Privacy Policy

Glaxtons Consulting is a leading UK-based bid writing and tender consultancy firm, providing expert services to businesses seeking to win public and private sector contracts.

We are the Data Controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This means we are responsible for deciding how we hold and use personal information about you.

Our Data Protection Lead can be contacted at info@glaxtons.co.uk for any queries relating to this policy or your personal data.

We collect and process various types of information to provide our services effectively and maintain our business relationships. The categories of data we collect include:

2.1 Personal Identification Data

• Identity Data: Full name, title, job title, professional qualifications, and employer/organisation name
• Contact Data: Business and personal email addresses, telephone numbers (landline and mobile), postal addresses, and social media handles where provided
• Professional Data: CV/resume information, professional experience, sector expertise, and relevant certifications when provided for tender submissions

2.2 Technical and Usage Data

• Device Information: IP address, browser type and version, operating system, device type, screen resolution, and unique device identifiers
• Usage Data: Pages visited, time spent on pages, navigation paths, click patterns, and scroll depth
• Location Data: Approximate geographic location derived from IP address (country and city level only)
• Referral Data: How you arrived at our website, including search terms, referring websites, and campaign sources

2.3 Transactional and Service Data

• Enquiry Data: Details of your service enquiries, requirements, tender deadlines, and project specifications
• Contract Data: Service agreements, project documentation, deliverables, and associated communications
• Financial Data: Invoicing details, payment records, and banking information necessary for payment processing
• Tender Documentation: Information provided for bid submissions, including company capabilities, past performance data, and case studies

2.4 Communication Data

• Correspondence: Emails, letters, meeting notes, and recorded communications (where consent is obtained)
• Feedback: Survey responses, testimonials, reviews, and any feedback provided about our services
• Marketing Preferences: Your choices regarding receiving newsletters, updates, sector insights, and promotional materials

2.5 Special Category Data

We do not intentionally collect special category data (such as data revealing racial or ethnic origin, political opinions, religious beliefs, health data, or sexual orientation). If such data is inadvertently provided within tender documentation, we process it only to the extent necessary for legitimate tender submission purposes and with appropriate safeguards.

We process your personal data for the following specific purposes:

3.1 Service Delivery

• Delivering bid writing, tender management, and consultancy services as contracted
• Preparing, reviewing, and submitting tender documents on your behalf through recognised procurement portals (including Find a Tender, Contracts Finder, CCS eSourcing, Jaggaer, Delta, ProContract, and sector-specific platforms)
• Conducting research and analysis to strengthen your bid submissions
• Coordinating with your team and third-party stakeholders during the tender process
• Managing project timelines, deliverables, and quality assurance processes

3.2 Client Relationship Management

• Responding to enquiries, quotation requests, and service-related questions
• Maintaining accurate client records and communication history
• Providing ongoing account management and client support
• Processing invoices, payments, and financial administration
• Conducting client satisfaction surveys and gathering feedback

3.3 Business Operations and Improvement

• Analysing website usage to improve user experience and content relevance
• Monitoring and enhancing the performance of our digital platforms
• Developing and improving our service offerings based on market trends
• Training our team to deliver better client outcomes
• Managing internal business administration and reporting

3.4 Marketing and Communications

• Sending newsletters, sector insights, and thought leadership content (where consent is provided)
• Notifying you of relevant tender opportunities, framework openings, and procurement updates
• Inviting you to webinars, events, and networking opportunities
• Personalising our communications based on your sector and interests

3.5 Legal and Regulatory Compliance

• Complying with legal obligations, including tax, accounting, and regulatory requirements
• Responding to lawful requests from regulatory authorities and law enforcement
• Establishing, exercising, or defending legal claims
• Preventing and detecting fraud, money laundering, and other unlawful activities

Under UK GDPR, we must have a valid legal basis for processing your personal data. We rely on the following grounds:

Legitimate Interests Assessment

Where we rely on legitimate interests, we conduct a balancing test to ensure our interests do not override your rights. Our legitimate interests include:

• Maintaining and developing business relationships with clients and prospects
• Improving our services through analysis of client outcomes and feedback
• Protecting our business, employees, and clients from fraud and security threats
• Conducting business-to-business marketing to relevant organisations
• Defending our legal rights and interests

We implement comprehensive technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction.

5.1 Technical Security Measures

• Encryption: All data transmitted to and from our website is protected using TLS 1.3 encryption. Sensitive data at rest is encrypted using AES-256 encryption standards
• Access Controls: Role-based access controls ensure only authorised personnel can access personal data relevant to their responsibilities
• Infrastructure Security: Our systems are hosted on secure, ISO 27001-certified cloud infrastructure within the UK and EU
• Monitoring: Continuous security monitoring, intrusion detection systems, and automated threat response mechanisms
• Backup and Recovery: Regular encrypted backups with tested disaster recovery procedures

5.2 Organisational Security Measures

• Staff Training: All employees and contractors receive mandatory data protection training upon joining and annual refresher training
• Confidentiality Agreements: All staff, contractors, and subprocessors are bound by confidentiality obligations
• Security Policies: Comprehensive information security policies governing data handling, acceptable use, and incident response
• Vendor Assessment: Third-party service providers undergo security and data protection assessments before engagement
• Regular Audits: Periodic internal audits and external penetration testing to identify and address vulnerabilities

5.3 Incident Response

We maintain a documented data breach response procedure. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and communicate with affected individuals without undue delay where required by law.

