Privacy Policy — QuickTenders

Last updated: 1 June 2026

Thuthu (Pty) Ltd t/a QuickTenders Registration Number: 2025/102758/07

This Privacy Policy explains how QuickTenders collects, uses, stores, and protects your personal information. We are committed to handling your data with transparency and in compliance with the Protection of Personal Information Act, 2013 (POPIA) and other applicable data protection laws.

Effective date: 1 June 2026 · Last updated: 8 July 2026

Data Controller
Data We Collect
How We Use Your Data
Lawful Basis for Processing
Retention Policy
Subprocessors
Cookies and Analytics
International Transfers
Your Rights Under POPIA
Security Measures
Children's Privacy
Changes to This Policy
Contact

1. Data Controller

Thuthu (Pty) Ltd t/a QuickTenders is the responsible party for personal information processed through this platform under POPIA. Our Information Officer can be reached at info@getquicktenders.com.

2. Data We Collect

Account Information

Name and email address
Password (stored as a cryptographic hash — never in plaintext)
Account creation date and last login timestamp
Subscription status and plan tier

Business and Compliance Data

Company name, registration number, province, sector, and business description
CIDB grade, B-BBEE level, employee count, annual turnover, years in business
Compliance documents you upload: CSD registration, tax clearance certificates, B-BBEE certificates, CIDB certificates, and other compliance records
Key personnel information including names, roles, and CVs you add to the platform
Project references and contract history you provide
Financial documents you upload for funding or compliance purposes

Tender and Application Data

Tender applications you create and submit through the platform
Workspace content including tender documents, section drafts, and submission records
Match scores and tender interaction history
Secretariat Service orders and associated documentation
Funding application data including business plan content and financial projections

Usage and Technical Data

IP addresses and device information (for security and rate limiting)
API request logs (retained 90 days for debugging and security)
Platform activity and feature usage data

Payment Data

Billing records and payment history
Payment processing is handled by iKhokha — we do not store payment card details

3. How We Use Your Data

To provide and operate the platform including tender matching, compliance tracking, workspace tools, and Secretariat Services
To authenticate your account and maintain session security
To generate your Readiness Score and provide compliance guidance
To match your business profile against open tenders and surface relevant opportunities
To provide AI-assisted features including tender writing assistance, compliance checks, and Go/No-Go analysis
To send transactional communications including expiry alerts, application updates, and billing notifications
To send marketing communications where you have given consent
To detect and prevent fraud, abuse, and security incidents
To comply with legal obligations

We do not sell your personal data. We do not use your data to train AI models for other customers or for third-party advertising.

4. Lawful Basis for Processing

Contract: Account management, tender matching, Workspace features, Secretariat Services, and core platform delivery
Legitimate interest: Security monitoring, error logging, platform improvement analytics
Consent: Marketing emails, analytics cookies
Legal obligation: Retention of billing records, responding to lawful information requests

5. Retention Policy

Account data: retained while your account is active
Compliance documents and other business data you upload: retained while your account is active, then deleted as part of the account-deletion process (within 30 days of your deletion request). They are not retained after deletion.
Tender applications, workspace content, match history, and Secretariat and funding records: retained while your account is active, then deleted in the same account-deletion process (within 30 days of your deletion request).
API request logs: 90 days
Invoices and billing records: retained in full for approximately 5 years after the relevant transaction, as required by South African tax and accounting law (including the Tax Administration Act). These records are kept intact — not anonymised — for the statutory period, and are retained even after you close your account.
Backups: we keep database backups for disaster-recovery purposes, stored encrypted at rest and retained for a maximum of approximately 90 days on a rolling schedule.
Upon account deletion: your personal data is removed from our live systems within 30 days of your request. Any residual copies held in disaster-recovery backups are automatically expired within approximately 90 days. If we ever restore from a backup, we re-apply any deletions that had already been completed, so a restore does not reinstate information you asked us to erase. The only exception is invoices and billing records, which we are legally required to keep for the statutory period described above.

6. Subprocessors

We use the following third-party processors to deliver the platform:

Cloudflare Inc. — hosting, edge compute, database (D1), and media storage (R2)
Resend — transactional email delivery
iKhokha — payment processing (we do not store card details)
Anthropic (Claude) — AI-assisted tender writing, compliance checks, and Go/No-Go analysis
Google (Gemini) — document classification and AI assistance for lighter tasks

All AI subprocessors process only the content you explicitly submit for AI assistance. Prompts and documents are not shared across customers or used to train models.

7. Cookies and Analytics

Strictly necessary cookies: Required for authentication and platform function
Analytics cookies: Only activated after explicit consent
IP anonymisation: Enabled for all analytics tracking

You can manage your cookie preferences via the consent banner displayed on your first visit.

8. International Transfers

QuickTenders operates on Cloudflare's global edge network. Your data may be processed in data centres outside South Africa, including in the United States and European Union. We rely on Cloudflare's standard contractual protections for international transfers. AI processing by Anthropic and Google may also occur outside South Africa. We ensure appropriate safeguards are in place in line with POPIA's requirements for cross-border transfers.

9. Your Rights Under POPIA

You have the following rights regarding your personal data:

Access — request a copy of your personal data
Correction — request correction of inaccurate or incomplete data
Deletion — request deletion of your account and associated data
Objection — object to processing based on legitimate interest
Withdraw consent — for consent-based processing (marketing, analytics)
Complaints — lodge a complaint with the Information Regulator of South Africa

To exercise any right, email info@getquicktenders.com with the subject line: Privacy Request — [type of request]. We respond within 30 days.

If you are dissatisfied with our response, you may lodge a complaint with the Information Regulator: Website: www.inforeg.org.za Email: inforegulator@justice.gov.za Telephone: +27 10 023 5207

10. Security Measures

We protect your data using:

TLS/HTTPS encryption for all data in transit
Encryption at rest via Cloudflare's storage layer
Organisation-scoped data isolation enforced at the API layer
JWT-based session management with server-side validation
Rate limiting, DDoS protection, and security headers on all endpoints
Role-based access controls for internal staff accessing platform data

11. Children's Privacy

QuickTenders is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected data from a minor, contact info@getquicktenders.com and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice in the platform at least 14 days before they take effect. The updated policy will always be available at getquicktenders.com/privacy. Continued use of the platform after changes constitutes acceptance of the updated policy.

13. Contact

For privacy enquiries, data requests, or to exercise your rights:

Thuthu (Pty) Ltd t/a QuickTenders Email: info@getquicktenders.com Subject line: Privacy Request — [type of request] Address: 23 Fielding Crescent, Mondeor Green, Johannesburg, Gauteng, 2091

We acknowledge all requests within 5 business days.

Contents