Tenderpreneurs (Pty) Ltd ("Tenderpreneurs", "we", "us") is a private South African service that helps businesses find and respond to government tenders. This policy explains what personal information we process, why, who we share it with, how long we keep it, and your rights under the Protection of Personal Information Act, 2013 (POPIA). It covers the website and the Android app, which shows the same website.
1. Responsible party and Information Officer
Tenderpreneurs (Pty) Ltd is the responsible party. Our Information Officer is the responsible director of the company, reachable at privacy@tenderpreneurs.co.za. Our physical address is given in our Terms. Our PAIA manual is available on request at the same address.
2. What we collect
We collect only what the service needs. Everything below is provided by you or created when you use the service.
- Account: email address (required to sign in); name, profile picture link and Google account ID if you sign in with Google; company name, province and sectors if you add them. We do not use passwords.
- Supplier profile (optional): CSD number, B-BBEE level, CIDB grades, turnover band, capacity, provinces, sectors, keywords, certifications and document expiry dates. This is used to match tenders and send expiry reminders. For sole proprietors this is personal information.
- Your activity: saved tenders and your notes on them, saved searches, closing alerts, and tender notice drafts you create.
- Phone number (optional): only if you enter one for alerts. We store it but do not currently send WhatsApp messages.
- Subscription and payment records: plan, status, amounts, dates and PayFast reference numbers. Card details are entered on PayFast and never reach us. PayFast notifications that include the payer name and email are kept for up to 90 days and then removed.
- Security data: when you sign in we record your IP address and browser user agent with your session, for fraud prevention. Sessions older than 90 days are deleted.
- Usage data: a first-party record of pages viewed, tender pages opened and search terms, linked to a pseudonymous ID rather than your name or email. Records are deleted after 12 months. We do not use advertising or third-party analytics trackers.
- Waitlist and entity contact data: emails given on waitlist forms, and public contact details of procuring entities.
- Location: if you use "Near me" on the map, your browser works out your position on your device. It is not sent to us.
- Documents you check: text or files you load into the Reviewer are processed in your request and are not stored.
Tender notices come from public sources and may contain buyer contact names, emails and phone numbers published by organs of state.
3. Why we use it
- To provide your account, sign you in and keep your saved work (performance of the service).
- To send tender alerts, digests and expiry reminders you asked for (consent, which you can withdraw).
- To take payment and keep tax records (contract and legal obligation).
- To keep the service secure and fix problems (legitimate interest).
- To understand which features are used so we can improve them (legitimate interest, pseudonymous).
We do not sell personal information and we do not show advertising.
4. Who processes it for us
These providers process information on our behalf under contract and may be outside South Africa:
- Cloudflare – hosting, database and file storage.
- Resend (USA) – sends sign-in links, alerts and digests, so it sees your email address.
- Google – Sign in with Google (name, email, picture, account ID) and Google Fonts (your IP address is visible to Google when fonts load).
- PayFast (South Africa) – card and subscription payments.
- OpenStreetMap and unpkg – map tiles and the map library; your IP address is visible to them when the map loads.
- AI providers (Google Gemini, Groq, Anthropic, OpenAI, OpenRouter) – used to classify public tender text. We do not send your account details, documents or Reviewer text to them.
Where information goes outside South Africa (for example Cloudflare and Resend in the USA), we rely on POPIA section 72: the provider is bound by contract to protect it to a similar standard, and it is needed to deliver the service you asked for.
5. How long we keep it
- Account, profile, saved items and drafts: until you delete your account.
- Sign-in links and security tokens: removed within a day of expiry. Sessions: up to 90 days.
- Usage and digest records: 12 months.
- Payment records (amounts, dates, reference numbers, without your name or email): 5 years, as tax law requires.
6. Deleting your account and data
You can delete your account in the app or on the website under Account → Delete account, or without signing in at tenderpreneurs.co.za/account-deletion. If you have a paid subscription it is cancelled first. Deletion removes your profile, supplier data, saved items, drafts, alerts, sign-in records and linked Google identity, usually immediately and within 30 days at most. Only the payment ledger described above is kept.
7. Your rights
You may ask us to confirm what we hold about you, to correct or delete it, to object to its use, or to stop marketing-type messages at any time. Email privacy@tenderpreneurs.co.za. We respond within 30 days.
8. Security and breaches
All traffic uses HTTPS. Sign-in uses one-time links or Google, with no stored passwords. If a breach is likely to harm you, we will notify you and the Information Regulator as POPIA requires.
9. Children
The service is for businesses and adults aged 18 or over. We do not knowingly collect information from children.
10. Complaints
If you are not satisfied with our response you may complain to the Information Regulator:
- Email: POPIAComplaints@inforegulator.org.za
- Website: inforegulator.org.za
- Postal: PO Box 31533, Braamfontein, 2017
11. Changes
We may update this policy. The "Last updated" date shows the latest revision, and we will tell you about material changes by email or in the service.