1. Introduction
BidIQ (Pty) Ltd ("BidIQ", "we", "us" or "our") operates a procurement intelligence platform at www.bidiq.co.za (the "Service") that helps South African businesses discover and monitor government procurement opportunities.
We are committed to handling your personal information with transparency, integrity and care. This Privacy Policy explains what personal information we collect, how we use it, how we protect it, and what rights you have as a data subject under the Protection of Personal Information Act 4 of 2013 (POPIA) and other applicable South African laws.
By registering for or using the Service, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal information as described herein.
2. Who We Are
BidIQ is a South African technology business operating a procurement intelligence platform. For the purposes of POPIA, BidIQ is the Responsible Party — the entity that determines the purpose and means of processing your personal information.
Our designated Information Officer is responsible for overseeing compliance with this Privacy Policy and POPIA. You may contact our Information Officer at:
- Email: hello@bidiq.co.za
- Website: www.bidiq.co.za
3. Information We Collect
We collect the following categories of personal information:
Account Information
- Email address (required for registration and communications)
- Password (stored exclusively in a hashed, irreversible form using Argon2id — never stored in plain text)
- Date of account creation and most recent login
Company Profile Information (voluntarily provided)
- Company or trading name
- Province of primary operation
- Industry or procurement categories
Activity and Usage Information
- Saved search configurations and search history
- Email alert preferences and notification settings
- Tender listings viewed, bookmarked or interacted with
Technical Information (automatically collected)
- IP address and approximate geographic location
- Browser type, version and language settings
- Device type and operating system
- Pages visited, features used and time spent on the Service
- Referral source (how you arrived at the Service)
Communications
- Any correspondence you send to us by email or contact form, and our responses
We do not intentionally collect special personal information as defined under Section 26 of POPIA, including race, gender, health information, biometric data, political beliefs, religious beliefs, criminal history, or trade union membership.
4. How We Collect Information
We collect personal information in the following ways:
Directly from You
When you register for an account, complete your company profile, configure saved searches, set up email alerts, submit support requests or otherwise interact with the Service.
Automatically
Through cookies, session data and similar technologies when you browse or use the Service. See the Cookies section below for details.
From Third Parties
We do not currently obtain personal information from third-party data brokers, social media platforms or advertising networks. Procurement information displayed on the Service is sourced from publicly available South African government portals and does not constitute personal information collected about you.
5. How We Use Your Information
We process your personal information for the following specific, lawful purposes:
Providing the Service
To create and manage your account, authenticate your sessions, personalise your experience, and deliver core procurement search and alert functionality.
Email Alerts
To deliver tender notifications matching your saved search criteria, where you have explicitly configured alerts.
Service Communications
To send you important notices regarding your account, changes to our Terms or Privacy Policy, security alerts, and system maintenance notifications. These communications are essential to the Service and cannot be opted out of while your account is active.
Service Improvement
To understand aggregate usage patterns, identify technical issues and continuously improve the Service, using anonymised or pseudonymised data where possible.
Legal Compliance
To comply with applicable South African laws, respond to lawful requests from regulatory authorities, and protect our legal rights.
Future AI-Powered Features
When AI-powered features are introduced (such as match scoring, tender summaries and intelligent categorisation), your company profile information will be used to personalise these recommendations. We will update this Privacy Policy at that time and notify you accordingly.
We process your personal information on one or more of the following lawful grounds under POPIA: your consent, the performance of a contract to which you are a party, compliance with a legal obligation, or our legitimate interests in operating and improving the Service, provided such interests do not override your rights and freedoms.
7. Analytics
We use analytics tools to understand how users interact with the Service — including which features are most used, where users encounter errors, and how we can improve the experience. Where possible, analytics data is collected in anonymised or pseudonymised form.
We do not share individually identifiable analytics data with third parties for commercial or marketing purposes.
8. Email Communications
8.1 Transactional Emails
We send transactional emails directly related to your account, including registration confirmation, password reset requests, account security notifications and important service changes. These emails are necessary for the operation of your account and cannot be opted out of while your account remains active.
