Tendertrace Report Marketplace
Privacy Policy
1.Who we are and how to contact us
1.1Controller. Tendertrace Pty Ltd (ACN 647 897 425) of 526/368 Sussex St, Sydney NSW 2000, Australia is responsible for the personal data described in this policy. In this policy "Tendertrace", "we", "us" and "our" mean that company.
1.2Australia. We handle personal information as an entity bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We treat ourselves as bound by the Privacy Act and do not rely on the small-business exemption, because our reports can include personal information and because that exemption is under reform.
1.3United Kingdom and European Union. Where we offer the Marketplace to individuals in the United Kingdom or the European Union, we act as a controller under the UK GDPR and the EU GDPR respectively. Because we are established in Australia, we [have appointed / will appoint] a representative in the United Kingdom and a representative in the European Union under Article 27 of each GDPR, whose contact details are on the cover and in Appendix B.
1.4Contact. For any privacy question or to exercise a right, contact us at [privacy@tendertrace.com] or write to the address above, marked "Privacy". You can also contact our UK or EU representative on privacy matters for their region.
2.What this policy covers
2.1This policy covers personal data we handle in running the Report Marketplace: setting up and running your account, taking your orders and payments, producing and delivering reports, supporting you, and (where you agree) marketing to you. It also explains how we treat personal data that appears inside report content.
2.2Separate notices may apply to our platform subscription and to information published on our website. This policy governs the Marketplace.
3.The personal data we collect, and where it comes from
We collect the following categories. This data map should be confirmed against the live build.
| Category | Examples | Source |
|---|---|---|
| Account & identity | Name, business email, company, role, account credentials. | You, at sign-up. |
| Order & request data | Report type, supplier / agency / bid selections, timeframe, order history, delivered reports. | You, when you order. Treated as commercially sensitive. |
| Payment data | Billing name and address; card processed by Stripe (we do not store card numbers). | You and Stripe. |
| Marketing preferences | Opt-in marketing consent (off by default) and opt-out status. | You. |
| Personal data in reports | Supplier, agency and bid intelligence that may name individuals (e.g. sole traders, named contacts in source data). | Government open data and licensed providers. |
| Technical data | Device, log and usage data; cookies and analytics identifiers. | Collected automatically. |
3.1Sources of report data. We build reports from government open data (for example AusTender and State and Territory sources in Australia; Contracts Finder and Find a Tender and equivalents in the United Kingdom; and, where in scope, Tenders Electronic Daily (TED) for the European Union) and from licensed third-party data (including Experian).
3.2If you do not provide it. If you do not give us the account and billing data we need, we cannot set up your account, take payment, or deliver a report.
4.How we use your data, and our lawful basis
For each purpose we set out the UK / EU GDPR lawful basis and the parallel Australian position. In Australia we collect and use personal information for the purposes below because they are reasonably necessary for our functions and activities, and we use it for those purposes and directly related purposes you would reasonably expect (APP 3 and APP 6).
| Purpose | Data used | UK / EU lawful basis | Australia (APP) |
|---|---|---|---|
| Create and run your account; deliver and store reports in your Library | Account & identity; order data | Performance of a contract with you (Art 6(1)(b)) | APP 3 / APP 6 — primary purpose |
| Take payment and issue invoices | Payment data; account & identity | Contract (Art 6(1)(b)); legal obligation for tax records (Art 6(1)(c)) | APP 3 / APP 6 |
| Provide support and handle disputes | Account & order data | Contract (Art 6(1)(b)); legitimate interests (Art 6(1)(f)) | APP 6 |
| Keep the Marketplace secure and prevent fraud | Technical data; account data | Legitimate interests (Art 6(1)(f)) | APP 6 |
| Improve our reports and services (in aggregate) | Order & technical data | Legitimate interests (Art 6(1)(f)) | APP 6 |
| Send marketing you have opted in to | Account & identity; marketing preferences | Consent (Art 6(1)(a)) | APP 7 + Spam Act consent |
| Comply with law and enforce our terms | As needed | Legal obligation (Art 6(1)(c)); legitimate interests (Art 6(1)(f)) | APP 6 |
4.1Legitimate interests. Where we rely on legitimate interests, we have weighed them against your rights. You can object (clause 11).
5.Marketing
5.1Opt-in, off by default. The order form includes an optional marketing consent that is off by default. We only send marketing where you opt in, or where the law otherwise allows (for example, to an existing business customer about similar products, where permitted, with an opt-out on every message).
5.2Australia. We comply with the Spam Act 2003 (Cth): we send commercial electronic messages only with consent, identify ourselves, and include a working unsubscribe.
5.3United Kingdom and European Union. We comply with PECR (United Kingdom) and the ePrivacy rules (European Union) and the GDPR: consent where required, clear identification, and an easy opt-out.
5.4Opting out. You can opt out at any time using the unsubscribe link or by contacting us. Opting out of marketing does not stop service messages about your orders.
6.Personal data inside reports
6.1Reports can contain personal data. Government procurement data can include personal data, such as the names of sole traders or of individual contacts recorded in source data. A report may therefore contain personal data.
6.2Lawfulness of the source. We take reasonable steps to ensure the data we use is obtained and used lawfully, drawing on government open data published for reuse and on licensed data used within the provider’s permitted purposes.
