What I hold, where it came from, and how to make me stop. Written to be read, not to be survived.
Last updated 4 September 2026
The Bid Room is a trading name of Fenris Ltd, registered in England and Wales, company number 17066052, registered office 71–75 Shelton Street, Covent Garden, London WC2H 9JQ.
Fenris Ltd is the data controller for everything described here. There is no data protection officer — the business is one person, and that person is Sigitas Kasperavicius.
Everything on this page can be actioned by email: hello@thebidroom.co.uk.
This site sets no cookies. It uses no local storage, runs no JavaScript, has no analytics, no tracking pixels, no advertising tags and no embedded third-party content. Nothing is stored on your device and nothing about your visit is sent anywhere else.
That is why there is no cookie banner. Nothing is written to your device and nothing is collected for analytics, advertising or profiling. The server does keep ordinary web logs, which necessarily include the IP address and browser type your device sends with every request — that is how the page reaches you and how the site is kept secure.
You can check this yourself — open your browser's developer tools, look at Application → Cookies and at the Network tab, and you will find an empty cookie store and no request leaving this domain. The typefaces are served from this server rather than from Google, so even font loading tells no one that you were here.
The server keeps ordinary web logs — IP address, time, page requested, browser type — which exist so the site can be operated and kept secure. The lawful basis for those logs is Article 6(1)(f) — legitimate interests, namely operating the site and keeping it secure. They are held by the hosting provider, Hostinger, and deleted on its rolling schedule; I keep no copy of my own, never use them to build a profile, and never use them to identify you. If you want the exact period, ask and I will get it in writing from Hostinger and tell you. If you contact me, your email is held in a mailbox with the same provider.
If you send me a notice reference, a tender, a brief or a question, I hold what you send and our correspondence about it. I use it to answer you and, if we go on to work together, to do the work.
The lawful basis is Article 6(1)(b) — steps taken at your request before entering a contract, and then performance of that contract.
If the work involves your staff — CVs, named managers, training records, case studies — I am acting on your instructions as a processor, and the terms of the engagement say so. That material is used only to write your bid, is not reused for any other client, and is deleted when the engagement ends unless you ask me to keep it for a re-bid.
This is the part that matters most, and it is the part most privacy notices bury. If you received an email from me that you did not ask for, here is exactly where your details came from and what I did.
| What I hold | Where it came from |
|---|---|
| Your organisation's name, and whether it is a limited company | The public register at Companies House |
| That you are a CQC-registered care provider, your location and local authority area | The CQC Care Directory, published as open data by the Care Quality Commission under the Open Government Licence v3.0. This site uses CQC information |
| A business email address, and sometimes a named contact | Your own website, or a list published by a local authority — for example a council's approved-provider list for home care, published on its own website |
| A live tender opportunity relevant to you | Find a Tender and Contracts Finder, the government's public procurement services |
Every source is public. I do not buy lists, I do not scrape social media, and I do not use data brokers or credit reference agencies.
Where the address identifies a person, the lawful basis is Article 6(1)(f) — legitimate interests. My interest is in offering a service to organisations that plainly need it; the interference with you is a single email to a work address about a contract in your sector. I have written this assessment down and will send you a copy if you ask.
Where an address is a role address such as info@ and I have no name for a person behind it, I am not processing personal data and the UK GDPR does not apply to that address. The electronic marketing rules below still do, and your right to object still works.
Separately, the Privacy and Electronic Communications Regulations allow marketing email to corporate subscribers — companies, limited liability partnerships, Scottish partnerships, corporations sole, and any other body corporate that is a legal person distinct from its members, which includes registered societies — without consent. Sole traders and ordinary partnerships count as individuals under those rules, and I do not send them unsolicited email. Before any address is used I check legal form against the Companies House number published in the CQC’s own care directory.
If you do not reply, I delete your details — including the email I sent you — within six months. If you get in touch but we do not end up working together, I keep the correspondence for twelve months and then delete it. If you ask me to stop, I keep only your email address on a suppression list — permanently, because that is the only way to guarantee I never contact you again. I keep it because data protection law requires me to honour your objection, and it is used for nothing else.
You have an absolute right to object to direct marketing. You do not have to give a reason, and I do not get to weigh it against anything. If you object, I must stop, and I will.
Reply to any email from me with "stop", "no thanks", or anything else that makes the point, or write to hello@thebidroom.co.uk. It takes effect the day I read it.
There is normally no charge, and I will respond within one month. If a request is unusually complex, or you make several, I may extend that by up to two further months — I will tell you inside the first month and say why. If you ask for further copies of the same information, I may charge a reasonable fee based on what it costs me to produce them.
You have a statutory right under section 164A of the Data Protection Act 2018 to complain to me directly. Email hello@thebidroom.co.uk with “Data protection complaint” in the subject line. I must acknowledge it within 30 days, and I must then respond and tell you the outcome without undue delay. If you would rather not, or if you are not satisfied, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to come to me first.
No automated decision-making. Nothing about you is decided by a machine without a person involved. I use AI tools to help draft documents — that is stated openly on the main site — but the decision to contact you, to take on work, or to say no, is mine.
Where your data is. Website hosting and email are provided by Hostinger, and mail is stored on servers in the EEA or the UK. Where I use AI tools to help draft a bid, your material — including any staff names, CVs or training records inside it — is processed by a commercial AI provider acting as my sub-processor, under terms that prohibit training on it and permit its use only for your engagement. Ask me and I will tell you which provider is used on your work. Some of that processing takes place outside the UK. There are no adequacy regulations under Article 45A of the UK GDPR covering it, so I rely on the International Data Transfer Addendum to the EU Standard Contractual Clauses, issued by the Information Commissioner, or another safeguard approved under UK data protection law. Email me and I will tell you which applies and send you a copy. I do not transfer your personal data to anyone for their own purposes, and I never sell or share it.
Confidential material. Tender documents you send me are commercially sensitive and are treated as confidential. They are not shared, republished, or used as samples for anyone else.
The date at the top is the date this version was published. If something material changes I will change that date, and if it affects people I have already contacted I will tell them.