POPIA Privacy Policy
How we handle your data
Effective 15 April 2026Reviewed quarterlyPOPIA Responsible Party
1.Plain-English summary
- We process email metadata (not body content) only as long as needed to verify fraud.
- Your account details are held in secure cloud infrastructure (EU region, migrating to South Africa).
- You can export or delete your data at any time via the DSAR page.
- You can lodge a complaint with the Information Regulator (South Africa).
2.Information Regulator (South Africa)
Responsible Party: Tender Fraud Prevention (c) 2026
Information Officer: Contact us
3.Information we collect
To deliver the service, we collect:
- Account data — name, organisation, work email, phone.
- Email metadata you submit for verification — sender, recipient, headers, SPF/DKIM/DMARC results. We do not store the email body.
- Verification outputs — risk scores and pattern matches generated by our AI.
- Usage data — page views, feature interactions, error reports.
- Billing data — payment-method tokens (not raw card numbers, which stay with our payment processor).
4.How we use it
- Provide the verification, reporting, and admin features you subscribed to.
- Detect, prevent, and investigate fraud across the user base (aggregated, never individual targeting).
- Send transactional notifications and security alerts.
- Bill subscriptions and meet South African tax obligations.
- Generate threat-intelligence statistics in fully de-identified form.
5.Legal basis under POPIA
- Contract performance — fulfilling the subscription you agreed to (s.11(1)(b)).
- Legitimate interest — fraud detection benefiting the broader procurement ecosystem (s.11(1)(f)).
- Legal obligation — tax records, audit logs, breach notifications (s.11(1)(c)).
- Consent — optional analytics cookies and marketing communications.
6.Data retention schedule
Email metadata
- Retention
- 180 days
- Purpose
- Fraud pattern correlation
- Deletion method
- Automatic purge
Email content (body)
- Retention
- Not stored
- Purpose
- Per s.5 minimality
- Deletion method
- N/A
Account PII
- Retention
- Account lifetime + 90 days
- Purpose
- Service delivery
- Deletion method
- On account close
Verification results
- Retention
- 90 days live + 7 years cold storage
- Purpose
- Audit + research
- Deletion method
- After 7 years
Billing data
- Retention
- 5 years
- Purpose
- SARS requirement
- Deletion method
- Year +5 anniversary
Cookies
- Retention
- 30 days
- Purpose
- Session persistence
- Deletion method
- Browser-driven
Audit log
- Retention
- 7 years
- Purpose
- POPIA s.53 + court evidence
- Deletion method
- After 7 years
Support messages
- Retention
- 2 years
- Purpose
- Quality assurance
- Deletion method
- Rolling 24 months
IP addresses
- Retention
- 90 days
- Purpose
- Security monitoring
- Deletion method
- Automatic purge
Deleted-account residue
- Retention
- 30 days soft + 30 days hard
- Purpose
- Reversal window
- Deletion method
- Cryptographic erasure
| Data category | Retention | Purpose | Deletion method |
|---|---|---|---|
| Email metadata | 180 days | Fraud pattern correlation | Automatic purge |
| Email content (body) | Not stored | Per s.5 minimality | N/A |
| Account PII | Account lifetime + 90 days | Service delivery | On account close |
| Verification results | 90 days live + 7 years cold storage | Audit + research | After 7 years |
| Billing data | 5 years | SARS requirement | Year +5 anniversary |
| Cookies | 30 days | Session persistence | Browser-driven |
| Audit log | 7 years | POPIA s.53 + court evidence | After 7 years |
| Support messages | 2 years | Quality assurance | Rolling 24 months |
| IP addresses | 90 days | Security monitoring | Automatic purge |
| Deleted-account residue | 30 days soft + 30 days hard | Reversal window | Cryptographic erasure |
7.Your rights under POPIA (DSAR)
We respond to verified DSAR requests within 30 days as required under POPIA s.52.
8.Data processors (sub-processors)
Cloud infrastructure
- Purpose
- Database, authentication, storage
- Location
- EU (migrating to South Africa)
- Safeguard
- SCCs + encryption in transit & at rest
AI analysis
- Purpose
- Phishing & fraud pattern detection
- Location
- EU multi-region
- Safeguard
- SCCs; your data is not used to train models
Email delivery
- Purpose
- Transactional email
- Location
- United States
- Safeguard
- SCCs
Error monitoring
- Purpose
- Application error monitoring
- Location
- US + EU
- Safeguard
- SCCs
Payment processing
- Purpose
- Subscription billing
- Location
- South Africa
- Safeguard
- In-country processor
Content delivery & security
- Purpose
- CDN + DDoS protection
- Location
- Global edge
- Safeguard
- SCCs
| Processor | Purpose | Location | Safeguard |
|---|---|---|---|
| Cloud infrastructure | Database, authentication, storage | EU (migrating to South Africa) | SCCs + encryption in transit & at rest |
| AI analysis | Phishing & fraud pattern detection | EU multi-region | SCCs; your data is not used to train models |
| Email delivery | Transactional email | United States | SCCs |
| Error monitoring | Application error monitoring | US + EU | SCCs |
| Payment processing | Subscription billing | South Africa | In-country processor |
| Content delivery & security | CDN + DDoS protection | Global edge | SCCs |
9.International transfers
Some processors are outside South Africa. We ensure equivalent protection via Standard Contractual Clauses under POPIA s.72 and, where applicable, the EU-US Data Privacy Framework.
10.Security & encryption
How your data is protected
- TLS 1.3 in transit; HSTS preload for tenderfraud.co.za.
- AES-256 at rest for database and storage.
- Row-level security at the database layer — every query is identity-scoped.
- HSM-backed signing keys; rotation quarterly.
- Audit logs cryptographically tamper-evident.
12.Children’s data
Tender Fraud Prevention is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal data, contact us and we will erase it.
13.Breach notification
If a security incident affects your personal information, we will notify you and the Information Regulator within 72 hours of discovery, per POPIA s.22.
14.Contact & complaints
Privacy queries
Contact usInformation Officer
Contact usRevision history
- v4.115 April 2026 · Added DSAR rights cards, expanded processor list
- v4.010 Jan 2026 · POPIA s.72 international-transfers section
- v3.504 March 2025 · Initial POPIA-aligned publication