Privacy notice.

Effective May 2026 · POPIA-compliant · Issued by TenderPack (Pty) Ltd

1. Who we are

TenderPack is operated by TenderPack (Pty) Ltd, a South African company registered with the CIPC. We're the Responsible Party under the Protection of Personal Information Act, 2013 (POPIA). Our Information Officer is registered with the Information Regulator at inforegulator.org.za.

2. What we collect

Three buckets:

• Account data. Your name, email address, company name, and Google profile fields if you sign in with Google. We need these to authenticate you.
• Tender data. The RFP PDFs you upload, the company profile fields you fill in (CSD number, CIDB grade, B-BBEE level, references, case studies), and the submission packs we generate. This is yours.
• Usage data. Anonymous logs (page views, error reports, pipeline timings). Used to fix bugs and improve speed. No personal identifiers attached.

3. What we do NOT do

• We do not sell your data. Not to anyone. Ever.
• We do not train AI models on the contents of your RFPs or your packs.
• We do not share your data with other TenderPack customers.
• We do not display your tender submissions in marketing material without explicit, written consent.

4. Where your data lives

Servers physically located in Cape Town, South Africa (Supabase Africa region). Backups encrypted at rest. POPIA-compliant by design, with no cross-border data transfer for primary storage. Limited transit through Anthropic's API (US) is necessary for the AI pipeline, and is subject to Anthropic's data processing terms which prohibit training on customer data.

5. How long we keep it

• Account data: while your account is active, plus 30 days after cancellation.
• Tender packs: indefinitely while your account is active. You can delete any pack at any time. After cancellation, all data is permanently deleted within 30 days unless you re-activate.
• Audit logs: 12 months, for security and compliance.

6. Your rights under POPIA

You have the right to:

1. Access the personal information we hold about you.
2. Correct or update it.
3. Delete it (right to be forgotten).
4. Export it in a portable format (a single ZIP archive) at any time.
5. Object to processing for direct marketing.
6. Lodge a complaint with the Information Regulator.

To exercise any of these, email support@tenderpack.co.za. We respond within 5 business days.

7. Cookies and tracking

We use a small number of strictly-necessary cookies for authentication and session management. We do not use third-party advertising cookies. We use anonymous, aggregate analytics (page views, error rates). No individual user tracking, no cross-site fingerprinting.

8. Children

TenderPack is not intended for users under 18. We do not knowingly collect data from minors. If you believe a minor has signed up, contact us and we will delete the account.

9. Changes to this notice

When we update this notice, we will email all active account holders at least 14 days before the change takes effect. If you disagree with a change, you can cancel and export your data before the effective date with no penalty.