Tenderfy

Legal

Privacy Notice

Last updated: 24 June 2026

1. Who we are

Tenderfy ("Tenderfy", "we", "us", "our") is operated by Round Out (Pty) Ltd, a company registered in South Africa, trading as Tenderfy ("the Service"). Round Out (Pty) Ltd is the data controller of personal data processed through the Service.

2. Categories of personal data we collect

  • Account & profile data — name, email address, password (hashed), company name, role, and other profile details you provide.
  • Company & supplier data — registration numbers, BBBEE / CIDB levels, certifications, contact details and supporting compliance documents you upload.
  • Tender activity data — tenders you view, mark as intended, submit through Tenderfy, and the submission packs and cover notes you upload.
  • Support & communications — messages you send us, notification preferences, and email engagement.
  • Usage & device data — IP address, browser type, device identifiers, pages visited, timestamps and other telemetry.
  • Cookies & similar technologies — strictly necessary cookies for authentication and session management.

Payment card data is collected and processed directly by Paddle, our Merchant of Record (see Section 5). We do not see or store your full card details.

3. Why we use your data (purposes & legal bases)

  • Provide the Service — creating your account, matching you to tenders, generating readiness analysis, and processing submissions (contract performance).
  • Billing & subscription management — sharing necessary data with Paddle to charge, invoice and renew your plan (contract performance and legal obligation).
  • Security & fraud prevention — protecting accounts, detecting abuse and securing the platform (legitimate interests).
  • Customer support — responding to your queries and reviewing submission packs forwarded on your behalf (contract performance).
  • Service improvement & analytics — understanding feature usage to improve Tenderfy (legitimate interests).
  • Marketing communications — only with your consent, and you may opt out at any time.
  • Legal & regulatory — complying with applicable laws, including the Protection of Personal Information Act (POPIA) (legal obligation).

4. Cookies

We use strictly necessary cookies to keep you signed in and to keep the Service secure. We do not currently set advertising cookies. If we introduce analytics or marketing cookies, we will update this notice and request your consent where required.

5. Who we share your data with

  • Paddle — our Merchant of Record. Paddle processes all payments, manages subscriptions, calculates and remits taxes, and issues invoices on our behalf. Information about Paddle's data handling is at paddle.com/legal/privacy.
  • Hosting & infrastructure providers — including our cloud platform, database, storage and email-delivery subprocessors used to operate the Service.
  • Professional advisers — accountants, auditors and lawyers, where reasonably necessary.
  • Authorities & regulators — where we are required by law, court order or to protect our rights.
  • Other Tenderfy users — limited public profile information (e.g. company name, sectors served) where you choose to be listed in the supplier directory.

We do not sell your personal data.

6. International transfers

Some of our subprocessors (including Paddle) may process data outside South Africa. Where this happens, we rely on lawful transfer mechanisms and require appropriate safeguards (contractual commitments and the recipient's own compliance program).

7. How long we keep your data

We keep personal data only as long as needed for the purposes set out above — typically for the life of your account plus a reasonable period to meet legal, tax, accounting and dispute-resolution requirements. After that, data is deleted or anonymised. Submission packs and invoices are retained for the period required by South African tax and commercial record-keeping rules.

8. Your rights

Subject to applicable law (including POPIA), you have the right to:

  • access the personal data we hold about you;
  • request correction of inaccurate or incomplete data;
  • request deletion of your data where there is no overriding legal basis to keep it;
  • object to certain processing, including direct marketing;
  • withdraw consent where processing is based on consent;
  • lodge a complaint with the Information Regulator (South Africa) or your local supervisory authority.

To exercise any of these rights, email privacy@tenderfy.co.za.

9. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, row-level security on our database, and least-privilege access for staff. No system is perfectly secure — please use a strong, unique password and keep your credentials confidential.

10. Children

Tenderfy is not directed at children under 18 and we do not knowingly collect data from them.

11. Changes to this notice

We may update this notice from time to time. Material changes will be communicated via the Service or by email. Continued use after changes take effect constitutes acceptance of the updated notice.

12. Contact

Round Out (Pty) Ltd
Email: privacy@tenderfy.co.za

See also our Terms & Conditions and Refund Policy.