Privacy Policy

1. Who we are and how to contact us

123 Tenders Ltd ("123 Tenders", "we", "us") is a company registered in England and Wales, company number 17407172, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. We are the data controller for the personal data described in this notice, except where section 5 says we act as a processor.

123 Tenders Ltd is registered with the Information Commissioner's Office as a data controller, registration reference ZC233798. You can check this on the ICO's public register.

For anything about your personal data, email hello@123tenders.co.uk.

2. What we collect

Account details (email, name, business name, plan); business profile details you enter (for example industry, experience and accreditations); the business information and contract notice text used for drafts, scores and analysis, and the results; your alert and region preferences; toolkit records you save; order and payment details we receive from Stripe; usage records used to apply plan and download limits; referral codes; and anything you send us through feedback or email.

We do not ask for special category data (such as health, ethnicity or religion) about you, and we never store card or bank details ourselves.

3. Why we use your data and our lawful basis

Each purpose below has a lawful basis under Article 6 of the UK GDPR.

Businesses we contact for the first time

We sometimes contact UK limited companies and other organisations that have not yet used 123 Tenders, to tell them about contracts and tools that may help their business.

What we collect: the organisation's name, its business email address and phone number, its public social media pages, and public information about contracts it has won.

Where we get it: the organisation's own website, its public Google business listing, its public social media pages, and public contract award notices.

Why we use it and our lawful basis: to tell the organisation about 123 Tenders. Our lawful basis is legitimate interests (business to business marketing). We only contact organisations, not individuals or sole traders, without their consent.

Your right to object: you can ask us to stop at any time by replying "stop" to any email or message, or by writing to hello@123tenders.co.uk. We will stop straight away.

How long we keep it: if an organisation does not respond, we delete its details within 12 months. If an organisation asks us to stop, we keep only its name and email address on a do not contact list so that we never contact it again.

4. Public contract data

We republish contract notices from Find a Tender, Contracts Finder and Public Contracts Scotland under the Open Government Licence v3.0. These notices can include the names and work contact details of buyer officials and supplier contacts, as published by the buying organisation.

Our lawful basis is legitimate interests: making public procurement information easier to search. We copy what the official portal publishes and do not add to it.

If a notice includes your details and you want them corrected or removed from our site, email hello@123tenders.co.uk with a link to the page. We will also point you to the buying organisation, which controls the original notice.

Supplier pages (/suppliers) are built from award notices about limited companies and limited liability partnerships only. We do not show individuals' names, including contact names from notices, on supplier pages. A company can request a correction using the link on its page. If a company claims its page, we keep the claim (work email, role and any note) while the claim is active, and delete rejected claims 12 months after the decision.

5. Toolkits and documents you create

If you put other people's personal data into a toolkit or document (for example staff, client or contact details), you are the controller of that data and 123 Tenders acts as your processor. The Data Processing Terms in section 14 of our Terms of Service apply to that data.

If you cite someone else's details in a draft (for example a reference), you are responsible for having a proper basis to share them. We use them only to produce your document and do not contact the people named.

5A. Worker profiles

Worker profiles are free and only for people aged 18 or over. We ask you to tick a box to confirm your age. We do not collect your date of birth.

What we collect: your first name, region, the first part of your postcode if you give it, the sectors and roles you work in, years of experience, availability, how far you will travel, whether you declare a DBS certificate with its level and issue date, a short optional about text, whether your profile is hidden, and your confirmation that you are 18 or over. We do not collect photos, CVs, right to work documents, DBS certificate numbers or copies, or health or other special category information. Please do not include health information, your address or other people's details in your about text.

Lawful basis: contract, to provide the free worker service you signed up for. Your DBS details are what you declare to us. We do not check them.

Who sees it: nobody but you. Businesses cannot browse, search or view worker profiles. They only see how many workers are registered in an area or sector, and only when that number is 4 or more. No business can contact you first. If a future feature lets you respond to a hiring post, you choose what to share and with whom at that time.

Retention: until you delete your profile, which you can do at any time and which takes effect immediately. If you do not sign in for 12 months we email you, and delete the profile 30 days later unless you sign in.

