TenderWise Privacy Policy

Effective date: 2025-08-20 | Last updated: 2026-06-25

TenderWise ("TenderWise", "we", "us", "our") is committed to protecting the privacy and personal information of our users. This Privacy Policy describes the personal information we collect, why we collect it, how we use it, with whom we share it, and the choices and rights you have regarding your information.

We process personal information in compliance with the Protection of Personal Information Act 4 of 2013 ("POPIA"), the Electronic Communications and Transactions Act 25 of 2002 ("ECTA"), and other applicable data protection laws. If you are located outside South Africa, additional protections may apply under the laws of your jurisdiction.

1. Responsible party (controller)

TenderWise (Pty) Ltd is the responsible party (data controller) for personal information collected via this website and our services. Our registered office is in South Africa.

Data protection enquiries: privacy@tenderwise.co.za

2. Definitions and interpretation

In this policy:

  • "Personal information" means information relating to an identifiable, living, natural person or an identifiable, existing juristic person, as defined in POPIA.
  • "Processing" means any operation or activity concerning personal information, including collection, receipt, recording, organisation, storage, updating, modification, retrieval, dissemination, and deletion.
  • "User", "you", "your" means any individual or entity who accesses or uses the TenderWise platform.
  • "Service" means the TenderWise tender discovery, document management, alert, and AI-summary platform.

3. Personal information we collect

We may collect the following categories of personal information:

  • Identity and account data: full name, email address, phone number, company name, company registration number, VAT number, B-BBEE level, physical and postal addresses, and proof of identity documents.
  • Profile and preference data: industry sectors, categories of interest, saved searches, notification preferences, dashboard customisations, and communication preferences.
  • Tender-related data: tenders you view, save, shortlist, or apply for; documents you upload in connection with tender applications including company profiles, CIDB grading, tax clearance certificates, and other tender submission documents.
  • Payment and billing data: billing contact name and email, invoicing address, and payment transaction records. We do not store full credit card numbers; payment processing is handled by our third-party payment processors (Yoco, PayFast, or similar).
  • Usage and device data: IP address, browser type and version, operating system, device type, referral source, pages visited, time and date of access, time spent on pages, and other diagnostic data collected via analytics tools.
  • Communications data: records of correspondence when you contact us via email, in-app chat, or other channels, including support tickets, enquiries, and complaints.
  • Marketing and communications data: your preferences in receiving marketing from us and third parties, and your communication preferences.

4. How we collect personal information

We collect personal information in the following ways:

  • Directly from you: when you register an account, complete your profile, upload documents, subscribe to a plan, contact support, or respond to surveys.
  • Automatically: through cookies, web beacons, and similar tracking technologies when you interact with our platform (see section 13 on cookies).
  • From third parties: payment processors (transaction confirmations), referral partners, and publicly available sources including government tender portals.

5. Purposes and legal bases for processing

We process personal information for the following purposes and on the following legal bases:

  • Providing and improving the service — to create and manage your account, display relevant tenders, generate AI summaries, and personalise your experience. (Legal basis: performance of a contract; legitimate interest.)
  • Processing payments and subscriptions — to bill you for paid plans, manage renewals, cancellations, and refunds. (Legal basis: contractual necessity.)
  • Sending notifications and communications — to send tender alerts, platform updates, account-related notices, and (with your consent) marketing communications. (Legal basis: consent; performance of a contract; legitimate interest.)
  • Customer support — to respond to your enquiries, resolve issues, and provide technical assistance. (Legal basis: performance of a contract; legitimate interest.)
  • Compliance and fraud prevention — to detect, prevent, and address fraudulent, unauthorised, or illegal activity; to comply with legal and regulatory obligations. (Legal basis: legal obligation; legitimate interest.)
  • Analytics and service optimisation — to analyse usage trends, measure performance, and improve the platform. Data is minimised and aggregated where possible. (Legal basis: legitimate interest.)
  • Business operations — for record-keeping, accounting, auditing, insurance, and business planning purposes. (Legal basis: legal obligation; legitimate interest.)

6. Sharing and disclosure to third parties

We may share personal information with the following categories of recipients:

  • Service providers and processors: third-party vendors who process data on our behalf under written contract, including cloud hosting providers (Supabase, Vercel), email delivery services (Resend), payment processors (Yoco, PayFast), analytics providers, and AI summarisation services. These providers are contractually bound to process data only for the purposes we specify and to implement adequate security measures.
  • Professional partners: where you explicitly request collaboration with tender specialists, consultants, or application assisters, we will share relevant information with your prior consent.
  • Regulatory and law enforcement: we may disclose personal information to courts, law enforcement agencies, regulatory bodies (including the South African Information Regulator), or other government entities where required by law, in response to a valid legal process (subpoena, court order, or similar), or to protect our rights, property, or safety.
  • Corporate transactions: in the event of a merger, acquisition, restructuring, or sale of assets, personal information may be transferred to the relevant third party, subject to appropriate confidentiality arrangements.

7. International data transfers

Your personal information may be transferred to, and processed in, countries outside South Africa where our service providers operate (including the United States and the European Economic Area). Where we transfer personal information across borders, we ensure appropriate safeguards are in place, including:

  • Standard contractual clauses approved by the South African Information Regulator or equivalent supervisory authority.
  • Ensuring the recipient is subject to adequate data protection laws substantially similar to POPIA.
  • Written agreements requiring the recipient to maintain equivalent security measures.

You may request a copy of the relevant safeguard mechanisms by contacting us at privacy@tenderwise.co.za.

