Tenderhub

Privacy policy

Draft. This text is awaiting legal review and may change.

Last updated [EFFECTIVE DATE]

1. Who we are

Tenderhub Africa is an online service for running requests for quotations and tenders. It is operated by [COMPANY LEGAL NAME], a company registered in Kenya under number [REGISTRATION NUMBER], whose registered address is [REGISTERED ADDRESS]. In this policy, “we”, “us” and “our” mean that company.

You can reach us about this policy at [CONTACT EMAIL]. Our contact for data protection matters is [DATA PROTECTION CONTACT].

We handle personal data in line with Kenya’s Data Protection Act, 2019. Our registration with the Office of the Data Protection Commissioner (ODPC): [ODPC REGISTRATION NUMBER, IF ANY].

2. What this policy covers

This policy covers the Tenderhub Africa website and portal, and the emails the service sends. It explains what personal data we hold, why, who can see it, and what you can ask us to do with it.

The service is used by two kinds of company. A buyer is a company that asks for prices on materials, goods or services. A supplier is a company that bids. Buyers invite their own suppliers; bidding is never open to the public.

Much of the data on the service, such as requests, bids, tender documents and messages, is put there by buyers and suppliers for their own purposes. We process that data on behalf of the buyer and supplier who use the service, to run the service for them. For account data, security and our own records, we decide how the data is used. [NOTE FOR LEGAL REVIEW: CONFIRM THE CONTROLLER AND PROCESSOR POSITION FOR EACH CATEGORY OF DATA.]

3. Information we collect

We collect only what the service needs to work:

  • Account details: your name, email address, password (stored only as a one-way hash, never readable), the companies you belong to and your role in each (owner, buyer or viewer on the buyer side), and your preferences, such as time zone and light or dark display.
  • Company details: the company name, KRA PIN, contact person, email, phone, town and address, and for a buyer its currencies and time zone. A buyer may also tag its suppliers with categories of its own.
  • Request and bid content: requests, line items, quantities, deadlines and terms written by buyers; and prices, lead times, validity, payment and delivery terms and notes entered by suppliers, including every submitted version of a bid.
  • Tender forms and documents: answers to a buyer’s questions and uploaded files. These often include statutory documents such as KRA PIN certificates, tax compliance certificates, certificates of incorporation and CR12 forms, insurance certificates, company profiles, references and CVs of key personnel.
  • Evaluation and award records: a buyer’s scores, verdicts and reasons, counter-offers and the answers to them, awards, and award agreements with their PDF copies and attachments such as purchase orders.
  • Messages: messages between a buyer and a supplier about a request, clarifications a buyer sends to all bidders, and files attached to them.
  • Technical data: server logs that record requests to the service, including IP address, time, the address requested and browser details, and a record of the emails we send.
  • Cookies: described in the “Cookies” section below.

Uploaded documents may contain personal data about people other than the person uploading them, for example staff named in a CV, directors named in a CR12, or referees. If you upload such a document, you are responsible for having the right to share it for the tender.

4. How we use it

We use personal data to:

  • create and secure accounts, sign you in, and send invitation and password reset links;
  • run requests, stages, auctions, bids, counter-offers, messages and awards as the buyer and supplier set them up;
  • send the service’s emails, such as invitations, new bid notices, stage outcomes, auction notices, counter-offer notices, award results and agreements;
  • keep the service working and secure, investigate faults and misuse, and restore data after a failure;
  • meet our legal obligations and deal with disputes.

We rely on these lawful bases: performing the contract with the buyer or supplier company you use the service for; our legitimate interest in running a secure and reliable service; compliance with legal obligations; and, where the law requires it, consent. [NOTE FOR LEGAL REVIEW: CONFIRM THE LAWFUL BASIS FOR EACH USE.]

We do not use your data for advertising, we do not build marketing profiles, and we do not make decisions about you by automated means. Awards and eliminations are decided by the buyer, not by the service.

5. Who can see what

Confidentiality between bidders is the heart of the service. In plain words:

  • Each buyer company’s data is kept separate from every other company’s. One buyer never sees another buyer’s requests, suppliers or bids.
  • Sealed bids. A buyer cannot see any bid price until the bidding deadline has passed or the buyer closes bidding early. Until then the buyer sees only which suppliers have submitted and how many times, never an amount.
  • Tender stages. On a tender with several stages, the buyer reads a stage’s answers and documents only after that stage has closed, and only what a supplier actually submitted, never a draft.
  • Competing bids. On a request the buyer has marked as open to comparison, a supplier who has submitted a bid can see the other live bids with the bidders’ names hidden, labelled “Bidder A”, “Bidder B” and so on: their prices per line, totals, lead times and rank. They never see another bidder’s name, validity, notes or terms. On invitation-only requests, suppliers see no other bids at all.
  • Auctions. During a live auction a supplier sees their own rank, and the best total only if the buyer chose to show it, never another bidder’s name. The buyer sees bidders by label while the auction runs and by name once it ends.
  • Messages between a buyer and a supplier are private to those two companies. When a buyer answers a question for everyone, the clarification goes to all bidders without saying who asked.
  • Counter-offers are private between the buyer and the one supplier concerned.
  • Award emails to suppliers who did not win never name the winner.
  • A supplier’s company details are visible to each buyer that has invited that supplier. The categories a buyer uses to tag its suppliers are seen only by that buyer.
  • Within a company, what a person can do depends on the role the company gave them.

