Data processing terms
Effective 2026-10-20
Scope and instructions
These terms form part of the service agreement where BidCanopy processes personal data you control. The seller in our legal information is the processor; your organisation is the controller. Processing lasts for the service relationship and the deletion or return period described below. It covers hosting, extraction, analysis, export, recovery and deletion of the account content you select. You instruct this processing by using those features and may issue further documented instructions through support. We will tell you if an instruction appears to breach applicable data protection law.
Data and people
Content can contain professional contact details, employment history, supplier personnel, buyer contacts, references and contractual information about staff, customers or suppliers. You determine which records to upload and must have a lawful basis and provide required notices. Do not upload special-category, criminal-record, classified or highly sensitive data unless a separate written arrangement expressly permits it.
Confidentiality, security and assistance
We restrict authorised access, require confidentiality and use account access controls, private storage, encrypted connections, server-side credentials, input limits and backups or restore points. We assist reasonably with data-subject requests, security assessments, impact assessments and regulator enquiries relating to this processing. We notify you without undue delay after becoming aware of a personal-data breach affecting your content, with available details and updates. We provide relevant compliance information and facilitate reasonable, confidential audits on notice, protecting other customers’ information and service security.
Service providers and transfers
You authorise OpenAI for hosting, sign-in and AI processing, and its infrastructure providers including Cloudflare. Stripe acts under its own applicable role for payment and billing data. We remain responsible for our processors’ performance of applicable processing obligations. We give notice of a material new processor for your content through the account or contact address and allow a reasonable opportunity to raise a substantiated objection before the change takes effect. International transfers must use a lawful transfer mechanism, including applicable adequacy arrangements or UK-compatible contractual safeguards. Support can supply details of the arrangements applicable to your content.
Return and deletion
You can export content at any time while the account is available. On account-content deletion we remove the workspace content and files from the active service, subject to the narrow financial and security records explained in the privacy notice. Provider security logs or backups expire under their retention cycles. We do not use supplier content for our own advertising or model training. Mandatory legal retention takes priority, with access restricted to that purpose.