Privacy Notice

This notice covers visitors, account holders, people who contact support, and business users whose details are supplied by their organisation. ProcureTwin is designed for business users aged 18 or over and is not directed at children.

• Account data: name, work email address, authentication identifiers, account status and organisation role.
• Organisation data: company and trading name, Companies House number if supplied, operating areas, services and company profile information.
• Capability and evidence data: accreditation, insurance, staff capability totals, equipment, project experience, references, uploaded documents and evidence links. The staff feature is designed not to collect individual employee names.
• Procurement data: opportunities, tender documents, requirements, notes, suitability reports, reviews and AI-assisted proposals.
• Usage and security data: timestamps, audit events, request and error information, device or browser information, and IP address where recorded by our hosting or security suppliers.
• Support and commercial data: messages, pilot arrangements, invoices and records needed to manage the business relationship.

Do not upload special-category data, criminal-record data, named employee records or other sensitive personal information. If a procurement document contains personal data, you must have a lawful reason to provide it to ProcureTwin.

We receive data:

• directly from you and other authorised users in your organisation;
• from account and email interactions;
• from public procurement sources, currently including the UK Find a Tender service; and
• automatically from the operation and security of the website and service.

We do not currently use account data for third-party advertising or sell personal data. If we introduce optional marketing email, we will provide a clear choice and an unsubscribe method.

When an authorised user requests an AI-assisted feature, relevant opportunity text, tender document text and the minimum information needed for that feature may be sent to OpenAI. The result is stored with the opportunity or report so users can review it. Do not submit sensitive personal data to an AI-assisted feature.

AI output proposes or explains procurement requirements. It does not independently change your company evidence and it does not make a legal or similarly significant decision about an individual. A user decides whether to accept a proposed requirement and whether to pursue a tender.

We share data only where needed with:

• Supabase, for authentication, database services and private file storage;
• Vercel, for application hosting, delivery and operational logs;
• OpenAI, when an authorised user runs an AI-assisted feature;
• Resend, for account and password email delivery;
• Cloudflare, for DNS, network and support-email routing;
• professional advisers where reasonably necessary; and
• courts, regulators or public authorities where disclosure is legally required.

Suppliers act under their own terms and data-protection commitments. We do not permit them to use your organisation’s private data for their own advertising.

Some suppliers may process data outside the United Kingdom. Where UK data-protection law requires a safeguard, we rely on an applicable adequacy regulation or approved contractual safeguards, together with appropriate technical and organisational measures. Contact us if you want more information about the safeguard used for a particular supplier.

• Account, organisation, capability, evidence, opportunity and report data is kept while the organisation account remains active, unless you delete it sooner.
• An organisation owner can export and permanently delete organisation data from Settings. If the separate authentication account remains after organisation deletion, you can ask us to remove it at support@procuretwin.com.
• Hosting, security and email-delivery logs are retained for the limited periods provided by the relevant supplier and only used for delivery, security and troubleshooting.
• We may keep limited contractual, invoicing, tax, dispute or abuse-prevention records for as long as reasonably required by law or to establish, exercise or defend legal claims.

ProcureTwin uses access controls, organisation-level database isolation, private file storage, short-lived document links, transport encryption, restricted server credentials, audit records and tested deletion controls. No internet service is risk-free. Tell us promptly if you believe an account or document has been accessed improperly.

ProcureTwin uses essential cookies and similar browser storage for authentication, session security and basic service operation. We do not currently use advertising cookies or third-party behavioural analytics. Essential cookies cannot be disabled through a consent banner because the signed-in service would not work without them.

Depending on the circumstances, UK data-protection law gives you rights to access, correct, erase or restrict personal data, receive portable data, object to processing based on legitimate interests, and complain about how data is handled. These rights are not absolute in every case.

The product provides organisation-data export and deletion in Settings. For an individual request, email support@procuretwin.com from the address connected to your account. We may need to verify your identity and authority before acting.

You can complain to the UK Information Commissioner’s Office at ico.org.uk. Please contact us first if you are comfortable doing so, as we would like the chance to resolve the issue.

We may update this notice when the product, suppliers or law changes. We will update the date above and give account holders reasonable notice where a change materially affects how their personal data is used.