MYTENDER.IO LTD
Last updated: 5 October 2026
MYTENDER.IO LTD ("mytender.io", "we", "us", "our") is committed to protecting personal data and handling it responsibly. This policy explains how we collect, use, share and protect personal data, and your rights under the UK GDPR and the Data Protection Act 2018. It covers personal data we handle as a controller (our website, enquiries, business contacts and recruitment) and, separately, personal data we process as a processor on behalf of our customers when they use the mytender.io platform.
For a detailed security and data protection overview written for customer reviewers, see our Data Protection Overview.
Legal entity: MYTENDER.IO LTD, registered in England and Wales (company number 15132671)
ICO registration: ZB867841
Product: mytender.io, an AI-powered bid writing platform
Data Protection Officer: Nicolas Dickreuter – nicolas@mytender.io
Privacy requests and complaints: privacy@mytender.io (monitored by the DPO)
mytender.io is a controller for personal data it processes for its own purposes: website visitors and enquiries, business contacts, job applicants and employees. The lawful bases for these activities are recorded in our Records of Processing Activities and summarised below.
When a customer organisation uses the platform, that customer is the controller of the personal data and content its users upload, and mytender.io acts solely as its processor. We process that data only on the customer's documented instructions, under a Data Processing Agreement meeting Article 28 UK GDPR, and only to deliver the service. Customer data is never used to train AI models, the customer owns the generated content, and data is exported or deleted on exit.
If you use mytender.io through your employer or another organisation, that organisation is the controller of your personal data in the platform. Please also read their privacy notice.
Technical data (IP address, device and browser information) and usage data collected through cookies and similar technologies. We use this to operate, secure and improve our website and to measure our marketing. Lawful basis: our legitimate interests, and your consent for non-essential cookies.
Identity and contact details (name, work email, telephone, company) and the content of your message when you contact us, request a demo or book a meeting. We use this to respond and to take steps at your request before entering into a contract. Lawful basis: our legitimate interests and steps prior to a contract.
Identity and business contact details, obtained from you or from public sources such as Companies House and company websites, used to send relevant information about our services to business contacts. Lawful basis: our legitimate interests. You can opt out at any time.
Identity and contact details, CV, employment history and right-to-work information, used to assess your application. Lawful basis: steps prior to a contract, our legitimate interests, and compliance with a legal obligation (right to work).
On behalf of our customers we process: user account data (name, role or job title and work email address of licensed users, for account creation, authentication and access management); IP addresses, recorded in an independent security audit log in line with best practice; and personal data contained in customer content (for example staff CVs within bid material), processed only to deliver the service.
We do not intend to process special category or criminal record data. We do not obtain or enrich platform data from other sources. There is no marketing profiling or behavioural tracking of platform users.
The platform uses essential session cookies only, with a cookie notice at first login. We do not place advertising cookies in the platform, and we do not use tracking beacons or pixels in service communications sent by the platform.
Under certain customer agreements, we may enable product analytics to monitor the performance, reliability and usage of the software. This is configurable on a per-agreement basis and can be switched on or off: where we have agreed not to use it, it is turned off for that account, and where its use has been agreed, it is turned on. When product analytics is enabled, the data it captures is sanitised and anonymised so that it does not expose the content of your tenders or other confidential information.
Our marketing website uses essential cookies and, with your consent where required, analytics and advertising cookies. These are provided by: Google (Google Tag Manager, Google Analytics 4 and Google Ads); the LinkedIn Insight Tag; PostHog (product analytics); HubSpot (CRM and marketing); G2 (review-site attribution); and Dealfront/Leadfeeder (identifying the business organisation associated with a visit from its IP address). You can manage non-essential cookies through our cookie banner. See our Cookie Policy for details.
