BIDFLOW LTD — Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Agreement between the Customer as controller (or, where applicable, processor acting for another controller) and BIDFLOW LTD (“BidFlow”) as processor. It applies automatically whenever BidFlow processes Customer Personal Data on the Customer’s behalf in providing the Platform. No separate signature or email request is required. Capitalised terms not defined here have the meaning in the Terms of Service.

1. Definitions and scope

“Applicable Data Protection Laws” means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 where applicable, each as amended (including by the Data (Use and Access) Act 2025 to the extent in force), and applicable replacement or successor legislation.

“Customer Personal Data” means personal data contained in Customer Data that BidFlow processes as processor on the Customer’s behalf under the Agreement.

“Data Subject”, “personal data”, “personal data breach”, “processing”, “controller” and “processor” have the meanings in Applicable Data Protection Laws.

“Restricted Transfer” means a transfer of personal data from the United Kingdom to a country or recipient not covered by applicable UK adequacy regulations, where a safeguard is required.

“Subprocessor” means a third party appointed by or for BidFlow to process Customer Personal Data.

This DPA does not apply to personal data BidFlow processes as an independent controller, as described in the Privacy Policy.

2. Processing details

3. Customer instructions and obligations

The Customer instructs BidFlow to process Customer Personal Data to provide, support and secure the Platform; enable requested AI, email, import and export features; comply with the Agreement; and follow other documented instructions consistent with it. The Agreement and use of configured features are documented instructions.

The Customer is responsible for ensuring that its instructions and Customer Personal Data comply with Applicable Data Protection Laws, that it has a lawful basis and gives required notices, and that it does not upload unnecessary data. If the Customer acts as processor, it confirms that the relevant controller authorises its instructions and BidFlow’s appointment as subprocessor.

BidFlow will promptly inform the Customer if, in its reasonable opinion, an instruction infringes Applicable Data Protection Laws, unless law prohibits that notice. BidFlow may suspend the affected processing while the parties resolve the issue and is not required to follow an unlawful instruction.

4. BidFlow obligations

BidFlow will:

• process Customer Personal Data only on documented instructions, including for Restricted Transfers, unless UK law requires other processing; where permitted, BidFlow will inform the Customer before that processing;
• ensure persons authorised to process Customer Personal Data are bound by confidentiality obligations and access it only as needed for their role;
• implement and maintain appropriate technical and organisational measures under clause 5;
• provide reasonable information needed to demonstrate compliance with this DPA;
• notify the Customer of a legally binding request for Customer Personal Data unless prohibited by law, and redirect the requester to the Customer where appropriate; and
• not sell Customer Personal Data or use it to train or fine-tune general or shared AI models without the Customer’s express written agreement.

5. Security measures

Taking account of the state of the art, implementation cost, processing context and risks to individuals, BidFlow will maintain measures appropriate to risk. Those measures include, where relevant to the service:

• authenticated access, role-based permissions, organisation-scoped server authorisation and row-level database policies for relevant tenant data;
• HTTPS/TLS for supported data transmission paths and encryption controls supplied by selected hosting and database providers;
• restricted administrative and service-role access, credential and secrets management, and multi-factor authentication where supported and appropriate;
• logging, monitoring, dependency maintenance, code review and vulnerability remediation proportionate to an early-stage SaaS service;
• availability, backup and recovery capabilities provided through the selected infrastructure services, with restoration procedures proportionate to service risk;
• incident assessment and response procedures; and
• periodic review of access, subprocessors and the effectiveness of relevant controls.

The Customer acknowledges that security is shared: it must manage Authorised Users, credentials, devices, source copies, data minimisation and the sensitivity of uploaded material. BidFlow may update measures as technology and risk change, provided protection is not materially reduced overall.

6. Subprocessors

The Customer gives general written authorisation for BidFlow to use the Subprocessors in Schedule 2 and to appoint replacements needed to provide the Platform. BidFlow will impose written data-protection obligations materially equivalent to those required by Applicable Data Protection Laws and remains responsible to the Customer for a Subprocessor’s performance of those obligations.

BidFlow will publish an updated list or otherwise notify affected Customers at least 15 days before a new Subprocessor begins processing Customer Personal Data where reasonably practicable. The Customer may object during that period on reasonable, documented data-protection grounds. The parties will work in good faith on a commercially reasonable alternative. If none is available, either party may terminate only the affected feature or service; BidFlow will refund prepaid Fees for its unused period.

Emergency replacements may be made without advance notice where needed for security, continuity or law; BidFlow will notify affected Customers as soon as reasonably practicable.

