Website and business services | Last updated 27 September 2026

Who we are

This notice explains how we collect, use and protect personal information when you visit 2bctenders.com, contact us, book a meeting or use our tender writing, procurement consultancy, training and business mentoring services. It also explains cookies and your data protection rights.

2BC Tenders is the trading name of Brendan James Cunningham, a sole trader. We are the controller responsible for the personal information we use for our own business purposes. Where we process information solely on a client’s instructions, our role is explained below.

Data protection contact	Details
Name	Brendan Cunningham
Email	brendan@2bctenders.com
Telephone	07825 662401
Postal address	42 Brookvale Rise, Lisburn, County Antrim, BT28 1DE
ICO registration	ZC250179

What we collect and why

We collect information directly from you through enquiries, correspondence, meetings and our services. We may also receive information from your employer, a client or a programme organiser, and collect technical information when you use the website. We use only what is needed for the relevant purpose.

Enquiries and appointment bookings

We use your name, business contact details, organisation, message and appointment details to respond, arrange meetings and discuss our services. Our lawful basis is our legitimate interest in responding to enquiries and managing business relationships. If you ask us to take steps towards a contract with you personally, we rely on those pre-contract steps instead.

Clients and business contacts

We use names, job titles, business contact details, correspondence, project information and invoicing details to provide our services and manage payment. We rely on contract where you are personally our client, and legitimate interests in delivering and administering services where you represent an organisation. We rely on legal obligation for records required by tax or accounting law.

What we collect and why continued

People named in tender documents

Clients may provide names, roles, CVs, qualifications, work histories and referee details so we can help prepare tender submissions. Where we handle this information solely on a client’s documented instructions, we act as its processor. The client is responsible for its lawful basis and for explaining the processing to the people concerned. We assist it with information rights requests and use the information only as authorised under our agreement.

If we submit documents on a client’s behalf, the intended recipient may be a procurement portal, contracting authority or other organisation specified by the client. That recipient’s own privacy arrangements apply to its subsequent use of the submission.

Training and commissioned programmes

We use participant names, contact details, attendance, communications and relevant feedback to arrange and deliver training or mentoring. For our own services, our basis is contract with an individual participant or legitimate interests in delivering services to an organisation. Where a council, public body or other organisation controls a programme and we act on its instructions, its programme privacy notice explains the use of participant information. We will explain any separate use for which we are the controller.

Testimonials and publicity

We publish agreed testimonials with the contributor’s name, organisation and any agreed photograph to describe our work. We rely on consent for this use of personal information. You can withdraw that consent by contacting us, and we will remove the relevant material from channels we control.

Website operation and statistics

Our website and security systems process technical information such as IP addresses, request times, pages requested, browser information and security events to deliver pages, prevent misuse and investigate faults. We rely on our legitimate interests in providing a reliable and secure website.

We use WP Statistics to understand website usage, including pages visited, referring websites, browser and device types, and approximate location derived from an IP address. This information is processed within our website hosting environment. Where this involves personal information, our basis is our legitimate interest in understanding and improving the website, subject to any consent required for access to information on your device. You can object to processing based on legitimate interests by contacting us.

Information you choose to provide

You do not have to contact us or book online. If you do not provide the details needed to answer an enquiry or deliver an agreed service, we may be unable to do so. Please avoid including sensitive personal information or unnecessary information about other people in a general website enquiry. Any necessary use of health information or other specially protected information will be explained separately with the relevant legal conditions.

We do not sell personal information or automatically add enquirers to marketing lists. We do not make decisions about people based solely on automated processing that have legal or similarly significant effects.

Cookies and similar technologies

Cookies are small files stored on your device. Websites can also use browser storage, scripts and other technologies to store or access information. Some support essential functions; others support optional features or measurement. Session cookies usually end when you close your browser. Persistent cookies remain until their expiry date or until you delete them.

Website security and administration

Our hosting and security services may use strictly necessary technologies to protect the website against malicious traffic and maintain requested services. WordPress also uses cookies when an authorised administrator visits the login area or signs in. These administration cookies are not needed simply to read our public pages.

WordPress cookie	Purpose and when used	Typical duration
wordpress_test_cookie	Checks cookie support on the login page.	Session
wordpress_logged_in_* wordpress_sec_*	Recognises and authenticates signed-in users.	Session; normally up to 14 days with Remember Me
wp-settings-* wp-settings-time-*	Stores a signed-in user’s administration preferences.	1 year

Website statistics

WP Statistics is designed to measure visits without setting analytics cookies. Cookie expiry therefore does not determine how long its website records are kept. Our use of technical and statistics data is explained in this notice. Cookies used by other features are separate from WP Statistics.

Google Maps and external booking services

The contact page includes a Google Maps feature. When it loads, your browser connects to Google, which receives technical information such as your IP address and browser details and may store or access information on your device. Google explains its processing at policies.google.com/privacy and its cookies at policies.google.com/technologies/cookies. You can use our written address, email or telephone details without using the map.

Our Book Now and Intro Calendar links take you to Calendly, a separate website. Its cookie controls and privacy notice apply when you visit: calendly.com/legal/privacy-notice. We receive the details you provide to arrange the meeting. You can book by email or telephone instead. Links to LinkedIn and other external websites are covered by those services’ own notices when you follow them.

Your choices

Where an optional service asks for consent, you can decline it and use the alternative contact methods above. You can also use your browser settings to inspect, block or delete cookies and other site data. Blocking necessary cookies may prevent some functions from working. Deleting cookies does not delete information already held in our records or by another provider. Contact us if you need help with your privacy choices.

