Privacy policy

Last updated 20 October 2026. This policy explains what EnJoin Labs ("we", "us") collects when you use BidRadar (the "Service"), why, and what your rights are.

1. Who we are

EnJoin Labs, Based in Newcastle, Tyne and Wear, United Kingdom. Postal address available on request.. We are the data controller for the information described in this policy. Contact: support@enjoinlabs.dev.

2. What the Service does

The Service reads publicly available procurement notices from the UK government's Find a Tender service, matches them against the search profile you configure, and — only when you choose to — creates or updates records in your Pipedrive account.

3. Information we collect

Account and connection data. When you install the Service from the Pipedrive Marketplace, Pipedrive gives us an OAuth access token and refresh token, your Pipedrive company ID and API domain, and the name and email address of the user who installed the app. We use these to act on your behalf in your Pipedrive account.

Configuration data. The search profile you set (keywords, CPV codes, regions, value ranges), your preference for creating Leads or Deals, and the pipeline and stage you select.

CRM data we write. When you push a notice, we create or update a Lead or Deal, and where needed an Organisation for the buyer, and we write the notice ID, submission deadline and source URL to custom fields. We keep a record of which notices map to which Pipedrive record IDs so we can avoid duplicates and apply amendments.

CRM data we read. We read the list of pipelines, stages and custom fields in your account, and the specific records we have created, so the Service can function. We do not read your other deals, contacts, emails or activities.

Public procurement data. Tender notices and related data published by Find a Tender under the Open Government Licence. This may include the names and contact details of public-sector procurement officers as published by the contracting authority.

Technical data. Server logs containing IP addresses, timestamps, request paths and error details, kept for troubleshooting and security.

We do not use advertising trackers, and we do not sell personal data.

4. Why we process it and on what basis

• To provide the Service you asked for — performance of a contract (UK GDPR Art. 6(1)(b)).
• To keep the Service secure and reliable (logs, abuse prevention) — our legitimate interests (Art. 6(1)(f)).
• To tell you about changes to the Service — legitimate interests; you can opt out of anything that is not a necessary service message.
• To process public-sector officers' published contact details — legitimate interests in enabling suppliers to respond to public procurement; the data is already published by the authority for that purpose.

5. Who we share it with

We share data only with processors needed to run the Service: our hosting provider (GitHub, Inc. (website) and the provider named in our app documentation (application hosting)), our email provider (Zoho Corporation) and, by the nature of the Service, Pipedrive. Each is bound by a data-processing agreement. We do not share your data with other customers or with the contracting authorities.

6. Where it is stored

Data is stored in the United Kingdom or the European Economic Area. Where a processor stores data outside the UK, transfers are protected by the UK International Data Transfer Agreement or an adequacy decision.

7. How long we keep it

• OAuth tokens: deleted immediately when you uninstall the app or revoke access in Pipedrive.
• Configuration and notice-to-record mapping: deleted within 30 days of uninstall.
• Records we created in your Pipedrive account remain in your account; they are yours and we do not remove them.
• Server logs: 90 days.
• Public procurement data: retained as a historical dataset; it is public information.

8. Your rights

Under UK GDPR you can ask us to access, correct, delete or restrict the personal data we hold about you, object to processing based on legitimate interests, and ask for a copy in a portable format. Email support@enjoinlabs.dev. We will respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.

9. Security

Tokens are stored encrypted at rest. All traffic to and from the Service uses HTTPS. Access to production systems is restricted to the people who need it. No system is perfectly secure; if we become aware of a breach affecting your data we will tell you without undue delay.

10. Changes

We will post any changes here and update the date at the top. If a change is significant we will email the installing user.