1. Who We Are
CodeBid (“we”, “us”, “our”) is a business-to-business tendering platform operated from the Republic of Ireland. We are the data controller for the personal data collected through this website.
You can contact us about data protection matters at legal@codebid.ie.
2. What Data We Collect
When you register and use CodeBid, we collect the following personal data:
- Account data: full name, work email address, company name, country, VAT number (optional), and company website (optional).
- Authentication data: your hashed password (we never store passwords in plain text) or, if you use Microsoft sign-in, your Microsoft account identifier.
- Tender data: tender titles, descriptions, budgets, deadlines, categories, and any documents you upload as part of posting a tender.
- Bid data: bid amounts, messages, and any proposal documents you upload when submitting a bid.
- Usage data: standard server logs including your IP address and browser type, retained for security and fraud prevention.
- Contact form submissions: name, email, and message content when you contact us via the Contact page.
3. Legal Basis for Processing
We process your personal data on the following legal bases under Article 6 of the UK/EU GDPR:
- Contract performance (Article 6(1)(b)): Account registration data, tender data, and bid data are processed to provide you with the CodeBid service under our Terms & Conditions.
- Legitimate interests (Article 6(1)(f)): Usage logs and security data are processed to protect the platform from abuse and fraud. We have conducted a balancing test and determined our interests do not override your rights.
- Legal obligation (Article 6(1)(c)): We may retain data to comply with applicable Irish and EU law.
4. How We Use Your Data
- To create and maintain your account.
- To verify your email address and authenticate you.
- To display your tenders to verified suppliers, and your bids to the relevant buyer.
- To send transactional emails (account verification, bid notifications, platform updates) via our email provider.
- To respond to support and legal enquiries.
- To detect and prevent fraud, abuse, and security incidents.
We do not sell your personal data. We do not use your data for behavioural advertising.
5. Data Sharing and Processors
We share your data only with the following third-party processors, each bound by a Data Processing Agreement (DPA):
- Supabase Inc. — database, authentication, and file storage. Data is stored in the EU (Frankfurt region). Supabase is SOC 2 Type II certified. Supabase Privacy Policy.
- Resend Inc. — transactional email delivery. Resend is a US-based company. International transfers are covered by Standard Contractual Clauses (SCCs) under Article 46 GDPR. Resend Privacy Policy.
- Cloudflare Inc. — security challenge (Turnstile CAPTCHA) to protect forms from bot submissions. Cloudflare processes your IP address for this purpose. Transfers to the US are covered by SCCs. Cloudflare Privacy Policy.
We may also disclose data to Irish or EU legal authorities if required by law.
6. Cookies
We use the following cookies on CodeBid:
- Authentication session cookies — set by Supabase when you log in. These are strictly necessary to keep you logged in and cannot be disabled without losing access to the platform.
- Cloudflare Turnstile cookies — set on pages with forms (sign-up, contact) to verify you are human. These are necessary to protect the platform from automated abuse.
We do not use analytics cookies, advertising cookies, or any third-party tracking. We do not use Google Analytics or similar tracking services.
7. Data Retention
- Active accounts: data is retained for as long as your account is active.
- Closed accounts: account profile data is deleted within 30 days of account closure. Tender and bid data associated with your account may be retained in anonymised form for platform integrity purposes.
- Server logs: retained for a maximum of 90 days.
- Contact form messages: retained for up to 12 months, then deleted.
8. Your Rights
Under GDPR, you have the following rights regarding your personal data:
- Right of access — you can request a copy of the personal data we hold about you.
- Right to rectification — you can ask us to correct inaccurate data.
- Right to erasure — you can ask us to delete your data where there is no legitimate reason to continue processing it.
- Right to restriction — you can ask us to restrict how we process your data in certain circumstances.
- Right to data portability — you can request your data in a structured, machine-readable format.
- Right to object — you can object to processing based on legitimate interests.
To exercise any of these rights, please email legal@codebid.ie. We will respond within 30 days.
You also have the right to lodge a complaint with the Data Protection Commission (DPC), the Irish supervisory authority, at dataprotection.ie.
9. Children
CodeBid is a B2B platform intended exclusively for businesses and individuals acting in a commercial capacity. We do not knowingly collect data from anyone under the age of 18.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes via the platform's notification system or email. The “Last updated” date at the top of this page will always reflect the most recent revision.
11. Contact
For any questions or requests regarding this Privacy Policy or your personal data, please contact us at legal@codebid.ie.
