Privacy notice
Version [date of publication] · Draft 2026-10-14
Who we are
The data controller is Nimbus, trading as ContractSpotter, until Contract Spotter Ltd is incorporated; this notice will then be updated to name the company. Address: [REGISTERED / CORRESPONDENCE ADDRESS]. ICO registration number: [ICO REGISTRATION NUMBER]. Contact: [email protected].
What we collect
- Sign-up details: name, email address, trade, area or postcode.
- Consent record: date and time, the consent wording and its version, where you signed up, a one-way hashed (not stored in plain form) version of your IP address, and your browser's user-agent string.
- Email activity: when we send you emails, and unsubscribe and deletion requests.
- Digest link activity: each digest has unique tracked links and a reference number. When you click a link, we record the time, a hashed (one-way) version of your IP address and browser string, and your country. We use this to protect your licence and detect account sharing.
- Payment details (paid plans only, when launched): handled by Stripe. We don't see or store your full card number.
- Business contact details from published notices: notices we show you may name buyer contacts published on Contracts Finder and Find a Tender.
Why we use it and our lawful basis
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Sending launch news and opportunity emails you asked for | Consent (Art. 6(1)(a)); and under PECR, your consent to marketing email |
| Providing a paid subscription you've bought | Contract (Art. 6(1)(b)) |
| Keeping proof of consent, detecting account sharing and misuse through digest link activity, preventing abuse, keeping the service secure | Legitimate interests (Art. 6(1)(f)) |
| Keeping accounting records | Legal obligation (Art. 6(1)(c)) |
How long we keep it
- Unconfirmed sign-ups are deleted automatically after 30 days.
- Confirmed subscribers are kept while you're subscribed. After you unsubscribe, we keep only what we need to respect your choice, for up to [e.g. 2 years], then delete it.
- Consent records are kept for as long as we email you, plus [e.g. 2 years], so we can show you agreed.
- Digest link activity is deleted after 90 days, and tracked links after 180 days.
- Billing records are kept for 6 years, as tax law requires.
Who processes data for us
- Cloudflare, Inc.: website hosting, database, and sending emails. May transfer data to the USA under the UK Extension to the EU–US Data Privacy Framework and/or the International Data Transfer Addendum.
- Google LLC (Google Workspace): our business email for replying to you. Same transfer safeguards.
- Stripe Payments Europe / Stripe, Inc.: payments, when paid plans launch.
We don't sell your data or share it for other companies' marketing.
Your rights
You have the right to access, correct, delete, restrict or object to our use of your data, and to data portability. Where we rely on consent you can withdraw it at any time; this doesn't affect anything we did before. Unsubscribe from any email, use Delete my data, or email [email protected]. We'll reply within one month.
Complaints
Please contact us first. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.
Cookies
See our cookie notice. We use no tracking cookies.