Privacy Policy

1. Who We Are and How to Reach Us

TENDER ASILI COMPANY LIMITED operates the TenderAsili website and platform. For the purposes of the Kenya Data Protection Act, 2019 (the "DPA"), TenderAsili is the data controller of the personal data you provide through the platform, and a data processor in respect of data we handle on behalf of buyers running their own sourcing activities.

TENDER ASILI COMPANY LIMITED is registered with the Office of the Data Protection Commissioner (ODPC) as a Data Controller, registration identification 519-6963-FF83. You can contact us about any privacy matter at contact@tenderasili.com, through https://www.tenderasili.com, or by writing to TENDER ASILI COMPANY LIMITED, Kunde Road, Nairobi, Kenya, +254 714 555 554.

2. Scope of This Policy and Definitions

This policy covers personal data processed through the TenderAsili website and platform for buyers, suppliers, their authorized representatives, and website visitors. By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. In this policy, unless the context otherwise requires:

• "Account" means a unique account created for you to access the Service or parts of the Service.
• "Company", "we", "us", or "our" refers to TENDER ASILI COMPANY LIMITED (TenderAsili).
• "Cookies" means small text files placed on your device by the Website, containing details of your browsing history on the Website.
• "Device" means any device that can access the Service.
• "Personal data" means any information relating to an identified or identifiable natural person, as defined under the DPA. "Sensitive personal data" carries the special meaning given to it under the DPA.
• "Service" means all products and services offered or provided on the Website and platform.
• "Website" means the TenderAsili website and platform, accessible from https://www.tenderasili.com.

This policy should be read together with our Cookie Policy and our Security & Data Protection statement, which are incorporated by reference.

3. Information We Collect

Depending on how you use the platform, we may collect, or you may be required to provide, the following categories of personal data. We collect it to verify whether you are entitled to access and use certain information, materials, and services on the platform, to enhance your visit, and to assist you with customer service or technical support issues:

• Contact and account data — name, email address, phone number, address, job title, company name, and role (buyer, supplier, or admin).
• Other personal identifying information — such as age, gender, and other personal data, where you provide it or where a particular Service requires it.
• Business and qualification data — company registration details, KRA/tax identification and compliance status, professional certifications, bank/payment details you submit for verification, and documents required for registration, prequalification, or sourcing.
• Sourcing and transaction data — RFQs, quotes, bids, purchase orders, invoices, evaluation records, and communications exchanged through the platform.
• Payment and financial data — financial information related to your orders, including your payment method and identifying payment information, and records of fees paid. Card payments are handled by our PCI-DSS-compliant payment partner; we do not store full card numbers.
• Social network data — where you sign in using a social network account (such as Facebook), the permissions and user information that network shares with us.
• Technical and usage data — server data related to the IP address you use to visit the platform, including your browser, operating system, access time, and site activity; log data; and cookies used to operate, secure, and improve the platform.
• Mobile device information — such as your device ID, model, and location.

4. How We Use Your Information and Our Lawful Basis

The personal information you provide is kept confidential and is used to support your customer relationship with us and to notify you of information that we think may be of interest to you. You may be required to submit limited personal information when accessing the Services. Specifically, we use personal information to:

• manage your account information;
• customize advertisements;
• deliver promotions;
• email you to confirm your account;
• manage payments;
• increase the efficiency of the platform;
• notify you of updates;
• offer new products and services;
• monitor and prevent fraudulent activity;
• request your feedback;
• resolve account disputes;
• respond to your service requests; and
• ensure compliance with applicable laws, including our obligations to make disclosures to authorities, regulators, and government bodies.

Under the DPA we must have a lawful basis for each processing activity. We rely on the following:

• Performance of a contract — to create and authenticate your account, run sourcing events (RFQ, quote, purchase order, invoice), and provide the services you request.
• Legal obligation — to verify tax and registration status, keep records required by law, and respond to lawful requests from regulators or courts.
• Legitimate interests — to secure the platform, prevent fraud and abuse, and improve our services, balanced against your rights and freedoms.
• Consent — to send marketing communications, make your supplier profile discoverable to buyers, and set non-essential cookies. You may withdraw consent at any time.

By using our website and providing personal information, you consent to the collection, use, and disclosure of your personal data as described in this Privacy Policy, for the purposes set out above, which include managing your account, customizing advertisements, delivering promotions, enhancing your experience of the platform, providing customer support, and complying with applicable laws and regulations. We also use cookies and similar technologies, as described in section 11 and our Cookie Policy, to improve the platform's functionality and personalize your experience. You have the right to withdraw your consent at any time by contacting us as described in this policy; please note that withdrawing consent may affect certain services or functionality provided through the platform.

