Privacy Policy

1. Who we are

KimonBids is a product of Kimon Services (UK) Ltd, a company registered in England and Wales. In this policy "we", "us", and "our" refer to Kimon Services (UK) Ltd. We are the data controller for personal data collected through the KimonBids platform and website.

2. What data we collect

We collect the following categories of personal data:

• Account information: name, email address, company name, job title
• Profile information: business sector, capabilities, certifications, typical contract values
• Usage data: pages visited, features used, search queries, tender interactions
• Communication data: emails and messages you send to us
• Payment information: processed by our payment provider; we do not store card details
• Documents you upload: bid documents, tender responses, and supporting files, which our AI language-model provider processes to help draft and match your bids
• Technical data: IP address, browser type, device information, cookies

3. How we use your data

We use your personal data to:

• Provide and improve the KimonBids platform
• Match your profile against tender opportunities
• Send you relevant tender alerts and platform notifications
• Process documents you upload through an AI language-model provider to draft and score bids
• Deliver notifications to your connected channels, such as a Slack or Microsoft Teams workspace where you have set one up (we store the connection securely and in encrypted form)
• Process your subscription and manage your account
• Provide customer support
• Comply with legal obligations
• Send marketing communications (where you have consented or we have a legitimate interest)

4. Legitimate Interests and Cold Outreach

Where we contact business decision-makers about KimonBids without prior consent, we rely on the legitimate-interest basis under PECR Regulation 22 (the corporate-subscriber exception) and Article 6(1)(f) of the UK GDPR. The controller for this processing is Kimon Services (UK) Ltd, registered at 71-75 Shelton Street, London, WC2H 9JQ and listed in the Information Commissioner’s Office data-protection register under number ZB664518. A full Legitimate Interests Assessment is held on file and reviewed quarterly.

Safeguards we apply to every cold message: a PECR sole-trader classifier blocks sole traders, partnerships, limited partnerships, Scottish partnerships, and personal mailbox addresses (gmail.com, hotmail.com, outlook.com, yahoo.com, btinternet.com, icloud.com, and similar) before the email is ever queued; our suppression registry records a single bounce or complaint and applies it globally across all channels; every cold email carries a one-click unsubscribe header and a visible link in the body; and corporate domains the Companies House record does not identify as a corporate subscriber are not contacted.

You have the right to object under Article 21 of the UK GDPR. To object, write to privacy@kimonbids.com and we will suppress your email address permanently across every channel, including any future re-acquisition of the same address.

Data we hold about people we contact

This section explains, in plain English, what we hold about business people we may contact about KimonBids who are not yet our customers, where it comes from, why we hold it, and how you can object. It is provided to meet our transparency duty under Article 14 of the UK GDPR, which applies when we obtain data about you from a source other than you directly.

What we hold: your name, your business role or job title, and business contact details such as a work email address and the name of the company you are connected to. We do not build profiles of your personal life, and we do not knowingly hold data about sole traders or personal mailbox addresses (our classifier blocks those before any contact).

Where it comes from: public and business-data sources. These include public company registers such as the Companies House officer records (which list company directors and their roles), the record of UK public contracts that companies have bid for or won, and business-data enrichment services that supply verified business contact details. We describe our suppliers by category rather than by name in line with our sub-processor policy in section 6.

Why we hold it (our lawful basis): we process this data on the basis of our legitimate interests under Article 6(1)(f) of the UK GDPR, namely to tell relevant UK businesses about a product that helps them find and win public sector contracts. We have weighed this against your rights in a documented Legitimate Interests Assessment, and we apply the safeguards described in section 4 above, including the PECR corporate-subscriber rules.

How long we keep it: we keep prospect data only for as long as it is useful for outreach and no longer than necessary. If you ask us to stop, or if an address bounces or a complaint is received, we suppress the record permanently. Records that are never converted into a customer account are reviewed and removed when they are no longer relevant.

Your right to object: you can object at any time under Article 21 of the UK GDPR. Write to privacy@kimonbids.com and we will suppress your details permanently across every channel, including any future re-acquisition of the same details. You also have the other rights set out in section 8 below, including the right to see what we hold and to have it corrected or deleted.

5. Legal basis for processing

We process your personal data under the following legal bases:

• Contract performance: to provide the services you have subscribed to
• Legitimate interests: to improve our platform, prevent fraud, contact relevant businesses about our product, and send relevant marketing
• Legal obligation: to comply with applicable laws and regulations
• Consent: for optional marketing communications and non-essential cookies

6. Data sharing and sub-processors

We do not sell your personal data. We share data only with:

• Service providers who help us operate the platform, described by category rather than by name: cloud hosting, email delivery service, payment processor, analytics, AI language-model provider, business-data enrichment services, and notification delivery
• Law enforcement or regulators where legally required
• Professional advisers (legal, financial) bound by confidentiality obligations

All third-party processors are bound by data processing agreements and GDPR-compliant data protection standards. We list our sub-processors by category, not by vendor name; we can provide the current list of named sub-processors on request.

7. Data retention

We retain your personal data for as long as your account is active. If you cancel your account, we retain your data for 30 days to allow export, then delete it. We may retain some data for longer where required by law or for legitimate business purposes such as tax records (typically 7 years). Prospect data we hold about people we have not yet contacted or converted is retained only as described in the "Data we hold about people we contact" section above.

8. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data (right to erasure)
• Restrict or object to processing
• Data portability
• Withdraw consent at any time where processing is based on consent
• Lodge a complaint with the Information Commissioner's Office (ICO)

To exercise any of these rights, contact us at privacy@kimonbids.com.

9. Cookies

We use cookies and similar technologies to operate the platform and understand how it is used. For full details, see our Cookie Policy.

10. Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit and at rest, access controls, and regular security reviews. Where you connect a third-party channel such as Slack or Microsoft Teams, the connection details are stored in encrypted form.

11. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email or via a notice on the platform. Continued use of KimonBids after changes are posted constitutes acceptance of the updated policy.

12. Contact us

For any questions about this policy or how we handle your data, contact us at privacy@kimonbids.com or write to: Kimon Services (UK) Ltd, 71-75 Shelton Street, London, WC2H 9JQ.