Privacy policy

What personal information this site holds, why, who sees it, how long we keep it and what you can require of us. The last five sections set out the rights that apply where you are.

In force from 27 August 2026. Last revised 27 August 2026.

In force, with some details still being settled. This document applies from 27 August 2026. A few contact details, marked to be supplied, are being finalised with our advisers and will be filled in here as soon as they are confirmed.

They are shown as gaps rather than filled with plausible text, because a document you are invited to rely on must not contain invented facts. None of them changes what this document says or what you may ask of us. If you need one of them in order to exercise a right, write to privacy@buysidefintech.com and we will give you the answer directly and act on your request either way.

Contents

Who is responsible for your information
What this policy covers
What we collect, and where it comes from
Why we use it, and our legal basis
Who we share it with
Where your information is held, and transfers
How long we keep it
How we protect it
Cookies
Email we send you
Your rights, wherever you are
Changes to this policy
European Economic Area, United Kingdom and Switzerland
Singapore
Hong Kong
Canada
United States

1. Who is responsible for your information

Straker Media LLC is the controller of the personal information described in this policy — in Canadian terms the organisation accountable for it, in Hong Kong terms the data user, and in Singapore terms the organisation. Our contact details are in the terms of use.

For anything about your personal information, including exercising any right in this policy, write to privacy@buysidefintech.com. We answer within the time the law where you are allows, and within 30 days if it sets no shorter period.

Role	Who
EEA representative (GDPR Article 27)	to be supplied: EEA representative name and EU postal address
UK representative (UK GDPR Article 27)	to be supplied: UK representative name and UK postal address
Data protection officer, Singapore (PDPA)	to be supplied: named DPO and business contact information
Privacy officer, Canada (PIPEDA)	to be supplied: named privacy officer and contact details

2. What this policy covers

This policy covers the personal information we handle when you visit buysidefintech.com, register an account, write a review, claim or maintain a vendor listing, run a request for proposal or answer one.

It does not cover other companies' websites we link to, or what a vendor does with information you give it directly.

This is a business-to-business service. Most of what we hold is information about companies, which is not personal information at all. Where we hold information that identifies a person, this policy applies to it.

3. What we collect, and where it comes from

The table below is the complete list, taken from the database schema rather than written from memory.

Category	What it is	Where it comes from
Account	Your work email address and its domain, a one-way hash of your password (never the password itself), your role on the site, and the professional context shown on a review byline: your type of firm, its assets-under-management band and your job role.	You, at registration.
Sign-in session	A one-way hash of your session token, the IP address and browser user-agent string recorded when the session was created, and its expiry.	Created automatically when you sign in.
Firm	Your firm's name, email domain, type, size band and country.	You, when you set up a request for proposal.
Request for proposal	The title, the category you are buying in, your intake answers, your chosen questions and weights, your deadline, which vendors you invited, and whether you chose to reveal your identity.	You.
RFP invitation and response	The vendor address an invitation was sent to, a one-way hash of the private access link, when it was opened, acknowledged or submitted, how many reminders were sent, and — for the person who answers — their name, email address and job role, with their answers.	You, and the vendor representative who answers.
Vendor answer library	If a vendor chooses to keep its answers, the answers themselves and the date each was last confirmed, held against that vendor's listing so a later request for proposal asking the same question can offer the stored answer back for the vendor to confirm. Keeping answers is the vendor's choice and is off unless they turn it on; turning it off deletes what was stored.	The vendor representative who answered.
Answer library access request	The contact address already published on the vendor's listing, a one-way hash of the access link sent to it, the IP address the request came from, and when the link was used. The link is only ever sent to the address on the listing, never to an address typed into the form.	Created when someone asks for a link to a vendor's answer library.
Reviews	Your rating on each dimension and what you wrote.	You.
Vendor directory	Company facts: name, website, headquarters, founding year, ownership, products and categories, plus a business contact address, phone number or contact page, each recorded with the page it was taken from and the date.	Published pages on vendors' own websites and industry publications, and from vendor representatives who claim a listing.
Correspondence	Emails you send us and our replies.	You.
Server logs	Your IP address, the page requested, the time, the response status and your browser user-agent string.	Recorded automatically by our web server.
Record of changes	Every time anything is changed on this site — an account created, a review written, a listing edited, an RFP sent — we record what was done, who did it, when, whether it succeeded, your IP address and your browser user-agent string, together with information derived from that IP address: the approximate city, region and country it is registered in, and the name of the network operator. It is approximate. It is not your exact location, and it is not taken from your device.	Recorded automatically whenever you change something. The derived location comes from IPinfo.io (IPinfo LLC).

