1. Controller
Bid Champions Ltd is the controller for personal information processed through Market Accord unless a project-specific notice identifies another arrangement. Contact: hello@marketaccord.co.uk.
2. Information we may collect
- Identity, role, organisation, contact and correspondence information.
- Application, buyer-challenge, expert, partnership, evidence and correction information.
- Project administration, attendance, actions, operating evidence, review and complaint records.
- Research consent, interview, survey, observation and publication choices.
- Registry information about legal operators, roles, funding, conflicts and status.
- Optional marketing preferences.
- Technical security information such as IP address, request time, page, user agent and server error logs generated by hosting systems.
3. Why we use it and lawful bases
| Purpose | Typical lawful basis |
|---|---|
| Respond to enquiries and assess applications or challenges | Legitimate interests and steps requested before a possible agreement |
| Administer a programme, pilot or service | Contract, legitimate interests and legal obligations |
| Conduct research and publish learning | Consent where required; legitimate interests for appropriately controlled organisational research; project-specific basis recorded |
| Maintain a transparent project registry and manage badge status | Legitimate interests, contract and consent where personal publication is optional |
| Send optional research or programme updates | Consent |
| Security, fraud prevention, complaints and legal claims | Legitimate interests and legal obligations |
4. Recipients and processors
Information may be handled by authorised Bid Champions personnel, relevant project specialists, hosting and email providers, technical service providers, professional advisers, and authorities where legally required. At launch, the website is hosted through Namecheap/cPanel infrastructure and form notifications are routed to authorised Bid Champions email systems. A project-specific notice will identify material additional recipients.
5. Research, registry and public information
Support participation does not automatically authorise research, a named case study, registry publication or marketing. Public registry information is agreed and reviewed separately. Where a legal operator is a company, some organisational identity and role information may need to remain public to make the relationship transparent.
6. International transfers
Some technology providers may process information outside the United Kingdom. Where UK data-protection law requires a transfer mechanism, Bid Champions uses the provider's applicable adequacy arrangement, approved contractual safeguards or another lawful mechanism and considers supplementary measures where appropriate.
7. Retention
- General enquiries: normally up to 24 months after the last meaningful contact.
- Unsuccessful or non-progressed applications: normally up to 12 months unless a longer period is needed for a complaint or agreed future contact.
- Project, contract, financial and material decision records: normally six years after completion, or longer where law, insurance or an active claim requires it.
- Research data: the period stated in the research record, ordinarily no longer than seven years for material supporting published findings unless anonymised earlier.
- Marketing preferences: until withdrawal, plus a suppression record to respect that withdrawal.
- Security and server logs: normally 30–90 days unless an incident requires longer retention.
Actual periods may be shortened or extended where the information, risk, law, funding or project agreement requires it.
8. Your rights
Depending on the circumstances, you may have rights to access, correct, erase, restrict, object, receive portable information and withdraw consent. You may complain to the Information Commissioner's Office. Withdrawal does not make earlier lawful processing unlawful and may not remove information that must remain for legal claims, contractual records or a transparent company/project record.
9. Security
Market Accord uses access controls, limited public forms, no public file upload, security headers, rate limiting, logging and separate private configuration. No internet system is risk-free; do not send sensitive material until an appropriate transfer route is agreed.
10. Automated decisions
Market Accord does not use the website to make solely automated eligibility, supplier quality, badge or publication decisions with legal or similarly significant effect. Automated tools may classify source records or assist drafting, but a human reviews material decisions.
11. Changes and contact
Material changes to purposes, processors or public data use will be reflected before the changed activity begins where required. Contact hello@marketaccord.co.uk with “Privacy” in the subject.