Privacy policy

TenderStandard UK, UK FM Tender Toolkit. Last updated 19 May 2026.

1. Who we are

TenderStandard UK operates tenderstandard.co.uk and sells the UK FM Tender Toolkit. It is operated by Martin Orr, trading as TenderStandard UK, from 59 Neilston Road, Paisley, Scotland. Contact us through the support form or at hello@tenderstandard.co.uk. Company, VAT and ICO registration details are published if they apply.

2. What data we collect

When you use the website or buy the toolkit, we may process:

Name, email address, order details and refund status.
Billing details needed by Whop or Stripe for payment, tax and fraud checks.
Support emails and contact form messages you send to us.
First-party website analytics: page viewed, referring site, campaign tags, device category, approximate country, scroll depth, time on page and clicks on key links such as guide links and checkout buttons.
First-party website optimization data: which page variant was shown and whether that session reached pricing or checkout.
TenderStandard Pro account data if you use the dashboard: hashed purchase email, email domain, company opportunity profile, saved tender notices, pipeline status, notes, digest preference and bid/no-bid scoring inputs.
Bid production workspace data if you use those tools: evidence vault entries, pasted tender-text excerpts, generated compliance matrix rows, bid-pack notes and draft excerpts submitted to the review engine.

We do not store raw IP addresses in the analytics database. Visitor identifiers are hashed server-side and used only for aggregate reporting. Order webhooks from Whop are stored with hashed customer identifiers rather than raw email addresses in the analytics database.

If you remove a saved opportunity from your Pro account, the related bid room, bid/no-bid decision, tender breakdown, compliance matrix, bid pack and review records are deleted from the account workspace. Evidence vault items can be deleted separately from the dashboard.

3. Why we process data

To deliver purchases and support customers: performance of a contract.
To keep tax and accounting records: legal obligation.
To respond to support, prevent abuse and improve the website: legitimate interests.
To understand whether visitors can find the right information before checkout: legitimate interests.

4. Who we share data with

Payments and product delivery are handled by Whop and Stripe. Support email is handled through our email provider. Contact form messages are stored in our access-protected Cloudflare database so we can respond even if email forwarding is delayed. We may share records with accountants, HMRC or regulators where required by law. We do not sell personal data or use third-party advertising trackers.

4a. International transfers

Some processors, including Whop, Stripe, Cloudflare or email providers, may process data outside the UK. Where this happens, we rely on the provider's UK GDPR transfer safeguards, such as an adequacy decision, the UK International Data Transfer Agreement or the UK Addendum to Standard Contractual Clauses.

5. Website analytics

The analytics system is first-party and runs on Cloudflare infrastructure for TenderStandard UK. It is designed to show aggregate website behaviour, including popular pages, visitor flow, checkout clicks and likely points of friction.

The analytics system does not record keystrokes, form-field contents, payment details, full card numbers, private tender data or raw IP addresses.

We may run controlled page variants and aggregate optimization analysis to improve the website. Variants are used to compare outcomes such as pricing views, checkout clicks and completed orders; they do not make legal, credit, employment or similarly significant decisions about visitors.

Optional first-party analytics and page testing only start after you accept analytics storage. See the cookie and storage notice for storage names, purposes and preference controls.

6. How long we keep data

Order, refund and tax records: normally six years.
Support email and contact form messages: normally 24 months from the last reply.
Pro dashboard account, company profile and saved pipeline data: while the account is active or until deletion is requested, subject to legal records we must keep.
Website analytics: normally up to 14 months.

7. Your rights

Under UK GDPR you may ask to access, correct, delete, restrict or object to processing of your personal data, subject to legal record-keeping duties. You may also complain to the Information Commissioner's Office.

To exercise your rights, use the support form or email hello@tenderstandard.co.uk.

8. Security

We use HTTPS, Cloudflare security controls, access-protected analytics, and payment processors that handle card data directly. No system is perfectly secure, but we keep access limited and avoid collecting unnecessary data.

9. Changes

We will update this page if our privacy practices change materially.