Privacy Policy

Who we are

KLIX Ltd is the data controller for personal information processed through the BidWell Design & Estimates website, trading as BidWell Design & Estimates, Company No. 16830278.

Registered office: 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. This is our statutory correspondence address and does not necessarily identify where every production or operational activity is carried out.

Email: info@bidwelldesign.co.uk.

Information we collect

Depending on how you contact us, we may collect:

• Full name
• Company or practice name, where provided
• Email address
• Telephone number, where provided
• Business or client type (for example, architecture practice, design-and-build firm, contractor, specialist subcontractor or private client)
• The purpose of your enquiry, requested service and project type, where applicable
• Preferred turnaround, where specified
• The project brief or description you provide
• Files you choose to upload directly through the project-enquiry form
• An external file-transfer link you choose to provide, instead of or alongside uploaded files
• Correspondence and follow-up information, if we discuss a submitted enquiry with you further
• Technical request information generated automatically to operate and secure the website and upload system, such as request timestamps, security logs and, where applicable, IP address

We only collect a category of information listed above where it is actually provided or generated as described.

How we receive information

We receive personal information through:

• The project-enquiry form on this website
• Direct email correspondence
• Telephone enquiries
• Files you upload through the project-enquiry form
• An external file-transfer link you choose to provide through the project-enquiry form
• Subsequent correspondence, if we discuss a submitted enquiry with you further

The website and business email are operated using infrastructure located in Germany. Enquiry details and uploaded files are stored using Supabase infrastructure in the European Union — see International access and transfers.

How and why we use information

We use the information you provide to:

• Respond to your enquiry and review the project information you provide
• Assess the suitability and scope of a requested service
• Prepare requested proposals or quotations
• Provide agreed services and deliver project outputs once you have instructed us
• Manage and administer an instructed project or contractual relationship
• Operate, secure and improve this website and the project-file upload system
• Prevent fraud, spam and unauthorised access
• Maintain appropriate business, contractual and financial records
• Comply with our legal and regulatory obligations
• Establish, exercise or defend legal claims, where necessary

Our lawful bases

Each purpose described in this policy relies on one of the following lawful bases under UK data-protection law.

Pre-contractual steps

Responding to your enquiry, reviewing the project information you supply, discussing scope, assessing whether we can help, and preparing a proposal or quotation you have requested.

Contract

Once you instruct us: providing the agreed services, managing the project, communicating with you as an engaged client, delivering outputs, and administering the contractual relationship.

Legitimate interests

Where the following genuinely apply, and we have considered that they do not override your own rights and interests:

• Managing business enquiries efficiently, including enquiries that do not proceed to a contract
• Maintaining appropriate business and correspondence records
• Securing and improving this website and the project-file upload system
• Preventing fraud, spam, abuse or unauthorised access, including the automated safeguards described in How we protect information
• Managing disputes, and establishing, exercising or defending legal claims

Legal obligation

Where we must process or retain information to comply with applicable law, such as tax, accounting or regulatory requirements.

Consent

We do not currently rely on consent for any processing described in this policy, and this website does not currently include a marketing sign-up or similar consent-based option. If that changes, we will ask for your consent separately, explain what it covers, and explain how to withdraw it.

Project enquiries and uploaded files

The project-enquiry form lets you attach project files directly, or provide a link to an external file-transfer service (for example Google Drive, OneDrive, Dropbox or WeTransfer) instead. We do not automatically visit or download from a file-transfer link you provide — it is stored as text and used by our team to access the files you have chosen to share.

When you submit the project-enquiry form, the enquiry details you provide are stored in our enquiry database (a PostgreSQL database hosted by Supabase, which acts as our processor), and we receive an internal email notification of the enquiry.

Files you upload directly pass briefly through our web server, which uses Hetzner infrastructure located in Germany, and are then stored in a private Supabase storage area that is not publicly accessible. Each file is stored under a random, non-guessable identifier rather than its original filename, and is only reachable through an individually generated, expiring download link that is included solely in our internal enquiry notification — it is never published, listed or made otherwise accessible. Our enquiry database and file storage are hosted in Supabase’s West EU (Ireland) region.