5. How We Share and Disclose Your Information

Any disclosure of your personal information is made in accordance with applicable law and regulations. We assess and review each request for information and may decline to provide it to the requesting party. We may share or disclose your personal data:

• With buyers — when you participate in their sourcing events or, with your consent, make your supplier profile discoverable to them.
• With service providers (data processors) — third-party service providers who require access to the data to perform work on our behalf and help us deliver our services, including cloud hosting and object storage, email and SMS delivery, analytics, and payment processing. Each is bound by written data-processing agreements requiring confidentiality and DPA-equivalent protection.
• With law-enforcement agencies, network providers, regulatory authorities, courts, or other statutory authorities — in response to a demand issued with the appropriate lawful mandate, where the form and scope of the demand comply with the law, or otherwise where required by law, regulation, or a valid court order, or to protect our rights, users, or the public.
• With emergency service providers — where disclosure is necessary for your rescue, health, or safety.
• On a business transfer — in connection with a merger, acquisition, or reorganization, subject to this policy and reasonable notice to you.
• With any other person with whom we consider it legitimately necessary to share the data, in accordance with applicable law.

6. Where and How We Store and Protect Your Data

We are committed to maintaining the confidentiality, integrity, and security of personal information, and we take all appropriate security measures to protect personal information made available to us against loss, destruction, and damage, and against unauthorized or accidental access, processing, erasure, use, transfer, modification, disclosure, or other misuse.

Your data is stored on reputable cloud infrastructure, with documents held in secure object storage. We employ industry-standard technical and organizational measures, including:

• Data encryption — encryption protocols to transmit and store sensitive data securely, including encryption of data in transit and encryption of sensitive data at rest.
• Access control — access to your personal information is restricted to authorized personnel only, on the principle of least privilege, through role-based access control.
• Regular audits — periodic security audits to identify and rectify potential vulnerabilities in our systems, supported by audit logging.
• Application protections — protection against common web attacks (such as cross-site scripting, cross-site request forgery, and SQL injection) and rate limiting.

In the unfortunate event of a data breach that may compromise the security of your personal information, we will take all necessary steps to mitigate its impact and notify you promptly, as described in section 10. Our full approach is described in our Security & Data Protection statement.

7. International Data Transfers

Some of our service providers may process data outside Kenya. Where we transfer personal data across borders, we do so in accordance with the DPA — either where the destination provides adequate protection, where appropriate safeguards (such as contractual data-protection clauses) are in place, or on another lawful basis permitted by the Act.

8. Data Retention

We will not keep your personal information for longer than we need to. In most cases, this means we retain it only for the duration of your relationship with us, unless we are required to keep it longer to meet our legal and regulatory obligations. In particular, supplier and sourcing records are retained for seven (7) years to satisfy tax, audit, and procurement record-keeping requirements, after which the data is securely deleted or anonymized unless a longer period is required by law. Contact-only records (for example, website enquiries) are held for a shorter period and deleted after prolonged inactivity.

9. Your Rights Under the Data Protection Act

Subject to the DPA, you have the right to:

• be informed of the use to which your personal data is put;
• request access to the personal data we hold about you, and receive a copy of it;
• request that we correct or update personal data that is inaccurate or incomplete;
• request deletion or erasure of your personal data where the law allows — for example, where it is no longer necessary for the purposes for which it was collected, or where you withdraw your consent and there is no other legal basis for processing it;
• request restriction of the processing of your personal data in certain situations, and object to processing for direct-marketing purposes or based on legitimate interests;
• receive the personal data you provided to us in a structured, commonly used, and machine-readable format, and have it transmitted to another controller where technically feasible (data portability);
• withdraw your consent at any time where we rely on it as the legal basis for processing, without affecting processing already carried out;
• not be subject to a decision based solely on automated processing that significantly affects you; and
• lodge a complaint with the Office of the Data Protection Commissioner, or with the relevant supervisory or data protection authority in your jurisdiction.

To exercise any of these rights, or if you have any questions or concerns about your personal data, contact us at contact@tenderasili.com or using the details in section 18. We will respond to your requests and inquiries in accordance with applicable data protection laws and within the timeframe required by the DPA. You may also complain to the ODPC via www.odpc.go.ke.

10. Data Breach Notification

We maintain procedures to detect, report, and investigate personal-data breaches. In the event of a data breach that may result in unauthorized access to or disclosure of personal data, we will take immediate action to mitigate its impact. We will notify affected users, and the ODPC and other relevant authorities as required by the DPA and other applicable laws and regulations, without undue delay; where a breach is likely to result in a risk to your rights and freedoms, we will always notify the ODPC. We will communicate the breach to affected users by email or other appropriate means promptly after discovering it.

