Privacy policy

Who we are

Bukadu Ltd (“Bukadu”, “we”, “us”) provides a service for finding public sector tender opportunities at bukadu.com. We are the data controller for personal data we collect through our website and our service.

Our details:

• Bukadu Ltd, a company registered in England and Wales (company number 17149819)
• Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
• Registered with the Information Commissioner’s Office (ICO), registration reference ZC123107
• For privacy queries or to exercise any of the rights described below: [email protected]

What this policy covers

This policy explains what personal data we collect about you, why we collect it, how we use it, who we share it with, how long we keep it, and what rights you have.

It applies when you use bukadu.com or the Bukadu service. It does not cover other companies’ websites or services we may link to. If you follow a link from Bukadu to another site, please read that site’s own privacy policy.

Your use of bukadu.com and the Bukadu service is also governed by our Terms of Service, which this policy forms part of.

Bukadu is a business-to-business service. By signing up, you confirm that you are using the service in the course of business and not as a consumer.

What personal data we collect, why, and our lawful basis

We collect the following categories of personal data. Under the UK GDPR we have to identify a “lawful basis” for each one — broadly, the legal reason we are allowed to process it.

Where we rely on “legitimate interests”, we have considered whether your privacy interests outweigh ours. We have concluded they do not, because the processing is limited to what is reasonably needed to run and improve the service, and you can object at any time (see “Your rights”).

When you subscribe, your card details are entered directly on Stripe’s secure payment page. We never see or store your full card number — we only receive confirmation from Stripe that your payment succeeded, along with the identifiers we need to manage your subscription.

We do not process special category data (such as health, racial or ethnic origin, political views, or biometric data) as part of providing the service. If a free-text field you fill in happens to contain such information, we will not single it out, build a profile from it, or process it under Article 9 of the UK GDPR.

We do not make any automated decisions about you that produce legal or similarly significant effects.

You choose whether to give us this data, but the service cannot run without some of it. The items above marked “Contract” are needed to create your account and provide the service. You are not legally required to give them to us — but if you do not, we cannot set up or operate your account.

Where we get personal data from

Most of the personal data we hold comes from you directly — when you sign up, fill in your profile, contact us, or use the service.

We also process a small amount of personal data from public sources. Tender notices published by the UK Find a Tender Service (FTS) and the EU Tenders Electronic Daily (TED) sometimes include the name and contact details of procurement officers who are running the tender. We index that data so our users can find and search those notices. We do not build profiles of these individuals, contact them, or use their data outside the context of the original tender notice.

Our lawful basis for processing this publicly available data is our legitimate interests in providing a search service over public procurement information. We weigh that against the fact that the upstream publisher has already made the data public.

The tender notices we index contain a large volume of records, and the named individuals’ contact details are already public on FTS and TED. Notifying each individual directly would involve disproportionate effort, so we rely on Article 14(5)(b) of the UK GDPR and treat this policy as the public notice of our processing. Individuals named in tender notices have the same rights as any other person — see “Your rights” below.

If you are an individual named in a tender notice we have indexed and you would like it removed from our service, please email [email protected]. The notice will usually remain published on the source site (FTS or TED) until those publishers remove it there, so we will also refer you to the original publisher.

How long we keep it

We keep personal data only as long as we need it.

Who we share it with — our processors

We use a small number of trusted suppliers to help us run Bukadu. They process personal data on our instructions, under written contracts that meet UK GDPR Article 28 requirements.

We do not sell personal data, and we do not share personal data with third parties for their own marketing.

We may share personal data with law enforcement or regulators if we are legally required to. We may share personal data with our professional advisers (such as accountants or lawyers) where reasonably needed and under confidentiality obligations.

If Bukadu is ever acquired or merges with another business, personal data may transfer as part of that transaction. We will tell you when your data has been transferred to a new controller and what that means for you.

International transfers

Some of our processors are based outside the UK, or process data outside it. UK data protection law requires that personal data sent outside the UK is protected to a similar standard, so for each processor we rely on a recognised legal transfer mechanism. Here is what we rely on for each one:

• Supabase, AWS, Vercel, and Sentry: data is held in the EEA (Sentry in Germany; the others in eu-west-1, Ireland), which the UK recognises as providing an adequate level of protection. No separate safeguard is needed. (AWS covers our OpenSearch vector index, also eu-west-1.)
• Google (Gemini API): data is processed in the US under the UK extension of the EU-US Data Privacy Framework (Google is certified under it).
• Resend: data is processed in the US under the UK extension of the EU-US Data Privacy Framework (Resend is certified under it).
• Stripe:payment and billing data is processed in the US by Stripe, LLC, under the protections set out in Stripe’s Data Processing Agreement — the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, together with the UK extension of the EU-US Data Privacy Framework.

Your rights

Under the UK GDPR you have a set of rights over the personal data we hold about you. To exercise any of them, email [email protected]. We will respond within one month. If your request is particularly complex or you have made several requests, we may extend that by up to two further months and will tell you why.

