Privacy Policy

What this policy covers

This Privacy Policy explains how we collect and use personal data in connection with:

• the Bullwhip website at bull-whip.com;
• the Bullwhip SaaS platform and related customer support;
• customer onboarding, contracts, billing, and supplier administration;
• our business and professional intelligence dataset; and
• optional customer imports, exports, AI features, or integrations where agreed.

This policy does not replace any separate privacy notice issued for a browser extension or other standalone product.

Our role under data protection law

Bullwhip may act as a controller or processor depending on the activity.

We act as an independent controller where we decide why and how personal data is processed, including website enquiries, account administration, billing records, security logs, support communications, product operations, and business contact or company-representative information independently sourced, created, structured, or enriched by Bullwhip for inclusion in the Services.

We act as a processor only where a customer submits, uploads, enters, or instructs us to process personal data on its behalf, such as customer-created notes, tags, uploaded prospect lists, CRM data, or integration payloads. Where we act as processor, the customer remains the controller and the processing is governed by our contract and Data Processing Addendum.

Personal data we process

Depending on how you interact with Bullwhip, we may process:

• Account and user data: name, business email address, employer, role, authentication identifiers, session information, IP address, device/browser information, access logs, support communications, and service administration records.
• Customer use of the platform: searches, filters, selected companies, tags, notes, saved lists, export requests, report requests, usage events, and optional import or integration records.
• Business and professional intelligence data: company names, company identifiers, addresses, websites, trade activity, logistics indicators, names of business contacts or company representatives, job titles, employer details, business email addresses, business telephone numbers, professional profile information, source information, and freshness or confidence indicators.
• Website and commercial data: demo requests, enquiries, correspondence, supplier onboarding information, contract records, invoice and payment administration details, and technical website logs.

Our services are for business use. We do not intentionally collect special category data, criminal offence data, private consumer contact information, or personal data relating to children.

How we collect data

We collect personal data from:

• you directly, when you contact us, use the platform, sign a contract, request support, or provide billing or onboarding information;
• our customers, where they add authorised users, submit notes or tags, request exports, or approve an import or integration;
• official public registers, company websites, public business sources, public professional sources, search results, and licensed professional data providers;
• service providers involved in authentication, hosting, security, email delivery, payments, support, and usage logging; and
• analysis we create from business, company, trade, logistics, and web-derived information.

Why we process personal data

We process personal data for the following purposes and lawful bases:

• Providing the Services: to create accounts, authenticate users, deliver the platform, show search results, generate reports, provide exports, and support customer workflows. The lawful basis is performance of contract and, where applicable, legitimate interests.
• Business and professional intelligence: to collect, structure, enrich, update, and display company and business-contact information for B2B prospecting and logistics intelligence. The lawful basis is legitimate interests, balanced against the rights and interests of the individuals concerned.
• Security and reliability: to monitor access, prevent abuse, investigate incidents, maintain backups, and keep the platform available. The lawful basis is legitimate interests and legal obligation where applicable.
• AI-assisted features: to classify, summarise, extract, enrich, or answer questions where a user requests that functionality. The lawful basis is performance of contract and legitimate interests.
• Customer support and administration: to respond to enquiries, manage onboarding, contracts, billing, supplier forms, and customer communications. The lawful basis is performance of contract, legitimate interests, and legal obligation.
• Legal, regulatory, and accounting compliance: to keep records, respond to lawful requests, and meet tax, accounting, and company-law obligations. The lawful basis is legal obligation and legitimate interests.
• Marketing to business contacts: to send limited B2B communications about Bullwhip where permitted by law. The lawful basis is legitimate interests or consent where required.

Standard platform access

For standard SaaS use, Bullwhip is accessed through a web browser over HTTPS. It does not require a customer to install software inside its network, grant inbound network access, connect internal file stores, or give Bullwhip access to internal CRM, mailbox, calendar, or customer database systems.

Where an import, export, API connection, CRM write-back, or other integration is requested, we agree the scope separately with the customer. Integrations can be designed with limited permissions, including write-only CRM access where supported by the customer's chosen system.

AI and model providers

Some Bullwhip features may use AI model providers, including OpenAI, to process prompts, business context, search results, enrichment tasks, classification requests, extraction tasks, or user-requested analysis.

We do not use Customer Confidential Information or Customer Personal Data to train general-purpose AI models. Where we use OpenAI API services, we do not opt in to provider training of submitted API inputs or outputs.

AI outputs may be incomplete or incorrect and should be reviewed before being used for important commercial, legal, financial, or compliance decisions.

Sharing and subprocessors

We do not sell customer account data, Customer Confidential Information, customer searches, customer notes, customer export activity, or customer usage activity to freight forwarders or other third parties.

We may share personal data with:

• authorised Bullwhip personnel and contractors who need access to provide, secure, or support the Services;
• platform providers for hosting, database, storage, deployment, authentication, email, payments, security, monitoring, support, search, enrichment, and AI functionality;
• professional advisers, insurers, banks, payment providers, regulators, courts, or public authorities where necessary;
• a potential buyer, investor, or successor business if Bullwhip is involved in a genuine corporate transaction, subject to appropriate safeguards.

Current platform provider examples include Amazon Web Services, Vercel, Neon, OpenAI, Stripe, Microsoft or Google identity services where enabled, Cloudflare Turnstile, Mailtrap or another transactional email provider, and search or professional-data providers used for lawful business-data enrichment.

The business and professional intelligence made available through Bullwhip is sourced independently by Bullwhip from public, licensed, or customer-approved sources. It is not created by selling one customer's confidential activity to another customer.

International transfers

Our core web and database services are configured with UK or European hosting locations where available and appropriate. Some providers may process personal data in the United States or other countries as part of service delivery, support, security, logging, or global infrastructure.

Where personal data is transferred outside the United Kingdom or European Economic Area, we use appropriate safeguards such as adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses, or another lawful transfer mechanism as applicable.

Retention

We keep personal data only for as long as reasonably necessary for the purposes described in this policy, unless a longer period is required by law, contract, dispute resolution, security, or legitimate business need.

• Customer account records and customer-created service content are normally retained for the active service period plus a reasonable wind-down period, usually 30 days after termination unless the contract says otherwise.
• Authentication sessions are normally retained for up to 14 days and may be revoked earlier for security or offboarding.
• Generated exports are normally retained during the active service period and deleted on request or during termination wind-down where applicable.
• Optional import files are normally deleted within 30 days after processing unless a different period is agreed.
• AI chat or analysis history held by Bullwhip is normally retained for up to 90 days after last activity unless deleted earlier or retained under contract.
• Routine application logs are normally retained for up to 30 days. Security audit events may be retained for up to 12 months.
• Support communications are normally retained for up to 24 months.
• Billing, tax, accounting, and company records are normally retained for six years or as otherwise required by law.
• Backups may retain deleted data for up to 35 days before ordinary backup expiry.
• Suppression records and opt-out records may be retained for as long as needed to respect the relevant request.

Accuracy, objections, and suppression

Because Bullwhip works with public and professional business information, some records may become out of date. We use reasonable processes to update, correct, suppress, or delete records where appropriate.

If you believe information about you is inaccurate, should not appear in the Services, or should be restricted, contact us at ryan.j@bull-whip.com or info@bull-whip.com.

Security

We use technical and organisational measures designed to protect personal data, including HTTPS/TLS in transit, access controls, authentication controls, least-privilege administration, tenant and user scoping, provider-managed encryption at rest where available, logging, monitoring, backups, vulnerability review, and incident-response procedures.

No online service can guarantee absolute security. If we become aware of a personal data breach affecting Customer Personal Data, we will notify the relevant customer in accordance with our contractual and legal obligations.

Cookies and website technologies

Our website and platform use essential cookies, local storage, and similar technologies for security, authentication, preferences, session management, and core functionality.

We do not currently use non-essential marketing cookies on the public website. If this changes, we will update this policy and, where required, request consent.

Your rights

Under UK data protection law, you may have rights to:

• access a copy of your personal data;
• correct inaccurate or incomplete data;
• request deletion of data where the law allows;
• restrict processing in certain circumstances;
• object to processing based on legitimate interests;
• object to direct marketing at any time;
• request portability of data you provided to us in certain circumstances;
• withdraw consent where processing is based on consent; and
• ask for information about sources where personal data was not collected directly from you.

To exercise your rights, contact ryan.j@bull-whip.com or info@bull-whip.com. We aim to respond within one month, subject to any lawful extensions or identity checks.

Customer outreach responsibilities

Bullwhip provides business intelligence, search, enrichment, and workflow tools. Customers are responsible for deciding how they use information obtained through the Services and for ensuring their own prospecting, marketing, sales, and outreach activities comply with UK GDPR, PECR, telephone preference rules, suppression lists, opt-outs, and other applicable requirements.

Complaints

If you are unhappy with how we handle your personal data, please contact us first so we can try to resolve the issue.

You may also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

Changes to this policy

We may update this Privacy Policy from time to time. Updates will be posted on this page with a new "Last updated" date.