8.2 Tender Alert Emails
If you configure saved searches with email alerts enabled, we will send you notifications about new procurement opportunities matching your criteria. You may disable or modify these alerts at any time through your account settings, or by following the unsubscribe link in any alert email.
8.3 Marketing and Product Communications
We may occasionally send communications about new BidIQ features, product updates or relevant procurement industry news. We will only send such communications where you have not objected to receiving them. You may opt out at any time by clicking "Unsubscribe" in any marketing email, or by emailing hello@bidiq.co.za.
8.4 Our Commitment
We will never sell, rent or trade your email address to third parties. We will not use your email address to send unsolicited commercial communications unrelated to the Service.
9. Saved Searches and Alerts
When you save a search on BidIQ, we store the configured parameters — including keywords, province filters, category filters and status filters — linked to your account. This information is used solely to:
- Display your saved searches when you return to the Service;
- Power your email alert notifications (where enabled); and
- Allow you to quickly re-run searches with previously configured parameters.
Saved search data is private to your account and is not shared with other users, advertisers or third parties. You may delete any saved search at any time through your account settings.
10. Company Profiles
Your company profile information — including company name, operating province and industry categories — is used to:
- Personalise your BidIQ dashboard and search experience;
- Calculate procurement match scores relevant to your business profile; and
- When AI-powered features are introduced, provide personalised tender recommendations.
Your company profile is not publicly visible on the Service. It is not shared with procuring entities, other platform users, or third parties, except as described in the Sharing section of this Policy.
11. Security Measures
We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, accidental loss, disclosure, alteration or destruction. Our security measures include:
- Password hashing: All passwords are stored using the Argon2id algorithm — a one-way cryptographic hash. Plaintext passwords are never stored or transmitted.
- Encrypted connections: All data transmitted between your browser and BidIQ is encrypted using HTTPS (TLS).
- Session management: Sessions are managed with appropriate security controls, including session regeneration on login and logout, to prevent session fixation attacks.
- CSRF protection: All state-changing operations are protected against Cross-Site Request Forgery attacks.
- Access controls: Internal access to personal data is limited to authorised personnel on a strict need-to-know basis.
While we take these precautions seriously, no method of electronic storage or transmission is completely secure. We cannot guarantee absolute security. In the event of a personal information breach that poses a risk to your rights and freedoms, we will notify you and the Information Regulator as required by Section 22 of POPIA.
12. Data Retention
We retain personal information only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law:
- Account information: Retained for the duration of your account and for up to three (3) years following account closure or deletion, unless a longer period is required by law.
- Company profile data: Retained for the duration of your account and deleted upon account closure.
- Email alert logs: Retained for up to twelve (12) months for debugging and service improvement purposes.
- Usage and analytics data: Retained in aggregated, anonymised form indefinitely for product improvement purposes.
- Legal and compliance records: Retained for the period required under applicable South African law.
- Support communications: Retained for up to three (3) years from the date of the communication.
When personal information is no longer required, it will be securely deleted, anonymised or disposed of in accordance with POPIA and best practice data management standards.
13. Sharing of Your Information
We do not sell, rent or trade your personal information to any third party, ever.
We may share your personal information in the following limited circumstances only:
Trusted Service Providers
We engage trusted third-party service providers to assist in operating the Service, including hosting and infrastructure providers, transactional email delivery services, and analytics tools. These providers are contractually required to protect your personal information and are permitted to use it only for the specific purpose of providing services to BidIQ. We require adequate data protection agreements with all operators who process personal information on our behalf.
Legal Obligations
We may disclose personal information if required to do so by applicable law, a binding court order, or a valid request from the Information Regulator or another South African government authority. Where lawfully permitted, we will notify you before making such a disclosure.
Business Transfers
In the event of a merger, acquisition, restructuring or sale of all or substantially all of BidIQ's business or assets, your personal information may be transferred to the acquiring or successor entity. We will take reasonable steps to ensure that equivalent privacy protections are maintained, and will notify you of any such transfer in advance where reasonably practicable.
