Complaints Policy
In short. If something has gone wrong, tell us. Email us or write to us - whichever suits you. We acknowledge every complaint, investigate it properly, answer in plain language, and tell you how to take it further if our answer does not satisfy you.
1. About this policy
1.1 What it covers. Two kinds of complaint, handled the same way and with the same seriousness:
- Data protection complaints — how we have collected, used, shared, kept or protected personal data, including personal data inside public procurement notices and personal data inside a document one of our customers has uploaded (section 10), and how we handled a request to exercise your rights;
- General complaints about the Service — the platform, alerts, AI Features and Olivia, billing and refunds, support, or anything else about how we have dealt with you.
1.2 Who can complain. Anyone. You do not need an account, you do not need to be a customer, and it costs nothing.
1.3 Complaining does not count against you. We will not treat you worse for complaining, and a complaint has no effect on your subscription.
1.4 The law behind it. This policy meets section 103 of the UK Data (Use and Access) Act 2025 (in force 19 June 2026), which sets requirements for handling data protection complaints. We apply those standards to every complaint, wherever you are.
1.5 Related documents. Our Privacy Notice, Terms of Service and Refund and Cancellation Policy say what we do and what we have promised; this policy says what happens when we get it wrong.
2. Our commitments
| We will | What that means |
|---|---|
| Make complaining easy | This policy is linked from every page of our website, and section 3 gives the addresses to use |
| Offer more than one route | Email or post — your choice (section 3) |
| Acknowledge your complaint | Within 30 days at the latest, in practice within 5 business days |
| Investigate without undue delay | We start as soon as we have your complaint (section 6) |
| Keep you informed | An update at least every 4 weeks while it is open |
| Explain our decision in plain language | What we found, what we decided, why, and what we will do |
| Aim to finish within three months | Our target for a final outcome, and usually much sooner |
| Tell you how to take it further | Internal review, then a regulator or the courts (sections 8 and 9) |
| Charge nothing | Complaining is free at every stage |
3. How to complain
3.1 Two routes. Use whichever you prefer.
| Route | Where | Good for |
|---|---|---|
| privacy@bidwhistle.com for data protection complaints; support@bidwhistle.com for everything else | Anything, including attachments | |
| Post | Bidwhistle OÜ, Sepapaja tn 6, 15551 Tallinn, Estonia — mark it “Complaint” | If you would rather write, or need a paper record |
3.2 Both routes are equally valid. A complaint sent by either of them is a complaint. You do not need to use the word “complaint”, quote a clause, or use any particular form of words. If you send it to the wrong address we will pass it on ourselves and tell you we have.
3.3 Complaining for someone else. A colleague, family member, adviser or trade body can complain for you if you have authorised them; we may ask for confirmation that they are acting for you.
4. What to tell us
A short, clear account beats a long one. Where you can, include:
- your name and how to reach you;
- what happened, and roughly when;
- what it concerns - your account email address, an invoice number, a tender notice reference, or your name as it appears in a notice;
- what you have already done about it;
- what you would like us to do to put it right;
- copies of anything relevant, such as an email or a screenshot; and
- anything you need from us to make the process work for you (section 12).
If you do not have all of this, send what you have, and we will ask if we need more.
5. What happens next
| Stage | What we do | Timescale |
|---|---|---|
| 1. Acknowledge | We confirm we have your complaint, give it a reference, and tell you who is handling it | Within 30 days at the latest; in practice within 5 business days |
| 2. Investigate | We work out what happened — records, logs, correspondence, systems — and ask you anything we need (section 6) | Starts straight away, without undue delay |
| 3. Keep you posted | We tell you where things stand, and say so if it is going to take longer | At least every 4 weeks while it is open |
| 4. Decide and respond | A written response in plain language: what we found, what we decided, why, and what we will do | Target within 8 weeks of receiving your complaint |
| 5. Final outcome | Our final position, with your escalation options | Target within 3 months of receiving the complaint |
| 6. Internal review | If you ask us to look again, a fresh review (section 8) | Target within 20 business days of your request |
These are targets rather than guarantees, except the 30-day acknowledgement, which is a commitment. If we are going to miss a target we will tell you before it passes, explain why and give you a new date.
6. How we investigate
6.1 Proportionately. The work matches what is at stake. A billing query may take an hour; a complaint about how we handled personal data in a tender notice takes longer.
6.2 Who handles it. Bidwhistle is a small company, so complaints are handled by the person responsible for the area concerned. That person may have been involved in what you are complaining about, and where they were we will say so. For an escalated complaint we will seek an independent view where we can.
6.3 What we may need from you. Enough to find the right records — usually the account email address, or your name as it appears in a notice. We ask for the minimum and will not demand identity documents where we can verify you another way.
