On this page
1. Who we are
Cana Bids ("Cana", "we", "us") is a platform that helps UK health and social care providers find public sector tenders and prepare bid responses. The service is operated by CanaTechnology Ltd, a company registered in England and Wales under company number 17333806, with its registered office at 25 The Hoe, Watford, WD19 5AY, United Kingdom.
For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), we are the data controller for the personal information described in this policy.
If you have any questions about this policy or your data, contact us at hello@getcana.co.uk.
2. What we collect
We only collect what we need to run the service. That includes:
- Account details: your first and last name, email address, job title and a password. Passwords are stored in a securely hashed form by our authentication provider, so we never see them.
- Company profile: your company name and details, and information you add such as your Companies House number, CQC registration, the services you offer, the regions you cover and your key performance figures.
- Evidence you upload: documents you add to your evidence library, such as policies, insurance certificates, accreditations and case studies. These may contain personal information about your staff.
- Tender and bid content: the tenders you choose to work on and the responses Cana prepares for you.
- Payment information: when you pay, your card details are collected and processed directly by our payment provider, Stripe. We do not receive or store your full card number.
- Contact and support messages: anything you send us by email or when booking a call.
- Basic technical information: information needed to keep you signed in and to keep the service secure and working, such as session information and standard server logs.
3. How and why we use it
Under UK data protection law we must have a lawful basis for using your information. Ours are set out below.
| What we do | Why | Lawful basis |
|---|---|---|
| Create and run your account | To give you access to the service you signed up for | Performance of a contract |
| Prepare your tender responses from your profile and evidence | This is the core service you are paying for | Performance of a contract |
| Email you your finished bid and service messages | To deliver what you asked for and keep you informed | Performance of a contract |
| Take payment | To process the purchases you make | Performance of a contract |
| Keep the service secure and prevent misuse | To protect you, us and other users | Legitimate interests |
| Meet our legal and accounting duties | For example keeping records required by law | Legal obligation |
| Send marketing, if we ever do | Only if you have opted in | Consent |
We do not sell your personal information, and we do not use it for automated decisions that have a legal or similarly significant effect on you.
4. Who we share it with
We use a small number of trusted suppliers ("processors") to run the service. They may only use your information on our instructions and to provide their service to us. They are:
| Supplier | What they do for us |
|---|---|
| Supabase | Stores your account, profile, evidence and bid data, and manages sign in |
| Netlify | Hosts the website and runs the service |
| Stripe | Processes payments securely |
| Anthropic | Powers the writing of your tender responses. The relevant tender, profile and evidence content is sent to Anthropic to generate your answers |
| Resend | Sends the emails that deliver your documents and service messages |
| Companies House | Provides your registered company details when you use the company lookup |
| Calendly | Manages call bookings, if you choose to book one |
We may also share information if we are required to by law, or if we sell or reorganise our business, in which case your information would be handled under the same protections set out here.
5. Where your data is held
Some of our suppliers, including Anthropic, are based outside the UK, such as in the United States. Where your information is transferred outside the UK, we rely on the safeguards required by UK data protection law, such as the UK International Data Transfer Agreement or equivalent approved terms, so your information keeps the same protection.
6. How long we keep it
We keep your information for as long as you have an account with us, and for a reasonable period afterwards so we can meet our legal, accounting and record keeping duties. When we no longer need it, we delete it or make it anonymous. You can ask us to delete your account and data at any time (see your rights below).
7. Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct information that is wrong or incomplete;
- ask us to delete your information, where there is no legal reason for us to keep it;
- ask us to restrict or object to how we use your information;
- ask for your information in a portable format;
- withdraw consent at any time, where we relied on consent.
To exercise any of these, email hello@getcana.co.uk. We will respond within the time limits set by law, normally within one month.
If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would ask that you contact us first so we can try to put things right.
8. How we protect it
We take appropriate technical and organisational measures to keep your information safe, including encryption of data in transit, access controls, and using reputable suppliers who maintain their own security standards. No online service can be guaranteed to be completely secure, but we work to protect your information and to deal quickly with any issues.
9. Cookies
We use only the essential cookies needed to keep you signed in and to keep the service secure. We do not use advertising or tracking cookies. You can read the detail in our Cookie Policy.
10. Children
Cana Bids is a service for businesses and is not intended for anyone under 18. We do not knowingly collect information about children.
11. Changes to this policy
We may update this policy from time to time. When we do, we will change the date at the top of this page, and for significant changes we will let you know by email or through the service.
12. How to contact us
For anything to do with your data or this policy, email hello@getcana.co.uk, or write to us at CanaTechnology Ltd, 25 The Hoe, Watford, WD19 5AY, United Kingdom.