Uploaded files, and their download links, are deleted automatically 14 days after submission. This automatic 14‑day deletion applies specifically to the copy of files uploaded through the project-enquiry form before a project is instructed. The enquiry details themselves are kept for longer — see How long we keep information.

Where technical project material is prepared for external production support, identifying information is removed before access is provided.

Project and drawing files can contain personal or sensitive information, including property addresses, ownership information, names and contact details of people connected with a project, drawings containing identifiable project details, and confidential third-party material. Please only upload files, or share a file-transfer link, that you are authorised to share with us.

Please do not upload information that is not necessary for your enquiry, including special-category personal information, criminal-offence information, identification documents, payment-card information, medical information, confidential third-party information, or information you do not have authority to disclose.

Sensitive and third-party information

We do not ask for special-category personal information (such as health, racial or ethnic origin, or religious belief) or criminal-offence information through the project-enquiry form, and you should not include it.

Project files and correspondence sometimes identify other people connected with a project — for example other occupants, neighbouring owners, or consultants named in supplied documents. Please only share information about other people where you have appropriate authority to do so. Where such information is included in a submission, we handle it under this policy for the purpose of reviewing and, where instructed, delivering the relevant service.

Who we share information with

We do not sell personal information, and we do not share it with third parties for their own marketing purposes. Depending on the circumstances, information may be processed by:

• Website-hosting and email infrastructure providers — we use Hetzner to provide the infrastructure supporting this website and our business email, including the web server through which project files are uploaded
• Database and file-storage providers — we use Supabase as our processor to store enquiry details and uploaded project files on our behalf
• IT and technical-support providers who help us operate, maintain or secure our systems
• Where a project is instructed, personnel or contractors involved in delivering that specific project
• Professional advisers, such as our accountants or legal advisers, where necessary
• Courts, regulators or public authorities, where we are legally required to disclose information

Any external file-transfer or file-storage service you choose to use yourself (for example Google Drive, OneDrive, Dropbox or WeTransfer) is operated by that third party under its own terms, not by us — see External websites.

Providers who process information on our behalf may only do so for the relevant purpose described above, subject to appropriate contractual or legal obligations, and are not authorised to use it for their own marketing.

International access and transfers

Our website and business email are operated using Hetzner infrastructure located in Germany. Enquiry details and uploaded project files are stored using Supabase infrastructure in its West EU (Ireland) region. Personal information submitted through the website, sent to our business email address or included within uploads may therefore be stored and processed in Germany and Ireland.

Germany and Ireland are part of the European Economic Area and are covered by UK adequacy regulations for international transfers. This means that personal information may be transferred from the United Kingdom to Germany and Ireland on the basis of those adequacy regulations.

Where Supabase or its sub-processors may access that information from outside the UK or European Economic Area, for example to provide technical support, this is governed by Supabase’s data-processing terms and the transfer safeguards they provide.

Where technical project material is prepared for external production support, identifying information is removed before access is provided. The resulting material does not identify clients or other individuals.

If our infrastructure or processing arrangements change in a way that affects international processing, we will assess the applicable data-protection requirements and update this policy where appropriate.

How long we keep information

We keep information only for as long as reasonably necessary for the purpose it was collected for. Retention is not the same for every category of information:

• Files uploaded through the project-enquiry form (before a project is instructed): deleted automatically 14 days after submission.
• Enquiry details submitted through the project-enquiry form: kept for up to 12 months from submission, unless they need to be kept for longer because the enquiry becomes an active client relationship or instructed project, to comply with a legal obligation, to deal with a dispute or potential legal claim, or as a legitimate business record.
• Other correspondence about enquiries that do not proceed further: kept only for as long as reasonably necessary to consider and respond to the enquiry.
• Enquiries that proceed to an instructed project: information becomes part of the project and client record, kept for the duration of the engagement and for a further period afterwards to deal with any follow-up queries or disputes.
• Contractual records: kept for the duration of the contractual relationship and for a further period afterwards, reflecting the time in which a claim could reasonably be brought.
• Financial records: kept for the period required by applicable UK tax and company-law obligations.
• Technical and security logs: kept for a limited operational period to support the safeguards described in How we protect information.
• Records relating to a dispute or potential legal claim: kept for as long as necessary to establish, exercise or defend that claim, including any applicable statutory limitation period.