6.3The buyer’s role. Once we deliver a report, the buyer decides how to use any personal data in it and becomes an independent controller (or an APP entity in its own right) for that use. The buyer’s obligations are set out in the Marketplace Terms & Conditions. If you are an individual named in source data and want to know how we handle data about you, contact us using clause 1.4.
7.Who we share your data with
7.1We share personal data with service providers who help us run the Marketplace, each under a contract that limits their use of it to our instructions:
- Payment: Stripe (card processing). Stripe handles card data under its own terms and privacy notice
- Cloud hosting: Sydney, Australia.
- Email and report delivery: Microsoft Inc
- Analytics: Elastic
- CRM and support: HubSpot
7.2Other disclosures. We may disclose personal data where the law requires it, to protect our rights, or in connection with a sale or reorganisation of our business (subject to this policy).
7.3We do not sell your personal data.
8.International data transfers
8.1Where your data is stored. We are based in Australia and use service providers that may store or process data in Australia, the United Kingdom, the European Union or elsewhere. [Confirm the primary hosting location.]
8.2Australia (APP 8). Before we disclose personal information to an overseas recipient, we take reasonable steps to ensure the recipient handles it consistently with the APPs, or rely on another basis permitted by APP 8.
8.3United Kingdom. Transfers out of the United Kingdom are made under an approved mechanism, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or to a country the United Kingdom recognises as adequate.
8.4European Union. Transfers out of the European Economic Area are made under an approved mechanism, such as the European Commission’s Standard Contractual Clauses, or to a country the European Commission recognises as adequate, with additional safeguards where needed.
8.5Copies. You can ask us for details of the safeguards we use, using clause 1.4.
9.Automated decision-making and use of algorithms
9.1How reports are produced. Reports are produced by automated post-processing of structured procurement data, supplemented by licensed data. Custom report requests are reviewed by a person against data coverage before any charge (the coverage gate).
9.2No solely-automated decisions with legal or similar effect. We do not make decisions about you that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing without human involvement. Our automated processing produces intelligence about suppliers, agencies and tenders, not decisions about you.
9.3Australian transparency (from 10 December 2026). Where and to the extent the automated-decision transparency requirements of the Privacy Act 1988 (Cth) apply to us, we will describe in this policy the kinds of personal information used and the kinds of decisions made or substantially assisted by a computer program. We keep this section under review ahead of and after those requirements taking effect.
9.4United Kingdom and European Union. You have rights in relation to solely automated decisions with legal or similarly significant effect under Article 22 of the UK and EU GDPR; as noted in clause 9.2, we do not make such decisions about you.
10.How long we keep your data
10.1We keep personal data only as long as we need it:
- Account & identity: for as long as you have an account, then 12 months after closure, unless we must keep it longer.
- Order data and delivered reports: kept in your Library while your account is open; retained for 7 years for record, warranty and tax purposes.
- Payment and invoice records: retained only to the extent necessary for accounting, taxation, fraud prevention and legal compliance. We generally do not retain full payment card details where payments are processed by a third-party payment provider.
- Marketing preferences: kept until you change them, and an unsubscribe record kept to honour your choice.
- Security and audit records: generally retained for up to 24 months, unless a longer period is reasonably necessary for security investigations, fraud prevention or legal compliance.
10.2Deletion on request. You can ask us to delete personal data we no longer need (clause 11). We may keep the minimum needed to meet a legal obligation, resolve a dispute or enforce our terms.
11.Your rights
11.1Subject to the law that applies to you, you can:
- Access the personal data we hold about you and ask for a copy;
- Correct data that is wrong or out of date;
- Delete data we no longer need (UK / EU erasure; and see clause 10.2);
- Object to or restrict certain processing, including direct marketing (UK / EU);
- Port data you gave us to another provider where the GDPR right applies (UK / EU); and
- Withdraw consent at any time, without affecting processing already done.
11.2How to exercise a right. Contact us using clause 1.4. We may need to verify your identity. We respond within the time the law allows (in the United Kingdom and European Union, normally within one month; in Australia, within a reasonable period). We do not charge, unless the law allows a fee for an access request.
11.3If we say no. If we refuse a request (for example an access request we may lawfully refuse), we will explain why and how to complain.
12.Cookies and analytics
12.1The Marketplace and order form use cookies and similar technologies for essential functions and, where you agree, for analytics.
12.2United Kingdom and European Union. We ask for your consent before setting non-essential cookies, in line with PECR and the ePrivacy rules, and you can change your choices at any time.
12.3Australia. We explain our use of cookies and analytics and, where they involve personal information, handle it under this policy.
13.How we protect your data
13.1We use technical and organisational measures appropriate to the risk, including access controls, encryption in transit, and limiting who can access personal data. No system is perfectly secure, but we take reasonable steps to protect your data and to detect and respond to incidents. Where the law requires, we will notify affected individuals and the relevant regulator of an eligible data breach.
14.Complaints
14.1Talk to us first. If you are unhappy with how we handle your data, contact us using clause 1.4 and we will investigate.
14.2Regulators. You can also complain to:
- Australia: the Office of the Australian Information Commissioner (OAIC), oaic.gov.au;
- United Kingdom: the Information Commissioner’s Office (ICO), ico.org.uk;
- European Union: the data-protection supervisory authority in your country.
15.Changes to this policy
15.1We may update this policy. We will post the current version on the Marketplace and, where a change materially affects you, take reasonable steps to tell you. The version and date are on the cover.
