Data Protection Overview

1. Roles and accountability

When a customer uses mytender.io, the customer is the Data Controller and mytender.io acts solely as its Data Processor. Customers upload their own material – tenders, case studies, policies, past bids and staff CVs – and the platform generates bid content from it for them. The customer decides why and how that data is processed (which documents, which bids, who has access) and determines the lawful basis.

We process customer data only on the customer's documented instructions, under a Data Processing Agreement meeting Article 28 UK GDPR, and only to deliver the service. Customer data is never used to train AI models. The customer owns the generated content, and data is exported or deleted on exit.

Our Data Protection Officer is Nicolas Dickreuter (nicolas@mytender.io). Privacy requests and complaints are handled at privacy@mytender.io, monitored by the DPO. Board-level responsibility for data protection sits with the CEO, Samuel Aaron.

2. Hosting and data location

All customer data is hosted and processed in the United Kingdom. AI inference runs in-region on Amazon Bedrock in AWS London; requests do not leave the London region. Supporting models (classification, search, embeddings) also run in AWS London, so all AI processing of customer data takes place in the UK.

No international transfers take place under our customer contracts. Any future transfer would happen only with prior notice to the customer and a valid UK GDPR Chapter V mechanism (UK IDTA). mytender.io support and engineering access to customer data is not routed outside the UK or EEA; where a customer requires it, access is limited to designated UK-based staff and requires the customer's approval.

3. Sub-processors and model providers

Anthropic and OpenAI are model providers, not sub-processors. Their models are accessed only through Amazon Bedrock in AWS London, and no data is sent directly to either.

Customers get at least 30 days' prior written notice of any new or replacement sub-processor (name, location, nature of processing) and may object. If an objection cannot be resolved, the customer may terminate the affected part of the service. A sub-processor register (name, location, role, data processed) is available to enterprise customers on request and updated within 30 days of any change.

Sub-processors are bound by Article 28 Data Processing Agreements, retain data only on our documented instructions, and are reviewed annually against their independent third-party audit reports and published security documentation.

4. AI data handling

• We use generative AI with retrieval-augmented generation (RAG). Outputs are drafts for human review, and users can see the source documents behind a response. We make no automated decisions about individuals, so there is no Article 22 UK GDPR risk.
• Customer data is never used to train, fine-tune or improve any model. Under the commercial API terms that apply to this processing, prompts and outputs are never used to train or improve any model, and any retention is solely for abuse and misuse monitoring, after which the data is deleted.
• Tenant isolation: logically separated customer data, role-based access, and isolated inference sessions with no cross-tenant data in prompts or retrieval. Multi-tenant isolation is included in penetration testing.
• AI governance: an internal EU AI Act risk classification has been completed (Limited Risk); governance is aligned to the NIST AI Risk Management Framework; ISO 42001 certification is in progress.

5. Security controls

• Encryption: AES-256 at rest (including backups), TLS 1.2 or higher in transit, and full-disk encryption on company devices.
• Access: least privilege, role-based access control, MFA on all company accounts, single sign-on for key systems, and quarterly access reviews.
• Monitoring: managed internally. Amazon GuardDuty, AWS CloudWatch and AWS Security Hub provide 24/7 automated monitoring and alerting; alerts and production logs are reviewed daily. Security and audit logs are retained for 12 months.
• Testing: an annual manual penetration test (external infrastructure and web application, including the OWASP Top 10 and multi-tenant isolation testing), plus continuous automated vulnerability scanning.
• Patching from release by severity: Critical within 24–72 hours; High within 7–14 days; Medium within 30 days; Low within 90 days.
• Email: Google Workspace with DMARC enforced at p=reject and strict SPF/DKIM alignment.
• People: pre-employment screening (identity, right to work, 3 years' employment history, references, qualifications and a confidentiality agreement); mandatory security and UK GDPR training on joining and annually, with monthly knowledge checks.
• Privacy by Design in our development lifecycle, with a DPO privacy review of new features and a template DPIA aligned to ICO guidance. We also assist customers with their DPIAs.

6. Certifications

• ISO/IEC 27001:2022 certified Information Security Management System, full organisational scope.
• Cyber Essentials and Cyber Essentials Plus certified.

7. Incident and breach notification

Where we are controller, the DPO assesses ICO notification under Article 33 UK GDPR within the statutory 72 hours. Where we are processor, we support the customer's notifications at no charge. A formal breach register is maintained by the DPO.

8. Retention, return and deletion

In the table below, T is the date of contract termination.

• Export on request at any point up to 30 days after termination, in CSV and/or JSON with a data inventory. Transfer to a replacement supplier on written instruction. No exit, retrieval or transfer charges.
• Bespoke retention periods are supported where they meet our security requirements and the law, and are imposed on sub-processors.
• Secure deletion aligned with NIST SP 800-88 where applicable; written confirmation of deletion on request.
• Pseudonymisation and anonymisation available on request.

9. Supporting your compliance

• Individual rights. For customer data, we support customers with access, rectification, erasure, restriction, portability and objection requests: export or deletion within 7 calendar days of the customer's instruction, at no charge, audit-logged and confirmed in writing. If an individual contacts us directly about customer data, we pass the request to the customer without undue delay.
• DPIAs. We assist customers with their DPIAs and maintain a template DPIA aligned to ICO guidance.
• Records of Processing Activities are maintained and available to customers on request.
• Audits. Certificates and security documentation are available on request to support customer due diligence.

10. Documents available on request

The following are available to customers on request: Information Security Policy; Data Protection Policy; Data Retention and Disposal Policy; Incident Response Policy; Business Continuity Policy; Backup Policy; Supplier Information Security Policy; Information Transfer Policy; Records of Processing Activities; sub-processor register; DPIA support; and certificates.

11. Contact

Data Protection Officer: Nicolas Dickreuter – nicolas@mytender.io

Privacy requests and complaints: privacy@mytender.io

For how we handle personal data as a controller, see our Privacy Policy.