8. Retention of personal information

We retain personal information only as long as necessary for the purposes for which it was collected, or as required by applicable law. Specific retention periods:

  • Account data: retained while your account is active and for a reasonable period thereafter (generally 12 months after account closure) to comply with legal obligations, resolve disputes, and enforce agreements.
  • Transaction and billing data: retained for 5 years after the financial year-end in which the transaction occurred, as required by South African tax law.
  • Tender documents and uploaded content: retained as long as your account is active, and deleted within 90 days of account closure unless retention is required for ongoing tender processes.
  • Communications and support records: retained for 3 years from the date of last contact.
  • Usage and analytics data: retained in aggregated or anonymised form for up to 3 years.

When we no longer need personal information, we will securely delete, destroy, or de-identify it.

9. Security measures

We implement appropriate technical and organisational security measures to protect personal information against loss, unlawful access, interference, modification, and disclosure, including:

  • Encryption of data in transit (TLS 1.2+) and at rest (AES-256).
  • Role-based access controls restricting data access to authorised personnel only.
  • Multi-factor authentication for administrative access.
  • Regular security assessments, vulnerability scanning, and penetration testing.
  • Written security policies, incident response plans, and staff training on data protection.
  • Contractual data protection obligations imposed on all third-party processors.

While we take reasonable steps to secure personal information, no method of electronic storage or transmission is completely secure. We cannot guarantee absolute security.

10. Data breaches

In the event of a security breach that results in unauthorised access to, or disclosure of, personal information that is likely to cause material harm or be significant, we will:

  • Notify the South African Information Regulator as soon as reasonably possible.
  • Notify affected data subjects where required by POPIA.
  • Take reasonable steps to contain, assess, and remediate the breach.

11. Your rights as a data subject

Under POPIA and applicable data protection laws, you have the following rights, subject to legal limitations and exceptions:

  • Right of access: you may request confirmation of whether we hold personal information about you, and request a copy of that information along with details of how it is processed.
  • Right to rectification: you may request correction of inaccurate or incomplete personal information.
  • Right to erasure (deletion): you may request deletion of your personal information where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies.
  • Right to restriction: you may request that we restrict processing of your personal information in certain circumstances (e.g., while a correction request is pending).
  • Right to object: you may object to the processing of your personal information for direct marketing purposes at any time, or on grounds relating to your particular situation where processing is based on legitimate interest.
  • Right to data portability: where technically feasible and where processing is based on consent or contract and carried out by automated means, you may request your personal information in a structured, commonly used, machine-readable format.
  • Right to withdraw consent: where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact privacy@tenderwise.co.za. We will verify your identity and respond to your request within 30 days as required by POPIA. If we cannot fulfil your request, we will provide reasons in writing.

12. Automated decision-making and AI summaries

TenderWise uses artificial intelligence and automated processes to generate tender summaries, extract key dates and requirements, and provide recommendations. These AI-generated outputs are provided as supplementary tools and do not constitute professional or legal advice. You should always verify AI-generated summaries against the original tender documentation.

Where automated decision-making produces legal effects concerning you or similarly significantly affects you, we will implement appropriate safeguards including the right to obtain human intervention, express your point of view, and contest the decision.

13. Cookies and tracking technologies

We use cookies, web beacons, and similar tracking technologies to enhance your experience, analyse usage, and deliver relevant content. The types of cookies we use include:

  • Essential cookies: required for the platform to function (e.g., session management, authentication). These cannot be disabled.
  • Analytics cookies: to understand how users interact with the platform, measure performance, and improve our service (e.g., Vercel Analytics).
  • Functional cookies: to remember your preferences and personalisation settings.
  • Advertising and marketing cookies: used only with your consent to deliver relevant advertisements and measure campaign effectiveness.

You can manage cookie preferences through your browser settings. Disabling certain cookies may affect platform functionality. Where required by law, we obtain your consent before placing non-essential cookies.

14. Direct marketing

We may send you direct marketing communications about our products, features, and special offers where you have provided your consent or where we have a legitimate interest. You may opt out of marketing communications at any time by:

  • Clicking the "unsubscribe" link in any marketing email.
  • Updating your communication preferences in your account settings.
  • Contacting us at privacy@tenderwise.co.za.

We will continue to send transactional and account-related communications (e.g., payment receipts, password resets, service notices) even after you opt out of marketing.

15. Third-party links and services

Our platform may contain links to third-party websites, tender portals, or services. This Privacy Policy does not apply to those third parties. We are not responsible for the privacy practices of third parties and encourage you to review their privacy policies before providing personal information.

16. Children's privacy

Our services are intended for businesses, professionals, and adults. We do not knowingly collect personal information from children under the age of 13. If we become aware that a child under 13 has provided us with personal information, we will take steps to delete it promptly. If you believe we may have collected information from a child under 13, please contact us immediately.

17. Complaints and disputes

If you believe we have processed your personal information in a manner that contravenes POPIA or other applicable laws, please contact us at privacy@tenderwise.co.za. We will investigate your complaint and respond within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the South African Information Regulator:

Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Email: enquiries@inforegulator.org.za
Website: https://www.justice.gov.za/inforeg/
Helpline: 010 023 5207

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational requirements. We will post the updated policy on this page with a revised "Last updated" date. For material changes, we will provide prominent notice, including by email notification where appropriate.

We encourage you to review this policy periodically. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.

19. Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Information Officer:

Email: privacy@tenderwise.co.za
Response time: We aim to respond to all enquiries within 5 business days and to data subject requests within 30 calendar days as required by POPIA.

This policy is drafted to align with POPIA and general best practices but does not constitute legal advice. For full legal compliance tailored to your organisation's circumstances, consult qualified South African legal counsel.

Privacy Policy — TenderWise | TenderWise