AwardSignal is operated by Jexera Limited (trading as Purpose Recruitment), 57 Avonmore View, Ballinderry Road, Rathdrum, Co. Wicklow, Ireland, company number 707158 ("we"). We are the controller of the personal data described here. Privacy contact: hello@awardsignals.com. We have not appointed a Data Protection Officer because our processing does not meet the Article 37 GDPR criteria; the privacy contact handles all requests.
| Purpose | Data | Lawful basis (Art. 6(1) GDPR) |
|---|---|---|
| Create and run your subscription; send your digests | name, work email, company, plan, filters (markets, trades, keywords), recipients | (b) contract |
| Billing, invoices, VAT, fraud prevention | billing name/address, VAT ID, payment status; card data is handled by Stripe and never reaches us | (b) contract; (c) legal obligation (tax records) |
| Service operation and improvement | digest delivery/bounce status, unsubscribe events, support messages | (f) legitimate interest in running a reliable service |
| Waitlist email | email, company, consent record | (a) consent – withdraw at any time |
| Marketing to business contacts | see section 7 | (f) legitimate interest, or (a) consent where S.I. 336/2011 requires it |
Providing subscription data is necessary to enter the contract; without it we cannot provide the service. We do not carry out automated decision-making with legal or similarly significant effects (Art. 22). We do not sell personal data.
Sources: (i) contract notices and contract award notices published on TED – Tenders Electronic Daily by the Publications Office of the European Union (ted.europa.eu); (ii) the National Planning Applications dataset published on data.gov.ie. Both are publicly accessible.
What we keep: project title, buyer organisation, winning organisation, notice reference, date, location and the link to the source notice. TED notices can contain a named contact person and professional email/phone, and an award winner can occasionally be a natural person (e.g. a sole trader). We do not extract or store contact persons, email addresses or telephone numbers. Personal data arises in our service only where an organisation name is itself a person's name.
Purpose and lawful basis: providing business market information about public contracts and planning, on the basis of legitimate interests (Art. 6(1)(f)). Our legitimate interests assessment concluded that this business-capacity use of already-published data does not override the rights of the people concerned, given the safeguards above. A summary is available on request.
Recipients: our subscribers (business users) and the processors in section 6. Retention: section 5. Rights: section 8, including the right to object (Art. 21(1)), which we will honour by removing you from our data and future digests unless compelling grounds apply.
How we inform you: contacting every person named in public notices individually would involve disproportionate effort, because we hold no contact details for them by design and collecting them only to notify would increase the intrusion. We therefore rely on Article 14(5)(b) GDPR and make this information publicly available here, as that provision requires, together with the safeguards described. If we ever contact a named person directly, we will give this information at the latest at that first communication (Art. 14(3)(b)).
This website sets no cookies and uses no analytics or tracking. Under Regulation 5 of the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336 of 2011), consent is needed before storing or accessing information on your device unless it is strictly necessary for a service you request; as we use none, no cookie banner is shown. Stripe's checkout pages (on stripe.com) and the embedded Zoho Forms demo request form (on zohopublic.eu) set their own strictly necessary/fraud-prevention cookies under their own notices. If we add non-essential cookies we will ask for consent first, with a banner that makes refusing as easy as accepting.
| Data | Retention |
|---|---|
| Subscriber account and filters | while subscribed + 12 months (then deleted) |
| Invoices and billing records | 6 years after the end of the financial year they relate to (Irish tax record-keeping) |
| Trial users who do not convert | 90 days after the trial ends |
| Waitlist entries | until you subscribe, withdraw consent, or 12 months, whichever is first |
| Lead records from public sources | 24 months from the source notice date |
| Objection / suppression list | kept as long as needed to respect your objection (minimal data: name or email only) |
| Email delivery logs | as retained by our email processor under its terms |
| Rights requests and correspondence | 3 years after closure |
Each processor acts under a written agreement meeting Article 28 GDPR. You can request a copy of the relevant safeguards from our privacy contact.
We only send marketing emails about AwardSignal (i) to people who have consented, (ii) to existing customers about similar services, with an opt-out given at collection and in every message, or (iii) to corporate (non-natural person) subscribers, such as generic company addresses, where the law permits this without prior consent. We do not send unsolicited marketing emails to individuals' personal addresses without consent. Every marketing email identifies us as sender, gives a valid postal and email address and a free, simple unsubscribe link. Unsubscribes are honoured promptly and kept on a suppression list.
You have the right to: access (Art. 15); rectification (Art. 16); erasure (Art. 17); restriction (Art. 18); data portability for data you gave us under contract or consent (Art. 20); object to processing based on legitimate interests (Art. 21(1)); and an absolute right to object to direct marketing at any time, after which we will stop all direct marketing to you (Art. 21(2)–(3)); and to withdraw consent at any time without affecting earlier processing (Art. 7(3)).
How: email hello@awardsignals.com or write to Jexera Limited (trading as Purpose Recruitment), 57 Avonmore View, Ballinderry Road, Rathdrum, Co. Wicklow. We may ask for information to confirm your identity. We respond within one month of receipt; this can be extended by two further months where necessary, taking into account the complexity and number of requests, in which case we will tell you within the first month and explain why (Art. 12(3)). Requests are free unless manifestly unfounded or excessive (Art. 12(5)).
Measures: no card data held by us (Stripe, PCI DSS Level 1); TLS for the website and email; least-privilege access with multi-factor authentication on all provider accounts; data minimisation (no contact data from public notices); encrypted backups; documented retention deletion. If a personal data breach occurs we will notify the Data Protection Commission without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people (Art. 33); and we will tell affected people without undue delay where it is likely to result in a high risk to them (Art. 34). We record all breaches internally.
You can complain to the Irish supervisory authority: Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland. Phone (01) 765 01 00 or 1800 437 737 (helpdesk 9.30am–1pm, Monday–Friday; general information only). Complaints must be made in writing, via the "Contact us online" form at www.dataprotection.ie. You may also complain to the authority in your EU country of residence or work.
We will post changes here with a new date and email subscribers about material changes.