Privacy Policy

This Privacy Policy explains how Public Mandate("we", "us", "our") collects, uses, and protects personal data when you visit our website or use our client portal. We are committed to handling your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Public Mandate is a management consultancy based in London, United Kingdom. For the purposes of data protection law, we are the data controller of personal data processed through this website and portal. You can contact us at info@publicmandate.co.uk.

2. Data we collect

• Account data: your name, email address, organisation, and role, used to create and manage your portal account.
• Usage data: the tenders you save ("star") and your activity within the portal.
• Enquiry data: the information you provide via our contact form.
• Analytics data (with consent): on our public marketing pages only, we record the page path visited, the referring website, and an anonymous random session identifier. We do not collect IP addresses or any data that identifies you personally through marketing analytics. This data is retained for 90 days.
• Technical data: browser type and similar information collected via essential cookies to keep you signed in.

2a. Client portal usage logging

When you use the authenticated client portal, we log usage tied to your account for account management, service improvement, and identifying inactive accounts. This includes sign-ins, tenders viewed, documents accessed, searches (where the search term does not appear to contain personal information), and shortlist changes. This data is linked to your user account, not collected anonymously, and is not subject to the cookie consent banner because it is based on your authenticated session rather than a tracking cookie.

Portal usage data is not shared outside the company except with our service providers who process it on our behalf under appropriate safeguards. It is retained for the same period as other usage data (90 days) unless a longer period is needed for legitimate business records.

3. How we use your data

• To provide and secure access to the client portal.
• To respond to enquiries you submit to us.
• To operate, maintain, and improve our services.
• To comply with our legal and regulatory obligations.

4. Legal bases for processing

We process your data on the basis of contract (to provide the portal you or your organisation have signed up for), legitimate interests (to run and improve our business securely), consent (for non-essential cookies and marketing), and legal obligation where applicable.

5. Sharing your data

We use trusted service providers to operate our platform, including Supabase (authentication, database, file storage, and analytics data storage — hosted in the EU) and our hosting provider (Vercel). These providers process data on our behalf under appropriate contractual safeguards. We do not use advertising networks, sell your personal data, or share it with third parties for marketing purposes.

6. Data retention

We retain account data for as long as your organisation maintains an active relationship with us, and enquiry data for as long as necessary to respond and for our legitimate record-keeping, after which it is securely deleted.

7. Your rights

Under UK GDPR you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability. To exercise any of these rights, contact us at info@publicmandate.co.uk. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

8. Security

Access to the portal is protected by authentication and row-level security so that each user can only access data they are authorised to see. We apply appropriate technical and organisational measures to protect your data.

9. Changes to this policy

We may update this policy from time to time. Material changes will be notified through the website or by email where appropriate.

This document is provided for general information and does not constitute legal advice. Public Mandate recommends that this template be reviewed by a qualified solicitor before the service goes live. Contact us with any questions.