Privacy Policy

1. Who We Are

Angelgroup-CVGeorgeRD Ltd (trading as CareBids) (Companies House number: 13227845) operates the CareBids platform at carebids.co.uk. We are the data controller for personal data processed through our website and platform.

Registered address: 18 Scoulding Road, London, E16 1NT

Data Protection Officer: [email protected]

2. Data We Collect

We collect the following categories of personal data:

• Account data: Name, email address, organisation name, job title, and password (hashed) when you register.
• Provider profile data: CQC registration number, service types, registered locations, and business profile information you enter into the platform.
• Usage data: Security and request data in server logs, plus aggregate website usage from optional analytics only when you allow it.
• Communications data: Emails and messages you send us through contact forms or support channels.
• Payment data: Billing name, address, and payment method details processed by our payment provider. We do not store full card numbers.
• Cookie data: See Section 9 (Cookies) below.

CareBids is intended for business procurement and regulatory drafting, not for care records or identifiable information about a child or person receiving care. Tender files and free-text drafts can nevertheless contain personal or special-category data. Do not upload identifiable child records, care records or unnecessary personal data. Contact us promptly if you believe this has happened so access can be restricted and the incident assessed.

3. Lawful Basis for Processing

We process your personal data under the following lawful bases as defined in UK GDPR Article 6:

4. How We Use Your Data

• Providing and managing your CareBids account and subscription
• Delivering tender alerts, scoring, and AI bid writing features
• Processing payments and issuing invoices
• Sending service communications (account confirmations, feature updates, security alerts)
• Sending marketing communications where you have consented
• Improving platform features through aggregated, anonymised usage analytics
• Detecting and preventing fraud and abuse
• Complying with legal and regulatory obligations

5. Data Retention

We retain personal data for the following periods:

• Active account data: For the duration of your subscription and for 2 years after account closure, unless you request earlier deletion.
• Financial records: 7 years from the end of the relevant tax year, as required by HMRC.
• Marketing consent records: Until you withdraw consent, plus 1 year.
• Support communications: 3 years from the date of the communication.
• Server logs: 90 days on a rolling basis.

After the applicable retention period, data is securely deleted or anonymised. You may request earlier deletion under your right to erasure (see Section 7).

6. Data Sharing

We do not sell your personal data. We share data only with:

• Infrastructure providers: Cloud hosting and database services operating under data processing agreements.
• Payment processors: who process payment card data under their own PCI DSS obligations.
• Optional analytics providers: Plausible Analytics and Ahrefs Web Analytics, loaded only after you choose to allow analytics. They provide aggregate page, referrer, device and approximate-location reporting under their published data practices.
• Legal and regulatory authorities: Where required by law or valid legal process.

All third-party processors operate under data processing agreements requiring them to process data only on our documented instructions and maintain appropriate security measures.

7. Your Rights Under UK GDPR

As a data subject under UK GDPR and the Data Protection Act 2018, you have the following rights:

To exercise any of these rights, contact our Data Protection Officer at [email protected]. We will respond within one calendar month. In complex cases we may extend by two further months, with notice.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

8. ICO Registration

Angelgroup-CVGeorgeRD Ltd (trading as CareBids) is in the process of registering with the Information Commissioner's Office. This section will be updated with our registration number once confirmed.

9. Cookies and Optional Analytics

We use cookies and similar technologies on carebids.co.uk. Cookies are small text files stored on your device by your browser.

Use “Privacy choices” in the footer or application to change your analytics choice. Declining optional analytics does not affect core functionality. Blocking strictly necessary session storage may prevent sign-in or other account features from working.

10. International Data Transfers

We aim to store and process personal data within the UK and European Economic Area. Where data is transferred outside the UK, we ensure adequate safeguards are in place, including Standard Contractual Clauses approved by the ICO or the UK IDTA (International Data Transfer Agreement).

11. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be notified by email to registered account holders and by a prominent notice on this page. The date at the top of this policy shows when it was last updated.

12. Contact Us

For any data protection queries, requests, or complaints, contact our Data Protection Officer: