Privacy notice

The Reneal Effect is the responsible party for personal information processed through The Bid Room. Our information officer can be reached through our contact form.

Operated by

The Reneal Effect

Website

therenealeffect.co.za

Contact

Contact form

• –Your account: your name, work email, the business you act for and your role in it. Your password is stored only as a one-way hash; nobody at The Reneal Effect can read it.
• –Your business details: what you add in Settings to appear on your quotes, such as contact person, phone, address, CSD number and VAT number.
• –Your work: tenders you quote, bills of quantities, quotes, price lists, requests for price and the documents you upload.
• –Suppliers who apply to be listed: the CSD registration report and the identity document of the person applying. These are seen only by that supplier’s own users and by our review staff.
• –Sign-up protection: the network address you sign up from, stored only as a one-way code, used to stop accounts being created in bulk, and deleted within a day.
• –Requests you send us: for a plan or for a service from The Reneal Effect.

Tender and award information comes from National Treasury’s public eTenders data. It can include the names of public officials and of businesses that won awards, as published by government.

• –to provide The Bid Room to your business: your account, your quotes and your requests for price (performing our agreement with you);
• –to review supplier applications, so that bidders can trust who is listed (our legitimate interest and that of bidders);
• –to bill your plan and answer your service requests (performing our agreement);
• –to keep the service secure and stop abuse (our legitimate interest);
• –to meet legal duties, such as tax records.

We do not use your information for advertising, and we do not send marketing without your consent. You can opt out of any message we send.

We use a small number of service providers (operators) under written agreements that require them to keep your information secure and to use it only for us:

• –Supabase: our database and file storage, in the European Union (Frankfurt, Germany).
• –Vercel: runs the website; the app’s servers are in the European Union (Frankfurt, Germany).
• –Anthropic (United States): the assistant that reads tender documents and finds online prices. It receives the document text and line descriptions, not your password or supplier ID documents. Under its commercial terms, Anthropic does not use this data to train its models.
• –Paystack: takes card and EFT payments. We never see or store your card details.

When you send a request for price, the supplier you choose sees your business name and contact details on it. You send bid documents and emails to buyers yourself; we do not send them for you.

Our data is kept in the European Union (Frankfurt, Germany), where the General Data Protection Regulation gives protection at least equal to POPIA. The assistant’s processing happens in the United States, under contractual safeguards. By using the assistant features you agree to this transfer, as section 72 of POPIA allows.

• –Account and business information: while your business has an account, and up to 12 months after it closes, unless you ask us to delete it sooner.
• –Invoices and payment records: five years, as tax law requires.
• –Supplier review documents: while the supplier is listed, and up to 12 months after.
• –Sign-in sessions: until they expire or you sign out. Sign-up protection codes: one day.

Information is encrypted in transit and at rest. Each business can see only its own work; our staff see only what their work needs. Passwords are hashed, sessions expire, and files are checked before they are stored. If a breach affects your information, we will tell you and the Information Regulator as POPIA requires.

We use two cookies, and only to keep you signed in and remember which business you are working for. They are essential for the service. We use no advertising or tracking cookies.

You may ask us, free of charge:

• –whether we hold personal information about you, and for a copy of it;
• –to correct or delete information that is wrong, out of date or no longer needed;
• –to stop processing your information, where the law allows you to object;
• –to withdraw a consent you gave.

Contact us through our contact form. We will reply within 30 days. If you are unhappy with our answer, you may complain to the Information Regulator at inforegulator.org.za.

We will update this notice when how we handle information changes, and tell you about important changes before they apply.