Privacy Policy

1. Who we are

BulkMatch operates the website at bulkmatch.co.uk and the application at app.bulkmatch.co.uk. We are the data controller for the personal data described in this policy.

Contact: hello@bulkmatch.co.uk

If you have questions about how we handle your data, please email us at hello@bulkmatch.co.uk.

2. Data we collect

3. How we use your data

• Waitlist emails: To notify you when BulkMatch launches and send updates about founding member perks. You can unsubscribe at any time.
• Account operation: To create and manage your account, verify your compliance credentials, and provide the marketplace service.
• Platform communications: To send transactional emails (quote notifications, job updates, document expiry reminders).
• Support: To respond to enquiries and resolve issues.
• Product improvement: To understand how the platform is used and improve it. Usage data only — never sold.

4. Legal basis for processing

5. Where we store your data

All personal data is stored in the UK or European Economic Area (EEA). We use:

• Supabase — database and authentication. Hosted on AWS EU (Frankfurt). Data encrypted at rest and in transit.
• Resend — transactional email delivery. Compliant with UK GDPR. Emails are not stored permanently after delivery.
• Vercel — website and application hosting. EU region. No personal data stored at the edge layer.

6. Third parties

We do not sell your data. We share data only with the service providers listed above (Supabase, Resend, Vercel) for the specific purposes described in this policy. Each provider has a Data Processing Agreement with us and is GDPR-compliant.

We may disclose data if required by law, court order or to protect the rights and safety of our users.

7. Cookies

We use only essential cookies:

• Session cookie: Required for authentication at app.bulkmatch.co.uk. Expires when you close your browser.
• Preference cookie: Remembers your UI preferences (if applicable). First-party only.

We do not currently use advertising cookies or third-party analytics scripts (e.g. Google Analytics). If this changes, we will update this policy and obtain consent.

8. Your rights

Under UK GDPR, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Ask us to correct inaccurate data.
• Deletion: Ask us to delete your data (subject to legal retention obligations).
• Withdraw consent: Unsubscribe from marketing emails at any time via the link in any email, or by emailing us.
• Portability: Request your data in a machine-readable format.
• Complain to the ICO: If you believe we've handled your data improperly, you can complain to the Information Commissioner's Office at ico.org.uk.

To exercise any of these rights, email hello@bulkmatch.co.uk. We will respond within 30 days.

9. Data retention

• Waitlist emails: Retained until we launch and you create an account, or until you unsubscribe, whichever is sooner.
• Account data: Retained for as long as your account is active. Deleted within 30 days of account closure, except records required by law.
• Financial records: Retained for 7 years as required by UK tax law.
• Waste transfer notes: Retained for a minimum of 2 years (per EA guidelines).

10. Changes to this policy

We may update this policy as the platform develops. Significant changes will be communicated by email to registered users and waitlist members. The “last updated” date at the top of this page will always reflect the most recent version.

Questions? Email hello@bulkmatch.co.uk.