How we protect information

We use reasonable technical and organisational measures to protect information submitted to us, including:

• Uploaded files are stored in a private storage area that is not publicly accessible, rather than being held in or attached to an email
• The enquiry database and file storage cannot be accessed directly from the website or your browser — only our server can read or write them
• Uploaded files are stored under a random, non-guessable identifier and are only reachable through an individually generated, expiring download link
• Download links force a file download rather than opening or running the file in a browser, and are rate-limited to reduce automated abuse
• Files left over from an incomplete or rejected submission are removed automatically
• This website enforces encrypted (HTTPS) connections and applies standard security headers
• The project-enquiry form includes automated safeguards against spam and automated submissions, and submission rates are limited
• Access to the systems used to operate this website is restricted to those who need it

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you become aware of a security concern involving information you have submitted to us, please contact us using the details in this policy.

Marketing communications

We do not use project-enquiry information to send unrelated marketing communications unless you have separately asked to receive them. This website does not currently include a marketing sign-up or newsletter option. If that changes, we will only send marketing communications in accordance with applicable law, and any such communication will explain how to opt out.

Cookies and similar technologies

This website does not currently set cookies for analytics, advertising or tracking purposes. Our use of cookies and similar technologies, including how this would change if that position changes, is explained in full in our Cookie Policy.

External websites

This website links to external websites, including the separately operated BidWell Estimates USA website, and, where you choose to provide one, a file-transfer link you select yourself. These external websites are operated independently of KLIX Ltd, have their own privacy notices and practices, and are not governed by this Privacy Policy. BidWell Estimates operates as a separate, separately owned business serving the US market; this policy applies only to the BidWell Design & Estimates website in the United Kingdom. We recommend reviewing the privacy notice of any external website before sharing information with it.

Automated decision-making

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects concerning you. Project enquiries are reviewed individually. A hidden field on the project-enquiry form is used only to silently filter out automated spam submissions; it does not evaluate or make a decision about a genuine enquiry submitted by a person.

Your data-protection rights

Depending on the circumstances and the lawful basis that applies, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Request deletion of your information
• Restrict how your information is processed
• Object to certain processing
• Receive information you have provided to us in a portable format
• Withdraw consent, where consent is the lawful basis for processing
• Complain about how your information has been handled

Which of these rights apply depends on the processing in question and the lawful basis relied on. We may need to verify your identity before acting on a request, and no fee is normally charged, subject to legal exceptions.

How to make a data-protection complaint to us

If you are concerned about how your personal information has been collected, used, shared, retained or protected, you can email a data-protection complaint to info@bidwelldesign.co.uk. This is separate from a general service or commercial complaint about a project — please make clear that your complaint concerns a data-protection matter so it can be handled under this process.

Where possible, please provide:

• Your name and contact information
• A description of your concern
• Relevant dates
• Relevant correspondence
• The outcome you are seeking
• Proof of authority, if you are acting on behalf of someone else

We will:

• Acknowledge receipt of your data-protection complaint within 30 days
• Take appropriate steps to investigate it without undue delay
• Keep you informed if the investigation continues
• Communicate the outcome to you without undue delay

Complaining to the Information Commissioner's Office

If you remain dissatisfied after contacting us, you have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline: 0303 123 1113

Make a complaint on the ICO website.

Changes to this policy

We may update this policy from time to time to reflect changes to our website, our processing, or our legal obligations. The current version, and the date it was last updated, will always be available at this address.

Contact

Questions about this policy or how we handle your information can be sent to info@bidwelldesign.co.uk. Full controller details are set out in Who we are, above.