept for up to 29 days. Data you delete can remain in a backup for up to 29 days, and is then removed as those backups expire. We do not restore deleted accounts from backup.

Under UK GDPR you have the right to:

• Be informed about how we use your data — this policy
• Access a copy of the personal data we hold about you
• Rectify data that is inaccurate or incomplete
• Erase your data ("the right to be forgotten")
• Restrict how we process your data
• Object to processing based on legitimate interests, including the business-transfer processing in section 7
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time, where we rely on it (analytics cookies)

You can exercise the two most common rights yourself, immediately, from your account settings: Download your data gives you a complete JSON export, and Delete account erases everything.

For anything else, email [email protected]. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, or by calling 0303 123 1113. We would appreciate the chance to resolve it first.

We take appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS with HSTS), passwords stored only as salted one-way hashes, restricted database access, rate limiting and bot protection on public endpoints, and regular dependency and security review.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours of becoming aware of it, and tell you directly without undue delay where the risk is high.

We do not make any decision that produces a legal or similarly significant effect on you by automated means alone. Alert matching and AI contract analysis are automated, but they only surface public information for you to read — they do not decide anything about you.

The service is for business use and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy. Each version has a version number and an effective date, and superseded versions stay available so you can see what changed.

For changes that materially affect how we use your personal data, we will give you at least 30 days’ notice by email to the address on your account, or by a prominent notice in the service, before they take effect.

Privacy questions and rights requests: [email protected].

Anything else: [email protected].