Privacy Policy

Last updated: 8 May 2026

1. Who we are

TenderSearch SA ("we", "us", "our") operates the website at www.tendersearch.co.za and the related tender intelligence service. We are the responsible party under the Protection of Personal Information Act, 2013 (POPIA). You can reach us at info@tendersearch.co.za.

2. What we collect

Account data: name, email address, hashed password, company name (optional).
Subscription data: chosen plan, billing status, invoice history.
Payment data: processed by PayFast. We never see or store your card number — PayFast returns a token and a transaction reference only.
Usage data: tenders saved, alert keywords, search filters used, login timestamps and the device / IP address used to log in (kept for security).
Technical data: IP address, browser type, referring URL and cookies set by us or by Cloudflare for security and basic analytics.
Communications: messages you send via the contact form or by email.

3. Why we collect it (lawful basis)

To provide the service you signed up for (contractual necessity).
To bill you and keep tax-compliant records (legal obligation).
To send you tender alerts and service emails you requested.
To detect abuse, scraping and fraud, and to keep the service secure (legitimate interest).
To answer your support questions.

We do not sell your personal information. We do not use your data to train any AI model.

4. Who we share data with

We use a small number of operators (third-party processors) to run the service:

PayFast — card payments and subscription billing (South Africa).
GoDaddy / SMTP — sending transactional and alert emails.
Cloudflare — DDoS protection, bot mitigation and CDN.
Replit / hosting provider — application and database hosting.
Google — if we run advertising or analytics, Google may set cookies for ad personalisation and measurement.

We may also disclose information when required by South African law, by a court order, or to protect the rights, property or safety of TenderSearch SA, our users or the public.

5. Cookies and tracking

We use a small number of cookies: a session cookie to keep you logged in, a CSRF cookie for form security, and Cloudflare's security cookies. If we run Google Ads or analytics, those services will set their own cookies for measurement and remarketing. You can clear or block cookies in your browser at any time, but the site will not work properly without the session cookie.

6. How long we keep it

Account data: while your account is active, plus 12 months after you close it.
Invoices and payment records: 5 years (SARS / Companies Act requirement).
Server access logs and security logs: up to 90 days.
Webhook and admin audit logs: up to 12 months.

7. Where your data lives

Our database is hosted on infrastructure that may store data outside South Africa. Where data leaves the country, we rely on providers that offer comparable protection to POPIA (for example, contractual safeguards with the operator).

8. Your rights under POPIA

You have the right to:

Ask what personal information we hold about you.
Ask us to correct it if it is wrong.
Ask us to delete it (subject to invoice retention obligations).
Object to processing for direct marketing.
Lodge a complaint with the Information Regulator at inforegulator.org.za.

To exercise any of these rights, email info@tendersearch.co.za from the email address on your account.

9. Security

Passwords are hashed with scrypt and never stored in plain text. All traffic to and from the site is encrypted with TLS. Sessions are bound to a device and capped at 4 active sessions per account. We log admin actions and webhook events for audit purposes.

10. Children

The service is intended for businesses and adults procuring on behalf of businesses. We do not knowingly collect data from anyone under 18.

11. Changes to this policy

If we make material changes we will email account holders and update the "Last updated" date at the top of this page. Continued use of the service after a change means you accept the new policy.