Sharing and international transfers

Who we share information with

We share information only where needed for the purposes in this notice. Providers acting on our behalf must follow our instructions and appropriate data processing terms. Some providers also act as independent controllers for their own service administration, security or other purposes, as explained in their notices.

Ballymena Website Design provides website and email-system support, including access needed for maintenance and troubleshooting. Our website infrastructure includes hosting and security services. Authorised providers may therefore have access to website records, enquiries and technical logs.

Microsoft 365 supports our business email, calendar and Teams calls. Zoom is used for video meetings where a client prefers it. These services process the contact details, communications and meeting information needed to provide the service.

Calendly processes appointment information on our behalf when you use our booking link, including your name, email address, appointment details and information you choose to provide. It also has its own responsibilities for data it uses for its independent purposes.

Google receives information when the embedded Maps feature loads. Its privacy notice describes its own uses of that information. A link to a third-party website does not itself mean that we supply that provider with our client records.

Website forms and stored copies

Our contact form uses Ninja Forms. Enquiry information is processed through our website and email systems so we can respond. Depending on the form’s settings, a copy may also be stored in the website database. Website email delivery uses WP Mail SMTP with the configured mail service. Website backups and migration copies may contain enquiries and other personal information held in the website database.

We may share relevant information with professional advisers, insurers, courts, regulators or public authorities where necessary for advice, legal claims or a legal obligation, including HMRC. Tender recipients and programme organisers receive information as described earlier in this notice.

Transfers outside the United Kingdom

Some service providers process information outside the UK, including in the United States. Calendly stores user and invitee data in US data centres. Where we make a restricted international transfer, we use the applicable UK adequacy arrangements or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with the assessments and additional protections required by law. You can contact us for details of the safeguards relevant to your information and how to obtain a copy.

Retention and security

How long we keep information

We keep personal information only for as long as needed for the purpose for which it was collected, including relevant legal and record-keeping requirements. The following periods apply to the records we control. Where we act as a processor, we follow the client’s documented retention and deletion instructions.

Information	Retention period or criterion
Enquiries and introductory bookings that do not lead to work	12 months after our last meaningful contact.
Client and invoicing records	Normally 6 years after our work together ends. Tax records are retained for the applicable statutory period where that ends later.
Personal information in client tender documents	Returned or deleted in accordance with the client’s instructions and agreement; normally within 12 months of the tender outcome unless a different period is agreed or required by law.
Training and programme records	For the delivery, follow-up and reporting period required by the engagement. Client-controlled programme records follow the organiser’s documented schedule; our own contractual records follow the client-record period above.
Website security and technical logs	For the period needed to detect and investigate faults or misuse, taking account of the relevant incident and legal obligations. Logs are deleted or anonymised when no longer needed.
Website statistics	For the period needed to understand usage and evaluate improvements. Personal or identifiable records are deleted or anonymised when no longer needed; genuinely anonymous aggregate statistics may be retained longer.
Backups and migration copies	For the recovery or migration period they support, then deleted or overwritten through the applicable retention cycle. Access is restricted and they are not used for routine business processing.

We may retain a limited relevant record for longer where required by law or necessary for an ongoing complaint, dispute or legal claim. We restrict its use to that purpose. Information removed from live systems may remain temporarily in protected backups until the backup cycle expires; if a backup is restored, applicable deletion requests must be reapplied.

How we protect information

We use appropriate technical and organisational measures to protect information against unauthorised access, loss and misuse. Access is limited to people and service providers who need it for their work. Our safeguards include access controls, secure connections, device protection and arrangements for maintenance and recovery. No online service can guarantee absolute security.

Your rights and how to complain

Your data protection rights

Depending on the circumstances and the lawful basis for the processing, you may ask us to:

Give you access to your personal information and explain how we use it.

Correct inaccurate or incomplete information.

Erase information where the right to erasure applies.

Restrict our use of information in the circumstances provided by law.

Provide information you supplied in a structured, commonly used, machine-readable format, where portability applies to automated processing based on consent or contract.

Your right to object

You can object to processing based on legitimate interests for reasons relating to your particular situation. We must stop unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims. You have an absolute right to object to the use of your information for direct marketing.

Withdrawing consent and making a request

Where we rely on consent, you can withdraw it at any time. This does not affect the lawfulness of processing before withdrawal. Contact Brendan using the details at the start of this notice to withdraw consent, exercise a right or ask a question. You do not have to use a particular form.

We normally respond within one month and without charge. We may need proportionate information to confirm your identity or clarify your request. Where the law permits an extension, pause, fee or refusal, we will explain the reason and your options. For complex or multiple requests, the response period may be extended by up to two further months, with notification as required by law.

Where we hold information only as a processor for a client or programme organiser, we will help direct your request to the relevant controller and assist it in responding.

Complaints

If you are unhappy with how we handle your information, please contact Brendan by email, telephone or post. You can explain what happened, what information is involved and the outcome you would like. We will acknowledge your complaint within 30 days, investigate appropriately, keep you informed of progress and explain the outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator. You can visit ico.org.uk/make-a-complaint, telephone 0303 123 1113, or write to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. The ICO generally expects you to raise the matter with us first and give us an opportunity to respond.

Changes to this notice

We review this notice at least annually and whenever relevant changes are made to our services or website. We update the date at the start when the notice changes and provide further information where a significant change affects how we use your personal information.