1. Who We Are

SteelBid ("we", "us", "our") is the data controller for personal data collected through the steelbid.co.uk platform. We operate as a UK-based business connecting structural steel fabricators and detailers.

For data protection enquiries, contact us at: accounts@steelbid.co.uk

2. Data We Collect

2.1 Information you provide directly

• Account information: first name, last name, email address, company name, job title, phone number, website
• Profile information: location (city, county, postcode, country), professional biography, years of experience, hourly rate range, skills, software proficiencies
• Tender information: project titles, descriptions, locations, budgets, drawings and documents uploaded by Fabricators
• Bid information: bid amounts, cover letters and availability submitted by Detailers
• Payment information: we do not store card or bank account details. Payment is by BACS transfer and we retain invoice records only
• Communications: any correspondence with us via email

2.2 Information collected automatically

• Session data: we use essential session cookies to keep you logged in during your visit
• Technical data: IP address, browser type and operating system collected by our hosting provider (Ionos) for security and operational purposes

2.3 Information we do not collect

We do not collect sensitive personal data such as racial or ethnic origin, health information, political opinions, religious beliefs, or biometric data.

3. How We Use Your Data

4. Data Sharing

4.1 With other platform users

Your profile information (name, company, location, skills, software, bio, experience) is visible to other registered users of the platform as part of the matching service. Bid amounts submitted by Detailers are visible to the Fabricator who posted the tender but not to other Detailers.

When a Fabricator awards a tender to a Detailer, we share the Fabricator's contact details with the awarded Detailer to enable them to make direct contact. This is an essential function of the service.

4.2 With service providers

We use the following third-party services to operate the platform:

• Ionos UK Ltd — web hosting and email services. Servers are located in the EU.
• Brevo (Sendinblue) — transactional email delivery (if applicable)

These providers act as data processors on our behalf and are contractually required to handle your data securely and only for the purposes we specify.

4.3 Legal disclosures

We may disclose your data if required to do so by law, court order or regulatory authority.

4.4 We do not sell your data

We do not sell, rent or trade your personal data to any third party for marketing purposes.

5. Cookies

SteelBid uses the following cookies:

• Session cookie (PHPSESSID): an essential cookie that keeps you logged in during your browser session. This cookie is deleted when you close your browser or sign out. No consent is required for this cookie as it is strictly necessary for the platform to function.
• Cookie consent cookie: stores your acknowledgement of this cookie notice. Expires after 12 months.

We do not use advertising cookies, tracking cookies or any third-party analytics cookies.

6. Data Retention

• Active accounts: data is retained for as long as your account is active
• Deleted accounts: personal data is deleted immediately when you delete your account, except where we are required to retain it for legal or financial reasons
• Invoice records: retained for 7 years in accordance with HMRC requirements
• Uploaded drawings: deleted automatically when a tender is closed or awarded
• Password reset tokens: deleted immediately after use or after 1 hour if unused

7. Your Rights

Under UK GDPR you have the following rights regarding your personal data:

• Right of access: you can request a copy of the personal data we hold about you
• Right to rectification: you can correct inaccurate data via your profile settings or by contacting us
• Right to erasure: you can delete your account and associated data at any time via the Security section of your dashboard
• Right to restriction: you can ask us to restrict processing of your data in certain circumstances
• Right to portability: you can request your data in a machine-readable format
• Right to object: you can object to processing based on legitimate interests

To exercise any of these rights, contact us at accounts@steelbid.co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data including:

• Encrypted HTTPS connections across the entire platform
• Passwords stored using bcrypt hashing — we cannot see your password
• CSRF protection on all forms
• Admin access protected by two-factor email verification
• Regular server backups by Ionos

Despite these measures, no internet transmission is completely secure. In the event of a data breach that is likely to result in a risk to your rights, we will notify you and the ICO within 72 hours as required by UK GDPR.

9. International Transfers

Your data is hosted on Ionos servers located within the European Union and is subject to EU GDPR equivalent protections. We do not transfer your data outside the UK or EU.

10. Children

SteelBid is a professional B2B platform intended for use by businesses and individuals aged 18 and over. We do not knowingly collect data from anyone under 18.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email. The date at the top of this page shows when the policy was last updated.

12. Contact Us

For any privacy-related questions or to exercise your rights, contact us at accounts@steelbid.co.uk.