6.4 If we have to wait for you. We will say exactly what we need and how it affects the timetable. We will not use that to run the clock down.
6.5 If we need more time. We will tell you before the target date passes, explain why, and give a realistic new date.
6.6 What we will not do. Charge you, ask you to sign anything to have your complaint considered, or make our answer conditional on you agreeing not to go elsewhere.
7. Possible outcomes
7.1 Three possible findings.
| Finding | What it means |
|---|---|
| Upheld | We got it wrong. We say so, explain what happened and put it right |
| Partly upheld | Some of what you raised is well-founded and some is not. We explain which is which |
| Not upheld | On the facts, we do not think we did anything wrong. We explain our reasoning, not just our conclusion |
7.2 What we may do to put things right. An apology; correcting or completing personal data; deleting or suppressing data so it is not collected again; restoring or changing something in your account; changing a setting, a process or one of our published documents; or a refund or credit where our Refund and Cancellation Policy allows one.
7.3 What we cannot do. We cannot change a notice published by a contracting authority, and we do not give refunds or credits for claimed inaccuracies in Procurement Data — it comes from public sources we do not control. Where that is the answer, we will say so plainly and point you to the buyer.
7.4 We tell you what changed. If your complaint leads us to change something, we say what.
8. If you are not happy with our response
8.1 Ask us to look again. Reply to our decision, or email the address you used, within 20 business days — later is fine if you have a good reason. Tell us which part you disagree with and why. We will review it afresh, independently where clause 6.2 allows, and respond within the timescale in section 5.
8.2 Then take it further. After our review, or instead of it, you can go to a supervisory authority or the courts (section 9).
8.3 You never have to come to us first. You can complain to a regulator at any time, whether or not you have raised it with us. We would like the chance to fix it, but that is your choice, not a condition.
9. Escalating to a regulator
9.1 Data protection complaints.
Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) — our lead supervisory authority Tatari 39, 10134 Tallinn, Estonia Telephone: +372 627 4135 · Email: info@aki.ee · Website: www.aki.ee
Information Commissioner’s Office (ICO) — for people in the UK Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom Telephone: 0303 123 1113 · Website: www.ico.org.uk
9.2 Which one is for you. If you are in the UK, complain to the ICO. If you are in the EU or EEA, complain to the supervisory authority where you live or work, or where you think the problem happened, or to the Estonian Data Protection Inspectorate as our lead authority — whichever is easiest for you.
9.3 Our UK representative. Article 27 of the UK GDPR requires us to appoint a representative in the United Kingdom, whom UK individuals and the ICO can also contact. Our UK representative is James Rehman, whom you can contact at privacy@bidwhistle.com. Contacting them does not stop you contacting us directly.
9.4 Courts. You have the right to an effective judicial remedy against a supervisory authority’s decision and against us, and to compensation for damage caused by a breach of data protection law. Using this policy does not affect that right or shorten any time limit.
9.5 Billing disputes. Bidwhistle is sold to businesses only. If your complaint is about billing, cancellation or a refund and we cannot settle it, our Terms of Service explain which law applies and which courts have jurisdiction.
10. Complaints about someone else’s data, about a tender notice, or about a document a customer uploaded
10.1 If you are named in a public procurement notice. Public bodies publish notices naming contact people, and that information reaches us from official sources. You can ask us to stop using your details, and you do not need an account to do it: email privacy@bidwhistle.com with your name as it appears in the notice, the organisation, and the notice reference if you have one. Our Privacy Notice explains what we hold, why, and how we handle an objection.
10.2 Suppression, not just deletion. When we act on an objection we suppress your details as well as deleting them, so the same information is not collected again from a later notice. You should not have to ask twice.
10.3 If the notice itself is wrong. We publish what the buyer published, so tell the buying organisation as well. Tell us anyway and we will correct our copy and suppress the wrong version.
10.4 If you are named in a document one of our customers uploaded. This is a different situation from a public notice, and it is worth setting out separately, because you may never have seen the document. Our customers use the Response Workspace to prepare bids, and they upload the tender pack the buyer issued. Tender packs commonly contain schedules naming the incumbent supplier’s staff — names, roles, sometimes salaries and length of service. If you have been told, or you believe, that your details reached us that way, you can complain to us and we will help.
Where the position differs from clause 10.1: the customer who uploaded the document decides what is in it and why, so they are the controller of it and we act on their instructions. We do not store the document. It is passed to the model provider that reads it and then discarded; all we keep is a usage record with no content. The short-lived platform request history described in our Data Retention Policy does not capture an uploaded pack: a tender pack is far larger than the size threshold that history records, so it is discarded rather than logged.
