Legal
TenderWinnow privacy notice
Last updated: 21 July 2026
Who controls personal data
NAVENE LABS LIMITED (company number 17350926), trading through the TenderWinnow brand, is the controller for personal data processed by TenderWinnow.
Contact: navenelabs@gmail.com
Address: 98 Woodford Lane, Cheshire, CW7 2JU
Data we process
- Account data, including email address, account identifiers, verification status and business workspace identifier.
- Capability-profile data, including services, sectors, contract-value preferences, regions, exclusions and digest preferences.
- Service activity, including tender matches, shortlist or dismissal choices, usage counts and service-delivery events.
- Feedback and support communications, including the message, category, route, app version and optional non-sensitive diagnostics submitted with feedback.
- Billing records, including Stripe customer, subscription, invoice, refund and dispute identifiers; plan and subscription status; amounts and currency; and Stripe-hosted receipt or invoice links. TenderWinnow does not receive full card details.
- Technical and security data, including request, error and authentication logs. We do not intentionally use customer content in application error logs.
Please do not submit identity documents, payment-card details, special-category data or confidential tender material in a profile or feedback unless we explicitly request it through a suitable secure channel.
Why we use it and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Create and authenticate an account; provide profiles, matching, billing and support | Performance of a contract or steps requested before a contract |
| Secure, monitor, troubleshoot and improve TenderWinnow; measure aggregate product use; prevent misuse | Our legitimate interests in operating a secure and useful business service, balanced against user rights |
| Maintain payment, tax, dispute and compliance records; respond to legal rights | Legal obligation and, where applicable, our legitimate interests in establishing or defending claims |
| Send optional product marketing | Consent, where required |
TenderWinnow uses automated and AI-assisted matching to recommend tenders. It does not make decisions that produce legal or similarly significant effects: the customer decides whether and how to pursue an opportunity.
Who receives data
We use service providers acting under contract, including:
- Amazon Web Services for hosting, authentication, databases, email delivery and operational logging. The primary application region is London (
eu-west-2). - Stripe for hosted Checkout, subscription management, receipts, refunds and disputes.
- OpenAI for bounded AI-assisted refinement of leading tender candidates. Relevant capability-profile and public tender content may be included in a request; payment-card data is not sent.
We may also disclose data where required by law, to protect legal rights, or in a business reorganisation subject to appropriate safeguards. We do not sell personal data.
Some providers may process data outside the UK. Where UK data-protection law requires it, we rely on an adequacy regulation or approved contractual safeguards and associated transfer assessment. Further information can be requested from navenelabs@gmail.com.
Retention
Current operational logs are configured for 14 to 90 days, depending on the function. OpenAI daily budget evidence expires after approximately 90 days. Account, profile, feedback, matching, billing and service-delivery records remain available while an account is active.
After an authenticated deletion request, access is disabled and applicable account and service data is deleted or anonymised without undue delay and normally within one month. A non-personal completion record expires after approximately 31 days. Billing, accounting, fraud-prevention and dispute evidence is separated from the deleted account and may be retained for up to six years where required for UK accounting or legal claims.
Your rights
Depending on the circumstances, people may have rights to access, correct or erase their personal data; restrict or object to processing; receive portable data; and withdraw consent. A person may also object to processing based on legitimate interests. To exercise a right, email navenelabs@gmail.com. We may need proportionate information to verify the request.
A concern can also be raised with the UK Information Commissioner's Office at ico.org.uk.
Security
TenderWinnow uses access controls, encryption provided by its cloud services, tenant-scoped records, log redaction and restricted service permissions. No internet service can guarantee absolute security. Please report a suspected security issue to navenelabs@gmail.com without including secrets in the initial message.
Cookies and browser storage
TenderWinnow uses browser storage and authentication mechanisms needed to sign users in and operate the service. We do not use advertising cookies or third-party behavioural advertising. If we introduce non-essential tracking, we will update this notice and seek consent where required.
Changes and contact
We may update this notice as the beta changes. Material changes will be highlighted through the service or account contact where appropriate. Questions and privacy requests should be sent to navenelabs@gmail.com.