Privacy notice

1. Who is responsible

The controller of your personal data is the business that provides SLETOR (details to be published).

Provider details: not yet configured. Until they are, SLETOR does not take payments.

2. What we collect and why

• Account: your email address, and the organisation profile you enter (services, regions, size, certificates). We need it to run your account and to produce reports. Basis: contract.
• Purchases: what you bought and its payment status, from our payment provider. We do not receive card numbers. Basis: contract and legal obligation (tax records).
• Messages: what you send through the contact form or by email. Basis: legitimate interests in answering you.
• Security logs: sign-in events and a keyed hash of your IP address, used for rate limiting and abuse prevention. We do not store raw IP addresses for this. Basis: legitimate interests in keeping the service secure.
• Updates: if you subscribe, your email and the consent text you agreed to. Basis: consent, which you can withdraw at any time.

3. Business contacts we find

To tell suppliers about relevant opportunities, SLETOR may record business contact details that a company publishes for this purpose, such as a general enquiries address, with a note of where we found it. We do not guess personal email addresses. We only contact a business where the law of its country allows it, and every such email says who we are, where we found the address and how to opt out. Opting out takes effect immediately and is kept on a suppression list so we do not contact you again. Basis: legitimate interests, or consent where the law requires it.

4. Cookies

We use one essential cookie to keep you signed in. We do not use advertising or tracking cookies.

5. Who we share data with

We use service providers to run SLETOR. Each processes data only on our instructions. Depending on which features are switched on, they are:

• Amazon Web Services (hosting and database, EU region)
• Cloudflare (network security and delivery)
• Stripe (payments)
• Resend (sending email)
• Anthropic (AI analysis of public opportunity documents; we do not send your payment data)

Where a provider is outside the UK or EEA, we rely on the appropriate safeguards, such as standard contractual clauses.

6. How long we keep it

We keep account data while your account is open and delete it after you close it, except records we must keep by law, such as tax records for purchases. Contact messages are kept for up to two years. Suppression entries are kept so that an opt-out keeps working. Final retention periods will be confirmed after legal review.

7. Your rights

You can ask for a copy of your data, a correction, deletion, restriction or a portable copy, and you can object to processing based on legitimate interests. Signed-in customers can request deletion from their account. Otherwise, contact us. If you are in the UK, you can complain to the Information Commissioner's Office. In the EU, you can complain to your local data protection authority.