Privacy Policy

Last updated: 7 November 2026

Preamble

This privacy notice is issued by INVEST BUSINESS LTD ("we", "us" or "our"), a company registered in England and Wales under company number 14852760, with its registered office at 207 Regent Street, Suite 8, Third Floor, London, England W1B 3HH, United Kingdom. We are the data controller of the personal information described in this notice.

It describes how and why we collect, store, use and/or share ("process") your personal information when you use our services ("Services"), such as when you: visit our website at https://investbusiness.com or any website of ours that links to this notice; download and use our INVEST BUSINESS mobile application or any other application of ours that links to this notice; or engage with us in other related ways, including sales, marketing or events.

The Services are provided to businesses only. The personal information we process is therefore primarily that of the owners, employees and other representatives acting for Registered Users (legal entities), and of individuals who contact us. This notice is governed by the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018 and, where it applies to users in the European Union, the EU General Data Protection Regulation ("GDPR").

Questions or concerns? If you do not agree with our policies and practices, please do not use the Services. For any question, contact us at privacy@investbusiness.com.

Contents

1. Summary of key points
2. What information do we collect?
3. How do we process your information?
4. What legal bases do we rely on?
5. When and with whom do we share your information?
6. International transfers
7. Cookies, analytics and third-party websites
8. How long do we keep your information?
9. How do we keep your information safe?
10. Do we collect information from minors?
11. Your privacy rights
12. Automated processing, matching, AI drafting and Connected Agents
13. Do-Not-Track features
14. Updates to this notice
15. How to contact us, and how to review, update or delete your data

1. Summary of key points

• What do we process? Identity, contact, professional, account, payment-related and usage information, depending on how you interact with the Services (Section 2).
• Special-category data? We do not seek to collect it; do not submit it to the platform (Section 2).
• Why? To provide and administer the Services — including matching Requests with counterparts and sending invitations and notifications — to process payments, communicate with you, keep the Services secure and comply with law (Section 3).
• On what basis? Only where we have a valid legal basis: contract, legitimate interests, consent, legal obligation or vital interests (Section 4).
• Who do we share with? Service providers under contract (such as Stripe and hosting/analytics providers), other Registered Users in the context of matching and invitations, software you have connected to your own account (Connected Agents — at your instruction, Section 5), competition authorities where we report suspected collusion on E-Tenders or are required to give them information, and in the other specific situations listed in Section 5. We do not sell personal data.
• Your rights? Access, rectification, erasure, restriction, portability, objection and complaint to a supervisory authority (Section 11). Exercise them at privacy@investbusiness.com.

2. What information do we collect?

Personal information you disclose to us. We collect personal information that you voluntarily provide when you register on the Services, express an interest in us or our Services, participate in activities on the Services (such as publishing Requests, sending invitations or messaging counterparts) or otherwise contact us. Depending on the context, this may include: names; job titles; phone numbers; e-mail addresses; mailing and billing addresses; usernames and passwords; contact preferences; and contact or authentication data.

Verification data. As a business-only platform, we may process information needed to verify a Registered User and its representatives, which may include information about authorisations and licences, company registration details and, where lawfully required for verification, government-issued identifiers and creditworthiness-related information.

Payment data. If you make purchases, payment is processed by Stripe. Payment card data is collected, handled and stored by Stripe, not by us; we receive confirmation of payment and limited billing information. Stripe's privacy notice is available at https://support.stripe.com/topics/privacy.

Special-category (sensitive) data. We do not seek to collect special-category personal information (such as data revealing racial or ethnic origin, health data or biometric data), and you must not submit it to the platform. If such data is exceptionally processed, it will only be with your explicit consent or as otherwise permitted by applicable law.

Application data. If you use our App, we may also process, where you grant permission: push-notification tokens (to send you notifications about your account, invitations and matches — you can turn these off in your device settings) and mobile device data (device ID, model, manufacturer, operating system, version, browser type, IP address, and information about the features of the App you use). This information is needed to maintain the security and operation of the App, for troubleshooting and for internal analytics.

Information automatically collected. When you visit or use the Services we automatically collect log and usage data (IP address, browser and device characteristics, operating system, language preferences, referring URLs, date/time stamps, pages viewed, searches and other actions), device data, and approximate location derived from your IP address. Like many businesses, we also collect information through cookies and similar technologies (Section 7).

