Privacy Policy
Bidding Specialists — The Bidding Workforce Platform™
Last updated: 7 November 2026
1. Introduction
Bidding Specialists Ltd (“Bidding Specialists”, “we”, “us” or “our”) is committed to protecting personal information.
This Privacy Policy explains how we collect, use, share, store and protect personal information, the lawful bases for processing it, and your rights under applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
It applies to bidding professionals, representatives of organisations, website visitors, Platform users, individuals participating in training or events, and others whose personal information we lawfully process.
This Policy should be read alongside our Terms of Service and Cookie Policy.
2. Who We Are
Bidding Specialists Ltd is the data controller for the processing activities described in this Policy, except where another organisation acts as an independent controller or we process information on its behalf.
Bidding Specialists Ltd
Company Registration Number: 11998189
Registered Office: Signature, 18th Floor, 100 Bishopsgate, London, United Kingdom, EC2N 4AG
Registered in England and Wales.
Website: https://www.biddingspecialists.com/
Email: info@biddingspecialists.com
3. Personal Information We Collect
Depending on how you interact with us, we may collect:
- Personal and contact information: Name, email address, telephone number, general location, account details and communication preferences.
- Professional information: CVs, employment history, qualifications, certifications, skills, experience, availability, portfolios, references and supporting documents.
- Organisational information: Company details, job titles, business contact information, job specifications, workforce requirements and procurement interests.
- Technical and usage information: IP addresses, device and browser information, login activity, Platform usage, security logs and cookie information.
- Communications and service information: Enquiries, support requests, matching activities, introductions, bookings, training participation and relevant correspondence.
Additional information may be collected where necessary for verification, onboarding, assignments or legal compliance.
We do not generally require special category personal information for standard registration. Users should avoid including unnecessary sensitive information in CVs or supporting documents. Where such information, or criminal offence data, must be processed, we will apply the additional legal conditions and safeguards required by law.
4. How We Collect Information
We collect personal information:
- Directly from individuals through registration, profiles, forms, uploads, enquiries and Platform use.
- From organisations submitting job specifications, workforce requirements or relevant contact information.
- From lawful professional, business and publicly available sources.
- From authorised service providers, professional contacts and relevant third parties.
- Automatically through Platform activity, security systems and permitted cookies or similar technologies.
Where information is obtained indirectly, we will provide the required privacy information within the applicable legal timeframe, unless a lawful exception applies.
5. How We Use Personal Information and Our Lawful Bases
We process personal information for the following purposes:
| Purpose | Typical lawful basis |
| Account registration, verification, administration and requested Platform services | Contract, where necessary for a contract with the individual, or legitimate interests |
| Professional matching, introductions and approved profile sharing | Contract or legitimate interests, as applicable |
| GovOpportunities™ and GovFrameworks™ procurement intelligence and opportunity recommendations | Contract or legitimate interests, as applicable |
| AI-assisted matching, analysis and recommendations | Contract or legitimate interests, as applicable |
| Institute of Bidding Specialists™ training, events and educational activities | Contract or legitimate interests, as applicable |
| Customer support and operational communications | Contract or legitimate interests |
| Marketing and promotional communications | Consent or legitimate interests where legally permitted, subject to electronic marketing rules |
| Security, fraud prevention and Platform improvement | Legitimate interests or legal obligation |
| Legal, regulatory, tax and accounting compliance | Legal obligation |
Contractual necessity applies only where processing is necessary to perform a contract with the individual concerned or to take steps at their request before entering into such a contract. It does not automatically apply to processing undertaken solely under an agreement with an organisation.
Where we rely on legitimate interests, we assess the necessity and proportionality of the processing against individuals’ rights and freedoms.
Where consent is required, individuals may withdraw it at any time without affecting earlier lawful processing.
We will not use personal information for incompatible purposes without an appropriate lawful basis and any notice required by law.
6. Professional Profiles and Controlled Matching
Bidding Specialists connects organisations with bidding professionals based on submitted job specifications, skills, experience, availability and other relevant requirements.
Registered organisations cannot freely browse, search or access the wider database of professional profiles.
An organisation must first submit a job specification or workforce requirement before receiving professional matches.
Profiles may be recommended through AI-assisted matching or identified manually by Bidding Specialists.
All matches must be reviewed and approved by Bidding Specialists before professional profiles become visible to the requesting organisation.
Only approved profiles are shared, subject to relevant access permissions and privacy controls. Shared information may include professional experience, qualifications, skills, employment history, availability, CVs and supporting documents where necessary.
Organisations must use this information only for legitimate workforce assessment, recruitment and engagement purposes.
Bidding Specialists prohibits browsing the wider professional database and using professional information for unrelated marketing, redistribution, resale or other unauthorised purposes.
Organisations independently determining how they use received professional information may act as separate data controllers.
7. AI-Assisted Processing and Profiling
We may use AI and automated technologies, including services provided by OpenAI, Anthropic or other assessed providers, to:
- Analyse professional profiles against job specifications.
- Recommend suitable bidding professionals.
- Identify and recommend tender and framework opportunities.
- Classify, summarise and analyse procurement information.
- Support professional assessment and matching decisions.
AI-assisted recommendations support human decision-making and do not automatically determine employment or engagement outcomes.
Bidding Specialists conducts meaningful human review of AI-generated professional matches before disclosure to organisations. Authorised reviewers assess the suitability of recommendations and have the authority to approve, reject or modify them.
We seek to minimise personal information shared with external AI providers, using structured or pseudonymised data where feasible.
Relevant provider agreements, security arrangements, retention settings and international transfer safeguards will be assessed before processing personal information through new AI integrations.