Our own staff can reach data held on the service only where that is needed to run, support or secure it. [NOTE FOR LEGAL REVIEW: CONFIRM THE STAFF ACCESS POLICY.]

6. Who we share it with

We do not sell personal data, and we do not share it with advertisers.

We use these service providers, who handle data only on our instructions:

  • DigitalOcean, which hosts the servers, database, uploaded files and backups;
  • [EMAIL PROVIDER], which delivers the service’s emails.

We may also disclose data where the law requires it, for example to comply with a court order or a lawful request from a public authority, or to protect the rights and safety of our users or of the service. [NOTE FOR LEGAL REVIEW: CONFIRM DISCLOSURE WORDING.]

7. Where your data is stored

The service is hosted on DigitalOcean servers in Frankfurt, Germany, in the European Union. Using the service therefore involves transferring personal data out of Kenya.

We make these transfers under the safeguards the Data Protection Act, 2019 allows for transfers outside Kenya. Germany is subject to the EU General Data Protection Regulation. [NOTE FOR LEGAL REVIEW: STATE THE SAFEGUARD RELIED ON FOR THE TRANSFER.]

8. How long we keep it

We keep data for as long as the service needs it and the law requires. Our current periods:

  • Accounts and company details: while the account is active, then [RETENTION PERIOD FOR ACCOUNT DATA].
  • Requests, bids, tender documents, messages and awards: [RETENTION PERIOD FOR TENDER RECORDS].
  • Server logs: [RETENTION PERIOD FOR LOGS].
  • Records of emails sent: [RETENTION PERIOD FOR EMAIL RECORDS].
  • Nightly backups of the database and uploaded files: [RETENTION PERIOD FOR BACKUPS].

Some records are kept unchanged by design, because buyers and suppliers rely on them as evidence of what happened: every submitted version of a bid, submitted tender forms and their documents, award agreements, and the log of stage decisions. A removed file is taken off the request but kept with the records it formed part of.

9. How we protect it

The measures we take include:

  • encrypted connections (HTTPS) between your browser and the service;
  • passwords stored only as a strong one-way hash, and sign-in links that expire and are stored only in hashed form;
  • separation of each buyer company’s data enforced in the database itself, not only in the application;
  • access within a company limited by role, and bid prices kept sealed by the server until the rules above allow them to be read;
  • uploaded files checked by their content rather than their name, and always delivered as downloads;
  • nightly backups of the database and uploaded files.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the ODPC as the law requires.

10. Cookies

The service uses only these cookies:

  • th_access and th_refresh: keep you signed in. They cannot be read by scripts in the page and are removed when you sign out. The first lasts up to an hour and the second up to 30 days.
  • th_theme: remembers whether you chose the light, dark or system display. It lasts up to a year and holds nothing else.

We use no advertising, analytics or tracking cookies or scripts, and no third-party tracking.

11. Your rights

Under the Data Protection Act, 2019 you have the right to:

  • be told how your personal data is used, as this policy does;
  • have access to the personal data we hold about you;
  • have inaccurate or misleading data corrected;
  • have data deleted where there is no longer a reason to keep it;
  • object to our use of your data;
  • receive your data in a portable form;
  • complain to the Office of the Data Protection Commissioner.

You can correct your own name, preferences and company details in the portal. For anything else, write to [DATA PROTECTION CONTACT]. We will reply within [RESPONSE PERIOD FOR REQUESTS].

Where the data is part of a buyer’s tender records, we may need to pass your request to that buyer, and some records cannot be changed or deleted, as explained under “How long we keep it”. We will tell you what we can do and why.

12. Children

Tenderhub Africa is a service for businesses. It is not meant for anyone under 18, and we do not knowingly collect data about children.

13. Changes to this policy

We may update this policy as the service changes. The date at the top shows the latest version. If a change is significant, we will tell account holders by email or in the portal before it takes effect.

14. Contact

[COMPANY LEGAL NAME], [REGISTERED ADDRESS]. Email: [CONTACT EMAIL]. Data protection: [DATA PROTECTION CONTACT].

If you are not satisfied with our answer, you can complain to the Office of the Data Protection Commissioner.

Privacy policy · Tenderhub Africa