Privacy policy

Information we collect

We only collect what we need to run the service. In practice that is:

• Account details. Name, email address, password hash, organisation and role, collected when you register. We never store your password in readable form.
• Alert preferences. The categories, regions, keywords, authorities and delivery channels you choose, together with the schedules you set.
• Saved searches and bookmarks. The queries and tender references you save, so the platform can re-run them for you.
• Usage information. Pages viewed, searches run, documents downloaded, device and browser type, and approximate location derived from your IP address.
• Communications. Messages you send to our support team, and any system emails we send you, such as password resets and deadline reminders.

We do not ask for and do not want special category data. Please do not include sensitive personal information in your profile or in messages to us.

How we use your information

• To provide the search, alert, bookmark and document features you asked for.
• To send the notifications you subscribed to, at the frequency you chose.
• To maintain account security, including suspicious login detection and password resets.
• To understand which features are useful so we can prioritise product work.
• To detect abuse, such as scraping or automated extraction that would degrade the service for others.
• To meet legal, tax and accounting obligations that apply to us.

We do not sell personal information, and we do not share it with advertisers or data brokers.

Legal bases for processing

Where the law requires a legal basis, we rely on the following: performance of our contract with you, for the features you use; our legitimate interests in operating and securing the service; your consent, for marketing email and for non-essential cookies, which you can withdraw at any time; and compliance with legal obligations.

How we share information

We share personal information only in these situations:

• Service providers. Hosting, email delivery, error monitoring and analytics providers, each under a written contract and limited to what the service requires.
• At your direction. For example, inviting a colleague to your team workspace, or sharing a bid report.
• Corporate events. If we merge with, or are acquired by, another company, your information transfers as part of that transaction, and we will tell you before your data is affected.
• Legal requirements. When compelled by a court, regulator or law enforcement authority, we will respond only to the specific legal demand.

Tender notices themselves are public information published by the issuing authority. We do not add your name, company or contact details to any notice or document.

Data retention

• Account data is kept while your account is active.
• Search history is kept for 24 months, then deleted.
• Download logs are kept for 12 months for security and audit purposes.
• Support correspondence is kept for 24 months after the last reply.
• When you close an account, we delete or anonymise your personal data within 30 days, except where retention is required by law.

Cookies and analytics

We use a small number of cookies: one to keep you signed in, one to remember interface preferences such as your chosen table view, and analytics cookies to understand aggregate usage. We do not use advertising cookies and we do not embed third-party trackers such as social media pixels. You can block or delete cookies in your browser settings, though sign-in will stop working.

Your rights

Depending on where you live, you may have the right to:

• Get a copy of the personal data we hold about you.
• Ask us to correct data that is wrong or incomplete.
• Ask us to delete your data.
• Restrict or object to certain processing.
• Receive your data in a portable, machine-readable format.
• Withdraw consent where we rely on it, without affecting past processing.
• Complain to your local data protection authority.

Send any request to privacy@tendersbox.com. We may ask you to confirm your identity before we act on the request.

Data security

Passwords are hashed with a modern adaptive algorithm and never stored in plaintext. Data is transmitted over TLS. Access to production data is limited to staff who need it and is logged. No system is perfectly secure, so if we become aware of a breach affecting your data we will notify you and the relevant authority without undue delay.

Children

TendersBox is a business service and is not intended for anyone under 16. We do not knowingly collect information from children. If you believe a child has created an account, contact us and we will remove it.

Changes to this policy

We update this policy when our practices change. The revision date at the top of this page always reflects the current version, and if a change materially affects your rights we will email account holders at least 14 days before it takes effect.

Contact us

TendersBox is operated from Islamabad, Pakistan. Write to us at privacy@tendersbox.com, or by post to the address listed on our About Us page.