We do not collect special category data — nothing about health, race, religion, political opinions, trade union membership, sex life or sexual orientation, biometrics or genetics. Please do not send it to us.

We do not knowingly collect information from children. The site is for professional use and is not directed at anyone under 18.

About the directory's contact details. These are business contact addresses published by companies for the purpose of being contacted about their products. Of the contact addresses in the directory today, effectively all are role addresses such as info@, sales@ or support@ rather than a named individual's address. Where an address does identify a person, that person may ask us to remove it and we will, using section 11.

4. Why we use it, and our legal basis

The legal basis column applies where the GDPR or UK GDPR governs the processing. Elsewhere, the purpose column states why we do it and the regional sections explain the local basis.

Purpose	Information used	Legal basis (EEA/UK)
Create and run your account, sign you in, keep you signed in	Account, sign-in session	Performance of a contract with you (Article 6(1)(b))
Confirm you work where you say you do, so reviews come from practitioners and vendor listings are claimed by the right company	Account, email domain	Legitimate interests (Article 6(1)(f)): keeping the directory honest, which is the point of the service and what every user relies on
Publish your review with its professional context	Reviews, account context fields	Performance of a contract, and legitimate interests in publishing an accurate record
Run a request for proposal: send it, chase it, collect and compare answers	Firm, RFP, invitation, response	Performance of a contract with the firm; legitimate interests as regards the vendor contacts we invite (Article 6(1)(f)), being the mutual business interest in vendors learning of relevant opportunities
Compile and maintain the vendor directory	Vendor directory	Legitimate interests (Article 6(1)(f)): publishing an independent, sourced record of a market, which is journalism in substance and is what buyers use the site for
Moderate content, investigate reports, enforce the rules	Any of the above	Legitimate interests, and legal obligation where one applies
Keep the site secure, prevent abuse, diagnose faults	Server logs, sign-in session	Legitimate interests (Article 6(1)(f)): protecting the service and its users
Reply to you	Correspondence	Legitimate interests, or performance of a contract
Comply with the law, and establish or defend legal claims	Any of the above	Legal obligation (Article 6(1)(c)); legitimate interests (Article 6(1)(f))

Where we rely on legitimate interests we have weighed those interests against your rights and freedoms. You can object to any of it — see section 11 — and you can ask us for our assessment.

We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you. The RFP comparison scores vendors, on weights the buying firm sets, and every score is shown with the arithmetic that produced it.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done either.

We share information only as follows:

Who	What they get	Why
Vendors you invite to an RFP	Your requirements and questions. Your firm's type and size band. Your firm's identity only if you choose to reveal it.	To answer your RFP.
The firm that invited you, if you answer an RFP	Your answers, your name, email address and role.	So the firm can evaluate and contact you.
Readers of the site	Your review, with your firm type, size band and job role — never your name or email address.	To publish the review.
The vendor whose product you reviewed	The same published review.	So they can exercise their right of reply.
Our hosting provider, Hetzner Online GmbH, Falkenstein, Germany	Everything stored by the service, as the operator of the servers it runs on. They do not access it for their own purposes.	To run the service.
Our email delivery provider	The recipient address and the content of the message.	To deliver confirmation, sign-in, invitation and reminder emails.
Our IP lookup provider, IPinfo.io (IPinfo LLC)	Your IP address, and nothing else. Not your name, your address, your account or what you were doing. We ask them once per address and keep the answer, so the same address is not sent again.	To find the approximate city, region, country and network operator for the record of changes described above. We do this to detect misuse of the site and to investigate a disputed change.
Professional advisers, and authorities	Only what is necessary.	Legal, accounting and insurance advice; and where we are required by law, or need to establish or defend a legal claim.
A buyer of our business	The information as part of the business.	If the business is sold or reorganised. We would tell you, and the buyer would be bound by this policy or one no less protective.

Everyone acting for us is bound by contract to use the information only on our instructions, to keep it secure and to return or delete it when they stop working for us.

6. Where your information is held, and transfers

The service runs on servers in Germany, operated by Hetzner Online GmbH in Falkenstein, Germany. Your information is stored in the European Union.

Straker Media LLC is established in the United States, and its personnel administer the service from there. That means personal information may be accessed from the United States, which for readers in the EEA, the United Kingdom and Switzerland is a transfer to a country outside their own.