10.5 The route, if that is you. Email privacy@bidwhistle.com with your name, the organisation you work or worked for, and — if you know it — the contract or tender the document relates to. You do not need an account and it costs nothing. We will:
| Step | What we do |
|---|---|
| Acknowledge | On the timescale in section 5, as for any complaint |
| Check what we hold | Tell you honestly what, if anything, of yours we still have, and delete anything we are free to delete |
| Identify the controller | Work out which customer uploaded the document and pass your request to them as controller, telling you that we have and who they are, unless the law prevents us |
| Act on instructions | Do what the controller lawfully instructs, and tell you what we were asked to do |
| Look at the customer’s conduct | Uploading personal data without a lawful basis, and uploading special category data, both breach the prohibited-content rules in our Acceptable Use Policy. Where that has happened we deal with it under the enforcement section of that policy, and you can also report it to abuse@bidwhistle.com |
If you would rather go straight to a regulator, section 9 tells you how, and you do not have to come to us first.
10.6 Complaining about someone else. If your complaint is about another person’s or organisation’s use of the Service, email abuse@bidwhistle.com. We may not be able to tell you what action we take on someone else’s account.
11. Records we keep
11.1 What we record. Your complaint and the correspondence, what we investigated, our decision and reasons, and anything we changed as a result.
| Record | How long we keep it |
|---|---|
| Data protection complaints and records of rights requests | 3 years |
| General complaints and support correspondence | 3 years |
| Anonymised summaries used to improve the Service | Kept without a time limit, with nothing that identifies you |
11.2 Why we keep them. To handle your complaint, to show a regulator how we dealt with it, and to spot patterns. We rely on our legitimate interests, and on legal obligation where a law requires the record. Our Privacy Notice has the detail.
11.3 Kept securely. Complaint records are held with access limited to the person handling the complaint.
12. Accessibility and reasonable adjustments
12.1 Tell us what you need. If the standard routes are difficult for you, email support@bidwhistle.com — or ask someone to email for you — and we will find a way that works.
12.2 What we can offer. Plain-text correspondence rather than a form; large print or another accessible format; more time to reply; accepting a complaint from someone acting for you; and a single, named point of contact.
12.3 If writing is difficult. We do not offer telephone support, so if written contact is not workable for you, tell us and we will arrange a video or voice call at a time that suits you.
12.4 Language. We work in English. If that is a barrier, say so and we will do what we reasonably can, including accepting a complaint through someone who can translate for you.
13. Vexatious or repeated complaints
13.1 We start from good faith. Almost every complaint is genuine, and a complaint being difficult, lengthy or strongly worded does not make it vexatious.
13.2 When we may restrict contact. Rarely, someone repeats a complaint we have already answered and reviewed without new evidence, or is abusive or threatening to the person handling it. We may then limit contact to one route, decline to re-investigate a matter already decided, or reply only to genuinely new points.
13.3 How we do it. In writing, saying what we are restricting, why, how long for and how to ask us to reconsider. We review any restriction at least every 6 months and still deal with any new complaint on its merits.
13.4 What it never affects. A restriction does not stop you complaining to a supervisory authority or going to court.
14. How we learn from complaints
14.1 We log every complaint with what caused it and how it ended, and we review the log at least once a year — sooner if a pattern is obvious. Complaints are the cheapest information a small company gets about what is not working, so a change to a process, a document or the product is a normal outcome rather than an exceptional one.
14.2 Where a complaint leads to a change we tell the person who raised it. Anything we publish about what we have learned is anonymised.
15. Changes to this Complaints Policy
15.1 We may update this policy — for example if we add a complaint route or the law changes. The dates at the top tell you which version you are reading, and we will handle a complaint under the version in force when you made it.
| Version | Effective date | Changes |
|---|---|---|
| 1.0 | 27 September 2026 | First published version |
16. How to contact us
Bidwhistle OÜ · Registry code 17567745 · Sepapaja tn 6, 15551 Tallinn, Estonia · https://www.bidwhistle.com
| What you need | Where to send it |
|---|---|
| Make a complaint (any kind) | support@bidwhistle.com |
| Data protection complaints and rights requests | privacy@bidwhistle.com |
| Complaints about the Service, billing, support | support@bidwhistle.com |
| Refunds and invoices | billing@bidwhistle.com |
| Reporting misuse of the Service | abuse@bidwhistle.com |
| Formal legal notices | legal@bidwhistle.com |
| By post | Bidwhistle OÜ, Sepapaja tn 6, 15551 Tallinn, Estonia — mark it “Complaint” |
We answer during UK business hours, Monday to Friday.