Privacy Policy
Bid Environment is run by Skhatsi Itstime (Pty) Ltd, a South African company. This policy explains what personal information we process when you use Bid Environment, why, where it is kept, who we share it with, and how you can ask to see, correct or delete it. It is written with the Protection of Personal Information Act, 2013 (POPIA) in mind.
1. Who we are and how to reach us
Skhatsi Itstime (Pty) Ltd (registration number 2024/563305/07), whose registered office is at Stand No 1918, Block B Trust, Kamaqekeza, Komatipoort, Mpumalanga, 1346, is the responsible party for the information you give us to run your account. For the tender information your company puts into its register, your company decides what goes in and why; we process it on your company's behalf, as its operator.
Information Officer: Vusi Cossa
Email: [email protected]
Phone: 072 304 5533
Our Information Officer is registered with the Information Regulator (South Africa). Registration number: 2026-038912. You can check the registration on the Regulator's eServices portal.
2. What we collect
- Your account: your name, work email address and department; your password (stored only as a one-way hash); your two-step login settings (the secret is stored encrypted); and, if you sign in with Microsoft or Google, the email address those services confirm.
- Your company: company name, the plan you are on and billing status. Card payments are handled by PayFast; we never see or store your card details.
- Your team: the names, work email addresses, roles and departments of the people your company invites.
- Tender data: everything your company records in its register: references, titles, issuing organisations, dates, values, tasks, comments, returnables and the documents you upload (for example tax, B-BBEE, CSD or CIDB certificates). These documents can contain personal information, such as directors' names or ID numbers.
- Connected mailboxes: if you connect Outlook or Gmail for email alerts, we store an access token (encrypted) so the app can send reminders from your own mailbox. We do not read your inbox.
- Usage and security records: an activity log of who changed what in your register, your IP address (to limit repeated login attempts and block abuse), and, if you turn on push alerts, your browser's push address.
- Cookies: we use only the cookies needed to keep you signed in and to finish two-step login. We do not use advertising or tracking cookies. The app remembers small display preferences (such as tile or list view) in your own browser.
3. Why we use it
- To provide the service: your register, countdowns, reminders, team tasks and document checklists.
- To send the emails the service depends on: invitations, password resets, task notices and the daily digest.
- To keep accounts and data secure: sign-in, two-step login, preventing abuse, and the activity log.
- To bill paid plans.
- To store the tender documents you upload with each tender, and, when a document is read to fill in the form (Read to fill in, or the first document on a new tender), to read it and pre-fill the form.
- To answer your support requests and tell you about important changes to the service.
We do this because it is needed to perform our agreement with you (the Terms of Service), to protect the service and its users, and, where the law requires it, with your consent. We do not sell personal information and do not use it for advertising.
4. Where it is kept, and who we share it with
Your register is stored in our database with our hosting provider, Oner. Uploaded documents are stored on the same servers, outside the public website, and are only available to signed-in members of your company. Each company's register is kept separate from every other company's.
We use these service providers (operators) to run Bid Environment. Each receives only what it needs:
| Provider | What for | What they receive |
|---|---|---|
| Oner | Hosting the app, database and uploaded files | All service data, stored on our behalf |
| Brevo | Sending the system's emails | Recipient name and email, and the email's content |
| Microsoft / Google | Sign-in, and sending from a mailbox you connect | Your email address; the content of reminders sent from your mailbox |
| PayFast | Card payments for paid plans | What you enter on PayFast's payment page |
| Anthropic | Reading a tender PDF, only when a document is read to fill in the form | The text of that document |
| Cloudflare | Protecting the website from attacks and keeping it fast | Website traffic, including IP addresses |
Some of these providers process information outside South Africa (for example in the European Union or the United States). We use providers that are bound by data-protection laws or contractual terms giving protection comparable to POPIA. We will also disclose information if the law requires it.
5. How we protect it
Connections are encrypted (HTTPS). Passwords are hashed, and two-step login secrets and mailbox tokens are encrypted. Admins must use two-step login. Access within a company follows its roles (Admin, Manager, Contributor, Viewer), and every company's data is isolated from every other company's. If a breach affects your personal information, we will notify you and the Information Regulator as POPIA requires.
6. How long we keep it
- While your company uses Bid Environment, we keep its register, documents and activity log.
- If your company deletes its account (Billing → Delete company), the register is locked straight away and permanently erased after 30 days. Until then an Admin can download everything or cancel the deletion.
- If you are removed from a company, your access to it ends at once. Your login is deleted when you no longer belong to any company. Tasks and comments you made stay in that company's records.
- Password-reset and invitation links expire after 1 hour and 48 hours respectively.
- Sign-ups that are never confirmed: the email confirmation link expires after 24 hours. If a new sign-up is not confirmed within 7 days, the login is deleted, together with the company register it created if nothing has been added to it.
- Backups are overwritten on a rolling schedule, so erased data leaves the backups within a limited time.
- We keep billing records for as long as tax law requires.
7. Your rights
You can ask us to confirm what personal information we hold about you and to give you a copy, and you can ask us to correct or delete it. You can also object to how we process it. Much of it you can change yourself under My profile. An Admin can download all of your company's data from the Billing tab.
To make a request, email the Information Officer at [email protected]. We may need to confirm who you are first. For tender information in your company's register, we will work with your company's Admin, because the company decides what that register holds.
If you are unhappy with how we handle your information, you can complain to the Information Regulator (South Africa).
8. Changes to this policy
If we change this policy, we will publish the new version here with a new version date. If a change materially affects how we use your information, we will tell your company's Admins by email before it takes effect.