Privacy Notice — South-West Tender Brief
Last updated: 12 May 2026
This notice explains what personal data South-West Tender Brief collects about you, why, what we do with it, and your rights. It’s written to meet our obligations under the UK GDPR and the Data Protection Act 2018.
1. Who controls your data
The data controller is Frederick Leatham, trading as Jarvis Galliers, a sole trader based in Reading, Berkshire, United Kingdom.
- Contact for any privacy question or request: privacy@swtenderbrief.co.uk (or support@swtenderbrief.co.uk).
- We are registered with the Information Commissioner’s Office (registration reference ZA734883).
2. What we collect, and why
| Data | When we get it | Why (purpose) | Lawful basis |
|---|---|---|---|
| Your email address | When you subscribe (free or paid) | To send you the digest you asked for | Performance of a contract (UK GDPR Art. 6(1)(b)) |
| Your selected trades and postcode areas (paid tier) | At sign-up / when you update them | To filter the weekly digest to opportunities relevant to you | Art. 6(1)(b) |
| Payment-related information — a Stripe customer ID, the fact and amount of your payments, the last 4 digits / card brand Stripe shares with us, billing country | When you pay (paid tier) | To take payment, manage renewals, give refunds, keep tax records | Art. 6(1)(b) for taking payment; legal obligation (Art. 6(1)(c)) for HMRC records |
| Email engagement data — whether a digest was delivered, opened, or a link clicked, and unsubscribe events | When we send you a digest | To run the mailing list, honour unsubscribes, see roughly whether the digest is useful, protect deliverability | Art. 6(1)(b) for list operation; legitimate interests (Art. 6(1)(f)) for the aggregate “is this useful” view — you can object |
| Support correspondence | If you email us | To answer you and keep a record of the issue | Art. 6(1)(b) / legitimate interests |
We do not collect special-category data. We don’t ask for it; please don’t send it.
We do not make automated decisions about you that produce legal or similarly significant effects. Which tenders appear in a digest is selected automatically — but that’s a decision about tenders, not about you.
3. Where your card details go
When you pay, you enter your card details directly into Stripe’s payment form. We never see or store your full card number. Stripe is the payment processor; it acts as our processor for handling the payment and as a controller in its own right for fraud-prevention and its regulatory obligations. Stripe’s privacy policy: https://stripe.com/privacy.
4. Who else we share it with (our processors)
We keep the list short on purpose:
- Stripe — payment processing (paid tier only). Where Stripe processes data outside the UK, it does so under the UK’s international transfer safeguards.
- Resend — sends the digest emails on our behalf and provides delivery/open/click and unsubscribe handling. It processes your email address and engagement data as our processor under a data-processing agreement, including via infrastructure outside the UK under appropriate safeguards.
- GitHub (GitHub Pages) — hosts this website; sees standard server-log information (IP address, timestamp) for requests to the site, kept briefly for security. We don’t run advertising or third-party analytics trackers on the site.
We don’t sell your data, don’t share it for anyone else’s marketing, and don’t use it to build profiles for advertising. We may disclose data if we’re legally required to (e.g. a valid request from HMRC or a court).
5. How long we keep it
- While you’re subscribed: for as long as you have a free or paid subscription.
- After you unsubscribe / cancel: we remove your email and filter preferences from the active mailing list promptly, and in any event within 30 days, unless you’ve asked us to keep you on the free tier.
- Payment and tax records: kept for 6 years after the end of the relevant tax year, because HMRC requires it. Kept minimal (amounts, dates, Stripe IDs) — not your card details.
- Support emails: kept for up to 2 years then deleted.
- Suppression list: if you unsubscribe, we keep a minimal record (a hash of your email) so we don’t accidentally email you again — you can ask us to delete even that.
6. Cookies / website
The South-West Tender Brief website is a simple static site. It does not set advertising or cross-site tracking cookies. The Stripe checkout pages set their own cookies, governed by Stripe’s policy. If we ever add analytics, we’ll update this notice and ask for consent where required.
7. Your rights
Under the UK GDPR you have the right to: access the personal data we hold about you; have inaccurate data corrected; have your data erased where it applies (for the digest, that’s as simple as unsubscribing, but you can also ask us to wipe everything including the suppression hash); restrict or object to processing in certain circumstances (including objecting to the legitimate-interests engagement-analytics use); data portability; and to withdraw consent where we rely on it.
To exercise any of these, email privacy@swtenderbrief.co.uk. We’ll respond within one month. We won’t charge you (unless a request is excessive or repetitive). We may need to confirm your identity (e.g. that you control the email address).
8. Complaints
If you’re unhappy with how we’ve handled your data, please tell us first — privacy@swtenderbrief.co.uk. You also have the right to complain to the UK regulator:
Information Commissioner’s Office — https://ico.org.uk/make-a-complaint/ — helpline 0303 123 1113 — Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
9. Changes to this notice
If we change this notice in a way that matters to you, we’ll tell you by email and/or in a digest. The “last updated” date at the top always shows the current version.
Controller: Frederick Leatham trading as Jarvis Galliers, sole trader, UK. Tender data contains public sector information licensed under the Open Government Licence v3.0.