Privacy Policy

RFPVenue is a trading name of My Island Solutions Ltd, a company registered in England & Wales (company no. 14082673). Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Contact: info@rfpvenue.com.

This notice explains how My Island Solutions Ltd (t/a RFPVenue) processes personal data as a controller under UK GDPR / the Data Protection Act 2018. My Island Solutions Ltd is registered with the UK Information Commissioner's Office (ICO registration no. ZB497494).

1. Who we are & contact. We are the data controller. For any privacy query or to exercise your rights, contact info@rfpvenue.com or write to our registered office above.

2. Personal data we collect. • Account & identity: name, work email, password (hashed), role, MFA status. • Organisation: the buyer company or supplier legal entity you act for, including its legal name, registration number and registered office where supplied, and its linked properties. • Marketplace activity: briefs, event dates and locations, connected-series links and review decisions, offers, bids, awards, values, reviews and related metadata. • Contract evidence: records of your acceptance of our terms and your business-purpose confirmation, including the wording and hash, contracting-entity snapshot, version, timestamp, IP address and user-agent. • Technical & security: IP address, device/user-agent, log and audit data. • Unauthenticated enquiries: if you submit the public 'source a meeting' form or a hotel enquiry form without an account, we collect your name, work email, company, city, property name (hotels), meeting details you paste, IP address and user-agent, together with the page on our site you arrived on, the page the form was on and, if your browser sends one, the address of the external site that referred you. We use these three to understand which of our pages lead to enquiries; they are attached to your enquiry only and are not used to build a profile or track you across sites. • Hotel registration: if you create a hotel account, we collect the property's name, city, country, star rating and quoting currency, and the contracting company's legal name, registration number and registered office where supplied.

3. Sources. Most data comes directly from you. Some is generated by your use of the platform (activity, logs), and operators may seed property/offer information that hotels then confirm. Enquiry forms may be submitted before any account exists.

4. Purposes & lawful bases. • Operating your account and providing the marketplace — performance of a contract. • Responding to meeting-sourcing and hotel enquiries, understanding which pages lead to them, and inviting a hotel to a matching locked brief — legitimate interests. • Confirming business eligibility, linking users and properties to a contracting legal entity, and keeping evidence of authority and contract formation — performance of a contract / legitimate interests. • Security, fraud prevention, auction integrity, detecting duplicate accounts, applying connected-event and liability controls, and audit — legitimate interests. • Keeping records of terms acceptance and transactions — legal obligation / legitimate interests. • Retaining accounting and tax records — legal obligation under UK tax law (HMRC record-keeping requirements for company tax and VAT); Companies Act 2006 separately requires accounting records to be kept for three years. • Keeping contractual evidence and security records after your account closes — legitimate interests (establishing, exercising or defending legal claims within the limitation period; keeping the platform and its auctions secure), each supported by a written assessment.

5. Recipients & sub-processors. We share personal data only with the sub-processors listed on the Sub-processors page — currently our hosting provider (Hetzner, EU) and our transactional email provider (Mailjet, EU) — each under a written data-processing agreement, and with authorities where legally required. We use no analytics, advertising or error-monitoring processors. We do not sell personal data.

6. International transfers. Personal data is hosted in the European Economic Area (Germany/Finland), and our transactional email provider stores data in the EU. As a UK controller, our transfers to the EEA are made in reliance on the UK's adequacy regulations for the EEA and require no additional safeguards. Where a transfer outside the UK/EEA would occur (for example processor support access), we put appropriate safeguards in place (UK International Data Transfer Agreement / EU Standard Contractual Clauses) with a transfer risk assessment.

7. Retention. We keep personal data for as long as your account is active and as needed for the purposes above, then for the periods below, which are maximum defaults except where a statutory minimum applies. Accounting and tax records (commission, invoices and the award and accepted offer that evidence them) are kept for 6 years after the end of the last financial year they relate to, longer if a tax enquiry requires; this legal obligation overrides erasure for those records. Contractual evidence (locked briefs, bids, auction closure, awards, accepted terms and approvals) is kept for 6 years after the contract ends or final settlement, whichever is later, limited to the fields needed to evidence the process, outcome, terms, authority and payment obligations. Routine activity and security logs are kept for 12 months, or 36 months for a documented set of security-significant events. Profile information on a closed account is anonymised within 12 months of closure except where a record above still needs it. Unauthenticated enquiries (no account) are kept for up to 24 months from the enquiry, then deleted. When a record expires, personal and linkable fields are removed and only an anonymous residual of the audit trail may remain. Retention beyond these periods happens only under a legal obligation or a narrowly scoped, regularly reviewed legal hold.

8. Your rights. You have the rights of access, rectification, erasure, restriction, portability and objection. You can export your core account data in-app, and lodge access or erasure requests via the in-app request tools or by contacting info@rfpvenue.com; our team then actions your request within one month. (Some requests are fulfilled manually by our team rather than fully automated.)

9. Automated decision-making. Best-value ranking applies automated scoring to commercial offers. It does not itself make an award or form a booking contract: the buyer selects the offer to award. We do not use it to make a solely automated decision about an individual which produces legal or similarly significant effects. Contact us if you want an explanation of data used in a ranking or believe it is incorrect.

10. Complaints. You have the right to complain to the Information Commissioner's Office (ico.org.uk); we ask that you contact us first so we can help.