Tender-Dude
Sign in Get started
Legal

Privacy Notice

Last updated: 2026-10-27.

1. Who we are

SupamanPro (Pty) Ltd, registration number [[TO BE INSERTED: company registration number]], trading as Tender-Dude, is the Responsible Party for your personal information under the Protection of Personal Information Act 4 of 2013 (POPIA).

Information Officer: [[TO BE INSERTED: Information Officer full name]], [[TO BE INSERTED: Information Officer email address]]. Registered with the Information Regulator: [[TO BE INSERTED: Information Regulator registration reference number]].

Our offices: [[TO BE INSERTED: registered physical address, South Africa]].

2. What personal information we collect

On the marketing website (tenderdude.co.za): Nothing. The marketing website does not use cookies and does not run analytics. No personal information is collected while you browse.

In the signed-in app:

  • Your name and work email address (used to create and identify your account).
  • Your workspace name (the trading name or business name you register under).
  • Company documents you upload: tax clearances, B-BBEE certificates, registration documents, tender responses, and any other files you choose to add.
  • Bid packs you build inside the app.
  • Usage events: which screens you visit, actions you take (such as running a tender match or downloading a bid), and timestamps. We use this to understand how the product is used and to detect abuse.

3. Why we process it

We process your personal information to:

  • Create and manage your account and deliver the Tender-Dude service you signed up for.
  • Scan uploaded files for malware and keep the platform safe.
  • Send you service emails about your bids, account status, and any material changes to these policies.
  • Detect fraud and abuse on the platform.
  • Improve the product, using aggregated and anonymised usage data where possible.

We do not use your information for unsolicited marketing without your explicit consent.

4. Lawful basis

We rely on the following lawful grounds under POPIA:

  • Contract: processing your account details and documents is necessary to deliver the service you signed up for.
  • Legitimate interest: fraud prevention, abuse detection, and platform security, where those interests do not override your rights.
  • Consent: for anything optional (such as optional marketing communications). You can withdraw consent at any time.

5. Who we share it with

We do not share your personal information outside South Africa, and we do not sell it.

The people and organisations who may access your information are:

  • Our hosting provider — Host Africa and/or Hetzner JHB, both operating within South Africa, who provide the servers your data lives on.
  • Payment processor — Paystack, once billing is enabled. We share only the transaction fields Paystack needs to process a payment. Paystack is a PCI-DSS-certified processor; we do not store your full card details.
  • Buyer institutions — if you click "Send" to submit a bid pack to a buying organisation, we transmit your bid pack to that organisation on your instruction only.
  • Law enforcement or regulators — if we are legally required to disclose information by a valid court order or regulatory requirement.

6. AI and third-party processors

Documents you upload are read on the Tender-Dude server. They are not sent to an outside AI service. Any text extraction, matching, or bid-fill processing happens on our own infrastructure.

7. How long we keep it

  • While your account is open, we keep everything you have uploaded.
  • After you close your account, we keep your data for 30 days to allow for recovery if you change your mind.
  • Financial records (transaction logs, invoices) are kept for up to 7 years in line with South African tax law.
  • After those periods, data is deleted or irreversibly anonymised.

8. Your POPIA rights

Under POPIA you have the right to:

  • Access — request a copy of the personal information we hold about you.
  • Correction — ask us to correct inaccurate or out-of-date information.
  • Deletion — ask us to delete your personal information, subject to any legal retention obligations.
  • Objection — object to us processing your information on legitimate-interest grounds.
  • Complaint — lodge a complaint with us if you believe we have mishandled your information.

To exercise any of these rights, email hello@tenderdude.co.za. We will respond within 30 days.

9. Right to complain to the Information Regulator

If you are not satisfied with our response, you may lodge a complaint with the Information Regulator of South Africa:

10. Security

We take reasonable technical and organisational measures to protect your information:

  • Passwords are hashed using Argon2 — we cannot see your password.
  • Data in transit is protected with TLS 1.2 or higher.
  • Backups are encrypted and stored off-site.
  • Access to personal data is restricted to staff who need it to do their job.

No system is completely secure. If we become aware of a breach that affects your personal information, we will notify you and the Information Regulator within 72 hours as required by POPIA.

11. Children

Tender-Dude is not for people under 18. If we discover that a person under 18 has created an account, we will close it and delete the associated data.

12. Changes to this notice

If we make a material change to this privacy notice, we will send you an email at least 14 days before the change takes effect. The updated notice will always be available at tenderdude.co.za/privacy/.

13. Contact

Privacy questions? Email us at hello@tenderdude.co.za.