Firm BidsPrivacy policy
Last updated: 1 October 2026
Who is responsible for your data
The data controller is Firm Bids ("we"); our full business details are in the footer of every page.
What we collect, why, and our lawful basis
| Who you are | What we collect | Why | Lawful basis (UK GDPR Art. 6) |
|---|---|---|---|
| Website visitor | Pages requested, IP address and device and browser data, recorded in our hosting provider's server logs. We set no advertising or analytics cookies. If we ever add advertising conversion tracking, we'll ask for your consent first | Running, securing and improving the site | Legitimate interests (running a secure site); consent (for any advertising cookies we may add) |
| Firm Bids Leads subscriber | Work email, company, trades or keywords, areas, contract size, plan and billing status (card details are handled by Stripe, not us) | Sending the leads you subscribed to, and managing your subscription | Contract |
| Free sample requester | Work email, company, trade and area | Sending your one-off free sample, and checking it is once per firm | Consent; legitimate interests (one sample per firm) |
| Customer (the people at a client company) | Contact details, order and payment records (card details are handled by Stripe, not us), messages, documents you upload | Providing the bid service, invoicing, keeping accounting records | Contract; legal obligation (tax records) |
| Prospective business customer (a person at a limited company we think may benefit) | Name, job title, work email, company name and number, registered address, public contract awards | Sending you a short business email about a specific live public contract relevant to your company | Legitimate interests: telling businesses about relevant public contracts and our service. You can object at any time, and we'll stop. |
| People named in client documents (e.g. staff CVs) | Whatever the client includes | Writing the client's bid | We act as the client's processor; the client is the controller |
Where prospect data comes from:
- public contract award notices
- public company registers
- the company's own website
We only email limited companies and LLPs, never sole traders or partnerships, in line with the Privacy and Electronic Communications Regulations. Every email identifies us and includes a one-click way to opt out.
Who we share it with
We only share data with service providers who help us run the business, under written terms:
| Provider | What it does for us |
|---|---|
| Google Workspace | Email and documents |
| Stripe | Payments |
| Netlify | Website hosting |
| Resend | Sending leads emails |
| A text-generation (AI) software provider used to help draft bids | Drafting. Configured so your content isn't used to train its models |
| Wordsmith Projects Ltd (freelance bid reviewer) | Reviewing and finishing bids, under a confidentiality and data-processing agreement |
| Our other freelance bid reviewers | Reviewing and finishing bids, under a confidentiality and data-processing agreement |
We don't sell personal data.
International transfers
Some providers process data outside the UK, for example in the US. Where they do, we rely on UK adequacy regulations (including the UK–US data bridge, for certified companies) or the ICO's International Data Transfer Agreement or Addendum, whichever applies to that provider.
How long we keep it
| Data | Retention |
|---|---|
| Prospects who don't reply | 12 months from first contact, then deleted |
| Opt-out records | Name and email kept on a suppression list for as long as we send marketing, so we never contact you again |
| Customer documents and answer library | 12 months after your last order, unless you ask us to keep them longer or delete them sooner |
| Accounting records | 6 years after the tax year they relate to (HMRC requirement) |
| Firm Bids Leads subscribers | Until your subscription ends, plus 30 days. Billing records are kept as accounting records (see above) |
| Free sample requests | Email and company kept for as long as the one-sample-per-firm offer runs, so we can apply it. You can ask us to delete them sooner |
Your rights
You have the right to:
- access your data
- have it corrected or erased
- restrict or object to our use of it (including an absolute right to object to direct marketing)
- data portability
- withdraw consent at any time
Email us at the address in the footer of any page. We'll reply within one month. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint or 0303 123 1113. We'd appreciate the chance to put things right first.
Changes
If we change this policy, we'll update the date at the top. Significant changes will be emailed to customers and subscribers.