7. International transfers

BidFlow may make a Restricted Transfer only where permitted by Applicable Data Protection Laws. Where adequacy regulations do not apply, BidFlow will use an appropriate safeguard, normally the then-current UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment and supplementary measures where required.

If a Subprocessor’s safeguard is directly between the Customer and Subprocessor, the Customer authorises BidFlow to enter it for the Customer where legally permitted. Otherwise, the relevant safeguard is incorporated by reference to the minimum extent required. Nothing in this clause reduces a Data Subject’s mandatory rights.

8. Data Subject requests

Taking account of the nature of processing, BidFlow will provide reasonable technical and organisational assistance to help the Customer respond to requests to exercise Data Subject rights. BidFlow will not respond substantively on the Customer’s behalf unless instructed or legally required. If BidFlow receives a request relating to Customer Personal Data, it will notify the Customer without undue delay where reasonably identifiable and permitted.

9. Personal data breaches

BidFlow will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. As information becomes available, the notice will describe the nature of the breach, affected data and Data Subjects where known, likely consequences, measures taken or proposed, and a contact point. BidFlow may provide information in stages and will reasonably assist the Customer with investigation, mitigation and any legally required notification.

Notification is not an admission of fault. The Customer is responsible for deciding whether to notify a regulator or Data Subject, except where law places that duty directly on BidFlow.

10. DPIAs and regulator consultation

Taking account of the nature of processing and information available to it, BidFlow will provide reasonable assistance with the Customer’s data-protection impact assessments and prior consultation with the ICO or another competent regulator where the processing through the Platform makes that assistance necessary.

11. Return and deletion

On termination or the Customer’s written instruction, and at the Customer’s choice where technically available, BidFlow will return or delete Customer Personal Data unless law requires retention. The Terms provide a 30-day post-termination request window for a reasonable active-system export. After that window, deletion from active systems will occur within a reasonable operational period.

Customer Personal Data may remain in access-restricted backups until normal overwrite and in Subprocessor systems for their documented deletion cycles or legal exceptions. During that period it remains protected, is isolated from ordinary use and is processed only for restoration, security or legal purposes. If a backup is restored, applicable deletion instructions will be reapplied.

12. Information and audits

On reasonable request, BidFlow will provide information reasonably necessary to demonstrate compliance, such as current security and Subprocessor information and relevant independent reports it holds. The Customer must protect that information as confidential.

If that information is insufficient, the Customer may conduct one audit in any 12-month period on at least 30 days’ notice, during normal business hours, in a way that avoids unreasonable disruption and exposure of other customers’ or BidFlow’s confidential information. Additional audits are permitted after a material personal data breach or where a regulator requires one. The Customer bears its audit costs and BidFlow’s reasonable additional costs unless the audit identifies BidFlow’s material breach. Auditors must be independent, suitably qualified, non-competitive and bound by confidentiality.

13. Liability, precedence and termination

The liability provisions in the Terms apply to this DPA to the fullest extent permitted by law. They do not limit liability to a regulator or Data Subject where Applicable Data Protection Laws prohibit that limitation. This DPA controls over conflicting Agreement terms only in relation to processing Customer Personal Data.

This DPA ends when BidFlow no longer processes Customer Personal Data, except for provisions intended to protect retained data or survive termination. A material breach of this DPA is a material breach of the Agreement.

Schedule 1 — Processing instructions

The processing description in clause 2, the Customer’s configuration and use of Platform features, and documented support requests constitute the Customer’s initial instructions. Additional instructions must be sent by an authorised Customer contact and may be subject to reasonable Fees where they require work outside the contracted service.

Schedule 2 — Current Subprocessors

The provider used for a particular feature depends on the Customer’s use and BidFlow’s current configuration. Processing locations below are deliberately qualified because providers use regional infrastructure, remote support and their own subprocessors. Restricted Transfers remain subject to clause 7.

Stripe processes billing and payment information, and PostHog processes minimised product analytics, principally for BidFlow’s controller purposes. They are described in the Privacy Policy rather than being treated as recipients of tender content. If either is used to process Customer Personal Data on the Customer’s instructions in future, BidFlow will update this Schedule as required.

Schedule 3 — Additional security information

BidFlow’s current public security description is in the Trust Centre. Customer-specific security requirements, service levels or audit commitments apply only if expressly agreed in an Order Form. A security control is not guaranteed to prevent every incident; BidFlow’s obligation is to maintain measures appropriate to the relevant risk and Applicable Data Protection Laws.