We may share your personal data with the following categories of recipients, always ensuring appropriate safeguards are in place:

6.1 Service Delivery Partners

• Associate Bid Writers and Consultants: Independent contractors engaged on specific projects, bound by confidentiality agreements and data processing terms
• Specialist Subcontractors: Subject matter experts (e.g., social value consultants, technical writers) engaged for specific tender requirements
• Translation and Localisation Services: Where tenders require multi-language submissions

6.2 Technology and Infrastructure Providers

• Cloud Hosting Providers: Secure, UK/EU-based infrastructure providers for data storage and processing
• Email and Communication Platforms: Business email, video conferencing, and collaboration tools
• Analytics Providers: Website analytics services to understand and improve user experience
• Security Services: Providers of cybersecurity, backup, and disaster recovery services

6.3 Professional Advisers

• Legal Advisers: Solicitors and barristers providing legal counsel
• Accountants and Auditors: For financial reporting, tax compliance, and audit purposes
• Insurance Providers: For professional indemnity and business insurance purposes

6.4 Procurement Authorities

When submitting tenders on your behalf, we share necessary information with:

• Contracting authorities and public sector buyers
• Framework operators (e.g., Crown Commercial Service, Pagabo, NHS Supply Chain)
• E-procurement platform operators (e.g., Jaggaer, Delta eSourcing, ProContract)

6.5 Regulatory and Legal Authorities

We may disclose personal data to:

• HMRC for tax and accounting compliance
• The Information Commissioner's Office in response to investigations or enforcement actions
• Law enforcement agencies where required by law or court order
• Other regulatory bodies with lawful authority to request information

We primarily store and process personal data within the United Kingdom and European Economic Area. Where we transfer data to countries outside the UK/EEA, we ensure appropriate safeguards are in place:

• UK Adequacy Regulations: Transfers to countries deemed adequate by the UK government under the Data Protection Act 2018
• Standard Contractual Clauses: International Data Transfer Agreement (IDTA) or UK Addendum to EU SCCs approved by the ICO
• Binding Corporate Rules: Where applicable, transfers to organisations with approved binding corporate rules
• Supplementary Measures: Additional technical and organisational safeguards where required by transfer impact assessments

You may request information about the specific safeguards applied to international transfers by contacting us at info@glaxtons.co.uk.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, and protect our legitimate interests.

At the end of the retention period, personal data is securely deleted or anonymised. Where data is retained in anonymised form for statistical or research purposes, it is no longer considered personal data.

Under UK GDPR, you have the following rights regarding your personal data. These rights are not absolute and may be subject to legal exemptions:

How to Exercise Your Rights

To exercise any of these rights, please contact us at:

• Email: info@glaxtons.co.uk
• Post: Data Protection Lead, Glaxtons Consulting, 3 More London Place, London SE1 2RE
• Telephone: +44 20 3668 5488

We will respond to your request within one month. This period may be extended by two further months where requests are complex or numerous, in which case we will inform you of the extension and reasons.

We may request proof of identity before processing your request to ensure the security of your data. There is no fee for most requests, but we may charge a reasonable fee for manifestly unfounded, repetitive, or excessive requests.

Our website uses cookies and similar technologies to enhance your browsing experience, analyse site usage, and support our marketing efforts.

Types of Cookies We Use

Managing Cookies

You can control cookies through:

• Our cookie consent banner when you first visit the site
• Your browser settings (note: blocking all cookies may affect website functionality)
• Opt-out mechanisms provided by third-party services (e.g., Google Analytics opt-out browser add-on)

For detailed information about the specific cookies we use and their purposes, please refer to our Cookie Policy.

Our website may contain links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you.

We do not control these third-party websites and are not responsible for their privacy practices. When you leave our website, we encourage you to read the privacy policy of every website you visit.

Our services are designed for businesses and professionals. We do not knowingly collect personal data from children under 16 years of age. If we become aware that we have collected personal data from a child without appropriate consent, we will take steps to delete that information promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the "Last updated" date at the top of this policy
• Post a prominent notice on our website
• Where appropriate, notify you directly by email

We encourage you to review this policy periodically to stay informed about how we protect your data. Continued use of our website and services after changes constitutes acceptance of the updated policy.

We take data protection concerns seriously and will endeavour to resolve any issues promptly. If you have concerns about how we handle your personal data:

1. Contact us first: Email info@glaxtons.co.uk or call +44 20 3668 5488. We aim to resolve complaints within 28 days.
2. Escalate if needed: If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

If you have any questions about this Privacy Policy, your personal data, or wish to exercise your data protection rights, please contact us:

This Privacy Policy was last reviewed and updated on 12 December 2024.