Where such a transfer happens we rely on the European Commission's standard contractual clauses, together with the UK International Data Transfer Addendum for UK transfers and the Swiss addendum for Swiss transfers, and on an assessment of the safeguards in place. You can ask us for a copy of the clauses at privacy@buysidefintech.com.

One further transfer. To turn an IP address into an approximate location we send that address, and only that address, to IPinfo.io (IPinfo LLC) in the United States. Nothing identifying you accompanies it. The same contractual protections described above apply.

For readers in Singapore, Hong Kong and Canada, the corresponding obligations to ensure a comparable standard of protection when information is transferred out of your jurisdiction are met by the same contractual protections. See the regional sections.

7. How long we keep it

We keep personal information only as long as we need it for the purpose we collected it for, or as long as the law requires.

What	How long
Server access logs, containing IP addresses	10 days, then deleted automatically as the logs rotate.
Record of changes, containing IP addresses	While the thing it describes is still published on this site, and after that for 24 months from when the entry was made or 12 months from when that thing came down, whichever is later. An entry about a published review is kept while the review is up, because it is the record of who wrote it. Entries are then deleted automatically. They cannot be edited at any point, by us or by anyone else, and nothing newer than 24 months can be deleted by anyone, including us.
The location derived from an IP address	12 months, then deleted, which is sooner than the entry it belonged to. After that we still hold the address on the entry, but not what we worked out about it.
Sign-in session records	The session expires after 7 days. Expired and revoked session records are deleted.
Account	While your account is open. If you close it, we delete or anonymise the account within 30 days.
Published reviews	For as long as the review is published, which may be after your account closes. Reviews are published without your name or email address, so what remains is not ordinarily information that identifies you. You can ask us to remove a review under section 11.
Vendor answer library	Until the vendor turns the library off or asks us to delete it, at which point the stored answers are deactivated and are no longer offered into any request for proposal.
Answer library access requests	The link expires after 14 days. The record of the request, including the IP address it came from, is kept for 12 months so we can investigate misuse of a link, then deleted.
Request for proposal, invitations and responses	While the RFP is open and for 24 months after it closes, so that both sides have a record of what was asked and answered. The private access link in an invitation expires after 45 days regardless.
Vendor directory records	For as long as the vendor is listed. Every fact carries the date it was checked. We correct a record whenever an error is reported to us, and whenever a vendor claims its listing and updates it.
Correspondence with us	24 months from the last message, unless it relates to a dispute.
Anything needed for a legal claim	Until the claim and any appeal is finally resolved, or the limitation period expires.

Where we no longer need information but cannot delete it immediately, for example because it sits in a backup, we isolate it and delete it when the backup cycle allows.

8. How we protect it

The whole site is served over HTTPS, with HTTP Strict Transport Security so a browser will not connect any other way.
Passwords are stored only as a one-way hash. We cannot read your password and neither can anyone who obtains the database.
Session tokens, email confirmation links and RFP access links are stored only as one-way hashes, so the database does not contain a usable link.
The database is not reachable from the internet. Only the application server can open it, and that server listens only on the machine's own internal interface.
The site sets a strict Content-Security-Policy, so a browser will not execute injected scripts or load resources from other sites.
Access to the production systems is limited to the people who need it.

No service can promise perfect security. If a breach happens that is likely to result in a risk to you, we will notify you and the relevant authority within the time the law where you are requires — the regional sections give the specific obligations.

To report a vulnerability, see security.txt or write to security@buysidefintech.com. We will not pursue anyone who reports a problem in good faith.

9. Cookies

We set one cookie, only after you sign in, and it does nothing but keep you signed in. There are no analytics cookies, no advertising cookies and no third-party cookies of any kind. The details are in our cookie policy.

Rendering a page on this site contacts no other company. Fonts, stylesheets, scripts and images are all served from this site, so your IP address is not passed to a third party simply because you read a page.

10. Email we send you

We send three kinds of email:

Service email you asked for by using the site: confirming your address, signing you in, and telling you about your own RFP. You cannot unsubscribe from these while you hold an account, because they are how the service works.
RFP invitations and reminders to a vendor, sent to the business contact address on the vendor's listing because a firm has invited that vendor to answer. Reminders go out before the deadline and stop as soon as the vendor answers or declines. Every one carries a link to decline.
Anything else — only if you have asked for it, and every message carries a one-click unsubscribe.

