Privacy Notice
How DataScene Tenders collects, uses and protects your personal data.
Last updated: 4 August 2026
1. Who we are
DataScene Tenders ("we", "us", "our") provides a UK public-sector tender intelligence and bid-management service at app.datascene-tenders.co.uk. For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), the data controller is Datascene Limited, registered in England & Wales (company no. 03602993), registered office as shown on its Companies House record.
Questions about this notice or your data can be sent to privacy@datascene-tenders.co.uk.
2. The data we collect
- Account data — name, work email, password (stored only as a hash), and your organisation/workspace details.
- Profile & content data — your company profile, saved searches, bookmarked tenders, bid records, and any documents you upload to your encrypted document library.
- Security data — two-factor authentication secrets and notification-channel credentials (e.g. Slack/Teams/webhook URLs), which we hold encrypted at rest.
- Usage data — login times, IP address, audit-log events, and feature usage, used to operate and secure the service.
- Communications — emails you send us and notification preferences.
The tender, contract-award and buyer information in the service is sourced from publicly available UK and European public-sector procurement data published by contracting authorities, and is not personal data we collect about you.
3. How and why we use your data
| Purpose | Lawful basis |
|---|---|
| Providing and operating the service (accounts, search alerts, bid tracking) | Performance of a contract |
| Securing the service (2FA, audit logging, fraud/abuse prevention) | Legitimate interests |
| Sending service emails (alerts, digests, account notices) | Performance of a contract |
| Improving the product and providing support | Legitimate interests |
| Billing and managing subscriptions | Performance of a contract / legal obligation |
| Optional marketing emails | Consent (you can withdraw at any time) |
4. Service providers (processors)
We share data with a small number of providers who process it on our instructions:
- Our cloud hosting provider — hosting and storage, in UK/EU regions.
- Our email delivery provider — outbound email (service notices, alerts and scheduled reports).
- Companies House API — to enrich buyer/supplier records you look up.
- Our AI provider — a third-party large-language-model provider, to power optional AI features (e.g. profile drafting, tender summaries). Content you submit to an AI feature is processed to generate a response and is not used to train third-party models.
- Stripe — our card-payment processor for subscriptions. Where you pay by card, card details are entered on Stripe's hosted checkout and never reach our systems (subscriptions can also be invoiced directly).
We do not sell your personal data.
5. International transfers
Your data is primarily processed in the UK/EU. Where a provider processes data outside the UK, we rely on an adequacy decision or appropriate safeguards (such as the International Data Transfer Agreement or Standard Contractual Clauses).
6. Retention
We keep account and content data for as long as your account is active. When you delete your account we remove your personal data and your content immediately — deletion is not deferred, and it is irreversible. We retain an anonymised record that an account was deleted, and we may keep a limited amount of information longer where we must to meet legal, tax or security obligations, or to establish or defend legal claims.
7. Your rights
Under UK data protection law you have the right to access, correct, delete or port your data, to object to or restrict certain processing, and to withdraw consent. You can export your data from your account settings, or contact us at privacy@datascene-tenders.co.uk. You also have the right to complain to the ICO (ico.org.uk). Datascene Limited is registered with the Information Commissioner's Office under registration reference ZC212152.
8. Cookies & analytics
We use strictly necessary cookies only — to keep you signed in and to protect against cross-site request forgery. We do not use third-party advertising or tracking cookies, and we do not require a cookie-consent banner because we set no non-essential cookies.
To monitor and improve site performance we collect aggregate, first-party analytics: which pages are viewed and how quickly they load in your browser (standard web-performance measurements such as load time and Core Web Vitals). This is collected directly by us — no third party such as Google Analytics is involved, and no cookies or other storage are placed on your device for this purpose. To estimate unique visitor counts we derive a short-lived, one-way hash from your IP address, browser and the current date; we do not store your raw IP address for analytics and the value cannot be used to track you across days or sites. Our lawful basis is our legitimate interest in keeping the service fast and reliable.
9. Changes to this notice
We may update this notice from time to time. Material changes will be notified by email or an in-app notice. The "last updated" date above shows the current version.