Privacy policy

1. Who is responsible for your data

The operator of TenderAfrica.org is the data controller for account and usage data, and a data processor for the client documents and bid records your organization stores in the Service. Each organization workspace is the controller of the personal data it uploads and is responsible for having a lawful basis to do so. Contact: privacy@tenderafrica.org.

2. What we collect

• Account and identity: name, work email, phone number where provided, organization, role, authentication state, multi-factor authentication status.
• Workspace activity: tenders viewed or saved, bids, tasks, notes, approvals, outcomes, audit events and notification preferences.
• Documents you upload: company documents, certificates, CVs and tender-related files, including metadata needed to classify, version and track expiry. Some of this may include personal data (for example named directors or personnel CVs).
• Payments: plan, invoices and payment status. Card and mobile-money details are processed by the payment gateway; we do not store full payment instrument details.
• Technical data: IP address, session identifiers, browser and device information, and security logs needed to protect the Service.

3. Why we use it and our lawful bases

• Contract: create and secure your account, provide the subscribed features, deliver fixed-fee services and process payments.
• Legitimate interests: keep the Service reliable and secure, improve ranking and data quality, and produce aggregate (de-identified) product analytics.
• Consent: marketing emails or optional channels such as WhatsApp/SMS where consent is required; you can withdraw at any time.
• Legal obligation: tax, accounting, record-keeping and lawful requests, and to enforce our terms.

We do not use client documents to train third-party AI models outside our approved processing terms. AI-assisted features are labelled, and material findings that affect a bid decision are subject to human review.

4. Who we share data with

We share personal data only with service providers that help us run the Service (hosting, storage, email/SMS delivery, payments, analytics) under written terms that require confidentiality and security, and where required with regulators, courts or law enforcement. We do not sell personal data and we do not share your organization's documents with other clients.

Source data and tender records contain publicly published procurement information and are processed under the source's terms. Where a source requires link-out only, we link rather than store.

5. Cross-border processing

Some providers process data outside Tanzania. Where that happens, we use contractual safeguards and rely on an approved transfer route under applicable law; the details are available on request.

6. How long we keep data

• Account and workspace data: for the life of the account, then for a short grace period before deletion.
• Bid and approval records: retained for the period needed to evidence statutory and contractual obligations (currently up to seven years), then archived or deleted.
• Tender and source records: retained according to source terms and our data-quality needs; closed tenders remain visible for reference for a limited period.
• Audit and security logs: retained for security and audit purposes, minimised to what is necessary.

7. Security

We use encrypted transport, hashed passwords, session controls, role-based access, audit trails and short-lived signed links for document downloads. Access by our staff is limited, logged and, for client workspaces, delivered under engagement-scoped access rather than blanket permissions. No system is perfectly secure; if a breach affects you, we will notify you and the PDPC as required by law.

8. Your rights

Subject to applicable law, you may request access to your personal data, correction of inaccurate data, deletion, restriction of processing, portability, and object to certain processing. Where processing relies on consent, you may withdraw it at any time. Requests from users should normally go through your organization's workspace owner, who can exercise them on behalf of the organization. We respond within the period required by law.

9. Cookies and local storage

We use strictly necessary cookies for session and security (for example the session cookie and CSRF token). We do not use advertising cookies. Optional analytics are minimised and, where required, subject to consent.

10. Children

The Service is for businesses and professional users and is not intended for children.

11. Changes and complaints

We may update this policy; material changes will be communicated in the product or by email. If you are not satisfied with our response, you may complain to the Personal Data Protection Commission of Tanzania. Questions and requests: privacy@tenderafrica.org.

Related: Terms of service · Help centre.