Monarch Market and Bid Development Customer Privacy Notice
At Monarch Market and Bid Development Ltd (referred to as “we”, “us”, “our”), we understand that your privacy is important to you and that you care about how your information is used and shared online.
This Privacy Notice explains how we collect, use, disclose, and safeguard your personal data. We are a UK-based bidding consultancy that provides services to businesses, charities, and public sector organisations. We are committed to protecting your privacy in accordance with UK GDPR and the Data Protection Act 2018.
This Privacy Notice was Last Updated: May 2025
Who We Are
Monarch Market and Bid Development Ltd is a UK-registered consultancy providing bidding and tendering support. For the purposes of data protection legislation, we are the Data Controller of your personal data.
In case of any questions regarding our privacy practices, if you would like to execute your rights or would like to submit a complaint, please contact
Email: info@monarchbd.org
Address: Office 1, Izabella House, Regent Place, Birmingham, England, B1 3NJ
What Data We Collect
- We collect and process the following types of personal data:
- Name, contact details, and job title
- Employment history, CVs, and qualifications
- Organisation details (where applicable)
- Communications and feedback
- Information required to support bid submissions (e.g. references, biographies)
- Personal data embedded in bid content including CVs, case studies, organograms, and
- compliance documents
- Data provided through our website or third-party forms
- Diversity information (optional and anonymised)
- Usage data from our website (via cookies and analytics tools)
We may also collect personal data about you from third parties such as recruitment agencies, referees, referrers, consortium partners, or public records. This may include data relating to joint bids or partner organisations.
Special category personal data
Where provided voluntarily (e.g. for recruitment diversity monitoring), we may collect special
category personal data such as ethnicity, gender identity, or sexuality. This data will only be
processed in anonymised, aggregated form for monitoring purposes in line with data protection
legislation.
This data will not be used in any part of the decision-making process for employment or
engagement.
Personal data provided by third parties
At times, we may collect personal data from third-party sources. These may include:
- Organisations you are affiliated with, such as your employer, partner organisations, or
clients - Recruitment agencies or professional referrers who contact us on your behalf
Individuals who engage us to provide consultancy services involving you (e.g.
submitting your CV as part of a bid) - Publicly available sources, such as LinkedIn, Companies House, or other business
directories
We only collect such information where it is relevant to the services we provide and where we are
satisfied that the third party has a lawful basis to share it with us.
How We Use Personal Data
We use your data for:
- Maintaining internal records (including names, contact details, and employment information)
- Providing consultancy and bid development services, including preparing and submitting tenders on behalf of clients
- Processing personal data contained in bid documents strictly for the purposes of response development, submission, and compliance
- Conducting due diligence and pre-engagement vetting (e.g. PQQ reviews, bid-readiness assessments)
Profiling and scoring team members or mock submissions to support client readiness
Internal administration (e.g. payroll, expense processing, supplier management) - Communication and relationship management
- Event and programme
- Administration
- Feedback and complaints handling
- Website optimisation and analytics
- Marketing and promotional activities (with appropriate consent or legitimate interest)
Where personal data is provided to us by a client in relation to consortium partners, referees, or subcontractors, it is the client’s responsibility to obtain appropriate consents or ensure such individuals are informed. We treat this third-party data with the same level of care and security.
We use personal data only where necessary and proportionate to deliver our services and operate effectively as a business.
Lawful Basis
Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website. The lawful bases we rely on for processing your personal data are:
Contract
Where processing is necessary to fulfil our contract with you or to take steps before entering into a contract.
This includes situations where we are required to:
- Provide services under a client agreement (e.g. preparing a bid that involves the disclosure of personal data)
- Engage you as a participant, trainee, or mentee in one of our events or programmes
- Administer a contract with you as a service provider, consultant, or other professional associate
- We may also process your personal information prior to entering into a contract, for example:
- Conducting due diligence on prospective clients, partners, or individuals
Assessing suitability when receiving quotes or proposals from potential suppliers or collaborators
In these cases, most of your data protection rights continue to apply, although the right to object does not apply when the processing is strictly necessary for the performance of a contract.
