Who is responsible
Zaiq, a South African business, runs Awardee and is responsible for the personal information it processes. Zaiq's information officer handles privacy requests: use the objection form or the corrections form, or write to [email protected].
What we collect and why
You voluntarily provide an email address to sign in. We store saved-search filters, followed tenders and companies, email preferences, sessions and payment records to run your account and provide requested alerts, and, when you use them, your description of your business, your bid tracker (stages, notes and who is on each bid), the drafts you ask for, the questions you ask about tenders and their answers, your private calendar link and the dates of the papers your business has on file (never the papers themselves or their numbers). Without an email address, you can browse public pages but cannot save searches. Contract-related account processing is assessed under POPIA s11(1)(b); optional consent is separate under s11(1)(a).
Procurement information comes from National Treasury's eTenders portal, its OCDS downloads and buyers' published bid registers. We retain tender details, organisation names and confirmed prices to help businesses find opportunities and understand published procurement results. Our basis is legitimate interests (POPIA s11(1)(f)), with public-record collection and compatible further processing under ss12(2)(a) and 15(3)(b). These provisions do not exempt Awardee from the rest of POPIA.
What we show
Public pages show counts, ranges, spreads and published award values. Confirmed company names are available only with paid access. Names that may identify sole proprietors are replaced with “Individual bidder”. We do not display bidder contact names, contact details, identity numbers, CSD numbers, CIPC numbers, officials' names or signatures. Company matching uses normalised names only; the restriction on certain unique-identifier linkage is in POPIA s57(1)(a).
Disputed and unconfirmed readings are excluded from displayed results and statistics. We minimise information and review accuracy under POPIA ss10 and 16. Linked source documents remain on their publishers' websites; they may contain information Awardee does not republish.
Service providers and processing abroad
Cloudflare hosts the website and D1 application data. The Awardee data pipeline runs on Zaiq's netcup server. Paystack processes payments; Awardee never receives card numbers. Resend sends account and alert emails. Scans selected for AI reading are sent through OpenRouter to providers configured not to store or train on those prompts. Tender documents (public notices) are sent to Anthropic's Claude API to write tender briefs and price guides, and, if you describe your business for Tenders for you, that description is sent there too, with names, phone numbers and email addresses removed, only to match tenders for you and to write the drafts you ask for, and the questions you ask about a tender go there to be answered from its documents; Anthropic's commercial terms bar using what we send to train its models. These services can process information outside South Africa. Each provider processes this information under its own written terms, which require confidentiality and security (POPIA s21). Account, payment and email processing outside South Africa is necessary to provide the service you ask for (POPIA s72(1)(c)). Register scans sent for AI reading go only to providers whose terms bar storing them or training on them (s72). Matching the business description you give to tenders is necessary to provide the Tenders for you service you ask for (s72(1)(c)).
Email and analytics
We send customer-requested tender digests and account messages, with sender identification and one-click unsubscribe. No bidder or buyer outreach is authorised. The electronic direct-marketing rules are in POPIA s69, including sender and opt-out requirements in s69(4).
We record first-party conversion events such as sign-up, saved search, checkout started and verified payment. Cloudflare Web Analytics is configured without advertising pixels. Necessary secure session cookies keep you signed in. No third-party advertising pixels are enabled.
Retention, closure and security
Account closure anonymises account details, saved preferences and account messages. An upheld objection removes the affected company name from served results and restricts it from reimport. Cancel any active subscription first. We keep payment records for five years as tax law requires (Tax Administration Act s29). Source records and objection evidence are kept only while the published service or a request needs them (POPIA s14). Some source files we hold may contain CSD numbers; we never publish them or use them for matching.
Magic links expire, sessions use secure HttpOnly cookies, and admin access requires a secret token. Security safeguards, operator obligations and compromise notices are addressed by POPIA ss19–22.
Your rights and requests
You may request confirmation and access (POPIA s23), correction or deletion (s24), or object on applicable grounds under s11(3). Processing must stop after a qualifying objection under s11(4); disputed accuracy is restricted while verified under s14(6)(a). Use object to processing or request a correction. We provide reasonable assistance without charge and act as soon as reasonably practicable. Our service target is a response within 30 days, not a claim that the law permits delaying action for that period.
Information Regulator
Contact details checked on 13 October 2026: [email protected]; 010 023 5200 or 0800 017 160; Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. See the Information Regulator's contact page.
Legal source: Protection of Personal Information Act 4 of 2013, sections cited above, read in the South African law corpus on 13 October 2026.