Privacy policy

1. Who is responsible for your data

The data controller is International Micro Services ("IMS", "we"), a company incorporated in Morocco, with its registered office at R403 Technopark Rabat, Maroc — tax ID (IF) 66998567, ICE 003756193000072.

For any question about your data: contact@tender.africa. This is also where to exercise your rights (section 12).

2. What this policy covers

It applies to the tender.africa website and app, to the API and the connector for AI assistants (the "Flux" plan), and to the emails and notifications we send.

It concerns two groups of people:

• — our users — people who create an account or contact us (sections 3 to 12);
• — people named in the public procurement data we republish — officials of public buyers, bidders, award winners (section 9).

The service is for professionals. It is not intended for anyone under 18.

3. The data we process

To open an account, a name, an email address and a password (or a Google sign-in) are required: without them we cannot create the account. Everything else is optional, except the billing identity we need to issue an invoice in your name.

We do not ask for any sensitive data (health, opinions, religion…), any national ID number or any card number: payment is by bank transfer.

4. Why we process it, and on what basis

We do not send you marketing on behalf of third parties, and we neither sell nor rent any data.

5. Personalisation and artificial intelligence

The "For you" feed

The order of tenders in your feed is computed from the sectors and regions you chose, inferred sectors, your bookmarks, the tenders you unlocked and the buyers you follow. Members of the same company account share this profile. This sorting has no legal effect on you: it only decides what you see first.

Inferred sectors

So that a new account does not start with an empty feed, we infer the sectors your company works in from the company name, the domain of your email address, public information about the company (its website, business directories, the press) and your use of the service. These inferences are used only to sort your feed. You can ask to see, correct or delete them, and object to their being made.

AI analyses

When you request an analysis, it is the tender documents — notice, tender regulations, specifications, bills of quantities — that are sent to an AI model provider. These documents are published by the public buyer. Your name, email, company and profile are not part of what is sent; the request is identified by the tender reference, not by your account.

The public documents may themselves contain people’s names (an official of the buyer, members of a committee, bidders): see section 9. Some AI providers may, under their own terms, use the content they receive to improve their models; one more reason why we send them public documents only.

The PDF report of a deep analysis, which carries your company name on its cover, is produced on our own servers.

6. Who can access your data

Within IMS, only people who need it for their work (support, billing, engineering) access your data. Our team is notified of each new sign-up (name, email, company, country) so we can help you get started.

Members of the same company account share the account’s credits and plan.

We use the following providers, who act only on our instructions:

We may also disclose data to administrative or judicial authorities where the law requires it.

7. Transfers outside Morocco

The providers shown outside Morocco in the table above receive data from Morocco. We limit each transfer to what the service you ask for needs: AI providers receive public documents only, Google is involved only if you sign in with Google, WhatsApp only if you write to us there.

These transfers are governed by articles 43 and 44 of Law No. 09-08: they are necessary to perform our contract with you, or subject to the CNDP’s authorisation where it is required.

Where the GDPR applies to you, transfers to countries without an adequacy decision rely on the provider’s standard contractual clauses, or on their necessity to perform our contract (GDPR articles 46 and 49).

8. How long we keep it

9. People named in public data

Tender Africa republishes notices published by public buyers and institutions: Morocco’s public procurement portal (marchespublics.gov.ma), other Moroccan sources, the official portals of Kenya, South Africa, Zambia and Tanzania, the African Development Bank and the United Nations Global Marketplace (UNGM).

These notices may name people: the name, work email and phone of the official in charge; members of a bid-opening committee; companies — including sole proprietorships trading under their owner’s name — that bid for or won a contract, with the amounts.

We republish them as published, to inform businesses about public procurement, which is public by nature. Officials’ contact details are shown only to signed-in users.

If you are one of these people, you can ask us for access to this data, ask us to correct it if we reproduced it wrongly, or object to its processing on legitimate grounds: contact@tender.africa. We handle your request within the same time limits as a user’s.

Users who contact a buyer using these details do so under their own responsibility, and only about the tender concerned (see our terms of service).

10. Cookies, local storage and traffic measurement

We set no cookies. The app does keep a few things in your browser’s local storage, because it could not work without them:

• — your session token and a copy of your profile, to keep you signed in;
• — your language, light or dark theme and display preferences (feed sorting, pricing zone, tips already seen);
• — your bookmarks, so they stay available offline, and your last six searches;
• — a temporary copy of some server responses (5 minutes for tenders, 1 hour for statistics and filters), so the app stays usable on a weak connection.

Signing out clears your session, profile, preferences, bookmarks and searches; the temporary copies expire by themselves.

Traffic measurement

We measure traffic with Umami, a tool we host ourselves. It sets no cookie and does not follow you to other sites. When you are signed in, statistics are linked to your account, so we know which features are actually used.

On some visits (about 15%), a session recording (pages viewed, clicks, scrolling, for 5 minutes at most) helps us find what blocks users. What you type into input fields is masked; text displayed on screen remains visible in the recording.

You can block both tools with any content blocker: the service works exactly the same.

Google

If you use Sign in with Google, Google may set its own cookies, under its own privacy policy.

11. Security

• — All communication with the service is encrypted (HTTPS).
• — Passwords and API keys are never stored in clear.
• — Data is hosted on our own infrastructure in Morocco, with access limited to the people who need it.
• — Signing out and deleting your account revoke open sessions immediately.

If a security incident put your data at risk, we would tell you without delay, and the competent authorities where the law requires it.

12. Your rights

Under Law No. 09-08, you have the right to access, rectify and object to the processing of your data. In practice, you can:

• — find out what data we hold about you and get a copy, in a machine-readable format if you wish;
• — correct inaccurate or incomplete data — most of it can be edited directly in your profile;
• — delete your account yourself, from your profile (see Deleting your account), or ask us to erase a specific piece of data;
• — object, on legitimate grounds, to processing — and without any reason to marketing;
• — withdraw your consent to push notifications, and switch off the email digest, at any time.

Write to contact@tender.africa from your account’s address. If we have reasonable doubt about your identity, we may ask you to confirm it. It is free, and we answer within 10 days.

If you believe your rights are not being respected, you can complain to Morocco’s Commission nationale de contrôle de la protection des données à caractère personnel (CNDP) — Avenue Al Arz, Secteur 4, M1, Hay Riad, Rabat · +212 5 37 57 11 24 · contact@cndp.ma · cndp.ma.

13. If you are outside Morocco

European Economic Area, United Kingdom, Switzerland. Where the GDPR (or its UK or Swiss equivalent) applies to you, you also have the right to restriction of processing and to data portability, and you can complain to the data protection authority of your country. The legal bases in section 4 are those of GDPR article 6: contract, legal obligation, legitimate interest and consent.

United States. We do not sell your personal information and do not share it for targeted advertising.

Other African countries. If your country’s law gives you additional rights — in Kenya, South Africa or Nigeria for example — write to us and we will apply them.

14. Changes

The date at the top shows the last update. If we change this policy materially — a new purpose, a new provider abroad, a longer period — we will tell you by email or in the app before the change applies.