WorkBank
Sign inJoin
Legal

Privacy Notice

Last updated 19 July 2026 — added: business emails you share with Walt, connected email accounts, email export files you upload, imported professional networks, the capacity noticeboard, and our service providers.

Interim notice — a full policy prepared with legal advisers will replace this before public launch.

1. Data controller

WorkBank Ltd is the data controller for personal data collected through this website and platform. Contact: hello@workbank.co.uk.

2. What we collect

Name, email address, company name, Companies House number, your role selection at signup, uploaded credential documents, and usage data generated as you use the platform.

3. Documents and content you give Walt to process

When you use Walt (our AI assistant) you may provide content that we process on your behalf. This includes:

  • Deposited past tenders — documents you upload to your library so Walt can draft case studies, staff and style from your own history. You choose what to deposit; Walt only reads what you deposit.
  • CVs — reformatted into your house template.
  • Inbound portal alert emails — alerts you forward to your WorkBank Radar address, read to extract opportunity details.
  • Business emails you choose to share— emails you forward or BCC to your WorkBank address. Walt reads these to log them against the right client, spot opportunities, and understand which relationships need attention. This includes the sender's and recipients' names, email addresses, and the content of the message.
  • Your professional network— if you import your LinkedIn connections (via LinkedIn's official export file), we store the names, employers and job titles in that file so Walt can show you who you know at companies that matter to your pipeline.
  • Company and contact data in the documents you upload.
  • Named individuals who appear in the documents you upload (for example staff named in a tender or CV).
  • Bid content you draft in a tender workspace. Your bid content is not shared with the buyer until you submit it.

This content is held within your own company's workspace, is not made visible to other companies on the platform, and is not used to train external AI models. Anything Walt extracts is held as a draft for your explicit review — nothing is sent, published or acted on without your approval.

4. Connected email accounts (when available)

You will be able to connect a Gmail or Outlook mailbox so Walt can read your business email automatically. If you do:

  • Access is read-only. WorkBank cannot send, delete or change anything in your mailbox.
  • You can disconnect at any time in Settings, which stops all access immediately.
  • We store the emails needed to provide the features above, under the retention periods in section 9.
  • Connection uses Google's / Microsoft's own sign-in; we never see or store your email password.

The same applies to email export files you upload (for example an Outlook .pst, .eml or .csv export): we treat the messages in them exactly as we treat connected-mailbox email — same features, same storage, same retention periods, and you can delete them the same way. Uploading the file is your choice each time; we never fetch mail from anywhere you haven't connected or uploaded.

For imported professional networks (such as a LinkedIn connections file): you choose what uploads — anyone you untick during import is never sent to us at all. After import, each contact carries a visibility level you control: private (visible only to you — not to colleagues or company administrators), my division, or whole firm. If you leave your company, your private contacts become invisible to everyone — they are not transferred to colleagues or administrators.

5. Information about people who don't have WorkBank accounts

Some of what our users share with us contains personal data about other people — for example the business contacts in a forwarded email, the connections in an imported LinkedIn file, staff named in a tender document, or attendees listed on a public industry-event page. For this data:

  • We process it on behalf of the user who provided it, to help them manage their own business relationships (lawful basis: legitimate interests).
  • It is limited to professional information: name, employer, job title, business contact details, and the content of business correspondence.
  • It is visible only inside that user's company workspace — never to other companies, and never published.
  • It is not used for marketing to those individuals, and WorkBank never contacts them.
  • If you are such an individual and want your data corrected or removed, email hello@workbank.co.uk and we will action it.

6. The capacity noticeboard

If your company posts spare or needed capacity on the noticeboard, the post — your company name, the discipline, region, dates, headcount and note — is visible to other member companies. That visibility is the purpose of the board. Your personal contact details are not shown; responses arrive through WorkBank messages. You can withdraw a post at any time.

7. Why we collect it, and our lawful basis

  • Account creation and authentication — contract
  • Platform operation (matching, award recording, credential tracking) — contract
  • Processing content you give Walt, including emails and your imported network — contract / legitimate interests
  • Service emails (confirmation, renewal reminders, notifications) — contract / legitimate interests
  • Platform improvement — legitimate interests

8. Who processes data on our behalf

We use a small number of service providers to run WorkBank: Supabase (database and file storage), Vercel (hosting), Postmark (inbound and service email), and Anthropic (AI processing of the content you give Walt — under terms that prohibit training on your data). Each processes data only on our instructions.

9. Retention

What happens today: we retain your account data, uploaded documents, forwarded and shared emails and bid content for as long as your account is open. When you ask us to delete specific content, or to close and erase your account, we action that request manually — email hello@workbank.co.uk and we will remove it. We do not yet run automated time-based deletion.

Proposed retention schedule (subject to legal review — not yet in force): our advisers have proposed the periods below. They are indicative only and are not automatically enforced by the platform today.

  • Forwarded portal alert emails — proposed 90 days
  • Shared business emails (forwarded, BCC'd or from a connected mailbox) — proposed 12 months, with extracted relationship records (e.g. "last contact date") kept for account lifetime
  • Imported LinkedIn connections — account lifetime, or until you delete the import
  • Uploaded documents — proposed account lifetime + 12 months
  • Submitted bids — proposed tender lifetime + 6 years
  • Draft content — proposed to be held with its parent bid
  • Disconnecting a mailbox stops collection immediately; already-stored emails follow the schedule above unless you ask for earlier deletion

10. Your UK GDPR rights

You have the right to access, correct, erase, restrict, port, and object to the processing of your personal data. Email hello@workbank.co.uk to exercise any right. This applies whether or not you hold a WorkBank account.

11. Complaints

You may complain to the Information Commissioner's Office at ico.org.uk.

12. Changes

This is an interim notice. A full policy will be published before public launch, and changes will be notified by email.