Privacy Notice

1. Information we collect

• Account information: name, email address, login identifiers, organisation details and account settings.
• Workspace content: tender details, documents, plans, BOQs, takeoffs, estimates, supplier evidence, locations, notes and support messages.
• Usage and technical data: feature interactions, timestamps, device and browser information, IP address, logs, diagnostics and security events.
• Communications: questions, feedback, support requests and related correspondence.

Paddle separately collects and processes payment and billing information for purchases as Merchant of Record. We do not need to collect full card details through TenderPro SA.

2. Why we use information

• To create accounts, authenticate users and provide the contracted platform service.
• To store and process workspace content, calculate rates, generate outputs and provide support.
• To operate subscriptions, apply plan limits and coordinate billing status with Paddle.
• To protect accounts, prevent fraud and misuse, investigate incidents and maintain service reliability.
• To analyse and improve performance, usability and features.
• To meet legal, accounting, regulatory and dispute-resolution obligations.
• To send service communications and, where permitted or consented to, marketing communications.

3. Legal bases

We process information where necessary to perform our contract with you; pursue legitimate interests such as securing and improving TenderPro SA; comply with legal obligations; or act with your consent where consent is required. You may withdraw consent at any time without affecting earlier lawful processing.

4. Who receives information

We may share relevant information with:

• Hosting, storage, authentication, analytics, AI-processing, communications and support service providers acting for us.
• Paddle, our Merchant of Record, for product sales, subscription management, payments, tax compliance, invoicing, customer-service inquiries and returns.
• Professional advisers such as legal, accounting, insurance and audit providers.
• Courts, regulators, law-enforcement bodies or other authorities where required by law or needed to protect legal rights.
• A buyer, investor or successor in a genuine restructuring, financing, merger or sale, subject to appropriate confidentiality protections.

We do not sell personal information for money.

5. International transfers

Some service providers may process information outside South Africa, the United Kingdom or the European Economic Area. Where required, we use appropriate safeguards such as adequacy decisions, contractual protections including standard contractual clauses, and supplier security reviews.

6. Retention

We retain account and workspace information while your account is active and thereafter only as long as reasonably needed to provide records, resolve disputes, enforce agreements and meet legal, tax, accounting and security obligations. Retention periods depend on the information and its purpose. When information is no longer needed, it is deleted or anonymised.

7. Security

We use appropriate technical and organisational safeguards designed to protect personal information, including access controls, account-scoped storage, encryption in transit, service monitoring and restricted administrative access. No online service can guarantee absolute security, so you should use a strong password and protect your account credentials.

8. Cookies and similar technology

TenderPro SA uses essential browser storage and cookies needed for sign-in, security, session continuity, preferences and payment checkout. The platform does not currently use marketing cookies. You can manage browser storage through your browser settings, although blocking essential storage may prevent sign-in or core features from working.

9. Your rights

Subject to applicable law, including South Africa’s Protection of Personal Information Act, you may ask to access, correct or delete personal information; object to or restrict certain processing; and complain to the Information Regulator. Where the UK GDPR or EU GDPR applies, you may also request portability, withdraw consent, and lodge a complaint with your local supervisory authority. We aim to respond within one month where that timeframe applies, although lawful extensions may be available for complex requests.

Submit a privacy request using the contact method made available with the service. We may need to verify your identity before acting on a request.

10. Changes and contact

We may update this notice to reflect changes in the platform, providers or law. The latest version and date will remain available here. Questions, complaints or privacy requests may be sent to PNP AIIIH (Pty) Ltd using the contact method made available with the service.