Privacy information for FundedSpend UK.

Controller and contact

FundedSpend UK is operated by ECOMMERCE ONLINE LTD, company number 12568562. Its registered office is 27 Old Gloucester Street, London, United Kingdom, WC1N 3AX. ECOMMERCE ONLINE LTD is the controller of the personal information described in this notice. Contact privacy@fundedspend.co.uk for privacy questions or rights requests.

Information we use

• Account and security information, including your work email, verification time, organisation membership, sessions and security events.
• Organisation and supplier-profile information, including capabilities, service categories, regions and optional preferred grant award sizes.
• Subscription and transaction references supplied by our payment provider. FundedSpend does not store complete card details.
• Product activity needed to operate allowances, saved projects, organisation-level match feedback, alerts, reports, API access and fraud controls. Match feedback stores the organisation and project choice, not a free-text comment or named staff member.
• Messages and evidence submitted through support, correction, objection and suppression routes.
• Organisation and project facts obtained from the approved public sources identified on each project and on our data-sources page.

Why we use it

Public-source intelligence

Our funded-project catalogue is designed around organisations rather than people. We do not sell private telephone numbers, consumer profiles or named-contact databases. The platform uses published project facts to produce organisation-level supplier matches and evidence-strength assessments. These outputs do not make legal or similarly significant decisions about individuals.

Recipients and processors

Information is shared only as necessary with service providers supporting hosting and databases, payment processing, transactional email, security monitoring and customer support. Our principal production hosting provider is Render and our payment provider is Stripe when billing is enabled. Providers act under contractual and security obligations. We may also disclose information to professional advisers, regulators, courts or lawful authorities where required.

International transfers

Some providers may process information outside the United Kingdom. Where this is a restricted transfer, we use an applicable UK adequacy regulation or approved contractual safeguard and complete any required transfer assessment. Contact us for information about the safeguard applying to a particular provider.

Retention

Single-use sign-in links expire after 15 minutes and active sessions after no more than 30 days. Generated report files expire after 30 days. Organisation-level project relevance feedback expires no later than 24 months after its last change. Operational, API, delivery and security records are retained only for the periods in our documented retention schedule. Account and supplier-profile information is kept while the account is active and then deleted or irreversibly anonymised after a verified closure. We retain a minimised record of the privacy request and limited billing, legal, fraud-prevention and security-audit information where required. Transaction and tax records may be retained for up to six years where legally necessary. Minimal suppression information may be kept for as long as needed to honour a marketing objection or completed closure.

Your rights

Depending on the circumstances, you may ask for access, correction, deletion, restriction or portability, or object to processing based on legitimate interests. You have an absolute right to object to the use of your personal information for direct marketing. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. We may need proportionate evidence to verify a request.

You can complain to the UK Information Commissioner’s Office at ico.org.uk. We would appreciate the opportunity to address your concern first.

Security, children and changes

We use access controls, hashed credentials and tokens, encrypted transport, audit records and tenant separation. No internet service is completely risk-free. FundedSpend is a business service and is not directed to children. Material changes to this notice will be dated here and communicated where required.