The notification will include information about the nature of the breach, the types of personal data potentially affected, the steps taken to address the breach, and any measures you can take to protect yourself from potential harm. We are committed to safeguarding our users' personal data and will take all necessary steps to prevent and respond to data breaches in a timely and transparent manner.

11. Cookies and Tracking

Cookies are small text files stored on your device when you visit our website. We use strictly necessary (essential) cookies to keep you logged in and secure the platform, and — with your consent — functional cookies to remember preferences, analytics cookies to help us understand how users interact with the platform, and marketing cookies to personalize content and advertisements based on your preferences.

You can manage non-essential cookies through the consent banner, and you can accept or reject cookies through your browser settings. Please note that disabling cookies may affect certain features and functionality of the platform. Full details are in our Cookie Policy.

12. Third-Party Links

The platform may contain links to third-party websites, in the form of policies, advertisements, and other non-affiliated links. Unless expressly disclosed, we do not endorse, recommend, or guarantee any third-party products or services by providing a link to them, and we are not responsible for the content or privacy practices of any external website. This Privacy Policy does not apply to third-party websites; we encourage you to review their privacy policies.

13. Automated Decision-Making, Profiling and Supplier Matching

We may use automated decision-making processes, including profiling, to analyze and predict your preferences, interests, behaviour, and other characteristics, so that we can provide personalized services, offers, and recommendations and enhance your experience of the platform.

To operate the platform we use automated processing, including matching and limited profiling based on the categories, locations, and qualifications in your profile. For example, we may automatically match suppliers to relevant sourcing opportunities, make supplier profiles discoverable to buyers whose requirements match, and send tender alerts based on your saved preferences.

These automated processes support, but do not replace, human decision-making — buyers make their own evaluation and award decisions. We do not make decisions producing legal or similarly significant effects about you based solely on automated processing without a lawful basis.

You have the right to request information about the logic involved in our automated decision-making processes, including profiling and matching, and about the potential consequences of such decisions. If you disagree with the results of automated decision-making, you may contest the decision and seek human intervention, subject to applicable laws and regulations. Please contact us using the details in section 18 if you wish to exercise these rights or have any concerns about the automated decision-making processes we use.

14. Marketing Communications, Opt-Out and Unsubscribe

Where you have consented — including by agreeing, when you register or subscribe, that we may contact you for marketing purposes, as set out in our Terms & Conditions — we may send you marketing communications and platform updates by telephone, email, and SMS. You can opt out of marketing at any time:

• Email — follow the instructions provided in our emails, click the "unsubscribe" link in the footer of any marketing email or newsletter, or email contact@tenderasili.com.
• SMS — reply STOP to any marketing text message, or contact us to be removed.
• In-app — manage your notification and tender-alert preferences in your account settings.
• Contact us — through the contact details on our website or in section 18.

15. Helping Us Keep Your Information Secure

While we take the utmost care to protect your personal information, it is essential that you also take certain precautions to safeguard your data:

• refrain from sharing sensitive information on public forums, and avoid using weak passwords;
• protect yourself against unauthorized access to your password and to the computer or device you use to access the platform; and
• always sign off when you finish using a shared computer or device.

We work to protect the security of your information during transmission. Where card details are shown when confirming an order, we reveal only the last four digits of your card number. The full card number is transmitted only to the appropriate card company or payment partner during order processing, and we do not store it. Always take care when sharing or using your account.

16. Inquiries and Complaints

You have the right to inquire about the personal information we collect, process, and store. We will make every effort to respond promptly and transparently to all legitimate inquiries about personal-data processing, within the scope of applicable data protection laws.

If you believe that your personal information has been processed in a way that is not in accordance with this Privacy Policy or applicable data protection laws, or if you have concerns about our data-handling practices, please contact us first at contact@tenderasili.com so that we can try to resolve it. We will acknowledge your complaint and promptly investigate it, with the objective of resolving it fairly and efficiently, and we will keep you informed of the progress and outcome of the investigation. We may require proof of your identity and full details of your request before we can process your inquiry or complaint.

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.

17. Changes to This Policy

We reserve the right to update, modify, or amend this Privacy Policy as necessary. When we make significant or material changes, we will notify you through a prominent notice on the platform or by other appropriate means. We encourage you to review this policy periodically to stay informed about how we protect your privacy. The version published on the platform is the one that applies, and by continuing to use the Service after changes take effect, you consent to the updated Privacy Policy.

18. Contact Us

If you have a question or concern about our handling of your personal information or this Privacy Policy, or wish to exercise your data protection rights, contact us at contact@tenderasili.com, call us on +254 714 555 554, submit a request through our digital platforms at https://www.tenderasili.com, or write to TENDER ASILI COMPANY LIMITED, Kunde Road, Nairobi, Kenya.