01Who we are
Guardspend is a trading name of Tomlin & Co Ltd, a company registered in England and Wales (company number 08353924) with its registered office at Fulford House, CV32 4EA. In this policy, "Guardspend", "we", "us" and "our" mean Tomlin & Co Ltd.
For the personal data described in this policy, we are the controller.
If you have any questions about this policy or how we use your personal data, contact us at hello@guardspend.com or +44 20 8050 9273.
02What this policy covers
This policy explains how we collect and use personal data when you:
- visit guardspend.com
- book a demo or contact us
- work for a customer that uses Guardspend to buy goods and services, run tenders, manage contracts or manage suppliers
- work for a supplier that quotes, tenders, contracts or is vetted through Guardspend
Where a customer uploads documents or data that contain personal data for us to process on its behalf, we act as that customer's processor and the customer's agreement with us, including its data processing terms, applies. The customer is then the controller, and you should read its privacy notice too.
03The personal data we collect
| CATEGORY | WHAT IT INCLUDES |
|---|---|
| Demo bookings and enquiries | Name, work email, company, number of sites, the topics you want to see, your chosen time, and anything you tell us. |
| Correspondence | Emails, call notes and messages you send us, including requests made to the platform by email. |
| Customer users | Name, job title, work contact details, site and cost centre, login details, approval limits, and the requests, approvals and decisions you make on the platform. |
| Supplier contacts | Name, job title, work contact details, quotes, tender responses, contract negotiation messages and signatures. |
| Supplier compliance | Business documents such as insurance certificates and accreditations, which may name individuals, and public records about directors and officers from sources such as Companies House. |
| Payments and invoicing | Billing contact details and payment information needed to invoice and be paid. We do not store full card numbers. |
| Website and technical | IP address, browser and device type, pages viewed and the time of your visit, collected in our hosting provider's logs. Analytics data only if you have agreed to it. |
| Marketing preferences | Whether you have asked us not to send you updates. |
04How we use it and our lawful basis
We only use personal data where UK data protection law allows it. The table sets out what we do and the lawful basis we rely on.
| PURPOSE | LAWFUL BASIS |
|---|---|
| Responding to enquiries and arranging demos | Legitimate interests (responding to people who contact us), or steps at your request before entering a contract |
| Providing the platform: requests, sourcing, tenders, approvals, ordering, contract management and invoicing | Performance of our contract with your organisation, and our legitimate interests in running the service |
| Vetting and monitoring suppliers, including insurance, accreditations and company records | Legitimate interests (making sure suppliers are safe and compliant to use), and legal obligations where they apply |
| Keeping financial and tax records | Legal obligation |
| Sending business updates about Guardspend to work email addresses | Legitimate interests. You can opt out at any time, using the link in each email or by contacting us |
| Keeping the website and platform secure and preventing fraud | Legitimate interests |
| Website analytics | Consent, given through our cookie settings. See our cookie policy |
| Handling legal claims and complying with requests from regulators | Legal obligation and legitimate interests |
Where we rely on legitimate interests, we have weighed those interests against your rights. You can ask us for more detail.
05Where we get it from
Most personal data comes from you directly, or from the organisation you work for when it sets up your account or adds you as a contact. For supplier vetting, we also use public and third-party sources such as Companies House, insurance and accreditation registers, credit reference and business information providers, and news sources.
07International transfers
Some of our service providers are based, or store data, outside the UK. When personal data is transferred outside the UK, we make sure it is protected by a UK adequacy decision or by appropriate safeguards such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
08How long we keep it
| DATA | HOW LONG |
|---|---|
| Demo bookings and enquiries that do not lead to a contract | Up to 2 years after our last contact with you |
| Customer and supplier account data | For the life of the relationship, then 6 years |
| Financial and tax records | 6 years from the end of the financial year they relate to |
| Website server logs | [—] days |
| Marketing opt-outs | Indefinitely, so we can respect your choice |
We may keep data longer if we need it for a legal claim or because the law requires it.
09How we protect it
We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls based on role, audit logs and secure supplier links that expire. Only people who need access to personal data to do their job have it.
10Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you
- have inaccurate data corrected
- have your data erased in certain circumstances
- restrict how we use your data in certain circumstances
- object to our use of your data where we rely on legitimate interests, and object at any time to direct marketing
- receive your data in a portable format in certain circumstances
- withdraw your consent at any time, where we rely on consent
To use any of these rights, contact us at hello@guardspend.com. We will respond within one month. There is normally no charge.
If you are unhappy with how we have handled your data, please contact us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
11Automated checks
Guardspend applies automated checks to business transactions, for example whether a purchase is within budget or whether a supplier's insurance is valid. These checks apply to organisations and transactions. We do not make decisions about individuals based solely on automated processing that have legal or similarly significant effects on them.
12Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed. If we make significant changes, we will tell customers and suppliers who use the platform.