• Right of access (Article 15): you can ask us for a copy of the personal data we hold about you. We will carry out a reasonable and proportionate search and provide what we find.
• Right to rectification (Article 16): you can ask us to correct personal data that is inaccurate or incomplete. Most profile fields you can also update yourself in your account settings.
• Right to erasure (Article 17): you can ask us to delete your personal data. We will do so where the law allows. Some data we may have to keep — for example where the law requires it, or data we need to defend a legal claim. We will tell you what we have kept and why.
• Right to restrict processing (Article 18): in certain situations (for example, while we look into a correction request) you can ask us to limit how we use your data.
• Right to data portability (Article 20): you can ask us for a copy, in a structured, commonly used, machine-readable format, of the personal data you provided to us that we process by automated means under your contract or consent. We provide this by email.
• Right to object (Article 21): you can object to processing we carry out on the basis of legitimate interests, including service-improvement analytics. We will stop unless we have a compelling reason that outweighs your interests.
• Right to withdraw consent (Articles 7(3) and 13(2)(c)): where we process your data on the basis of consent, you can withdraw consent at any time. Withdrawing consent does not affect the lawfulness of any processing we carried out before you withdrew it.
• Rights relating to automated decision-making (Article 22): we do not make solely automated decisions about you that have legal or similarly significant effects. Our search ranking is not such a decision — it suggests results to you, but the decisions about which tenders to pursue are made by you.

You can exercise these rights free of charge. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse it, and will explain our reasoning if so.

Cookies and similar technologies

We keep our use of cookies and similar technologies to a minimum. We do not use any advertising cookies, and we do not build a cross-site profile of you.

Strictly necessary cookie. We set one strictly necessary cookie: an authentication session cookie, set by our authentication provider (Supabase), so you stay logged in. Because it is strictly necessary for the service to function, UK rules on cookies (PECR) allow us to set it without asking for consent.

Functional storage on your device. To make the app work smoothly we store a small amount of functional information in your browser’s local and session storage — for example whether you have collapsed the sidebar, a short-lived cache of your most recent search results, a per-tab search-session identifier, and whether you have dismissed certain prompts. This stays on your device, is first-party, and is not used to track you.

Usage analytics (Vercel Web Analytics). We use Vercel Web Analytics, provided by our hosting provider Vercel, to understand aggregate usage of our site such as page views and overall traffic. It is privacy-friendly and cookieless: it does not set advertising cookies, does not store information on your device, and does not build a cross-site profile of you.

Server-side product analytics. We also measure how the service is used by recording events on our server — for example when you click on a tender or save one — worked out from your normal logged-in requests. These events are personal data under the UK GDPR; our lawful basis is our legitimate interest in improving Bukadu, and you can object (see “Your rights”).

Payments (Stripe).When you choose to subscribe, we send you to Stripe’s secure hosted checkout to enter your payment details. Stripe sets its own cookies on its checkout pages — for example to prevent fraud and to make checkout work — governed by Stripe’s own privacy policy. We do not load Stripe on bukadu.com, so Stripe does not set cookies on our own site.

If we add any analytics or marketing technology that needs to read or write information on your device beyond the functional storage described above, we will update this policy and ask for your consent first.

Marketing communications

We do not currently send marketing emails. If we start sending them, we will ask for your separate, clear opt-in first. You can withdraw consent at any time, and every marketing email will include an unsubscribe link.

We do send service emails — for example, account confirmation and password resets (sent via our authentication provider, Supabase), reminders before your free trial ends, and the email alerts you have asked us to send for your saved searches. Stripe may also send you payment receipts and invoices for your subscription. These are necessary to deliver the service you signed up for and are not marketing.

Children’s data

Bukadu is a business-to-business service. It is not designed for or directed at anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please email [email protected] and we will delete it.

How we protect personal data

We use a combination of technical and organisational measures to keep personal data secure. These include:

• Transport Layer Security (TLS) version 1.2 or higher for all data sent between your browser and our service
• Encryption at rest at the database and storage level, provided by our infrastructure processors
• Row-level security on our database to keep different customers’ data separate
• Password hashing using bcrypt — a standard, well-tested method for protecting passwords, and the default in Supabase Auth, which handles our authentication. We never store passwords in readable form
• Error monitoring with personal data scrubbing enabled, so error reports do not contain account contents

Our infrastructure processors (such as Supabase and AWS) hold their own independent security attestations, including SOC 2 (a widely recognised security audit standard).

Bukadu itself has not yet completed an independent security audit such as SOC 2, or certified against a framework such as ISO 27001, and does not currently run a regular penetration testing or bug bounty programme. We will update this policy if any of that changes.

What happens if there’s a personal data breach

If we discover a personal data breach that is likely to result in a risk to your rights or freedoms, we will notify the ICO within 72 hours of becoming aware of it, as required by Article 33 of the UK GDPR.

If the breach is likely to result in a high risk to you, we will also notify you directly, without undue delay, with information about what happened and what you can do.

We keep an internal record of personal data breaches whether or not they meet the threshold for notification.

Where a breach affects one of our processors, we rely on their notification to us under our contract with them and act on it from there.

Changes to this policy

We may update this policy from time to time. If we make material changes that affect how we use your personal data, we will let you know by email at least 30 days before the change takes effect. For minor changes (such as a typo or a clarification), we will update the policy and the “Last updated” date below without separate notice.

The Data (Use and Access) Act 2025 is being phased in during 2026, and the ICO is updating its guidance to reflect it. We will update this policy as that guidance is finalised.

How to make a complaint

If you are unhappy with how we have handled your personal data, please contact us first at [email protected]. We will respond within one month.

You also have the right to complain to the ICO, the UK regulator for data protection: ico.org.uk/make-a-complaint. You can do this without complaining to us first, although we would appreciate the chance to put things right.

By 19 June 2026, under the Data (Use and Access) Act 2025, we will offer a formal data protection complaints procedure that you can use before going to the ICO. We will publish it on bukadu.com on or before that date.