Applies to: Everyone who uses the platform.
Who controls your data
The data controller is [to be completed], registered at [to be completed]. [to be completed] — if you handle data about people in the UK or EU, you may need a registered representative and, in the UK, an ICO registration. Confirm this with a qualified adviser.
What we collect
Account details: your name, email address, password (stored only as a cryptographic hash, never in a readable form), and role.
Business details: company name, description, category, location, contact details, and anything else you choose to put on your profile.
Verification documents: the files you upload to prove your business is what it says it is.
Activity: the requests you post, the quotations you send or receive, and the messages you exchange with other users.
Technical data: your IP address and browser user agent, recorded against security-relevant events such as sign-ins and administrative actions.
Why we hold it
To provide the service — showing your profile to buyers, delivering requests to relevant suppliers, and carrying your messages.
To verify businesses, so that other users can rely on the verified mark.
To keep the platform safe — detecting abuse, investigating reports, and keeping an audit record of administrative decisions.
To send you service messages such as email verification, password resets, and notifications about your requests and quotations.
Who can see what
Your public company profile and published listings are visible to anyone, including search engines. Do not put anything on your public profile you would not want indexed.
Your verification documents are private. They are visible only to you and to the administrator reviewing your case. They are never shown to other users and are never served without an authorisation check.
Your messages are visible only to the participants in that conversation, and to an administrator investigating a report.
Cookies and tracking
We set one cookie: a session cookie that keeps you signed in. It is strictly necessary for the service to work.
We do not use third-party advertising or analytics cookies, and we do not embed third-party trackers. Our usage statistics are counted on our own servers and are not shared with anyone.
Sharing
We do not sell personal data.
We use service providers to run the platform — hosting, database, object storage for uploaded files, and an email relay for transactional messages. They process data on our instructions only.
We may disclose data where we are legally required to, or where it is necessary to investigate a serious safety or fraud concern.
Where data is held
Our infrastructure is hosted at [to be completed]. Where data is transferred outside the country you are in, an appropriate safeguard must be in place — confirm the mechanism with a qualified adviser once your hosting region is fixed.
How long we keep it
Account and business data: for as long as your account is open, and for a limited period afterwards so we can resolve disputes and meet legal obligations.
Verification documents: for as long as the verification is relied upon, plus a retention period for audit.
Audit records of administrative decisions: retained, because their purpose is to provide an accurate history.
[to be completed] — set concrete retention periods with a qualified adviser and state them here.
Your rights
Depending on where you live, you may have the right to access the data we hold about you, to correct it, to delete it, to object to or restrict how we use it, and to receive a copy in a portable format.
You can edit most of your data directly in your account. For anything else, contact us and we will respond within the period the law requires.
If you think we have handled your data badly, you can complain to your local data protection authority.
Security
Passwords are hashed with bcrypt. Sessions are signed, and changing your password invalidates sessions issued before the change.
Uploads are checked against their actual file contents, not merely their declared type, and private documents are served only through an authorisation check.
No system is perfectly secure. If you find a vulnerability, please tell us before telling anyone else.