Information from other sources. We may obtain limited information from publicly available sources — such as company registers and the official sources from which we aggregate tenders, public funding and facilities announcements — and from business partners, to maintain the accuracy of our records and operate the Services. For E-Tenders we copy public procurement notices and contract award notices from TED, the European Union's tenders database, and from the UK Find a Tender service. A notice can contain personal information: the name, telephone number and e-mail address of a person at a contracting authority, names in its title or description, a contracting authority whose name includes a person's name, or the name of a supplier who is an individual, such as a sole trader. We keep each notice as published, and its backups. On the Platform, a notice's title, summary and lot descriptions are shown as published, except that we remove the e-mail addresses and telephone numbers we recognise in them, including those a notice gives for its contracting authority; they can still name a person; the award watch shows a supplier's name, where it shows supplier names at all, only where the name reads as an organisation's, and withholds a name that reads as a person's — a rule that reads each name as published and can be wrong; and a contracting authority is shown as the notice names it. We rely on our legitimate interest, and that of Registered Users, in knowing of public procurement opportunities and awards (Article 6(1)(f)). Section 8 says how long notices are kept, and Section 11 how to ask us to withhold a name.

All personal information you provide must be true, complete and accurate, and you must notify us of any changes.

3. How do we process your information?

• To provide the Services — including creating and authenticating accounts, publishing Requests, operating the matching engine, transmitting invitations, enabling user-to-user messaging, and delivering the notifications described in Section 12.
• To manage payments — to fulfil and manage orders, subscriptions, credits and verification fees processed through Stripe.
• To respond to inquiries and offer support.
• To send administrative information — details about the Services and changes to our terms and policies.
• To send marketing communications — in accordance with your preferences; you can opt out at any time (Section 11).
• To protect the Services — security monitoring, fraud prevention and enforcement of our Terms of Use.
• To analyse and improve — identifying usage trends and evaluating the effectiveness of our communications.
• To comply with legal obligations — and to establish, exercise or defend legal claims.
• To protect vital interests — where necessary to prevent harm to any person.
• To record and evidence agreements between Registered Users — keeping the record of any Platform Confidentiality Agreement you accept, so that it can be proved and so that claims under it can be established, exercised or defended.
• To operate E-Tenders and keep its record — showing a company's financing statement to the institutions whose statements match it, and institutions' statements to companies; matching declarations on E-Tender participations and showing them, under a reference, to the members they complement; carrying teaming conversations and screening written messages for the content our Terms of Use prohibit; keeping the record of what the Platform showed each member and what each member did; looking for patterns that may indicate collusion, receiving reports of it, deciding on them and, where we decide to, reporting suspected collusion to a competition authority; and showing institutions the contract awards that TED and Find a Tender publish.
• To operate Connected Agents — authenticating software you connect to your account, answering its requests within the permissions you have set, and recording what it did and which categories of information it read (Section 12).

4. What legal bases do we rely on?

• Performance of a contract — most of our processing is necessary to provide the Services under our Terms of Use to the Registered User you represent, or to take steps at your request before entering into that contract.
• Legitimate interests — where reasonably necessary to achieve our legitimate business interests and those interests are not outweighed by your interests and fundamental rights: for example, operating and improving the matching engine, analysing use of the Services, preventing fraud and securing the platform, and sending relevant business communications; and, on E-Tenders, our interest, the interest of the members and the public interest in preventing and detecting collusion in public procurement, in being able to show what the Platform showed each member and what each member did, and in informing members of the procurement notices and contract awards public bodies have published.
• Consent — for processing where we ask for it (for example, certain cookies or optional marketing). You can withdraw consent at any time (Section 11); withdrawal does not affect the lawfulness of prior processing.
• Legal obligations — for example cooperation with law enforcement or regulators, tax and accounting duties, disclosure in litigation, and compliance with an order of a court, tribunal or competent authority, including an order to disclose the identity of a Registered User behind its pseudonym. This includes a requirement of a competition authority of the United Kingdom made under its legal powers; where an authority of the European Union or of a Member State requires information, we rely on our legitimate interests (Article 6(1)(f)). We also rely on our legitimate interest in the establishment, exercise and defence of legal claims, our own and those of Registered Users.
• Vital interests — protection of the vital interests of any person.