Legitimate Interests
For purposes such as managing our business, improving services, conducting bid-readiness reviews, or collecting data during early-stage engagement.
This basis may apply to you either as a client, a job applicant, or in another professional capacity (e.g. as an associate or supplier).
Consent
For activities such as newsletters, surveys, or specific promotional communications.
You have the right to withdraw your consent at any time, and we will stop processing your data for those purposes. To withdraw your consent, please contact us using the details provided in this notice
Legal Obligation
Where processing is necessary to comply with the law (e.g. HMRC, ICO).
Data Sharing
We may share your personal data with:
- Third-party service providers (e.g. IT support, cloud storage, accountants, legal advisors)
- Subcontractors or partners involved in bid submissions (where authorised)
- Regulatory bodies and authorities (e.g. HMRC, courts, ICO)
- Event and survey platforms (e.g. Eventbrite, SurveyMonkey)
- We will only share personal data when necessary and with appropriate safeguards in place.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or to comply with legal, regulatory, or contractual obligations.
Examples
- Payroll data: retained for 6 years after employment ends (HMRC)
- Bid-related personal data: retained only while the bid is under evaluation, unless instructed otherwise by the client
- Client correspondence: retained for duration of the relationship plus a defined archival period
Upon contract termination, clients may request
- A copy of all electronic files
- Printed copies (subject to a reasonable fee)
- A certificate of data destruction, upon request
International Data Transfers
We use cloud-based platforms including but not limited to Google Drive, Trello, and Notion to manage our work and collaboration. These platforms may store data on servers located outside the UK/EEA. In such cases, we ensure that appropriate safeguards are in place, including:
- Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner
- Participation in recognised data frameworks (e.g. Google’s adherence to the Data Privacy Framework)
Cookies and Aggregated Data
Our website uses cookies to track usage and optimise performance. Some cookies are essential; others are optional and require consent. Aggregated data (which cannot identify individuals) may be used for statistical analysis and service improvement.
You can control cookies via your browser settings. See our Cookie Policy for more information
Marketing and Campaigns
We may send you:
- Email newsletters with news, insights, and service updates
- Invitations to events, webinars, or training sessions
- Surveys or feedback requests
- Information about new services or partnership opportunities
- Telephone contact, where appropriate and lawful
- Postal communications, such as event flyers or brochures
We rely on consent or legitimate interest for marketing. You can opt out at any time by contacting us or using unsubscribe links. We may use platforms like Mailchimp, LinkedIn, or Eventbrite for these purposes.
Your Rights
Your right of access
You have the right to ask us for copies of your personal information, known as a Subject Access Request (SAR). You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. You can read more about this right here.
Your right to rectification
You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. You can read more about this right here.
Your right to erasure
You have the right to ask us to delete your personal information. You can read more about this right here.
Your right to restriction of processing
You have the right to ask us to limit how we can use your personal information. You can read more about this right here.
Your right to object to processing
You have the right to object to the processing of your personal data. You can read more about this right here.
Your right to data portability
You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. You can read more about this right here.
Your right to withdraw consent
When we use consent as our lawful basis you have the right to withdraw your consent at any time. You can read more about this right here.
Requests should be sent using the contact details above. We will respond within one month. Requests from clients regarding their organisation or employees will be handled as efficiently as possible. There is no fee unless the request is excessive or additional copies are required.
Data Security
We take data protection seriously. We use:
- Encryption in transit and at rest (e.g. HTTPS and cloud-based encryption)
- Password-protected systems and access control
- Secure disposal of physical and electronic records (e.g. cross-cut shredding, permanent file deletion)
Changes to this Policy
We may update this privacy notice from time to time. Any changes will be published on our website with an updated revision date.
If you have any questions or concerns, please contact us directly using the contact details provided above.
Complaints to the regulator
You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.