Hiring posts: a business can publish a job advert, which anyone can read. If you choose to respond, the business sees your first name, roles, years of experience, availability, DBS declaration and about text, your message, and only the contact details you tick to share. We email the business your first name and role only. Posts and responses are deleted 12 months after the post closes.

If you report content, we keep your report, your account ID if you are signed in, and a one-way scrambled version of your IP address used only to limit repeated reports.

5B. Homeowner job requests

What we collect: the type of work, your job description, the postcode of the job, the timescale, the property type, your name, email and phone number, your confirmation that you are 18 or over, and a one-way scrambled version of your IP address used only to limit repeated requests.

Lawful basis: we run the request (email confirmation, matching and updates) because you asked us to, which is contract or legitimate interests. We share your details with trades only with your consent, given by ticking the box on the form.

Who receives it: before accepting, matched trades see only the type of work, the first part of your postcode, the timescale, the property type and your description. Up to 3 trades can accept. Each one that accepts receives your name, phone, email and full postcode so they can contact you about this job, and we email you their business name. We use postcodes.io to look up the postcode area and location, and it receives the postcode only.

Withdrawing: every email we send you about the request has a link to withdraw it. Withdrawing removes your contact details from the request, stops any more trades seeing it and stops our emails about it. Details already shared with a trade who accepted are then held by that trade as their own records, under their own responsibility as data controller. You can ask them directly to delete them.

Reviews: 14 days after a trade accepts, we email you a link to review them. If you leave a review we publish your rating, text, first name, the type of job and the date.

Retention: job request data is deleted 12 months after the request closes (requests close after 30 days, or when you withdraw). Unconfirmed requests are deleted after 7 days. Reviews are kept while they are published.

5C. Quick Quotes

What we collect. From public sector buyers: name, work email, organisation name and type, and the request details, files, questions, answers, evaluation scores and award decision. From suppliers: account email, business name, Companies House number, size, base postcode, categories, quotes, files and questions. From suppliers a buyer invites: the email address the buyer gives us and whether the invitation was opened. From evaluators: the email address the buyer gives us and the scores they enter.

Our role. For request, quote, evaluation and award data a buyer posts, the buyer organisation is the controller and 123 Tenders is its processor (see section 14 of our Terms). For supplier accounts and supplier profiles, 123 Tenders is the controller.

Who can see what. Anyone can see the public summary of an open request. Signed-in suppliers can see the full request, attachments and published answers. Each supplier sees only its own quote. The buyer, and an evaluator the buyer invites, see the quotes only after the deadline. Quotes are sealed until the deadline, and our server does not release them before then.

How long we keep it. Attachments, quotes and audit records are kept for 6 years after award, then deleted.

5D. 123 Answer (AI receptionist)

What is processed: when someone calls a business that uses 123 Answer, we process the caller's phone number, the name, postcode and job details they give, a text transcript of the call, the call length and any booking made. We do not store call audio.

Our role: the business that uses 123 Answer is the controller of caller data, and 123 Tenders is its processor (see section 18 of our Terms). The business decides how it uses the details, so please read that business's own privacy notice too.

Retention: transcripts are deleted automatically after 30, 90 or 365 days, as chosen by the business. Other call and booking details are kept while the business keeps its account, and deleted when it closes the service.

Subprocessors: Retell AI, Inc. runs the AI voice agent and processes the call (USA). Twilio provides the UK phone numbers, call routing and text messages. Call data is processed in the United States under each provider's data processing terms, with UK GDPR transfer safeguards in place.

Why calls are processed: calls are transcribed and processed only so the business gets the caller's message and any booking. We keep minimal call data.

Deletion requests: callers can ask the business directly, or email hello@123tenders.co.uk and we will pass the request to the business and help it respond.

5E. 123 Answer: building a receptionist from your website

Website analysis: when you ask us to, we read up to 8 public pages of the one website you enter, following its robots.txt. An AI model extracts business facts (name, services, areas, hours, contact details shown on the site and common questions) so you can check and edit them. We do not read other websites.

Consent records: we keep your email address, the website domain, the consent wording and version you agreed to, the time, a one-way code made from your IP address and your browser type, so we can show what was agreed and prevent misuse.