Every message we send identifies us and gives a way to contact us. We act on an unsubscribe request immediately, and in any event within the time the law where you are requires. To stop all non-essential email, write to privacy@buysidefintech.com.

11. Your rights, wherever you are

Whoever and wherever you are, you may ask us to:

tell you what we hold about you and give you a copy;
correct anything wrong or incomplete;
delete what we hold, where we have no continuing reason or legal duty to keep it;
stop or limit a particular use, including using your details for any marketing;
give you a portable copy of what you gave us, in a commonly used machine-readable format;
explain anything in this policy you want explained.

Write to privacy@buysidefintech.com. We may need to check who you are before we act, which protects you. Exercising a right costs nothing and we will never treat you worse for it.

The regional sections below set out the additional rights that apply where you are, and how to complain to your regulator if we get it wrong. Please come to us first if you can — we would rather fix it.

12. Changes to this policy

If we change this policy we will publish the new version here and change the date at the top. If a change materially affects how we use your information we will tell you by email before it takes effect, where we hold an address for you.

EEA · UK · Switzerland

13. European Economic Area, United Kingdom and Switzerland

This section applies if you are in the EEA, the United Kingdom or Switzerland. It adds to the rights in section 11; it does not replace them.

Your rights under the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection are:

Access (Article 15): confirmation of whether we process your data, a copy of it, and the information in this policy.
Rectification (Article 16).
Erasure (Article 17), where the data is no longer needed, you withdraw consent we relied on, you object successfully, or the processing is unlawful.
Restriction (Article 18) while a dispute about accuracy or our legitimate interests is resolved.
Portability (Article 20) for data you gave us that we process by automated means on the basis of contract or consent.
Objection (Article 21) to processing based on legitimate interests, on grounds relating to your particular situation. If you object to direct marketing we must stop, with no balancing test.
Withdraw consent at any time, where we relied on it. That does not affect what we did before you withdrew it.
Not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you. We do not make such decisions.

We answer within one month, extendable by two further months for complex requests, and we will tell you if we need the extension.

Complaining. You may lodge a complaint with the supervisory authority in the EEA member state where you live, work or where the problem happened. In the United Kingdom that is the Information Commissioner's Office, ico.org.uk. In Switzerland it is the Federal Data Protection and Information Commissioner.

Our representative for the purposes of Article 27 is to be supplied: EEA representative for the EEA and to be supplied: UK representative for the United Kingdom.

Breach notification. We notify the supervisory authority of a personal data breach within 72 hours of becoming aware of it where it is likely to result in a risk to people's rights, and we tell affected people without undue delay where the risk is high.

Singapore

14. Singapore

This section applies if you are in Singapore, and reflects the Personal Data Protection Act 2012.

Consent. We collect, use and disclose your personal data for the purposes in section 4 with your consent, or where the Act permits it without consent, including under the legitimate interests and business improvement exceptions in the First and Second Schedules. We notify you of the purpose at or before collection, and we do not collect more than a reasonable person would consider appropriate.
Withdrawing consent. You may withdraw consent for any purpose on reasonable notice, by writing to privacy@buysidefintech.com. We will tell you the likely consequences — usually that you can no longer use part of the service — and then stop that use.
Access and correction. You may ask for the personal data we hold and how it has been used or disclosed in the past year, and ask us to correct an error. We respond within 30 days, or tell you when we can if we need longer. We may charge a reasonable fee for an access request and will tell you before we do.
Data protection officer. Our DPO is to be supplied: named Singapore DPO and business contact information.
Data breach notification. We notify the Personal Data Protection Commission, and affected individuals, of a notifiable data breach as the Act requires — within 3 calendar days of assessing that a breach is notifiable.
Do Not Call. We do not send marketing calls, texts or faxes to Singapore telephone numbers. If we ever do, we will check the Do Not Call registers first.
Transfers out of Singapore. Where we transfer your data abroad, we take reasonable steps to ensure a standard of protection comparable to the Act, by the contractual means described in section 6.

You may complain to the Personal Data Protection Commission at pdpc.gov.sg.

Hong Kong SAR

15. Hong Kong

This section applies if you are in Hong Kong, and reflects the Personal Data (Privacy) Ordinance (Cap. 486) and its six data protection principles.