We are the data controller of the personal information described in this notice. Where we process personal information strictly on behalf and under the instructions of a customer (as a processor), that customer is the controller and its privacy notice applies; direct your questions to it.

5. When and with whom do we share your information?

Service providers. We share data with third-party vendors, service providers, contractors or agents who perform services for us or on our behalf and need access to the information to do that work — under contracts designed to safeguard your personal information: they may only process it on our instructions, may not share it with organisations other than us, and must protect and retain it only as instructed. The categories are: AI drafting providers (Google); cloud computing services; communication and collaboration tools, including chat and e-mail (Brevo); consent management and consent records (BusinessConsent); data analytics services; data storage providers; finance and accounting tools; payment processors (Stripe); performance monitoring tools; product engineering and design tools; testing tools; user account registration and authentication services; and website hosting providers. Section 12 describes separately what is sent to the AI drafting provider, on what basis, and how long that provider may keep it.

Registration and verification details. The details you provide when registering your organisation — such as its legal name and address, national identification number, beneficial-owner disclosure and, for financial institutions, regulator and licence details — are used for internal purposes only: verifying your organisation and administering your account, unless we are required by law to disclose them (for example, to a competition authority) or they are disclosed as Section 25 of our Terms of Use describes. They are never published on the platform. Counterparts only ever see your pseudonym, together with the information you subsequently choose to share with them, as described below. On a Capital Desk funding appeal, and only there, the financial institution that expresses interest is named to the public body that published the appeal, and the public body is named to it; the institution's contact card is shared once the public body opens an introduction. Apart from that Capital Desk case, we never disclose your identity to a counterpart as a feature of the platform, on request, or because you and that counterpart have agreed that we may. The only other exception is a disclosure ordered by a court, described in the next paragraph.

Courts, tribunals and competent authorities. Where you and another Registered User have each accepted a Platform Confidentiality Agreement, that agreement records your agreement that we may disclose your organisation's legal name, registered office and the record of your acceptance to a court, tribunal or other competent authority under an order or other lawful process, and to that other Registered User only where an order of such a body requires it. We disclose nothing to the other Registered User without such an order, and we do not disclose beneficial-ownership information, identification-document data or licence documentation unless a court expressly orders it. This is a contractual agreement, not your consent: we rely on Article 6(1)(c) of the UK GDPR where we are under a legal obligation, and otherwise on Article 6(1)(f), the establishment, exercise or defence of legal claims. Nothing in it affects your rights, or the rights of any individual, under data protection law.

Competition authorities. Where we decide to report suspected collusion on E-Tenders to a competition authority, we give it the records we hold about the matter. We give it the legal identity of an organisation, and the messages of a private conversation, only where it requires them under its legal powers. We rely on our legitimate interests, and those of the public, in preventing and detecting collusion in public procurement (Article 6(1)(f)), and, where a competition authority of the United Kingdom requires information, on our legal obligation to provide it (Article 6(1)(c)). Where the authority is outside the United Kingdom, the safeguards in Section 6 apply to the transfer.

Other Registered Users. The platform is built on controlled disclosure: your Requests are presented to matched counterparts under your pseudonym, and when you engage with a counterpart (for example through an invitation, an inquiry or chat), the business and contact information you choose to share is disclosed to that counterpart so it can respond to you. Information you post in areas visible to other users may be viewed by them. On E-Tenders: a company's financing statement is shown, under its pseudonym, only to the institutions whose own statements match it, and an institution's statement to companies, under the institution's pseudonym; an introduction shows the institution the asking company's pseudonym and its note. A declaration on E-Tender participations is shown under a reference that changes from notice to notice and from member to member — before a teaming request is accepted, only the role the organisation seeks, the lots in common and what each could offer the other; after acceptance, its other structured fields; its pseudonym only once both have executed the Teaming Agreement; and its legal name never. The other party to a teaming conversation sees each lot clearance the organisation records, and the members of a consortium record see what the assessment acknowledgement sets out. A Registered User may tell another who it is, in its own words, once a Teaming Agreement between them is in force; the Platform never does.

