Bidvanetenders

Privacy Policy

Last updated: 10 August 2026 · Change note: extended to Ireland — the EU GDPR named alongside the UK GDPR, the Irish ePrivacy Regulations alongside PECR, and the Data Protection Commission added as a supervisory authority.

This policy explains what personal data we collect through the Bidvane service, why we collect it, the lawful bases we rely on, where it is held and your rights, in accordance with the UK GDPR and the Data Protection Act 2018, and — because we serve customers in Ireland and host data in the EU — the EU GDPR (Regulation (EU) 2016/679). Where the two differ, whichever applies to you is the one we honour.

1. Who we are

Bidvane is operated by YatedLabs ("we", "us", "our"), a registered business and the data controller for the personal data described in this policy. You can reach our team about any privacy matter at admin@yatedlabs.com.

2. What data we collect

  • Account details — your name, company name, email address and a password (stored hashed) used to create and secure your account.
  • Business profile — the details you enter so we can match tenders to you: sector, classifications and accreditations, regions of operation and financial scale.
  • Usage information — basic usage data and operational logs (such as tenders you save, hide or track) used to run, secure and improve the service.
  • Analytics data — where you consent, aggregate website-analytics data about how visitors use our site (see our Cookie Policy).

3. Lawful bases for processing

We process your personal data under the following lawful bases in Article 6 of the UK GDPR and the EU GDPR:

  • Performance of a contract — to provide the service you have signed up for.
  • Legitimate interests — to analyse and improve the product, and to keep the service secure, balanced against your rights and freedoms.

Where we use non-essential cookies (such as analytics), we set them only with your consent — under the Privacy and Electronic Communications Regulations (PECR) in the UK, and the ePrivacy Regulations (S.I. No. 336/2011) in Ireland — which you can give or withdraw at any time via our cookie controls.

4. How we use your data

We use your data to provide the service and match tenders to your profile; to send the daily digest and service messages; to verify and secure your account; and — where you have consented to analytics — to understand and improve how the service is used.

To read and score opportunities, we use an AI provider (Anthropic) to analyse tender documents and, where relevant, the business profile used for matching, and to help draft replies to support messages. It processes this data only on our instructions and does not use it to train its models.

5. Hosting and international access

Personal data is hosted in the European Union — the Frankfurt region — with Render (cloud hosting), which deploys our application and database there.

To run and support the service, members of our team may access account and usage data on a need-to-know basis for administration, support and aggregated analytics — for example, to resolve a support request or investigate a problem. We do not otherwise browse the contents of customer accounts. Any such access takes place from a jurisdiction recognised as providing an adequate level of data protection under UK and EU adequacy decisions, so no additional transfer safeguards are required for it.

Separately, our website-analytics provider, Google Analytics (GA4), may process data in the United States. That transfer is covered by the EU–US and UK–US Data Privacy Framework, under which Google is certified. Analytics only runs where you have given consent.

6. Sharing with third parties

We do not sell your personal data. We share it only with the service providers (sub-processors) listed below, which act on our behalf under contracts requiring confidentiality, security and use only for the purposes of the service. We may also disclose data where required by law.

7. Retention

We keep personal data only as long as we need it for the purposes above:

  • Account and profile data — kept for the life of your subscription, and deleted or anonymised within 60 days of cancellation.
  • Usage and analytics data — kept for up to 12 months, then aggregated or anonymised.
  • Cookie-consent records — kept for 12 months to evidence your consent choices.
  • Billing and tax records — retained for approximately 6–7 years as required by tax law. Paddle holds the primary billing records as Merchant of Record (see below).

8. Your rights

Under UK and EU data protection law you have the right to access, rectify, erase or port your personal data, to restrict or object to processing, and to withdraw consent where we rely on it. To exercise any of these rights, email our team at admin@yatedlabs.com; we will respond within the statutory time limits.

9. Complaints

If you have a concern about how we handle your data, please contact us first. You also have the right to lodge a complaint with a supervisory authority:

  • United Kingdom — the Information Commissioner's Office (ICO), at ico.org.uk.
  • Ireland — the Data Protection Commission (DPC), at dataprotection.ie.
  • Elsewhere in the EU/EEA — the supervisory authority in the country where you live or work.

10. Sub-processors

We use the following sub-processors to deliver the service. Each processes personal data only on our instructions and under appropriate contractual terms.

  • Render — cloud hosting of the application and database, in the EU (Frankfurt).
  • Paddle — payments, as our Merchant of Record.
  • Google Analytics (GA4) — website analytics. Google may process this data in the United States under the EU–US / UK–US Data Privacy Framework, under which Google is certified.
  • Google Ads — advertising-conversion measurement and remarketing (US; EU–US / UK–US Data Privacy Framework, same footing as GA4). Set only where you consent; see our Cookie Policy.
  • Anthropic — AI analysis of tender documents and, where relevant, the business profile used for matching and support-message drafting (US; EU–US / UK–US Data Privacy Framework and Standard Contractual Clauses, under commercial terms that do not train models on our data).
  • Spacemail — transactional and marketing email delivery.

We will update this list as our providers change.

11. Contact

For any privacy question or request, contact our team at admin@yatedlabs.com.

› Back to home