With Your Consent
In all other circumstances, we will seek your explicit consent before sharing your personal information with any third party.
14. Your Rights under POPIA
As a data subject under the Protection of Personal Information Act 4 of 2013, you have the following rights in respect of your personal information that we process:
Right of Access
You may request confirmation of whether we hold personal information about you, and request a copy of that information in a portable format where reasonably practicable.
Right to Correction
You may request that we correct or update inaccurate, incomplete or misleading personal information we hold about you.
Right to Deletion (Erasure)
You may request the deletion or destruction of your personal information in circumstances where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (if consent was the processing ground), or where processing is unlawful.
Right to Object
You may object to the processing of your personal information on grounds relating to your particular situation, including objection to processing for direct marketing purposes. Where you object to direct marketing, we will immediately stop processing your information for that purpose.
Right to Restriction
You may request that we restrict the processing of your personal information in certain defined circumstances.
Right to Complain
If you are not satisfied with how BidIQ handles your personal information, or how we have responded to your request, you have the right to lodge a complaint directly with the Information Regulator of South Africa:
- Website: www.inforegulator.org.za
- Email: enquiries@inforegulator.org.za
- Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
To exercise any of the above rights, please submit a written request to hello@bidiq.co.za. We will respond within thirty (30) days, as required under POPIA, and we will not charge a fee for reasonable requests.
15. Updating Your Information
You may review and update your account information — including your email address, company name, operating province and industry categories — at any time through your account settings page. If you need assistance updating your personal information, or if you believe we are holding information about you that is inaccurate or outdated, please contact us at hello@bidiq.co.za.
16. Third-Party Services
The Service may contain links to or references to third-party websites and resources, including South African government procurement portals (such as the National Treasury eTender Publication Portal). BidIQ is not responsible for the content, security or privacy practices of any third-party website or service. We encourage you to review the privacy policies of any external service you access.
Third-party services currently integrated with or relied upon by BidIQ may include:
- Web hosting and cloud infrastructure providers;
- Transactional email delivery services; and
- Website analytics services.
Where these providers process personal information on our behalf, they do so as operators under appropriate data processing agreements consistent with POPIA requirements.
17. Children's Privacy
The Service is not directed to, and is not intended for use by, persons under the age of 18 years. We do not knowingly collect personal information from children. If you are a parent or guardian and believe that a child under 18 has provided us with personal information without your consent, please contact us immediately at hello@bidiq.co.za.
Upon receiving a credible report of personal information collected from a child, we will take prompt steps to verify and, where confirmed, securely delete such information from our systems.
18. International Transfers
BidIQ primarily stores and processes personal information within the Republic of South Africa. In certain circumstances, your information may be processed by our third-party service providers in other jurisdictions.
Where personal information is transferred outside of South Africa, we will take reasonable steps to ensure that an adequate level of data protection is maintained, consistent with the requirements of Section 72 of POPIA. This may include entering into data transfer agreements or relying on other appropriate transfer mechanisms.
19. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our information practices, the features of our Service, or applicable legal requirements. When we make material changes to this Policy, we will notify you by email (to the address associated with your account) and by posting a prominent notice on the Service, with the "Last Updated" date revised accordingly.
Your continued use of the Service following such notification constitutes your acknowledgement of the revised Policy. If you object to any changes, you should stop using the Service and may request deletion of your account.
20. Contact and Complaints
For any questions, concerns, access requests or complaints relating to this Privacy Policy or the way in which BidIQ handles your personal information, please contact our Information Officer:
- Role: Information Officer, BidIQ (Pty) Ltd
- Email: hello@bidiq.co.za
- Website: www.bidiq.co.za
We will acknowledge your request within five (5) business days and will endeavour to fully resolve your query within thirty (30) days, in line with POPIA requirements.
If you are dissatisfied with our response, you may escalate your complaint to the Information Regulator of South Africa:
- Website: www.inforegulator.org.za
- Email: enquiries@inforegulator.org.za
- Postal Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