Collection. We collect personal data lawfully and fairly, for a purpose directly related to running this service, and we collect no more than is necessary. section 4 is the notice required by data protection principle 1.
Accuracy and retention. We take practicable steps to keep data accurate and to keep it no longer than necessary. section 7 sets out how long.
Use. We use personal data only for the purpose it was collected for, or a directly related purpose, unless you consent otherwise.
Security, openness and access. section 8 and section 11 describe the safeguards, this policy is our statement of policies and practices, and you may make a data access request or a data correction request at privacy@buysidefintech.com. We respond within 40 days. We may charge a fee for a data access request that is not excessive.
Direct marketing. We will not use your personal data in direct marketing without first telling you and obtaining your consent, and we will not provide it to anyone else for their direct marketing. You may tell us at any time to stop using your data for direct marketing and we will do so free of charge.
Transfers. Where data is held or accessed outside Hong Kong, the contractual protections in section 6 apply.

You may complain to the Office of the Privacy Commissioner for Personal Data at pcpd.org.hk.

Canada

16. Canada

This section applies if you are in Canada, and reflects the Personal Information Protection and Electronic Documents Act, Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25, and the equivalent Alberta and British Columbia legislation.

Accountability. Our privacy officer is to be supplied: named Canadian privacy officer and contact details.
Consent. We obtain your consent to collect, use and disclose personal information, except where the law permits otherwise. The form of consent reflects how sensitive the information is; for the business contact information in the directory we rely on the business contact information exemption. You may withdraw consent on reasonable notice, subject to legal and contractual restrictions.
Access and correction. You may ask what personal information we hold, how it is used and to whom it has been disclosed, and ask us to correct it. We respond within 30 days.
Quebec — additional rights. If you are in Quebec you also have the right to data portability, the right to request that we cease disseminating information or de-index a link where dissemination causes serious injury to your reputation or privacy, and the right to be informed of and to object to a decision based exclusively on automated processing. We do not make such decisions.
Breach reporting. We report a breach of security safeguards involving a real risk of significant harm to the Office of the Privacy Commissioner of Canada and to affected individuals as soon as feasible, and keep records of breaches as required.
Commercial email. We comply with Canada's Anti-Spam Legislation. Where we email a vendor's published business address about an RFP relevant to that business, we rely on the exception for conspicuously published business contact information. Every message identifies us and carries a working unsubscribe that we honour within 10 business days.
Transfers. Information is processed in Germany and accessed from the United States, and while there it is subject to the laws of those countries. We use contract to ensure a comparable level of protection, as section 6 describes.

You may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or to your provincial authority — in Quebec the Commission d'accès à l'information.

United States

17. United States

This section applies if you are in the United States. It reflects the California Consumer Privacy Act as amended by the California Privacy Rights Act, and the comparable laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states as they take effect. Where your state gives you a right listed here, you have it.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding 12 months. We do not process personal information for targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects.

Categories collected in the last 12 months, in the terms the CCPA uses:

CCPA category	Collected	Source	Purpose	Disclosed to
Identifiers — name, email address, IP address, account identifier	Yes	You; automatically from your browser	Run the service, security	Service providers; the RFP counterparty
Commercial information — your RFP requirements and responses	Yes	You	Run the RFP service	The RFP counterparty; service providers
Internet activity — pages requested, user-agent	Yes	Automatically	Security and fault diagnosis	Service providers
Professional or employment information — employer, job role, firm type and size band	Yes	You	Verify practitioner status; review bylines	Readers, in the anonymised form described in section 5
Sensitive personal information	No	—	—	—
Biometric, geolocation, education, audio or visual information	No	—	—	—

Your rights. You may ask us to: tell you what we have collected, the sources, the purposes and who we disclosed it to; give you a copy; correct it; delete it; and limit the use of sensitive personal information, though we do not collect any. You may exercise these rights twice in a 12-month period, free of charge, by writing to privacy@buysidefintech.com.

Authorised agents. You may use an authorised agent. We will ask for written proof of their authority and may ask you to confirm it directly.

Appeals. If we refuse a request, you may appeal by replying to our decision or writing to legal@buysidefintech.com. We will respond with our reasons within 45 days. If we deny your appeal you may contact your state attorney general.

No discrimination. We will not deny you service, charge you a different price or give you a lower quality of service because you exercised a privacy right.

California "Shine the Light". We do not share personal information with third parties for their own direct marketing purposes.

Do Not Track. We do not track you across other websites, so there is nothing for a Do Not Track signal to switch off. We honour opt-out preference signals such as Global Privacy Control by default, because we already do not sell or share.