UK GDPR &
DPA 2018.

1. Data controller

Honey-B2024 Ltd, registered in England & Wales, trading as Bidsmith. Registered office: 86–90 Paul Street, London EC2A 4NE. ICO registration available on request.

2. Lawful basis

We process personal data under Article 6(1)(b) (contract performance) and Article 6(1)(f) (legitimate interests) of the UK GDPR, in line with the Data Protection Act 2018. Marketing communications rely on Article 6(1)(a) consent and PECR.

3. Your rights

• Right of access (DSAR)
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object
• Rights regarding automated decision-making and profiling

4. Data residency & transfers

Customer tender data is hosted in the UK / EEA. Where transfers outside adequacy regions are necessary, we rely on the UK International Data Transfer Agreement (IDTA) and Standard Contractual Clauses (SCCs) with a Transfer Risk Assessment.

5. Retention

Bid drafts and account data are retained for the duration of the contract plus 6 years to satisfy UK statutory limitation periods, then securely deleted.

6. Sub-processors

We use vetted sub-processors for hosting, AI inference and analytics. A current list is available on request and forms part of our Data Processing Agreement (DPA).

7. Exercising your rights

Submit DSARs or any privacy request to Info@bidsmith.co.uk. We respond within 30 days. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.