Supplier privacy notice

This notice is for businesses that register on Tenderscape to find and respond to public-sector quotes, and for the people who use those accounts. Our website privacy notice covers visitors to this website.

Who we are

Tenderscape is a trading name of Lanayr Ltd, a company registered in Scotland with company number SC689824. Our registered office is 74 Union Street, Hamilton, ML3 6NE. Information Commissioner’s Office registration number: added before the pilot starts.

Lanayr Ltd is the controller of your supplier account, your business profile and your evidence documents. When you send a response to a quote, the buyer organisation becomes the controller of the copy it receives, and we process that copy on the buyer’s behalf under our agreement with it.

What we collect

• Your account: your name, work email address, phone number if you give it, and job title. Your password is stored only as a secure one-way hash, so we cannot read it.
• Your business profile: business name, company or charity number, address and postcode, size, the categories of work you do, the areas you cover and your description.
• Your evidence: insurance certificates, accreditations, policies and declarations you upload, with their expiry dates.
• Your responses: what you submit to a quote, including attachments and any clarification questions.
• Activity records: when you sign in and the actions you take, kept in an audit log for security and record-keeping.

We don’t ask for personal financial information. If a quote asks for financial information about your business, you will see that before you submit.

Why we use it and our lawful basis

• To run your account and let you respond to quotes. Lawful basis: contract, because you asked us to provide this service.
• To let buyers find your business. Lawful basis: consent. You choose this in your profile settings and can switch it off at any time; you stop appearing in buyer searches straight away.
• To tell you about quotes that match your business. Lawful basis: legitimate interests. You can change how often you hear from us, or turn these emails off, in your notification settings.
• To check your evidence and show buyers whether it meets their requirements. Lawful basis: legitimate interests – helping public buyers meet their duties to check suppliers before they award.
• To keep the service secure and keep an audit record of what happened and when. Lawful basis: legitimate interests.

Who we share it with

If you let buyers find your business, they see your listing – business name, size, area and categories – and your Passport status only. They do not see your documents.

When you respond to a quote, only the documents that quote asks for are shared with that buyer, and you see the list before you submit.

These providers process data for us under contract:

• Vercel Inc. hosts the Tenderscape service.
• Supabase Inc. provides our database and sign-in, in Dublin, Ireland.
• Resend Inc. sends account and notification emails, from Ireland (EU).
• Functional Software Inc. (Sentry) receives error reports, stored in Frankfurt, Germany, with email addresses, cookies and request contents removed.

Some of these providers are based in the United States. Where data leaves the UK, it is protected by the UK International Data Transfer Addendum or the UK–US data bridge.

We never sell your data or use it for advertising. We share it with anyone else only if the law requires us to.

Buyer-held records after you respond

When you submit a response, the buyer keeps it as part of its procurement record. For that copy, the buyer is the controller and sets how long it is kept. Public bodies may need to keep these records for audit, and may receive requests for them under the Freedom of Information (Scotland) Act 2002; they must consider commercially sensitive information before releasing anything.

To ask about a record a buyer holds, contact that buyer. Their contact details are on the quote.

How long we keep it

• Your account, profile and evidence: while you use Tenderscape. We delete an account, its profile and its documents 2 years after its last sign-in.
• Quotes, responses and award decisions: Each public body sets retention for its records; the default is 6 years after the contract ends, or 6 years after the decision if no contract is awarded. When a public body’s Tenderscape contract ends, we return its data and delete it within 90 days, as set out in Leaving Tenderscape.
• Audit log entries: for as long as the record they relate to.

Deleting your profile and what happens to responses you have already sent

You can ask us to delete your account at any time by emailing support@tenderscape.co.uk. We will delete your account, profile and documents within one month, and you stop appearing in buyer searches straight away.

Responses you have already submitted stay part of each buyer’s procurement record and are kept for the period above.

Your rights

You can ask to see the information we hold about you, correct it, delete it, restrict how we use it, or object to how we use it. Where we rely on your consent you can withdraw it at any time, and where we rely on contract or consent you can ask for a copy of your data to take elsewhere. Email support@tenderscape.co.uk and we will reply within one month.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk.

Contact

Write to Lanayr Ltd, 74 Union Street, Hamilton, ML3 6NE, or email support@tenderscape.co.uk.