Privacy Policy

Last updated: 2 October 2026

1. Introduction

TenderSignal is a trading name of KK London (Designs & Fashion) Limited, a company registered in England and Wales under company number 12968488, VAT registration number GB371399079, with its registered office at 1 Davies Meadow, East Hanney, Wantage, OX12 0GG. TenderSignal ("we", "us", "our") is committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you use our service at tendersignal.co.uk. KK London (Designs & Fashion) Limited is the data controller for the personal data processed through the service.

2. What Data We Collect

  • Account information: name, email address, and password (hashed)
  • Business profile: industry sectors, regions, and keywords you provide during onboarding
  • Usage data: pages visited, tenders viewed, and search queries
  • Preferences: alert frequency, saved searches, and notification settings

3. How We Use Your Data

  • Personalise tender alerts and recommendations based on your business profile
  • Send email digests and notifications about relevant opportunities
  • Improve and develop our service
  • Respond to your enquiries and provide support
  • Prevent fraud and ensure security

4. Cookies

We use essential cookies to keep you signed in and remember your preferences. We do not use third-party advertising cookies. Analytics cookies may be used to understand how the service is used; these are anonymised where possible.

5. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where we are required by law to retain it for longer.

6. Your Rights Under UK GDPR

Under UK data protection law, you have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data (you can also delete your account yourself at any time in Settings)
  • Object to or restrict processing of your data
  • Data portability: receive your data in a structured, machine-readable format
  • Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us at the address below.

7. Third Parties and Sub-processors

We do not sell your personal data. We share data only with trusted service providers who process it on our behalf under strict data processing agreements. Our key sub-processors are:

  • Resend (Resend, Inc.): delivery of transactional and digest email
  • Customer.io (Peaberry Software, Inc.): lifecycle and onboarding email. Data is processed in Customer.io's EU data region
  • Stripe (Stripe, Inc.): payment processing for paid subscriptions
  • Anthropic (Anthropic, PBC): AI relevance scoring of tender matches against your saved searches and business profile
  • Cloudflare (Cloudflare, Inc.): content delivery, performance and security
  • Hetzner (Hetzner Online GmbH): server hosting, within the EU

Where a sub-processor is located outside the UK or EEA, any transfer of personal data is protected by appropriate safeguards, such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses.

8. Buyer contact details shared through our API

Our tender records can include the work contact details (name, work email address and work phone number) of people at public bodies and other buyers, taken from the procurement notices those buyers publish. We disclose these details to business customers of our data API, who receive them as independent controllers and are responsible for their own compliance with UK data protection law.

The API Terms limit how customers may use these details: only to contact the buyer about the specific opportunity or contract the record relates to, and never for marketing lists, resale or profiling. We only supply them to customers whose billing address is in the UK, the EEA or a country the UK recognises as providing adequate protection.

If your details appear in a record, you can object to this or ask us to correct or remove them by contacting us at the address below. We will act on your request and tell our API customers, who must update or delete the details within 10 business days.

9. Contact

If you have any questions about this privacy policy or wish to exercise your data rights, contact us at [email protected].