Privacy

What we store

For an account we store the name, email address, and a password hash. If an authenticator app is turned on, we also store an encrypted authenticator secret and hashes of one-time recovery codes. Emailed sign-in codes are kept only until they expire. For a workspace we store the company profile, logo, vault files, uploaded tender packs, preparation progress, proposal drafts, and the bid team list. Contact form messages are stored so we can reply.

Official tender text comes from public sources, including National Treasury OCDS. Website extract reads only public pages that robots.txt allows. We do not sell company files or bid content.

Payments

Card payments are taken by PayFast. The card number is entered on PayFast’s page and is not stored by Lula Bid. We keep the package, the amount, the payment status, and the PayFast subscription reference so the workspace can show whether the subscription is active. VAT is not charged.

Email and Microsoft

Invite and proposal-team notices are emailed to the address on the bid team record when mail is configured. The same notice is kept on the Bid team page.

Microsoft directory search is optional. It runs only after that company’s Microsoft admin grants consent. Until then, people are added by name and email.

Access and deletion

The workspace owner controls who is invited. Each signed-in person only sees workspaces on their account. The owner can delete the workspace from Settings, which removes that workspace’s records. To ask for a copy of account information, or to raise a privacy request, use the contact page.