Termwell Privacy Notice

Last updated: 13 November 2026

This notice explains how Termwell uses personal information, why, and what your rights are. It is written for three groups of people:

  • Customers and people who contact us (section 3)
  • People we contact about our services by business email (section 4)
  • People named in public contract notices, such as procurement officers whose work contact details appear in our data (section 5)

Sections 1, 2 and 6 to 10 apply to everyone.

1. Who we are

Termwell is a trading name of Reliness Ltd, a company registered in England and Wales with company number 17558426 and registered office at 4th Floor, Silverstream House, 45 Fitzroy Street, London W1T 6EB.

Reliness Ltd is the controller of the personal information described in this notice. That means we decide how and why it is used.

Contact for anything about this notice or your information: hello@termwell.co.uk, or by post to 4th Floor, Silverstream House, 45 Fitzroy Street, London W1T 6EB.

We have not appointed a data protection officer because we are not required to. Our registration number with the Information Commission is TBC.

2. Summary

  • We sell business information about public sector contracts to other businesses.
  • That information comes from public notices on Contracts Finder and Find a Tender, and from Companies House.
  • Some notices name a person at the public body, usually a procurement officer, with their work email and phone. We include those work details in our products.
  • We never look for anyone's personal (non-work) details, and we do not add any extra information about named individuals beyond what the public body itself published.
  • You can object at any time and we will remove you. See section 5.6.

3. Customers and people who contact us

What we collect

  • Name, job title, business name, business email, phone number and business address
  • Order details: what you bought, when, the price, and your subscription status
  • Payment information: Stripe tells us the payment status, card type and last four digits. We never receive or store full card numbers.
  • Messages you send us and our replies
  • Your alert settings (categories, regions) and, for agency customers, the names and contact details of the clients you send alerts to
  • Basic technical information when you use our website, such as IP address and browser type

Where it comes from: you, and Stripe (payment status).

Why we use it, and our lawful basis

Purpose Lawful basis (UK GDPR Article 6)
Taking payment, delivering products and running your subscription Contract (6(1)(b))
Keeping accounting and tax records Legal obligation (6(1)(c))
Answering questions and handling complaints Legitimate interests (6(1)(f)): running our business and looking after customers
Telling existing customers about similar products, with an opt-out in every message Legitimate interests (6(1)(f)). Where PECR applies (for example, sole traders), we rely on the "soft opt-in" in regulation 22(3) PECR.
Preventing fraud and misuse of our data, and enforcing our terms Legitimate interests (6(1)(f))

How long we keep it: for as long as you are a customer, then for 6 years after your last purchase or the end of your subscription, to meet accounting and tax rules and to deal with any claims. Marketing preferences and opt-outs are kept for as long as needed to respect them.

4. People we contact about our services

We send a small number of business emails to introduce Termwell.

Who we contact: only limited companies and other incorporated bodies. We check each company against the Companies House register first. We do not send marketing emails to sole traders or ordinary partnerships unless they have agreed to receive them.

What we use: the company name and a generic or published business email address, such as one listed on the company's own website. If that address includes a person's name, it is personal information, and this section applies to it. We may also record the company number, the date we emailed, any reply, and whether you have asked us to stop.

Where it comes from: the company's own website or other places where the business has published its contact details, and the Companies House register.

Why, and our lawful basis: to tell businesses about our services that may be relevant to them. Our lawful basis is legitimate interests (Article 6(1)(f) UK GDPR). The law recognises that direct marketing can be a legitimate interest (Article 6(11)(a) UK GDPR). Our assessment of that interest is available on request.

How we contact you: we send one email, and at most one follow-up. Every email says who we are and gives a simple way to tell us to stop.

Your right to object: you can tell us to stop at any time by replying to any of our emails or writing to hello@termwell.co.uk. We will stop straight away and keep only the minimum details needed (email address and company name) on a suppression list, so that we do not contact you again.

How long we keep it: if we do not hear back, we delete your details 12 months after our last email, except the suppression list entry if you asked us to stop.

5. People named in public contract notices

This section is the information we must give under Article 14 of the UK GDPR, because we did not collect your details from you.

5.1 What we hold

Public bodies, such as councils and NHS bodies, publish notices about their contracts. Many notices give a named contact person. Where a notice does this, we may hold:

  • your name, as given in the notice
  • your work email address and work phone number, as given in the notice
  • your job title or team, if given in the notice
  • the public body you work for
  • the notices you are named in (contract title, value, dates and reference)

We do not hold, look for or add any other information about you, such as personal contact details, social media profiles or home address. We do not hold any special category information about you.

5.2 Where we got it

From contract notices published by your organisation on:

  • Contracts Finder (www.contractsfinder.service.gov.uk), and
  • Find a Tender (www.find-tender.service.gov.uk).

