Last updated: 1 October 2026. This policy explains how Tendertrace collects, uses, discloses and protects personal information when you use the Tendertrace Market Insights platform (the “Platform”) and its AI features, including Tracey. Please read it together with our Terms and Conditions and the Tracey AI Addendum.

1. Who we are

The Platform is provided by Tendertrace Pty Ltd (Australia) and Tendertrace UK [confirm entity name and company number] (together, “Tendertrace”, “we”, “us”). The entity responsible for your personal information depends on where you are located: for Australian customers this is Tendertrace Pty Ltd; for United Kingdom customers this is [Tendertrace UK entity]. Our contact details are in section 11.

2. Scope of this policy

This policy applies to personal information we handle as a business (for example, account holders, authorised users, prospects and website visitors). Where we process personal information contained in Customer data on a customer’s instructions, we act as a service provider or processor and the customer’s own privacy terms and our data processing agreement govern that processing.

3. The information we collect

Depending on how you use the Platform, we collect:

• Identifiers and account data:name, work email, organisation, role, and access credentials.
• Query and prompt content:the questions, prompts, instructions and selections you submit to Tracey and other AI features.
• Usage and interaction data:logs of how you use the Platform and the AI features, including queries run, features used, and derived signals used to personalise results.
• Integration data:where you connect a third-party system (such as Salesforce or HubSpot), the data needed to enable that integration.
• Technical data:device, browser, IP address and similar data collected automatically, including through cookies and similar technologies.

The Platform analyses government procurement data (which is largely public) together with your account and usage data to generate personalised insights and recommendations. We do not intend the AI features to process special or sensitive categories of personal information, and you should not submit such information in prompts.

4. How we collect it

We collect information directly from you when you register, use the Platform or contact us; automatically as you use the Platform; and from third parties such as our resellers, referral partners and public sources. Government procurement data on the Platform is aggregated from publicly available government sources.

5. Why we use it and our legal basis

Provide the Platform
Authenticating users, delivering the Service and support, running your queries.
Legal basis (UK / EU): Performance of a contract

Operate the AI features
Processing your prompts and data to generate and personalise AI Output, including sending prompts to a model provider.
Legal basis (UK / EU): Performance of a contract

Personalise and recommend
Tailoring opportunities and recommendations to your profile and usage.
Legal basis (UK / EU): Legitimate interests (to provide a useful, relevant service)

Improve and secure the Service
Analysing usage, maintaining security, developing and improving features, generating de-identified and aggregated data.
Legal basis (UK / EU): Legitimate interests

Communicate and market
Service messages and, where permitted, marketing.
Legal basis (UK / EU): Legitimate interests or consent

Comply with law
Meeting legal, regulatory and tax obligations, and handling disputes.
Legal basis (UK / EU): Legal obligation / legitimate interests

In Australia, we handle personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth). In the United Kingdom and the European Union, we rely on the legal bases above under the UK GDPR and EU GDPR. Where we rely on consent, you may withdraw it at any time; where we rely on legitimate interests, you may object (see section 10).

6. The Tracey AI features

Tracey and our other AI features use generative and machine-learning models to answer queries and produce insights and recommendations over procurement and account data. You are interacting with an AI system, and AI Output is generated by probabilistic models that can be inaccurate or incomplete. AI Output is decision-support only and should be independently verified before you rely on it.

When you use an AI feature, your prompt and the data needed to answer it may be sent to one or more third-party model providers that process it on our behalf to generate a response. We put contractual protections in place with these providers. [Confirm the zero-retention and no-training position and name or category of providers in section 8 and the sub-processor register.]

7. Automated decisions and profiling

The Recommendation AI profiles your account and usage to suggest relevant tenders, partnerships and opportunities. These are suggestions to support your own evaluation. We do not make decisions that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing without meaningful human involvement.

If you are in the United Kingdom or the European Union, you have rights in relation to solely automated decision-making under Article 22 of the UK GDPR and EU GDPR. Because our recommendations are decision-support and not solely automated significant decisions, those provisions are not generally engaged; if that changes we will update this policy and provide the required information and safeguards. You may contact us for more information about how the Recommendation AI works.

8. Model training

We do not permit third-party model providers to use your prompts, content or usage data to train or improve their own general-purpose models. We [do not / do] use your prompts, content or usage data to train or fine-tune our own models. Where we improve the Service using your data, we do so [by personalising results to you / using de-identified or aggregated data], not by contributing your identifiable content to model training. [If any training or fine-tuning on identifiable data occurs, describe it here, state the legal basis, and offer an opt-out where required.]

9. Retention

• Account & identity data: for as long as you have an account, then 12 months after closure, unless we must keep it longer.
• User-generated Tracey content, saved searches, prompts, workspaces and Library content: kept while the account is active, then 90 days after closure, after which delete or de-identify it unless you asks for earlier deletion
• Orders, subscriptions and commercial transaction records: 7 years. Australian companies generally need to retain financial records for at least seven years under the Corporations Act. ASIC
• Marketing preferences: kept until you change them, and an unsubscribe record kept to honour your choice.
• Security/audit logs: generally retained for up to 24 months, unless a longer period is reasonably necessary for security investigations, fraud prevention or legal compliance

10. Who we share it with

We share personal information with:

• Service providers and sub-processors that help us run the Platform, including model providers, cloud hosting, and analytics and support tools. We maintain a sub-processor register [link], and we require these providers to protect personal information and use it only to provide services to us.
• Integrated systems you connect (such as Salesforce or HubSpot), at your direction. Once data reaches those systems you or their providers control it.
• Advisers, authorities and successors where needed for legal, regulatory, audit or corporate-transaction purposes.

We do not sell your personal information.

11. International transfers

Your personal information may be processed outside the country where you are located, including where our model providers and cloud infrastructure operate. When we transfer personal information across borders we use appropriate safeguards:

• From the United Kingdom: the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
• From the European Union (when applicable): the EU Standard Contractual Clauses.
• From Australia: we take reasonable steps under Australian Privacy Principle 8 before disclosing personal information to overseas recipients.

14. Cookies

We use cookies and similar technologies to operate the Platform, remember your preferences and understand usage. You can manage cookies through your browser and, where provided, our cookie controls.

15. Changes to this policy

We may update this policy from time to time. Where changes are material we will give reasonable notice. The “last updated” date shows when it was last revised.

16. Contact us

For any privacy question or request, contact us at hello@tendertrace.com, or by post at 526/368 Sussex St, Sydney NSW 2000.