Legal / UK
Privacy Notice
Last updated: 30 August 2026
Who is responsible for your information
CompositeBid is the controller of personal information submitted through this website under the UK GDPR and the Data Protection Act 2018. For data protection questions or to exercise your rights, email hello@compositebid.com.
Information we collect
We collect the business and contact information you provide, including names, company details, work contact details, locations, manufacturing requirements, capabilities, capacity and material enquiries. We also process limited technical and security information needed to operate and protect the website, such as submission time and anti-spam signals.
Do not submit special-category personal data, criminal-offence data, classified information, UK export-controlled technical data, US ITAR or EAR-controlled data, trade secrets, or information you are not authorised to share.
Why we use it and our lawful bases
- To respond to enquiries, assess supplier applications and take steps requested before a possible business arrangement.
- To operate the CompositeBid network, identify potentially relevant business matches, prevent misuse and keep appropriate records where this is necessary for our legitimate interests and does not override individual rights.
- To comply with legal obligations and establish, exercise or defend legal claims where necessary.
Submitting a form asks us to use the information for the relevant enquiry. We do not rely on that submission as consent for unrelated marketing.
Who we share it with
Access is limited to people who need the information to operate CompositeBid. We may use vetted hosting, database, security and professional service providers acting under appropriate obligations. We may share a proportionate, non-confidential business brief with a potentially suitable buyer or supplier when needed to explore an introduction. We do not sell personal information.
How long we keep it
Inactive or unsuccessful enquiries are normally reviewed for deletion after 24 months from the last meaningful contact. Active supplier and capacity records are kept while relevant and reviewed after 24 months of inactivity. Where a commercial relationship or legal issue arises, relevant records may be retained for up to six years after it ends, or longer where law requires.
International transfers
CompositeBid is UK-first. If future US expansion or a service provider requires a restricted transfer of personal information outside the UK, we will use an applicable UK adequacy regulation, appropriate safeguard such as the UK International Data Transfer Agreement or Addendum, or another lawful transfer mechanism.
Your UK data protection rights
Depending on the circumstances, you may have rights to be informed, access your information, correct it, ask for erasure or restriction, object to processing, and receive portable data. You can contact us using the email above. You may also complain to the Information Commissioner's Office.
Security and confidentiality
We use proportionate technical and organisational measures and restrict administrative access. However, a public website form is not a secure technical-data room, and submitting information does not create an NDA. Use a separately signed NDA and an approved secure disclosure process before sharing protected technical information.
Changes
We will update this notice if our processing changes, including before any material change connected with expansion outside the UK.