CompositeBid Privacy Notice v1.2

1. Who we are

CompositeBid is operated by George Hailey, a sole trader trading as CompositeBid. George Hailey is the controller of the personal information described in this notice under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. CompositeBid is not currently an incorporated limited company.

Address for service: 5 Woodcote House, Lavant Road, Chichester, West Sussex, PO19 5RQ, United Kingdom. Email: hello@compositebid.com. Information Commissioner’s Office registration number: ZC241223.

This notice explains what personal information CompositeBid collects, why, who receives it, how long it is kept and the rights you have. It applies to the compositebid.com website, public enquiry forms, buyer and supplier accounts, private messaging and file sharing, and the Opportunity Scout research described in section 5.

2. What CompositeBid does

CompositeBid is a UK introduction and sourcing service for composite manufacturing. Buyers submit requests for quotation (RFQs) or Small Project enquiries. CompositeBid reviews each submission privately and may publish a separately prepared, non-confidential summary to suppliers whose recorded capabilities match. A supplier can express interest; if the buyer side accepts, CompositeBid opens a controlled, opportunity-specific conversation (a Direct Connection) where the participants can message each other and share supported attachments. CompositeBid does not currently charge users, process payments or hold project funds.

3. Information we collect

We collect the following information, most of it directly from you:

• Enquiry and application information: names, company, job title, business contact details, location, whether a Small Project is for business or personal purposes, manufacturing requirements, capabilities, processes, capacity and material information, how you heard about CompositeBid and any referral or outreach reference code.
• Account information: email address, name, telephone number, job title, company and registered address, account role, sign-in and session records, and multi-factor authentication (MFA) settings. Passwords are stored only as secure hashes by our authentication provider; CompositeBid cannot see your password.
• Supplier profile information: company details, capabilities, processes, equipment, facilities, certifications, operational details, alert preferences and the business identity evidence we record.
• Marketplace activity: RFQ and Small Project records, published summaries, expressions of interest, introduction and conversation records, messages, read status, legal acceptances, awards and project stage and quantity updates.
• Files: normal conversation attachments and their metadata, including original and safe filenames, type, size, integrity hash, uploader, conversation or project, upload and scan times, scan result, versions, access, revocation, archive and deletion events.
• Safety and complaints: reports, complaints, moderation decisions, appeals and related correspondence.
• Security and audit information: request, error and delivery records, anti-spam and bot-protection signals, rate-limiting data derived from your connection, and immutable audit events such as account changes (with previous and new values), MFA changes and file activity.
• Communications: emails and other messages you send to us.

Please do not submit special category personal data (for example health information), criminal-offence data, classified or export-controlled technical data, trade secrets, information restricted by a non-disclosure agreement or information you are not authorised to share.

4. How attachments and private files are protected

Attachments can only be shared by authorised participants in a Direct Connection conversation. A new upload is first placed in private quarantine. CompositeBid checks its declared and detected file type, file signature, extension, size and integrity hash and sends the file content to our malware scanner. Only a file that passes every check is copied to private attachment storage and attached to a message. If the scanner is unavailable, times out, errors or has out-of-date antivirus definitions, the file stays quarantined or is rejected. Malware screening reduces risk but cannot guarantee that a file is safe.

Files are stored in private storage and are never given a permanent public link. An authorised participant can download a file only while CompositeBid confirms their current permission; the download is streamed through CompositeBid. Revoking or archiving a file stops future access through CompositeBid but cannot recall a copy that an authorised recipient has already downloaded. Operational logs are designed not to contain file contents, signed storage links, message contents or customer or project identifiers. Protected technical-file release to suppliers and the draft technical non-disclosure agreement are not active.

5. Opportunity Scout: business contact information from public sources

CompositeBid runs a research tool called Opportunity Scout to find composite-manufacturing opportunities and organisations that may benefit from the service. Scout reads publicly published procurement notices (including Find a Tender, Contracts Finder and Public Contracts Scotland) and public organisation websites. It records the organisation, the published opportunity details and any business contact details published with them, such as a contact name, role, work email address or work telephone number. We did not obtain this information from the people concerned.

Scout uses automated classification, including an AI model run by Cloudflare, to assess whether a notice is relevant to composite manufacturing. Results are reviewed by a person. Scout does not make any decision that has a legal or similarly significant effect on anyone.

Scout does not currently send outreach emails. If CompositeBid enables business outreach in future, it will contact only published corporate addresses about relevant business opportunities, every message will explain how to opt out, and we will honour opt-outs. We keep a minimal suppression record so that anyone who objects is not contacted again. You can object to this processing at any time by emailing hello@compositebid.com.

6. Why we use information and our lawful bases

• To provide the service you ask for, create and secure accounts, review and match enquiries, run introductions, messaging and file sharing, and record awards and project updates: performance of a contract with you or steps you ask us to take before one.
• To keep the platform secure, prevent fraud, spam and misuse, enforce access controls, keep audit evidence, moderate reported content, improve the service, understand which referral sources lead to enquiries, run Opportunity Scout and communicate with business contacts: our legitimate interests in operating a safe and effective business-to-business service. We have balanced these interests against your rights and you can object (see section 10).
• To keep records we are required to keep, meet online-safety duties, respond to lawful requests and establish, exercise or defend legal claims: legal obligation or legitimate interests.
• Where we ask for your consent for something optional, we rely on that consent and you can withdraw it at any time.