Connected Agents. Where you connect software — such as an AI assistant — to your account as a Connected Agent under Section 6 of the Terms of Use, we disclose to it, at your instruction and only within the permissions you have switched on, the information your account can see. That includes your own information and the Requests, messages, notices and other content of other Registered Users presented to you under their pseudonyms; it never includes any Registered User's legal name or registration details, which the Platform does not show to anyone. The Connected Agent, and the provider that operates it (for example Anthropic, OpenAI or Google), are chosen and contracted by you. They are not our service providers, they do not act on our instructions, and what they do with the information — including where they process it and for how long they keep it — is governed by their terms and your arrangements with them, not by this notice. We show you a notice saying this before you connect a Connected Agent, and you can disconnect it at any time. The Terms of Use restrict what you, and therefore your Connected Agent, may do with information obtained from the Platform.

Other situations. We may also share personal information: in connection with, or during negotiations of, any merger, sale of company assets, financing or acquisition of all or part of our business (business transfers); with Google Maps Platform APIs (e.g. Maps and Places APIs) where map features are used; and with our affiliates, who must honour this notice. We do not sell personal data.

6. International transfers

The Services are hosted in the United Kingdom. Where personal information of users in the European Union or the European Economic Area is transferred to the United Kingdom, the transfer is covered by the European Commission's adequacy decision for the United Kingdom. Where we or our service providers transfer personal information to other countries, we rely on appropriate safeguards recognised by the UK GDPR and the GDPR — such as adequacy regulations or standard contractual clauses — details of which are available on request at privacy@investbusiness.com. Where you connect a Connected Agent operated outside the United Kingdom, the transfer of information to it is made by you, at your instruction, and is not a transfer by us or by our service providers.

7. Cookies, analytics and third-party websites

We use cookies and similar tracking technologies (such as web beacons and pixels) to operate and secure the Services, save your preferences and understand how the Services are used, and we permit selected third parties to use such technologies for analytics. Details — including how to refuse cookies — are set out in our Cookies Policy.

Google Analytics. We may share information with Google Analytics to track and analyse use of the Services. To opt out, visit https://tools.google.com/dlpage/gaoptout; for more on Google's practices, see the Google Privacy & Terms page.

Third-party websites. The Services may link to third-party websites, services or applications that are not affiliated with us. Data collected by third parties is not covered by this notice; we are not responsible for their content, privacy or security practices. Review their policies and contact them directly with questions.

8. How long do we keep your information?

We keep personal information only as long as necessary for the purposes set out in this notice, unless a longer retention period is required or permitted by law (for example tax or accounting requirements). We keep your personal information for as long as you have an account with us, and afterwards only where a longer period is needed: the compliance audit trail of declarations, agreements and consents, which we must be able to produce; records required by tax and accounting law; and backups, which are overwritten within about five weeks. A retention schedule listing each category and period is available on request. When there is no ongoing legitimate business need, we delete or anonymise the information — or, where that is not immediately possible (for example, backup archives), we securely store it, isolated from further processing, until deletion is possible. The exceptions are the records described in Section 12, the one that follows, and the E-Tenders records listed after it. Where you have accepted a Platform Confidentiality Agreement, we keep the record of that acceptance — the version accepted, a hash of that wording, the confirmations recorded, the date and time, the account and the pseudonym recorded at acceptance — together with the link between that pseudonym and your organisation, for the limitation period applicable to a claim under it — six years after that agreement ends, under the Limitation Act 1980 — and in no event for more than twelve years after acceptance. We keep these records even if you close your account or your pseudonym is changed, so that the agreement can be proved and claims under it brought or defended. We rely on the legitimate interest of both Registered Users in the establishment, exercise and defence of legal claims (Article 6(1)(f)), and you may object under Section 11. We keep a record of any disclosure made under such an agreement for the same period.