These are publicly available sources.

5.3 Why we use it

To include your work contact details, alongside the contract information, in business products that we sell to suppliers, so they can contact the right person at your organisation about public contracts that may be re-tendered.

5.4 Our lawful basis

Legitimate interests (Article 6(1)(f) UK GDPR).

  • Our interest: running a business that helps suppliers find and approach public sector buyers.
  • Our customers' interest: knowing which contracts are coming up and who to talk to, which the public body itself chose to publish for that purpose.
  • Wider interest: competition and transparency in public procurement.

We have assessed that these interests are not overridden by your rights, because we use only work details your own organisation has already published, we use them only in connection with your work role, and we offer an easy way to object. A summary of our assessment is available on request.

5.5 Who we share it with

  • Our customers: businesses that buy our lists, reports and subscriptions. They are suppliers to the public sector, and agencies that act for those suppliers.
  • Clients of our agency customers: agency customers may send alerts that include your details to their own business clients, under the agency's name.
  • Our service providers (section 6).

Each customer becomes a separate controller of your details. Our terms require them to use your details only to contact you in your work role, to comply with data protection and electronic marketing law, to give you their own privacy information when they first contact you, to stop immediately if you object, and to apply any removal requests we pass on.

5.6 Your right to object, and how to do it

You can object at any time, and we will remove you. Because we provide your details for direct marketing purposes, this right is absolute: we do not need a reason and will not refuse (Article 21(2) and (3) UK GDPR).

To object, email hello@termwell.co.uk with the subject "Remove me", or use the form at termwell.co.uk/remove. Please tell us your name and work email so we can find you.

When you object we will:

  1. remove your details from our products within 5 working days;
  2. add your work email and name to our suppression list so you are not added again when we refresh our data; and
  3. tell the customers who have already received your details to stop using them and delete them, unless this is impossible or would involve disproportionate effort (Article 19 UK GDPR).

A public body can also ask us to stop including any named staff from its notices, and we will use a generic contact for that body instead.

5.7 How long we keep it

We keep your details only while they appear in a current notice, and we re-check them every time we refresh our data from the source. If your details no longer appear in a current notice from your organisation, or a newer notice names someone else, we delete them within 3 months. In any case we delete them 24 months after the date of the most recent notice they came from.

Suppression list entries are kept for as long as we hold any data from that organisation, so that we do not add you again.

5.8 How and when we tell you

We do not contact each named person individually. Their work contact details were published by their own employer in a public notice so that suppliers could get in touch, and we rely on publishing this notice instead, as Article 14(5)(e) and 14(7) UK GDPR allow. If you are named in our data you can ask us to remove you at any time at termwell.co.uk/remove.

5.9 Note on the "disproportionate effort" exemption

The law allows a controller not to contact people individually where that would be impossible or involve disproportionate effort (Article 14(5)(e) UK GDPR, which replaced Article 14(5)(b) on 5 February 2026). In that case the controller must still protect people's rights, including by publishing the information (Article 14(7)).

6. Service providers

We use a small number of providers who handle personal information for us under contract:

  • Stripe (payments). Stripe also acts as a separate controller for some purposes, such as fraud prevention, under its own privacy notice.
  • our email delivery provider
  • Cloudflare (website and data hosting)
  • Google Workspace (business email and file storage)

We also use Companies House data, and may share information with our professional advisers, the authorities, or a buyer of our business where the law allows.

7. International transfers

Some of our providers may store or access information outside the UK. Where they do, we rely on UK adequacy regulations or the International Data Transfer Agreement or Addendum to protect it.

8. Security

We keep personal information on secure, access-controlled systems and limit who can see it.

9. Your rights

Depending on the circumstances, you have the right to:

  • access the personal information we hold about you;
  • have it corrected if it is wrong;
  • have it deleted;
  • restrict how we use it;
  • object to our use of it, which is absolute for direct marketing (see sections 4 and 5.6);
  • data portability, where we rely on contract and process it electronically.

We do not make decisions about anyone using only automated processing that has legal or similarly significant effects.

To use any of these rights, email hello@termwell.co.uk. We will respond within one month, which can be extended by up to two further months for complex requests. We may need to confirm your identity first.

10. Complaints

To us. If you are unhappy with how we have used your information, please complain to us first at hello@termwell.co.uk or by using the form at termwell.co.uk/remove. We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome (section 164A of the Data Protection Act 2018).

To the regulator. You also have the right to complain to the Information Commission (formerly the Information Commissioner's Office, ICO): www.ico.org.uk, telephone 0303 123 1113.

11. Changes to this notice

We will update this notice when our practices change and show the date at the top. If a change materially affects people named in notices, we will publish it here before it takes effect.