Privacy and data protection

Privacy notice

Who we are: Haldwyns provides bid support for UK small businesses. Haldwyns is a trading name of Conoscend Ltd, company no. 16941677. Contact: info@haldwyns.co.uk.

What we collect and why: when you request a free tender brief we process your email address and the tender documents you send or link, solely to produce and deliver your brief. Our lawful basis is your consent, given when you submit the form.

Automated processing: your tender documents are analysed by automated tools (including AI models) to produce the brief. No decision with legal or similar effect is made about you automatically.

Retention: free-brief data (your email and brief content) is deleted automatically after 30 days. If you become a client, retention is governed by the service terms you sign.

Our decision record: for clients, we keep a record of every recommendation we make: the tender, what we advised, the competitive range and your stated floor at the time, and what the buyer's published award notice later showed. We keep it because it is how we hold ourselves accountable for the advice we give, and how we verify it against public data rather than asking you to take our word. It is retained for six years, matching the limitation period for the work it evidences.

Erasure of that record: on request we anonymise it. Your company name, your matched supplier identity, and (where a published award notice would identify you as the winner) the notice reference are removed. The anonymous statistics that remain, counts and values with no link to you, stay in our aggregate record. Numbers we have already published are point-in-time statements as at their date and are not recalculated afterwards.

Sharing: we do not sell or share your data. Processing uses infrastructure and AI providers under contract (hosting; model API); tender documents are public procurement materials.

Business-to-business outreach: we sometimes introduce Haldwyns by email to limited companies, and to named people at those companies, using a work email address published by the company itself (its own website, a Companies House filing, or a professional profile the person maintains for their business). We never use personal or non-work accounts. Our lawful basis is legitimate interest: the businesses and business contacts we write to are ones whose trade matches live public contracts we have found. Every such email identifies us, links this notice, and carries a working opt-out: reply STOP and the company goes on a permanent suppression list that every future send is checked against before it can leave. A spam complaint does the same automatically. Public research used to judge relevance (a company's own website and Companies House record) is the minimum needed for that judgment and is never sold or shared.

Workspace links in our emails: if we have written to you about a public contract, the email may carry a link to a workspace page holding the analysis we prepared for you. Opening that link is recorded. We store one row per event with four event types — opened, returned, claimed and exported — a UTC timestamp, a salted hash of your IP address (never the address itself), and whether the request looked like a browser or an automated scanner. We do not store user-agent strings, and there is no in-page tracking and no per-element analytics. In plain terms: we can see that the link was opened, and that someone came back to it on a later day; we cannot see who you are or what you looked at. If one link is opened from more than three different addresses we flag it to ourselves as possibly forwarded. Prices you type into the page stay in your own browser's local storage — saved on that device only, never sent to us unless you claim the workspace, and clearable with the button on the page. If you download the schedule as a spreadsheet we log that a download happened, never what you did with it. Our lawful basis is legitimate interest: measuring engagement with our own business correspondence. Because that is the basis, you have the right to object under Article 21 — reply to the email or write to us and we will stop. These event rows are deleted 90 days after the workspace link archives, and they never enter our six-year audit records. A link archives 30 days after the letting's current closing date.

Claiming a workspace: you can claim a workspace by entering your business email address and ticking the consent box. We store that address. If you choose to send us the prices you have entered, they travel with the claim and are encrypted under a key held for that claim alone. Our lawful basis for the claim and anything you send with it is your consent — the explicit claim action and its checkbox. If we do not decide a claim within seven days it expires and the prices staged with it are crypto-erased: the key is destroyed and the data cannot be read again, including from backups. If the address you enter is not an exact match for the contact address we already hold for the firm, the claim goes to a manual queue where a person reads the address and decides — we would rather ask than hand a firm's figures to the wrong reader. If we accept a claim, what you sent moves into your own account and is held under the contract basis described above.

Your rights: you may request access, correction, or erasure at any time: info@haldwyns.co.uk. You may complain to the ICO (ico.org.uk).

Haldwyns is a trading name of Conoscend Ltd (company no. 16941677)