E-Tenders. On E-Tenders we keep information for the periods below, which the Platform applies itself, whether or not your account is still open; what is deleted remains in our backup archives, isolated from further processing, until those archives are deleted, as this Section states above:

• Financing statements of companies — one made for the bid stage against a named notice leaves every list, and is deleted within the hour, at that notice's submission deadline (for a prior-information notice that states none, when it expires) or twelve months after it was made, whichever comes first, and moves to any notice that replaces its own in the procedure; any other leaves every list, and is deleted within the hour, twelve months after it was made; one you withdraw leaves every list at once and is deleted within the hour. The audit trail keeps a record that it was made, shown to an institution or withdrawn, with the notice it names, if any, never its other fields.
• Financing statements of institutions, and introductions — an institution's statement made against a named notice stops being shown when that notice's deadline passes, and any statement when it is withdrawn; statements, introductions and the conversations they open are kept without a set end date.
• Declarations on E-Tender participations — a declaration leaves every list, and is deleted within the hour, when the notice's declaration window closes, three days before its submission deadline (for a prior-information notice that states none, three days before it expires), or earlier in the cases its acknowledgements set out. What it stated stays in the record: in a copy each teaming conversation holds until its messages are deleted, in the matching results of the members it was shown to for the period below, and in the audit trail.
• Teaming messages — deleted thirty days after the notice's submission deadline (for a prior-information notice that states none, thirty days after it expires), in every conversation, including one kept for longer below.
• The record of what was done on a notice — briefings, assessments, matching results, teaming conversations with their lot clearances, and consortium records: six years after the notice's submission deadline (for a prior-information notice without one, after its publication plus its validity). A teaming conversation whose Teaming Agreement came into force is kept, with its executions and lot clearances, as that agreement's record until twelve years after its first execution, and then deleted; one whose agreement never came into force goes with the rest, any execution with it; and anything a collusion report or finding relies on, including the teaming conversations from which the members of a consortium record it relies on joined that record, is kept for as long as that report or finding.
• Collusion reports and the patterns the Platform finds — six years after a report was made, or after a pattern was last found, but never while it awaits a decision, however long that is; where a report is decided by reporting the matter to a competition authority, by escalating it, or by suspending an account (or a pattern by either of the first two), six years from that decision when that is later.
• Buyers' statements — a public body's claim that its notice welcomes consortia or financing signposting, and the decision on it, are kept without a set end date.
• The audit trail — the record of each action taken on E-Tenders: which account did what, when, on which notice and under which version of the texts, with the structured fields of each declaration and the outcome of each assessment, and a hash of each message, from which a message made of the Platform's set choices can be reconstructed; never the words of a written message or of a note. It is kept without a set end date, and it is not deleted when your account is closed.
• Public notices and contract awards — kept as published, with their backups, without a set end date; a notice past its deadline is retired, not removed. A request to withhold a name is kept, as a keyed hash and never as the name, for as long as the withholding lasts and afterwards as the record of what was withheld.

We keep these records so that it can be shown, for as long as claims and proceedings about a procurement or a suspected infringement of competition law can be brought, what the Platform showed each member and what each member did: six years is the limitation period for most claims under the Limitation Act 1980, the law of England and Wales that governs our Terms of Use. We rely on the legitimate interests described in Section 4. You may object under Section 11; where a record is needed for a legal claim, or a competition authority requires it, we will normally keep it and tell you why.

9. How do we keep your information safe?

We have implemented appropriate technical and organisational security measures designed to protect the personal information we process. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise that hackers, cybercriminals or other unauthorised third parties will not be able to defeat our security. Transmission of personal information to and from the Services is at your own risk; access the Services only within a secure environment.

10. Do we collect information from minors?

The Services are for business users aged 18 or over. We do not knowingly collect data from, or market to, anyone under 18. If we learn that personal information of a person under 18 has been collected, we will deactivate the account concerned and take reasonable measures to delete the data promptly. If you become aware of any such data, contact us at privacy@investbusiness.com.

11. Your privacy rights

Under the UK GDPR and, where applicable, the GDPR, you have the right to: (i) request access to and obtain a copy of your personal information; (ii) request rectification or erasure; (iii) restrict the processing of your personal information; (iv) data portability, where applicable; (v) object to processing based on legitimate interests, including direct marketing; and (vi) not be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you. Make a request at privacy@investbusiness.com; we will consider and act on it in accordance with applicable data protection law.

Withdrawing consent. Where processing is based on your consent, you may withdraw it at any time by contacting us or updating your preferences; withdrawal does not affect the lawfulness of processing carried out before it.