All customer data is hosted and processed in the UK: AWS London (eu-west-2) for hosting and encrypted backups, and MongoDB Atlas on AWS London for database storage. AI inference runs in-region on Amazon Bedrock in AWS London, so all AI processing of customer data takes place in the UK. No international transfers take place under our customer contracts. Any future transfer would happen only with prior notice to the customer and a valid UK GDPR Chapter V mechanism (UK IDTA).
Some of the service providers we use for our own website, marketing and recruitment (see below) may process limited personal data. Where any such provider would involve a transfer of personal data outside the UK, we rely on an appropriate UK GDPR Chapter V safeguard.
We do not sell personal data. We share it only as set out below.
| Sub-processor | Role | Location |
|---|---|---|
| Amazon Web Services (AWS) | Hosting, encrypted backups, AI inference via Amazon Bedrock | UK – AWS London (eu-west-2) |
| MongoDB Atlas | Database storage | UK – AWS London (eu-west-2) |
Anthropic and OpenAI are model providers, not sub-processors. Their models are accessed only through Amazon Bedrock in AWS London, and no data is sent directly to either. Customers receive at least 30 days' prior written notice of any new or replacement sub-processor and may object, and a sub-processor register is available to enterprise customers on request.
For our website, marketing, sales and recruitment – separately from the customer-data sub-processors above – we use: Google (Tag Manager, Analytics, Ads and Google Workspace for email); HubSpot (CRM and marketing); LinkedIn (advertising); PostHog (product analytics); G2 (attribution); Dealfront/Leadfeeder (business visitor identification); and Monday.com (sales operations). These providers process website, enquiry and business-contact personal data as described in this policy.
We may also share personal data with professional advisers, and with authorities or other third parties where the law requires it or in connection with a business transfer. We never sell personal data.
We keep personal data only for as long as necessary. For customer data (where we are processor), retention is set by the customer's contract and instructions. In the table below, T is the date of contract termination.
| Data | Retention |
|---|---|
| Account data and bid/tender content | Duration of the contract; after termination kept securely until T+30 days solely for export |
| Active production data, including sub-processor copies | Deleted by T+37 days at the latest |
| Encrypted backups (30-day rolling cycle) | Overwritten by T+67 days at the latest |
| Deletion requests outside termination | Completed within 7 calendar days |
| Session logs | 30 days |
| Security and audit metadata (including IP addresses; no bid content) | 12 months |
| Marketing data | Until you unsubscribe or ask us to stop |
| Legal and financial records | Statutory period (e.g. billing records 6 years under UK tax legislation, anonymised where possible) |
We hold ISO/IEC 27001:2022, Cyber Essentials and Cyber Essentials Plus certifications. We use AES-256 encryption at rest and TLS 1.2 or higher in transit, least-privilege role-based access with MFA, 24/7 automated monitoring and alerting (Amazon GuardDuty, AWS CloudWatch and AWS Security Hub) with daily review, and an annual manual penetration test alongside continuous vulnerability scanning. Our Data Protection Overview sets out our security controls, certifications and incident commitments in full.
The platform uses generative AI with retrieval-augmented generation to draft bid content from the material a customer provides. Outputs are drafts for human review, and users can see the source documents behind a response. We make no automated decisions about individuals.
Customer data is never used to train, fine-tune or improve any model. Under the commercial API terms that apply to this processing, prompts and outputs are never used to train or improve any model, and any retention is solely for abuse and misuse monitoring, after which the data is deleted. All AI inference runs on Amazon Bedrock in AWS London, so AI processing of customer data takes place in the UK.
Under the UK GDPR you have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing (including direct marketing), and to withdraw consent where we rely on it.
To exercise any of these rights, contact privacy@mytender.io.
We acknowledge complaints within 30 days of receipt; they are investigated by the DPO, with an outcome normally provided within one month, and a review by the CEO on appeal. You can also complain to the Information Commissioner's Office (ICO) at any time.
We keep this policy under regular review. If we make material changes, we will tell you by email or through a prominent notice before they take effect. Please keep us informed if your personal data changes.