This document is pending formal legal review and may be updated before general launch.
1. Who we are
TenderLock is operated by Cognivo FZ LLC. For personal data used to run our website, accounts and billing we are the controller. For personal data contained in tenders and bids, we act as a processor for the buyer organisation (see our Data processing terms).
2. What we collect
- Account data: name, email address, job title, phone number and organisation.
- Security data: sign-in times, IP address, approximate location, device and two-factor settings.
- Content: tenders, documents, bids, clarifications, scores and notes added by users.
- Billing data: plan, invoices and payment status. Card details are held by Stripe, not by us.
- Website data: essential cookies, described in our Cookie policy.
3. How we use it and our lawful bases
- To provide the Service: performance of our contract with you or your organisation.
- To secure accounts and keep audit records: our legitimate interests and our customers' legal obligations.
- To send transactional emails: performance of contract.
- To bill and keep financial records: legal obligation.
- To improve the Service: legitimate interests, using aggregated information where possible.
4. AI processing
AI features process tender and bid content only to perform the action a user requested. We do not use Customer Content to train AI models, and our AI providers are contractually prevented from doing so.
5. Sharing
We share personal data only with processors that help us run the Service, including hosting, email delivery (Brevo), payments (Stripe), AI (OpenAI) and company data (Companies House), and where required by law. We do not sell personal data.
6. International transfers
Where data is transferred outside the UK or EEA, we use appropriate safeguards such as the UK International Data Transfer Addendum or Standard Contractual Clauses.
7. Retention
We keep account data while the account is active and for a reasonable period afterwards. Tender records are kept for as long as the buyer organisation needs them to evidence its procurement decisions, in line with its retention settings and legal duties.
8. Your rights
You may request access to, correction of, erasure of, or restriction of your personal data, object to processing, and request portability. Where we are a processor, we will pass your request to the relevant organisation. You can also complain to the Information Commissioner's Office (ico.org.uk).
9. Contact
Contact us about privacy through our contact page.