Marketing opt-out. You can unsubscribe from marketing at any time via the unsubscribe link in our e-mails or by contacting us; we may still send you non-marketing, service-related messages necessary for the administration of your account.

Account information. You can review or change your account information, or terminate your account, by logging into your account settings or contacting us. On termination, we deactivate or delete your account and information from our active databases and instruct our payment processor to stop any further subscription renewals, so that no further renewal payment is taken; we may retain some information to prevent fraud, troubleshoot problems, assist investigations, enforce our legal terms and/or comply with legal requirements. Where you have accepted a Platform Confidentiality Agreement, we keep the acceptance record and the pseudonym-to-organisation link described in Section 8 after your account is deleted, for the period stated there.

Names in published awards. If you are named in a contract award the award watch shows, you may ask us at privacy@investbusiness.com to stop showing your name, or the award, there. We then leave out of the award watch every award showing your name, or the award you name, and record that as a keyed hash of the name, never the name itself, so that later notices naming you are withheld too; the e-mail you send us is kept as the record of your request. Our own copy of each notice as published, and its backups, still contain your name, and the notice is unchanged at its source. For a name in another notice or listing, we can stop showing that notice or listing, but we cannot withhold the name alone.

The E-Tenders record. You may ask for a copy of the personal information about you that the E-Tenders record holds; your organisation may ask for what it holds about the organisation under Section 25 of our Terms of Use. We may withhold information about another person, including who made a report and what a report says. Your right of access may be limited where the Data Protection Act 2018 allows, for example where giving access would be likely to prejudice the prevention or detection of crime. Your rights to erasure, restriction and objection do not prevail where we need the record to establish, exercise or defend legal claims. When we refuse or limit a request we tell you so, unless telling you would itself prejudice the prevention or detection of crime.

Complaints. If you believe we are unlawfully processing your personal information, you have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or, if you are in the EU/EEA, with your Member State data protection authority; if you are in Switzerland, with the Federal Data Protection and Information Commissioner. We would, however, appreciate the chance to address your concerns first at privacy@investbusiness.com.

12. Automated processing, matching, AI drafting and Connected Agents

The platform's matching engine automatically compares the structured parameters of Requests (such as request type, sector, location and value ranges) to present Requests to relevant counterparts and to send match and invitation notifications. This automation determines what is shown and notified to whom; it does not produce decisions with legal effects on you or similarly significant effects — whether to send, accept or decline an invitation always remains a human decision of the Registered Users concerned.

AI-assisted drafting. This paragraph is about AI drafting; the paragraph above is about matching. Where you use an AI drafting tool, we send the brief you write and the studio context to our AI provider, which returns a draft to you. We do not send your pseudonym: it stays on our systems and is used only to check the draft that comes back for wording that could identify you. Before it is sent, we automatically remove email addresses, web links and telephone-number patterns from your brief and from the studio context. That is a safeguard rather than a guarantee: it works by matching patterns, so it does not remove your organisation's legal name, and contact details written in an unusual form can pass through it. The filter is deliberately broad and also removes text that is not a contact detail at all: figures written with dots such as 2.500.000, dates such as 15.03.2026, and long reference numbers are replaced too, so a draft can come back missing a figure you gave us. You must therefore not put your organisation's name, its registration or verification details, anyone's contact details — or any special-category data — in a brief. We do not authorise any provider to use briefs or drafts to train its models, and we will not engage one on terms that permit it. A provider may hold them briefly for its own security and abuse monitoring. Where a provider is established outside the United Kingdom, the safeguards described in Section 6 apply. We show the draft to you and we do not publish it. If a draft is adopted, we keep it alongside the wording actually adopted, so that it can later be shown what the tool produced and what your organisation changed. A draft is a suggestion and nothing more: nothing follows from it unless an individual at your organisation decides to adopt it, so it produces no decision about you based solely on automated processing that has legal effects on you or similarly significantly affects you. We rely on our legitimate interests in providing the drafting tool your organisation has contracted for, and in keeping a reliable record of who adopted which wording; we do not rely on your consent for any of this, and you may object under Section 11. We keep an adoption record for as long as we may need it to establish, exercise or defend a legal claim about the adoption, and after the account it was made from is closed. In practice that is the limitation period for such a claim: six years from the adoption, under the Limitation Act 1980, the law of England and Wales that governs our Terms of Use. This is an exception to Section 8, and where you ask us to erase or change an adoption record we will normally refuse on that ground and tell you that this is why.

