Privacy policy
How we handle your information, who can access your documents and how to exercise your privacy rights.
Review version Updated
1. About this policy
This policy explains how TenderDirect handles personal information when you browse tenders, use a company workspace, publish opportunities or prepare and submit responses. It covers visitors, account holders and people named in tender records.
For privacy questions or requests, email contact@tenderdirect.co.za. This policy should be read alongside our terms and conditions.
2. Information we collect
The information we handle depends on how you use the service:
- Accounts and companies: your name and email, sign-in information, business details, company memberships, roles and invitations.
- Tender activity: searches, saved tenders, alert preferences, published notices, requirements, buyer contacts and amendments.
- Documents and responses: uploaded files and versions, application notes, selections, declarations, messages, submission receipts and delivery records.
- Subscriptions: plan, coverage, billing contact, payment references, subscription status and renewal information. Stripe handles card entry through its hosted pages.
- Website use and support: technical request and device information, cookies, diagnostic events and correspondence you send us.
Tender files may contain identity, tax, banking, ownership or qualification information. Upload only material needed for your work that you are authorised to share, and take particular care with sensitive information about other people.
3. Sources and purposes
We receive information from you, authorised company colleagues, buyers, sign-in and payment providers, and your use of the website. Published tender and buyer information may also come from issuing organisations, public notices and source documents.
We use it to provide accounts and company collaboration, show tender information, support document preparation and responses, send requested messages, administer billing, answer queries, maintain the service and prevent misuse.
Depending on the activity, processing is based on performing a contract, a legal obligation, legitimate interests or consent where required. Account and essential business details are needed for workspace features. Other information is optional unless the relevant service or tender requires it.
To raise a concern about information in a public listing, send us the listing link and the details that need attention.
4. Company and buyer access
Company workspaces are shared. Authorised colleagues can access company documents and relevant work. Your company manages membership; removing a member does not erase company records.
Published tender information is available through public previews and supplier access features. Review contact details and attachments before publishing them.
Your document library and private preparation work are not automatically sent to a buyer. A supported TenderDirect submission includes the final files, declarations and message you select. Private notes and unselected files are excluded. Submitted content is sealed from buyer access until the tender closes, after which authorised buyer members can review it.
Exporting or sending documents through email, an external portal or physical delivery places them under the receiving organisation’s arrangements. Recording external delivery here does not send the bid.
We act as a responsible party for our account, billing and service administration. Where we process company documents on an organisation’s instructions, we may act as its operator. Buyers and suppliers are responsible for their own use and disclosure of information.
5. Service providers
We use infrastructure and specialist providers to operate the service. Integrations include:
- Backblaze B2: document storage.
- Stripe: hosted checkout, recurring payments and billing management.
- Resend: account, invitation and tender-related emails.
- Google: optional sign-in, address suggestions and website analytics, where enabled.
- Sentry: errors, performance diagnostics and sampled session replay, where enabled.
Providers receive information relevant to their services. We may also disclose information where lawfully required, to investigate misuse or to advisers handling a specific matter under appropriate confidentiality arrangements.
Some providers process information outside South Africa. Cross-border processing is subject to POPIA’s applicable requirements. Contact us for information about the processing arrangements relevant to your records.
7. Retention and deletion
Retention depends on the reason for holding a record, applicable legal requirements, tender evidence and unresolved disputes. You can ask us to review information that is no longer needed.
Archiving a document does not delete it. Historical library versions, published tender revisions and response events are retained by the current workflow. Replacing or withdrawing a response preserves its history. Cancelling a subscription does not automatically delete company records.
For a deletion request, email contact@tenderdirect.co.za. We will assess your request and explain any information that must be retained and why. A request about one person’s information may require redaction rather than deletion of an entire business record.
8. Security
We use access controls and protected document routes to restrict information to authorised users. Keep your credentials private and report suspected unauthorised access promptly.
No online service is immune to security incidents. Where a compromise triggers POPIA notification duties, we will notify the Information Regulator and affected people as required.
9. Messages and marketing
Account, invitation, billing and requested tender messages support your use of the service. Promotional messages require an appropriate separate legal basis.
You can object to direct marketing or withdraw marketing consent by emailing contact@tenderdirect.co.za or using an available unsubscribe link. Essential account and billing communications may continue while relevant.
10. Your rights and complaints
You can ask whether we hold your personal information, request access or correction, request deletion where applicable, object to eligible processing and withdraw consent for future consent-based use. These rights are subject to applicable legal requirements and limitations.
Send requests to contact@tenderdirect.co.za. We may need to verify your identity or authority. Do not send identity documents until we have agreed an appropriate verification method.
You may also complain directly to the Information Regulator, including through its eServices portal.
11. Changes to this policy
We will update the date on this page when this policy changes and provide additional notice where appropriate. A policy update does not replace consent or another legal step required for a new use of information.