Privacy Policy

TenderPal is a South African procurement intelligence platform operated by TenderPal (Pty) Ltd. We aggregate publicly available tender and RFQ information and provide tools to help businesses find and bid on procurement opportunities. For questions about this policy, contact us at privacy@tenderpal.co.za.

We collect the following categories of personal information:

• Account information: your name, email address, and password (stored as a secure hash).
• Company profile information you voluntarily provide (company name, registration number, sector).
• Usage data: pages visited, search queries, tenders saved, and feature interactions.
• Technical data: IP address, browser type, and device identifiers collected automatically.
• Enquiry data: name, phone number, and message content submitted via contact or specialist enquiry forms.

We do not collect payment card details directly. Any future payment processing will be handled by a compliant third-party processor.

• To create and manage your account and authenticate your sessions.
• To provide tender alerts, dashboard features, and saved tender functionality.
• To forward specialist enquiries to our team at specialist@tenderpal.co.za.
• To send transactional emails (account verification, password reset, alert digests) where you have opted in.
• To improve the platform through aggregated, anonymised analytics.
• To comply with legal obligations under South African law.

Under POPIA, we process your personal information on the following bases: performance of a contract (providing the service you signed up for), legitimate interest (platform security and improvement), and consent (marketing communications, which you may withdraw at any time).

We do not sell your personal information. We share data only with:

• Infrastructure providers (Vercel for hosting, Neon for database) under data processing agreements.
• Email service providers for transactional email delivery.
• Law enforcement or regulators where required by law.

Account data is retained for as long as your account is active, plus 12 months after deletion. Tender data sourced from public government APIs is retained for 90 days after the tender closes, then purged automatically. Enquiry form submissions are retained for 24 months.

You have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your account and associated data.
• Object to processing for direct marketing purposes.
• Lodge a complaint with the Information Regulator (www.inforegulator.org.za).

To exercise these rights, email privacy@tenderpal.co.za with the subject line “POPIA Request”.

We use strictly necessary session cookies to keep you logged in. We do not use third-party advertising cookies. Usage analytics, if enabled, use privacy-preserving aggregation with no cross-site tracking.

Passwords are hashed using bcrypt and never stored in plaintext. Database connections are encrypted in transit. We conduct periodic security reviews. In the event of a data breach affecting your rights, we will notify you and the Information Regulator within 72 hours as required by POPIA.

We will notify registered users by email of material changes to this policy at least 14 days before they take effect. Continued use of the platform after that date constitutes acceptance.