Demo calls: the demo call in your browser is processed by Retell AI, Inc. in the United States under its data processing terms, with UK GDPR transfer safeguards. The temporary demo receptionist is deleted after the call. We do not store demo call audio.

Phone demos: we verify your UK mobile with a code sent by Twilio, then use your caller number to select your business blueprint on our shared demo line. Access lasts 24 hours with up to two calls of two minutes. Retell AI processes the audio in the USA with basic call attributes only retained; we keep the mobile, verification time, call count and duration with the trial for up to 30 days. Nothing is booked or texted during the call.

Phone demo texts: verification codes are service messages you request. The optional one-off text with a link to buy 123 Answer is marketing, sent only with your separate consent recorded at verification. Our sender cannot receive replies, so we do not ask you to reply STOP. No further marketing texts are sent. The one follow-up email respects your email opt-out and includes an unsubscribe link.

Retention: drafts that do not become a live 123 Answer receptionist are deleted after 30 days. If you go ahead, the details are copied into your 123 Answer setup and kept with your account.

Emails: we send the code you asked for and, if you do not go ahead, at most one reminder, which you can unsubscribe from.

6. How AI is used for drafts and analysis

When you ask for a Bid Pack draft, a match score, a Tender X-Ray or Bid Copilot help, the business information you provide and the relevant contract notice text are sent through Lovable's AI gateway to Google Gemini models to produce the result. The result is stored in your account for you to review. It is never submitted anywhere on your behalf. 123 Tenders does not use your content to train AI models.

7. How long we keep data

8. Who receives personal data

Card payments happen on Stripe Checkout. You enter your card details directly into Stripe's systems. 123 Tenders never sees or stores your full card number. We receive the payment outcome and limited details such as your email, the plan bought and billing details Stripe returns, which we use for account access, receipts and accounting records. Stripe's own privacy notice applies to the payment step. If you pay by invoice or bank transfer, we handle only the billing details you send us.

We do not sell your data or share it with data brokers or advertisers.

9. International transfers

Some of these providers process data outside the UK, including in the United States and the European Economic Area. Where personal data leaves the UK, transfers are protected by UK adequacy regulations or by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

Our database and hosting are in the United States (Amazon Web Services, Oregon). Transfers are protected by the UK International Data Transfer Addendum and, where the provider is certified, the UK Extension to the EU-US Data Privacy Framework.

10. Your rights

Under the UK GDPR you have the right to access your data, have it corrected, have it erased, restrict how we use it, object to how we use it (including for direct marketing), receive it in a portable format, and withdraw consent at any time where we rely on consent.

To use any of these rights, email hello@123tenders.co.uk. For subject access requests we respond within one month and will carry out reasonable and proportionate searches.

11. Cookies and browser storage

123 Tenders itself sets no advertising, analytics or tracking cookies. The Trustpilot review button in our footer is provided by Trustpilot and may set Trustpilot's own cookies; see Trustpilot's cookie policy. We use the browser storage items below. Most are essential or remember a choice you made. 123t_first_touch records only how you first arrived. It is used only to understand which channels bring visitors so we can improve the service, is never shared with anyone else, holds no identifier and is saved to your account only if you sign up. You can object at any time with "Don't record how I arrived" in the table below; sign-up then saves no source. The cookie notice works as before.

Trustpilot's cookie policy

12. Automated decisions

We do not make automated decisions about you that have legal or similarly significant effects. Match scores and matched alerts are recommendations only. You decide what to bid for.

13. Security

See our Security page for how we protect your data. We do not hold formal certifications such as ISO 27001 or Cyber Essentials and will say so here if that changes.

14. How to complain about how we use your data

You have the right to complain to us about how we use your personal data (Data (Use and Access) Act 2025, section 103, in force from 19 June 2026). Use our online complaint form at 123tenders.co.uk/privacy/complaint, giving your name, email and the details, or email hello@123tenders.co.uk with the subject 'Data protection complaint'.

We acknowledge every complaint within 30 days, look into it and respond without undue delay, and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office, now the Information Commission: ico.org.uk, 0303 123 1113.

15. Changes to this notice

We will update this page if how we handle data changes and change the date at the top.