Privacy notice

1. Who is responsible

The controller of your personal data is the business that provides SLETOR (details to be published).

Provider details: not yet configured. Until they are, SLETOR does not take payments.

We have not appointed a data protection officer. Write to us about anything in this notice at the contact address above.

2. What we collect, why, and on what basis

• Account: your email address, name if you give it, your role in an organisation, and the company profile you enter (services, regions, size, certificates). We need it to run your account, match opportunities and produce reports. Basis: contract.
• Team invitations: the email address of a colleague you invite. Basis: legitimate interests in letting you add your team.
• Purchases: what you bought and its payment status. Stripe takes the payment as the seller of record and handles card details. We never see card numbers. Basis: contract, and legal obligation for tax records.
• Documents you upload: tender documents you upload for an assessment. They may name officials of the buyer. Basis: contract. Deleted after 90 days.
• Messages: what you send by email or the contact form. Basis: legitimate interests in answering you, or contract if you are a customer.
• Security logs: sign-in events and a keyed hash of your IP address for rate limits and abuse prevention. We do not store raw IP addresses for this. Basis: legitimate interests in keeping the service secure.
• Site statistics: pages viewed and a daily keyed hash of your IP address and browser, with no cookies, so we can count visits. We cannot identify you from it and it changes every day. We honour Do Not Track and Global Privacy Control. Basis: legitimate interests, under the UK exemption for statistics. See cookies and statistics.
• Updates: if you subscribe, your email and the consent text you agreed to. Basis: consent, which you can withdraw at any time.

3. Businesses we contact

To tell suppliers about relevant contracts, SLETOR may record a business contact address that a company publishes on its own website, such as tenders@ or info@, and the public contract award notice that names the company as a supplier. We do not guess personal email addresses and we do not buy lists.

• Purpose: to tell your company about public contracts and grants in its field, and about SLETOR.
• Basis: legitimate interests (we have a written assessment), and the email marketing law of your country. We do not email sole traders or partnerships in the UK, or companies in countries where the law needs consent first.
• Your right to object: use the link in any email or reply "unsubscribe". It takes effect at once and we keep your address on a do-not-contact list so it keeps working.
• How long: if you do not reply, we delete the contact details after 90 days and keep only a scrambled (hashed) copy on the do-not-contact list.
• AI: replies to your messages may be written by our automated assistant from our published facts. Each one says so and tells you how to reach a person.

4. Cookies

We use only essential cookies: to keep you signed in, remember your organisation and time zone, and show a one-off message after a form. No advertising or tracking cookies. Details: cookies and statistics.

5. Who we share data with

Service providers that process data for us under contract, and Stripe, which handles payments as a separate controller. The full list, with locations, is on the sub-processors page. We do not sell personal data.

6. Data outside the UK

We host in the EU (Stockholm). Some providers are US companies. Where data goes to the US, we rely on the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum to the standard contractual clauses.

7. How long we keep it

• Account data: while your account is open. After you delete your account we wait 14 days, then erase it.
• Orders and invoices: 6 years, because tax law requires it. Your name and email are removed when you delete your account.
• Business contacts who never replied: 90 days.
• Site statistics: 13 months.
• Email and messages: 2 years.
• Do-not-contact list: kept so that an opt-out keeps working.

8. Your rights

You can ask for a copy of your data, a correction, deletion, restriction or a portable copy, and you can object to processing based on legitimate interests. Signed-in customers can download their data and delete their account on the privacy page of their account. Otherwise, contact us. We answer within one month.

9. Complaints

If you are unhappy with how we use your data, tell us first through the contact form or by email. We acknowledge complaints within 30 days and tell you the outcome. You can also complain to the Information Commissioner's Office (ico.org.uk) at any time, or, in the EU, to your local data protection authority.

10. Changes

We will update this page when anything changes and show the date at the top.