Privacy notice

Who we are

BidProof is a product of ThinkTribal Limited, registered in England and Wales, company number 12116434, registered address AvenueHQ, 10-12 East Parade, Leeds, LS1 2BH. ThinkTribal is registered with the Information Commissioner's Office, reference ZB011235. Contact us at info@thinktribal.com, for the attention of the data protection contact.

ThinkTribal is the controller of the data needed to run and secure BidProof: your account, your organisation memberships, the audit log, feedback, email delivery records and support sessions. Each customer organisation is the controller of what it puts into BidProof, such as its answers, evidence, packs and Companies House check, and ThinkTribal processes that data on its behalf under the customer's contract. If your question is about an organisation's own content, ask that organisation first; we pass requests we receive to it within two working days.

What we collect, why, and on what basis

Your account: your name, your work email address and your authenticator app factor. We use them to sign you in, protect your account and show colleagues who did what. Basis: performance of the contract with your organisation, and our legitimate interests in running a secure service.

What you do in BidProof: sign-offs record who approved an answer and when, and sensitive actions are written to an audit log. A buyer opening a shared evidence room is recorded by date and by what was opened, without their name. Basis: legitimate interests in an accurate, tamper-evident record.

Feedback and email: messages you send through Send feedback, and a record of each email we send you and whether it was delivered. Basis: legitimate interests.

Public records: the daily Companies House check reads your organisation's own record, and where your organisation switches on the connected persons check, the names and roles of its officers and persons with significant control as the public register shows them. Contract award notices from Find a Tender name the suppliers that won, as published. Basis: legal obligation where your organisation is tendering under the Procurement Act 2023, otherwise legitimate interests.

We do not sell personal data, we send nothing to any AI model provider, and we make no automated decisions with legal or similarly significant effects.

How long we keep it

Customer content and accounts: for the length of the contract, then deleted within 30 days of it ending, after the organisation has been offered an export.

Email delivery records and notifications: 12 months. Feedback: 24 months after it is closed. Records of scheduled jobs: 90 days. Contract award notices: 12 months after the contract's expected end, or 6 years after signing when no end is known.

Backups roll out of the backup window on their own and are not restored to bring deleted data back, except to recover from an incident.

Who processes it for us

Each provider works under a written contract that limits it to our instructions. Supabase holds the database, sign-in and evidence files, in London. Vercel hosts the service, with its functions in London. Brevo delivers email, from France and Belgium. Cloudflare runs the bot check on sign-in.

BidProof also reads Find a Tender, GOV.UK, the Crown Commercial Service pipeline and the Companies House register. These receive nothing about you beyond the request itself.

Where your data goes

BidProof's data is held in the United Kingdom. Email passes through the European Union, which the UK recognises as adequate. Where a provider or its sub-processors are outside the UK, transfers are protected by the UK Addendum to the EU standard contractual clauses or the UK International Data Transfer Agreement.

Cookies

BidProof uses only the cookies it needs to work: one that keeps you signed in, and those Cloudflare sets for the bot check on the sign-in page. There are no analytics or advertising cookies, so there is nothing to accept or decline. You can clear cookies in your browser at any time; you will then need to sign in again.

Your rights

Under the UK GDPR you can ask for a copy of your data, have it corrected, have it deleted where the law allows, restrict or object to its use, ask for it in a portable form, and withdraw consent where consent is the basis. Send requests to info@thinktribal.com. We reply within one month, free of charge.

Complaining to the regulator

Please raise a concern with us first, so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by calling 0303 123 1113, or by writing to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Children

BidProof is a service for organisations and is not meant for children. We do not knowingly collect data about anyone under 13.

Changes to this notice

We will update this notice when how we handle data changes, and show the date it was last reviewed at the top.