Privacy Policy

1. Who we are

Tender Risk Assurance (the "Service") is operated by H-Kay Limited, a company registered in England and Wales, company number 10417923. References to "we", "us", or "our" mean H-Kay Limited. The data controller for all personal data processed through the Service is H-Kay Limited.

2. What we collect

When you use the Service, we may collect:

• Contact details: name, email address, organisation name, telephone number
• Transaction details: purchase history, invoice data, referral codes used or issued
• Technical data: IP address, browser type, device information, approximate location derived from IP
• Communication records: emails you send us and our responses

We do not collect or store your card details. All payment data is handled by Stripe, which is PCI-DSS compliant.

3. Why we collect it

• To deliver the products you buy (including download links and invoices)
• To provide customer support and respond to enquiries
• To process refunds
• To track referral codes and apply renewal credits
• To comply with UK tax and company law obligations
• To prevent fraud and abuse of our Service

4. Legal basis for processing

We process personal data on the following legal bases under the UK GDPR:

• Contract: to fulfil the purchase contract with you
• Legal obligation: to keep financial records as required by HMRC and Companies House
• Legitimate interests: to prevent fraud, improve our Service, and contact customers about updates to products they've purchased

5. Who we share it with

We share limited personal data with:

• Stripe — for payment processing
• Resend — for transactional email delivery (receipts, download links, sample policies)
• Our hosting provider — for server and database operations (AWS)
• HMRC — where required by law for tax compliance

We do not sell, rent, or trade personal data to any third party under any circumstances.

6. How long we keep it

We retain transaction records for 6 years as required by UK tax law. Email correspondence is retained for up to 3 years to provide ongoing support. You may request deletion of your data at any time by emailing us — we will comply within 30 days unless legal retention requirements prevent this.

7. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request erasure of your data (subject to legal retention obligations)
• Object to processing based on legitimate interests
• Request a copy of your data in a portable format
• Complain to the Information Commissioner's Office (ico.org.uk)

To exercise any right, email henry@tenderriskassurance.co.uk.

8. Cookies

We use minimal cookies — only those necessary to run the Service. See our Cookie Policy for details.

9. International transfers

Some of our service providers (e.g. Stripe, Resend) may process data outside the UK and EEA. Where this occurs, data is protected by Standard Contractual Clauses or equivalent safeguards as required by UK GDPR.

10. Changes to this policy

We may update this Privacy Policy periodically. The "Last updated" date at the top of this page reflects the most recent version. Material changes will be communicated to existing customers by email.

11. Contact

For any privacy-related questions, contact the data controller directly:

H-Kay Limited
Email: henry@tenderriskassurance.co.uk
Phone: +44 7347 953997