Legal / UK
Privacy Notice
Last updated: 2 September 2026
Who is responsible for your information
George Hailey trading as CompositeBid is the controller of personal information processed through this website under the UK GDPR and the Data Protection Act 2018. For data protection questions or to exercise your rights, email hello@compositebid.com.
Information we collect
We collect the business and contact information you provide in buyer RFQs, Small Project enquiries, supplier applications, capacity registrations, support requests and material forms. This can include names, company details, work contact details, locations, manufacturing requirements, capabilities, processes, capacity and material information.
Approved supplier users, and buyers invited after an opportunity has been approved, have authentication accounts. We process the authentication and session information needed to sign users in, enforce opportunity-specific access and support account deletion. We also process supplier interests, opportunity-scoped text messages, read/unread state, message delivery records and any message a participant formally reports for moderation. We also process limited request, submission-time and anti-spam information needed to operate and protect the website.
Do not submit special-category personal data, criminal-offence data, classified information, UK export-controlled technical data, US ITAR or EAR-controlled data, trade secrets, or information you are not authorised to share.
Why we use it and our lawful bases
- To respond to enquiries, assess supplier applications and take steps requested before a possible business arrangement.
- To create and secure approved supplier accounts, provide supplier-only access, create invited buyer access limited to explicitly linked opportunities, and honour account or notification preferences.
- To match published, non-confidential Commercial RFQ and Small Project summaries with active suppliers using recorded industries, capabilities and processes. Matching suggests relevant opportunities; it does not award work or make a decision with legal or similarly significant effects.
- To record supplier interest, allow an authorised buyer or administrator to accept or reject it, and provide private text-only messaging within the relevant approved opportunity.
- To send generic new-message alerts. These emails identify only an RFQ reference and never include message text or participant contact details.
- To send matched Commercial RFQ or Small Project email alerts where a supplier has selected instant alerts for that separate feed. Suppliers can select either type of email notification off when applying and can change each preference later.
- To prevent misuse and keep proportionate operational, security and delivery records where this is necessary for our legitimate interests and does not override individual rights.
- To comply with legal obligations and establish, exercise or defend legal claims where necessary.
Submitting a form asks us to use the information for the relevant enquiry. We do not rely on that submission as consent for unrelated marketing.
Who we share it with
Access is limited to people who need the information to operate CompositeBid. Cloudflare supports website hosting and security, Supabase provides database and authentication services, and Resend delivers operational and matched-opportunity notification emails. We may also use professional advisers where necessary.
We may share a proportionate, non-confidential business summary with a potentially suitable buyer or supplier when needed to explore an introduction. Buyer contact details, private RFQ or Small Project descriptions, drawings and confidential technical material are not included in supplier alert emails or approved supplier summaries. We do not sell personal information.
RFQs, Small Projects and supplier accounts
A buyer can submit an RFQ without creating an account. The submission remains private while it is reviewed. Only a separately prepared and approved non-confidential summary can be published to matching active suppliers.
A buyer can also submit a Small Project without creating an account. Low or unestablished budgets require a setup-cost acknowledgement, and every Small Project remains private until a separate approved summary is expressly published by an administrator.
Supplier applications do not automatically create portal access. If an application is approved, an authentication account can be linked to that supplier profile. Account approval means access to the supplier area; it is not certification, due diligence or a guarantee of capability.
After an approved opportunity is published, CompositeBid may invite the submitter at the verified submission email to create buyer access. Access is not created silently and is limited to opportunities explicitly linked by an administrator. Accepting supplier interest opens only a controlled, opportunity-specific text conversation. It does not disclose private email addresses, phone numbers, end-customer identity, CAD, drawings or technical files.
Private messaging and reports
Conversation content is available to the authorised buyer and the accepted supplier only. Routine administrator views show operational metadata such as participants, RFQ reference, message counts, timestamps and delivery status, not ordinary message bodies. If a participant reports a specific message, the reported content and a limited amount of surrounding context are copied into a restricted moderation record and the review action is audited.
How long we keep it
CompositeBid does not currently use an automatic deletion schedule for public form submissions. Records are reviewed manually and kept only for as long as reasonably needed to handle the relevant enquiry, operate and secure the platform, resolve disputes or meet legal obligations.
When a supplier deletes their account, the authentication account and active sessions are removed immediately. The linked supplier profile is disabled and its personal and manufacturing details are redacted. Minimal identifiers, timestamps and notification-delivery state may be retained where needed for security, duplicate prevention and audit integrity. This retained information is not used as an active supplier listing.
When an invited buyer deletes their authentication account, their sessions and linked opportunity access are removed and existing conversations become read-only. Original RFQ or Small Project submissions are separate operational records and are not erased merely by deleting login access; verified erasure requests for those records are handled separately.
Buyer RFQs, Small Projects and other public submissions are not linked to an authentication account. Verified deletion requests for those records are handled manually. An opportunity that must be retained for audit integrity can be withdrawn and have its personal or supplier-facing content redacted where appropriate.
International processing
Some infrastructure and email services may process information outside the UK. The current Supabase database region is in the Republic of Korea, which is covered by UK adequacy regulations. Cloudflare and Resend may process information in other locations depending on how their services operate. Their current processing locations and the applicable UK transfer arrangements remain a launch-review item and will be documented as those arrangements are confirmed.
Your UK data protection rights
Depending on the circumstances, you may have rights to be informed, access your information, correct it, ask for erasure or restriction, object to processing, and receive portable data. You can contact us using the email above. You may also complain to the Information Commissioner's Office.
Security and confidentiality
We use proportionate technical and organisational measures and restrict administrative access. However, a public website form is not a secure technical-data room, and submitting information does not create an NDA. Use a separately signed NDA and an approved secure disclosure process before sharing protected technical information.
Changes
We will update this notice when the platform's processing, service providers or retention arrangements materially change.