Useful data. Firm boundaries.

Controller and contact.

Bid Champions Ltd, company 05387870, is the controller. Registered office: Charter Buildings, 9 Ashton Lane, Sale, Manchester M33 6WT. Privacy enquiries may be sent to hello@payperaward.co.uk.

What we hold.

We may hold account identity and contact data; organisation and role; subscription and payment references (not complete card data); professional evidence; project briefs, source links, reward terms and outcomes; support and dispute correspondence; consent records; and security, session and audit events. Private document upload is not currently enabled.

Do not submit special-category data, criminal-offence data or personal data unrelated to the procurement. Client users must have authority and provide any necessary notice before adding another person’s data.

Why and on what basis.

• Contract: account access, profiles, project drafting, recorded acceptance, subscription administration and support.
• Legitimate interests: service security, fraud prevention, audit, disputes, product measurement and proportionate continuous improvement, balanced against user rights.
• Legal obligation: tax, accounting, company, regulatory and lawful-authority requirements.
• Consent: optional research invitations or study participation where consent is the stated basis.

We do not currently use automated decision-making that produces legal or similarly significant effects. Professional and outcome reviews require a person.

R&D without a blank cheque.

Necessary operational analysis can identify friction, quality problems and security events. Optional study participation is unticked by default and can be withdrawn without losing ordinary service access. Private tender material is not placed in a public graph, marketing case study or model-training dataset without separate recorded authority.

Where feasible, analysis uses aggregated or de-identified records. We document the question, minimum fields, access, retention and publication boundary before a study.

Who may receive data.

Only authorised client and professional participants receive the project information needed for their role. We may use contracted hosting, email, security, payment and professional advisers under appropriate duties, and disclose data where required by law or to establish or defend legal claims. Card providers will process complete card data directly when checkout is connected.

We do not sell personal data. If a provider transfers data internationally, we will document the destination and use an applicable adequacy decision or contractual safeguard before that processing begins.

How long.

• Inactive unaccepted project drafts: normally 12 months.
• Declined professional evidence: normally 24 months, unless needed for a live dispute.
• Contracts, payment evidence, accepted projects and material audit records: normally six years after the relationship or project ends.
• Routine security logs: normally 12 months.
• Optional research contact permission: until withdrawal or two years after the last interaction, whichever comes first.

Legal hold, fraud, tax or dispute needs may justify longer restricted retention. At the end, data is deleted or irreversibly de-identified.

Your choices and rights.

Depending on the circumstances, you may ask for access, correction, erasure, restriction, portability or objection, and may withdraw consent at any time. We verify requests and normally respond within one month. You may complain to the UK Information Commissioner’s Office at ico.org.uk.