Screening and drafting tools. We apply automated security and abuse screening to messages and documents exchanged privately between Registered Users, including material covered by a Platform Confidentiality Agreement, and, on E-Tenders, screening of written messages for the content our Terms of Use prohibit, personal data included. We do not use that material for marketing, for ranking, or to train models, and our staff read it only where necessary to investigate a security incident, to respond to a competent authority or to meet a legal obligation. Where you choose to use a drafting tool we make available on the Platform, the text you submit to it is processed by us and by the model provider we engage for that purpose, as our processor and on our instructions, solely to produce the draft you asked for; the result is a draft only, and whether to adopt, change or discard it is always your decision. Neither the screening nor the drafting tools produce decisions with legal effects on you or similarly significant effects.

Connected Agents. This paragraph is about software you connect to your own account; the paragraphs above are about matching and drafting. When a Connected Agent reads your account or acts through it, we record the agent, the time, the permission it used, what it did and which categories of information it read — for example "messages" or "Requests" — together with a cryptographic hash, not the text, of anything it wrote. We show you that record in your account so that you can see what your agent has done. We use it to protect the Platform and other Registered Users: to apply the volume and frequency limits every Connected Agent is subject to, to detect retrieval, correlation or other patterns that suggest a breach of the Terms of Use, and to suspend a Connected Agent automatically when fixed thresholds are exceeded. Our administrators see such records as pseudonymous volumes and may suspend a Connected Agent; they do not read your content for this purpose. Suspending a Connected Agent is a measure about software you connected: your account, your access and your Requests are not affected by it, and any measure against your account itself is decided by a person under Section 17 of the Terms of Use, so it produces no decision about you based solely on automated processing that has legal effects on you or similarly significantly affects you. We rely on our legitimate interests in the security of the Platform, in your own oversight of software acting through your account, and in enforcing the Terms of Use, and on the performance of our contract with the Registered User you represent; you may object under Section 11. We keep these records for twelve months after the Connected Agent concerned is disconnected, and for longer only where they are needed to investigate suspected misuse or to establish, exercise or defend a legal claim. This is an exception to Section 8.

E-Tenders. On E-Tenders the Platform decides automatically which institutions are shown a company's financing statement, which declarations are shown to a member as candidates and in what order (Section 8 of our Terms of Use), whether a written teaming message may be sent — a message in which the screen finds prices, other competitively sensitive content or personal data is refused, and only the reasons and a hash of it are kept — and, once two organisations have concluded a Teaming Agreement on a notice whose competition is still open, that the general chat between them is closed until its submission deadline (for a prior-information notice that states none, until it expires). It also looks for patterns in consortium records and Teaming Agreements that may indicate collusion. No pattern is acted on automatically: a person decides what, if anything, to do about it. None of this produces a decision based solely on automated processing that has legal effects on you or similarly significantly affects you.

13. Do-Not-Track features

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") setting. No uniform technology standard for recognising and implementing DNT signals has been finalised, and we therefore do not currently respond to DNT browser signals. If a standard we must follow is adopted, we will inform you in a revised version of this notice.

14. Updates to this notice

We may update this notice from time to time to stay compliant with relevant laws. The updated version will be indicated by an updated "Last updated" date at the top. If we make material changes, we will notify you by prominently posting a notice of the changes or by directly sending you a notification. We encourage you to review this notice frequently.

15. How to contact us, and how to review, update or delete your data

If you have questions or comments about this notice, or wish to exercise any of your rights — including requesting access to, correction of, or deletion of your personal information — contact our privacy team by e-mail at privacy@investbusiness.com, by phone at (+44) 20 3290 2022, or by post at:

INVEST BUSINESS LTD
Company No. 14852760
207 Regent Street, Suite 8, Third Floor
London, England W1B 3HH, United Kingdom

These rights may be limited in some circumstances by applicable law. We will respond in accordance with applicable data protection laws.