Privacy Policy

1. Who We Are and How to Reach Us

TenderAsili Limited operates the TenderAsili website and platform. For the purposes of the Kenya Data Protection Act, 2019 (the "DPA"), TenderAsili is the data controller of the personal data you provide through the platform, and a data processor in respect of data we handle on behalf of buyers running their own sourcing activities.

We are in the process of registering with the Office of the Data Protection Commissioner (ODPC) as a data controller and as a data processor, and we handle personal data in accordance with the DPA in the meantime. You can contact us about any privacy matter at contact@tenderasili.com, or by writing to TenderAsili Limited, Kunde Road, Nairobi, Kenya, +254 714 555 554.

2. Scope of This Policy

This policy covers personal data processed through the TenderAsili website and platform for buyers, suppliers, their authorized representatives, and website visitors. "Personal data" means any information relating to an identified or identifiable natural person, as defined under the DPA. "Sensitive personal data" carries the special meaning given to it under the DPA.

This policy should be read together with our Cookie Policy and our Security & Data Protection statement, which are incorporated by reference.

3. Information We Collect

Depending on how you use the platform, we may collect the following categories of personal data:

• Contact and account data — name, email address, phone number, job title, company name, and role (buyer, supplier, or admin).
• Business and qualification data — company registration details, KRA/tax identification and compliance status, professional certifications, bank/payment details you submit for verification, and documents required for registration, prequalification, or sourcing.
• Sourcing and transaction data — RFQs, quotes, bids, purchase orders, invoices, evaluation records, and communications exchanged through the platform.
• Payment data — records of fees paid. Card payments are handled by our PCI-DSS-compliant payment partner; we do not store full card numbers.
• Technical and usage data — IP address, device and browser information, log data, and cookies used to operate, secure, and improve the platform.

4. How We Use Your Information and Our Lawful Basis

Under the DPA we must have a lawful basis for each processing activity. We rely on the following:

• Performance of a contract — to create and authenticate your account, run sourcing events (RFQ, quote, purchase order, invoice), and provide the services you request.
• Legal obligation — to verify tax and registration status, keep records required by law, and respond to lawful requests from regulators or courts.
• Legitimate interests — to secure the platform, prevent fraud and abuse, and improve our services, balanced against your rights and freedoms.
• Consent — to send marketing communications, make your supplier profile discoverable to buyers, and set non-essential cookies. You may withdraw consent at any time.

5. How We Share Your Information

We share personal data only as necessary to provide the services:

• With buyers — when you participate in their sourcing events or, with your consent, make your supplier profile discoverable to them.
• With service providers (data processors) — cloud hosting and object storage, email and SMS delivery, analytics, and payment processing. Each is bound by written data-processing agreements requiring confidentiality and DPA-equivalent protection.
• For legal reasons — where required by law, regulation, or a valid court order, or to protect our rights, users, or the public.
• On a business transfer — in connection with a merger, acquisition, or reorganization, subject to this policy and reasonable notice to you.

6. Where and How We Store Your Data

Your data is stored on reputable cloud infrastructure, with documents held in secure object storage. We apply technical and organizational measures including role-based access control, encryption of data in transit and encryption of sensitive data at rest, protection against common web attacks (such as cross-site scripting, cross-site request forgery, and SQL injection), rate limiting, and audit logging. Our full approach is described in our Security & Data Protection statement.

7. International Data Transfers

Some of our service providers may process data outside Kenya. Where we transfer personal data across borders, we do so in accordance with the DPA — either where the destination provides adequate protection, where appropriate safeguards (such as contractual data-protection clauses) are in place, or on another lawful basis permitted by the Act.

8. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy and to meet our legal and regulatory obligations. As a general rule, supplier and sourcing records are retained for seven (7) years to satisfy tax, audit, and procurement record-keeping requirements, after which the data is securely deleted or anonymized unless a longer period is required by law. Contact-only records (for example, website enquiries) are held for a shorter period and deleted after prolonged inactivity.

9. Your Rights Under the Data Protection Act

Subject to the DPA, you have the right to:

• be informed of the use to which your personal data is put;
• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion or erasure of your data where the law allows;
• object to, or request restriction of, certain processing;
• data portability, where applicable;
• withdraw consent at any time, without affecting processing already carried out;
• not be subject to a decision based solely on automated processing that significantly affects you; and
• lodge a complaint with the Office of the Data Protection Commissioner.

To exercise any of these rights, contact us at contact@tenderasili.com. We will respond within the timeframe required by the DPA. You may also complain to the ODPC via www.odpc.go.ke.

10. Data Breach Notification

We maintain procedures to detect, report, and investigate personal-data breaches. Where a breach is likely to result in a risk to your rights and freedoms, we will notify the ODPC and, where required by the DPA, affected data subjects, without undue delay.

11. Cookies and Tracking

We use strictly necessary cookies to keep you logged in and secure the platform, and — with your consent — functional and analytics cookies to remember preferences and understand usage. You can manage non-essential cookies through the consent banner or your browser settings. Full details are in our Cookie Policy.

12. Third-Party Links

The platform may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites, and we encourage you to review their privacy policies.

13. Automated Processing and Supplier Matching

To operate the platform we use automated processing, including matching and limited profiling based on the categories, locations, and qualifications in your profile. For example, we may automatically match suppliers to relevant sourcing opportunities, make supplier profiles discoverable to buyers whose requirements match, and send tender alerts based on your saved preferences.

These automated processes support, but do not replace, human decision-making — buyers make their own evaluation and award decisions. We do not make decisions producing legal or similarly significant effects about you based solely on automated processing without a lawful basis. Where such a decision is made, you have the right to request information about the logic involved, to contest the decision, and to obtain human review by contacting us using the details below.

14. Marketing Communications and Your Choices

Where you have consented, we may send you marketing communications and platform updates by email and SMS. You can opt out of marketing at any time:

• Email — click the "unsubscribe" link in the footer of any marketing email, or email contact@tenderasili.com.
• SMS — reply STOP to any marketing text message, or contact us to be removed.
• In-app — manage your notification and tender-alert preferences in your account settings.

15. Complaints

If you have a concern or complaint about how we handle your personal data, please contact us first at contact@tenderasili.com so that we can try to resolve it. We will acknowledge your complaint, investigate it fairly, and let you know the outcome. We may ask you to verify your identity and to provide details of your concern before we act on it.

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.

16. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will post a prominent notice on the platform. The version published on the platform is the one that applies, and your continued use after changes take effect constitutes acceptance of the revised policy.

17. Contact Us

For questions about this Privacy Policy or to exercise your data-protection rights, contact us at contact@tenderasili.com, by phone on +254 714 555 554, or by post to TenderAsili Limited, Kunde Road, Nairobi, Kenya.