Public enquiry forms can be submitted without creating an account. A form submission asks us to handle that enquiry. We do not treat it as consent to unrelated marketing. Approved suppliers choose whether to receive selected instant alerts; that preference is not consent to unrelated marketing.

Buyer RFQs and supplier applications may record how the person heard about CompositeBid and, where a recognised referral link was used, its attribution code. A recognised referral code is carried in the signup link and stored with the resulting application or RFQ. If an account is later approved, its first-touch attribution is retained with that account. It does not apply a discount or create a referral commission, and it is not used for advertising or behavioural tracking. An administrator may correct inaccurate attribution; the earlier value and reason remain in a private audit record.

A CompositeBid outreach link may contain a random first-party reference. We use it only after a relevant RFQ, supplier application, capacity registration, material request or surplus-material listing is actually submitted, to record a possible company-level conversion for that campaign purpose. We distinguish confirmed, strong and review-required evidence and do not claim that an email caused a submission merely because the company appears to match. The reference is not used to record email opens, link clicks or page views, and we do not place an advertising or analytics cookie for this purpose.

7. Who can see your information

Within CompositeBid, access is limited to what is needed to run the service. Suppliers see only an approved non-confidential summary of an RFQ; buyer contact details, private descriptions and underlying end-customer identity are not included in supplier alerts or published summaries. When a supplier’s interest is accepted, the participants in that Direct Connection can see the messages and attachments shared in it and the identity information the introduction allows. The label “Business identity checked” refers only to the identity evidence CompositeBid recorded; it is not a certification or recommendation.

We use these service providers, who process personal information on our behalf under contracts that require them to protect it:

• Supabase: database, authentication and private file storage. Our primary database and file storage are hosted in the United Kingdom (London).
• Cloudflare: website hosting and delivery, security, bot protection (Turnstile), the malware-scanning service (run in the European Union) and the AI classification used by Opportunity Scout. Cloudflare operates a global network.
• Resend: delivery of service, security and RFQ-alert emails. Resend is based in the United States.
• Google (Google Workspace): CompositeBid’s business email mailbox, which receives and stores emails you send us.
• Better Stack: uptime monitoring of the public website. It checks that compositebid.com is available and does not receive customer account, message or file data.

We may also share information with professional advisers and insurers where necessary, with law-enforcement or regulators where the law requires it, or to protect people or the service. We do not sell personal information and we do not use advertising or cross-site tracking cookies.

8. International transfers

Some providers may process information outside the UK, including in the European Union and the United States. Where information is transferred outside the UK, we rely on UK adequacy regulations where they apply (including for the European Union) and otherwise on appropriate safeguards: the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or, where a provider is certified, the UK Extension to the EU-US Data Privacy Framework. You can ask us for details of the safeguard used for a particular provider.

9. How long we keep information

• Upload sessions expire after 15 minutes. Abandoned and expired quarantine objects are deleted on a short operational schedule by an automated clean-up process, and we check for any residue at least monthly.
• Accounts: kept while the account is active. When you delete your account, your sign-in access and sessions are removed immediately and supplier profile contact details are erased, leaving a non-identifying record needed to keep other records consistent.
• Enquiries and applications that do not proceed: deleted or anonymised within 24 months of the last activity.
• RFQs, interests, introductions, conversations, messages, attachments, awards and project records: kept while the opportunity or project is active and then for up to 6 years after the last activity, the usual period for legal claims, before being deleted or anonymised.
• Complaints, reports and moderation decisions: up to 3 years after the case closes.
• Immutable security and audit events: up to 6 years, to demonstrate access and security decisions and to establish, exercise or defend legal claims.
• Email delivery records: up to 24 months, after which message content is cleared.
• Opportunity Scout records: reviewed and deleted within 12 months if no business relationship follows. Opt-out suppression records are kept for as long as needed to honour the opt-out.
• Application logs are kept by our providers for a short period, normally no more than 30 days. Provider backups are overwritten on a rolling basis, normally within 30 days.

Information may be kept longer where the law requires it or where it is needed for an ongoing complaint, investigation, dispute or legal hold. Deleting an account does not rewrite immutable audit evidence or automatically erase another party’s lawful business record.

10. Your rights

Depending on the circumstances, you have the right to be informed about, access, correct or erase your personal information, to restrict or object to its use, and to receive it in a portable format. You can object at any time to processing based on our legitimate interests, including Opportunity Scout research and any business outreach. To exercise a right, email hello@compositebid.com. We may need to confirm your identity and will normally reply within one month.

You can complain to the Information Commissioner’s Office (ico.org.uk). We would appreciate the chance to resolve your concern first.

11. Automated decision-making

CompositeBid does not make decisions about you based solely on automated processing that have legal or similarly significant effects. Supplier matching and Opportunity Scout classification help people decide what to review; they do not award work or approve anyone.

12. Security

We use private storage, role- and opportunity-based access controls, optional MFA for buyers and suppliers (required once enrolled), mandatory MFA for administrators, malware screening, immutable audit records and restricted administrative access. No system is completely secure, so please keep your sign-in details and devices secure.

13. Children

CompositeBid is a business service and is not designed for children. We do not knowingly create accounts for children. If you believe a child has given us personal information, please contact us.

14. Cookies

CompositeBid uses only cookies needed to provide and protect the service, such as the secure sign-in session cookie and your light or dark display preference. Our Cookie Notice explains them.

15. Changes to this notice

We will update this notice when our processing, providers or retention arrangements change, and we will show the new version and its effective date on this page. Earlier versions are preserved and not silently rewritten.