Privacy Notice

Last updated 24 September 2026 · Nomadopoly Ltd trading as Groundlark

This explains what personal data Groundlark handles, why, and what you can do about it. It covers both our customers and the people whose details appear in the public procurement records we process.

1. Who is responsible

Nomadopoly Ltd is the data controller — a company registered in England and Wales under number 17344194, registered office 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ. We are registered with the Information Commissioner's Office (registration number ZC258570).

Data protection enquiries: support@groundlark.co.uk.

2. What we collect from you

• Account data — your email address, and the name of your business. We do not ask for a password; sign-in is by emailed link.
• Your profile — the trades you work in, your postcode area, how far you travel, and your minimum job size. We keep only the outward part of your postcode (the "KY7" of "KY7 5LT"), because a full postcode identifies roughly fifteen addresses and distance matching needs nothing finer.
• Your pipeline — which opportunities you mark as tracking, bidding, won or lost, and any notes you add.
• Billing data — handled by Stripe. We see the last four digits of your card and its expiry, never the full number.
• Telegram — if you link Telegram for alerts, we store the chat identifier needed to send them. Nothing else.
• Technical data — IP address and request logs, kept briefly for security and troubleshooting. Email addresses in our logs are partially masked.

3. Personal data in public procurement records

Groundlark processes contract notices published by UK public bodies. These are business records, but they occasionally contain personal data — a named contact at a buying authority, or a sole trader whose business name is their own name.

We limit this deliberately:

• We do not publish named individuals on our public supplier or buyer pages.
• We do not build profiles of procurement officers.
• Our public pages show organisation-level information only.

Our lawful basis for this is legitimate interests: helping small contractors find public work they are eligible for. We have weighed this against the privacy interests of the people involved, and the data is already published by public bodies for the purpose of being found by potential suppliers. If you appear in this data and object, contact us.

4. Why we process your data, and our lawful basis

• To provide the service — matching opportunities to your profile and sending alerts. Basis: performance of our contract with you.
• To take payment — basis: performance of our contract.
• To keep the service secure and prevent abuse. Basis: legitimate interests.
• To meet tax and accounting obligations. Basis: legal obligation.
• To send product updates, only if you opt in. Basis: consent, which you can withdraw at any time.

We do not sell personal data, and we do not use it for advertising or cross-site tracking.

5. Who we share it with

Only the providers needed to run the service:

• Stripe — payment processing.
• Our email provider — sign-in links and alert digests.
• Telegram — if you choose to link it. Messages we send you pass through Telegram's infrastructure and are subject to their privacy policy.
• Hetzner — our hosting provider, in Germany.

Where a provider processes data outside the UK, we rely on UK adequacy regulations or standard contractual clauses.

6. If you hear from us before you are a customer

We sometimes contact businesses who may benefit from Groundlark, using business contact details from public sources such as Companies House and company websites. Our lawful basis is legitimate interests.

We contact registered companies at business addresses, not individuals or sole traders at personal ones. Every message says who we are and how to stop hearing from us. Ask once and we will not contact you again — that is recorded permanently, and it survives any later data refresh.

7. How long we keep things

• Account and profile data — while your account is open, then deleted within 90 days of closure.
• Billing records — six years, as HMRC requires.
• Request logs — 30 days.
• Suppression records — kept indefinitely. This is the list of people who have asked not to be contacted, and deleting it would mean contacting them again. It holds only what is needed to honour the request.
• Public procurement records — kept as an archive. They are published public records, and keeping them is what lets us tell you a contract is ending.

8. Cookies

We use essential cookies only — one to keep you signed in, one to protect forms against cross-site request forgery, and one that remembers which link brought you to us so we know which of our own channels is working.

We use no advertising cookies, no third-party trackers, and no cross-site profiling. That is why you are not being asked to dismiss a consent banner.

9. Your rights

Under UK GDPR you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything inaccurate;
• delete your data, where we have no overriding obligation to keep it;
• provide it in a portable format;
• restrict or object to how we use it, including objecting to legitimate interests;
• withdraw consent, where consent is the basis.

Email support@groundlark.co.uk and we will respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you raised it with us first.

10. Automated decisions

Groundlark scores how well an opportunity matches your profile, and shows you the reasoning for every score. This affects what you see, not any decision about you, and it produces no legal or similarly significant effect. You can change your profile at any time and the scoring changes with it.

11. Changes

If we change this notice materially, we will email you before it takes effect.

Data protection enquiries: support@groundlark.co.uk