Data protection
Who does what
Lanayr Ltd is the controller of the personal data described in our website privacy notice.
Lanayr Ltd is the controller of your supplier account, your business profile and your evidence documents. When you send a response to a quote, the buyer organisation becomes the controller of the copy it receives, and we process that copy on the buyer’s behalf under our agreement with it.
Personal data in the Tenderscape application is covered by the agreement with each customer organisation. See the supplier privacy notice for supplier accounts and buyer-held responses.
Sub-processors
| Provider | What it does | Where data is processed | Data involved |
|---|---|---|---|
| Vercel | Runs the app and this website | Dublin, Ireland (EU) | All app and website traffic |
| Supabase | Database, file storage and sign-in | Ireland (EU) | All records and documents |
| Sentry | Error reports | Frankfurt, Germany (EU) | Technical error details, with email addresses, cookies and request contents removed |
| Resend | Sends email notices (the demo and the app use an outbox only until then) | Ireland (EU) | Names and email addresses on notices |
| HubSpot | Our CRM: enquiries and sign-ups from this website, and our sales records | HubSpot’s EU data centre | Name, work email, organisation, job title and what you asked for |
| Vercel AI Gateway and the model provider | Tenderscape Assist, only if your administrator switches it on | Published before Assist can be switched on | Only the text you choose to send |
Version 1.0 · 19/10/2026. We tell customers at least 30 days before we add or change a sub-processor.
How data moves
- A buyer enters a quote; it is stored in the database in Ireland.
- Suppliers respond; their documents are stored in Ireland and shared only with the buyer of that quote.
- Notices appear in the app; email notices are sent through Resend once email is switched on, and go to an outbox until then.
- If something breaks, an error report goes to Sentry in Frankfurt with personal details removed.
- Public award notices are read from the Public Contracts Scotland open data feed.
- Tenderscape Assist, if switched on, sends only the text you choose to the published model provider.
Data processing agreement – summary
- We process your records only on your written instructions.
- Everyone at Tenderscape who can see your data is bound by confidentiality.
- Security measures are set out on our Security page.
- We use only the sub-processors listed here and give notice of changes.
- We help you answer data subject requests and complete your DPIA.
- We tell you about incidents as our Security page sets out.
- When you leave, we return and delete your data as set out below.
- We answer reasonable security questionnaires and share our assurance pack.
The full agreement comes with the pilot contract.
How long we keep data
Supplier accounts, documents and responses: as set out in the supplier privacy notice.
Records your organisation keeps in Tenderscape. Each public body sets retention for its records; the default is 6 years after the contract ends, or 6 years after the decision if no contract is awarded. When a public body’s Tenderscape contract ends, we return its data and delete it within 90 days, as set out in Leaving Tenderscape.
Finance data you send for a free spend baseline: deleted once the baseline is done.
Leaving Tenderscape
Your records are yours. Your administrator can download everything at any time from Settings › Data export: every record as a CSV file, the full audit log and every document, with a list of the files. When your contract ends we keep your data ready to export for 30 days, then delete it within a further 60 days and confirm the deletion in writing.
If we ever decided to close the service, we would give every customer at least 90 days' notice and keep the export working until the end.
DPIA support
We give you a completed draft data protection impact assessment for your organisation to review.
Businesses named in award notices
Buyers can see businesses named in award notices already published on Public Contracts Scotland, as leads. We show only the published award details, never contact details, and any business can ask us to remove it.
We rely on legitimate interests to show this published information.