Where solely automated decisions producing legal or similarly significant effects are introduced, we will comply with applicable legal requirements and provide the relevant safeguards and individual rights.
We will undertake Data Protection Impact Assessments where required.
8. Marketing Communications
We may use HubSpot, Microsoft Outlook, WhatsApp and other authorised communication services for operational messages and promotional communications, including professional opportunities, procurement updates, training, events and business news.
Marketing communications will comply with applicable data protection and electronic marketing requirements, including the Privacy and Electronic Communications Regulations (PECR).
Where consent is required, we will obtain it. Where another lawful basis is permitted, applicable transparency and objection requirements will be respected.
Individuals may unsubscribe, withdraw consent or object to direct marketing at any time by using available opt-out mechanisms or contacting us.
Essential account, security and service-related communications may continue where necessary and lawful.
9. Sharing Personal Information
Where necessary and lawful, we may share personal information with:
- Registered organisations receiving approved professional matches.
- Bidding professionals involved in authorised introductions or engagements.
- AWS and other technology providers supporting hosting, infrastructure and security.
- AI providers, including OpenAI and Anthropic where used.
- CRM and communication providers, including HubSpot, Microsoft and WhatsApp-related services.
- Professional advisers, regulators, authorities and other authorised service providers.
We apply appropriate contractual, confidentiality and data protection safeguards to providers processing information on our behalf.
We do not sell personal information to third parties for their independent marketing purposes.
Independent recipients may have their own data protection responsibilities.
10. Data Hosting and International Transfers
Our core Platform infrastructure, primary databases and backups are intended to be hosted in the United Kingdom using Amazon Web Services (AWS), Europe (London) region.
Access to core Platform information is intended to be restricted to authorised personnel and services.
External AI, CRM and communication providers may process or access personal information outside the UK, even where our core Platform is hosted in London.
Where international transfers occur, we will comply with applicable UK data protection requirements, including UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, where applicable.
We will also carry out the required data protection test and implement additional safeguards where necessary.
We minimise information shared with external providers and assess their relevant processing and security arrangements.
11. Data Security
We apply appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse and unlawful processing.
Depending on the Platform’s configuration, these may include encryption, secure authentication, role-based permissions, restricted profile access, security monitoring, backups and incident response procedures.
Users must protect their login credentials and report suspected unauthorised access.
Where a personal data breach occurs, we will comply with applicable assessment and notification obligations.
12. Data Retention
We retain personal information only for as long as necessary for its intended purpose, subject to legal, regulatory and contractual requirements. Retention periods are reviewed periodically to ensure they remain necessary and proportionate.
Our standard retention periods are:
| Information category | Retention period |
| Active professional profiles, CVs and documents | While the account remains active, with periodic accuracy reviews |
| Inactive professional accounts | First review after 12 months, second review after 24 months, and normally deleted or anonymised after 36 months of inactivity |
| Closed accounts and profile documents | Normally deleted within 180 days of account closure |
| Unsuccessful applications and matching records | Normally up to 24 months after the selection process concludes, where justified |
| General enquiries | Normally up to 12 months after the last substantive communication |
| Organisational accounts | While active; inactive accounts reviewed after 24 months |
| Contracts and financial records | Generally six years, subject to legal requirements |
| Security and access logs | Normally up to 180 days |
Professional account inactivity is measured from the last meaningful account activity. Inactive profiles may be retained beyond 36 months only where the account has been reactivated or another lawful retention purpose applies.
Information may be retained longer where necessary for legal obligations, disputes, security investigations or existing contractual commitments.
When no longer required, information will be securely deleted or anonymised. Backup copies may follow a separate retention and deletion cycle, subject to appropriate safeguards and applicable legal requirements.
13. Your Data Protection Rights
Subject to applicable legal conditions and exceptions, individuals may have the right to:
- Access their personal information.
- Request correction of inaccurate information.
- Request deletion or restriction of processing.
- Receive certain information in a portable format.
- Object to processing based on legitimate interests.
- Object to direct marketing at any time.
- Withdraw consent where applicable.
- Exercise rights concerning automated decision-making and profiling.
- Be informed about how their information is processed.
Requests may be submitted to info@biddingspecialists.com.
We may verify identity before responding and will respond within applicable legal timescales, generally within one month, subject to permitted extensions.
14. Cookies and Similar Technologies
Our website and Platform may use cookies and similar technologies for essential functionality, security, preferences, analytics and other permitted purposes.
Non-essential cookies and similar technologies will be used only where applicable consent requirements are satisfied.
Further information is available in our Cookie Policy: https://www.biddingspecialists.com/cookie-policy/
15. Children, Third-Party Services and Required Information
The Platform is intended for individuals aged 18 or over. We do not knowingly provide registered accounts to children and will take appropriate action if information is collected contrary to our eligibility requirements.
Our website and Platform may link to external websites and services governed by their own privacy policies. We are not responsible for the independent processing practices of those third parties.
Certain information is necessary for registration, verification, matching or contractual purposes. Failure to provide required information may prevent access to relevant services or features. Optional information may be provided voluntarily.
16. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our services, technology, processing activities or legal requirements.
The latest version will be published on our website with an updated revision date.
Where material changes affect individuals, we will provide appropriate notice where required.
17. Contact Information and Complaints
For privacy enquiries, data protection requests or concerns about how we process personal information, please contact:
Bidding Specialists Ltd
Website: https://www.biddingspecialists.com/
Email: info@biddingspecialists.com
Company Registration Number: 11998189
Registered Office: Signature, 18th Floor, 100 Bishopsgate, London, United Kingdom, EC2N 4AG
Registered in England and Wales.
You have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s data protection regulator.
Website: https://ico.org.uk/
