BidWunder

BidWunder Privacy Policy

Last Updated: 2026/05/25

Welcome to BidWunder (“we,” “us,” or “our”). We are committed to protecting your privacy and ensuring that any personal information we collect is handled in a safe and responsible manner, in compliance with the Protection of Personal Information Act (POPIA) of South Africa and other applicable laws.

If you have any questions or concerns about our practices, please contact us at info@bidwunder.com or visit our Contact Page.

1. Scope of This Privacy Policy

This Privacy Policy applies to:

  • Our website, za.bidwunder.com, including all subdomains and related services.
  • Any other websites, pages, features, or content owned and operated by BidWunder that include this Privacy Policy.
  • Interactions you may have with our emails and/or customer support.

By accessing or using our service, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy and our compliance with POPIA.

2. Information We Collect

2.1 Personal Information You Provide

  • Registration Data: When you create an account or profile, we may collect personal information such as your name, email address, and business preferences.
  • Communication Data: If you contact us (e.g., by email or through our website), we may collect the contents of your message, your contact details, and any attachments you provide.
  • Survey and Questionnaire Data: We may occasionally invite you to participate in surveys or questionnaires (e.g., to gather feedback, understand your needs, or improve our service). These are hosted on Google Forms. Participation is voluntary. Any personal information you provide in a survey response is processed in accordance with this Privacy Policy and Google's Privacy Policy.

2.2 Automatically Collected Information

  • Usage Data: We may collect information automatically about your interactions with our website, such as your IP address, browser type, pages viewed, and the dates/times of your visits.
  • Analytics: We use two complementary analytics tools to understand how visitors and users interact with our service:
    • Umami (self-hosted on our own infrastructure): Records only anonymous, aggregated data such as page views, referrer URLs, browser type, operating system, and approximate country. It does not use cookies, does not track users across websites, and does not collect personal identifiers. No data is shared with third parties.
    • PostHog (hosted by PostHog Inc. on their EU Cloud, with data stored in Frankfurt, Germany): Captures product-usage events such as page views and clicks, and records anonymised session replays so that we can diagnose usability issues and improve the product. Session recordings have input masking enabled by default: anything you type into form fields (search queries, email addresses, passwords, business information) is blocked from the recording and never sent to PostHog. We do not create a user profile in PostHog for anonymous browsing - profiles are only linked once you sign in. PostHog acts as a data processor on our behalf under a signed Data Processing Agreement (see §4.8).
  • Marketing Attribution: When you arrive at our website via a marketing campaign link (e.g., from social media or email), the campaign parameters (known as UTM parameters) in the URL may be temporarily stored in your browser's session storage. This data is tab-scoped, is not shared with third parties, and is automatically cleared when you close the browser tab. If you create an account during that session, we may record the campaign that led to your registration to help us understand which marketing efforts are effective.
  • Cookies: In addition to the essential cookies required for secure login and session management, our analytics processor PostHog sets a small number of first-party cookies in your browser to remember your anonymous identifier and current session, so that page views and clicks within a single visit can be grouped together. These cookies do not identify you personally on their own and are not shared with any third party other than PostHog. Umami does not use cookies.

3. How We Use Your Information

We use the information we collect for the following purposes, in compliance with POPIA’s requirement for lawful processing:

  1. Service Provision: To provide, maintain, and improve the BidWunder service, including AI-based tender recommendations.
  2. Customer Support: To respond to your inquiries, troubleshoot issues, and improve customer experience.
  3. Email Communications: To send regular email updates (e.g., tender recommendations on your chosen schedule) and account-related notifications such as trial reminders and onboarding tips. Every commercial email includes an unsubscribe link, and your email client may offer a one-click unsubscribe option. You can manage your email preferences at any time from your account settings, including choosing which days to receive recommendations and whether to receive marketing emails. Links in our emails may contain campaign parameters to help us measure email effectiveness.
  4. Business Operations: To analyze usage trends, maintain security, and help us improve the functionality and user experience of our service.

We will not sell or share your personal information with third parties for direct marketing purposes without your explicit consent.

3.1 Automated Decision-Making and Profiling

BidWunder uses AI-powered algorithms to provide personalized tender recommendations. This automated processing:

  • Analyzes your business profile information and stated preferences
  • Generates relevance scores for available tenders
  • Determines which tenders to recommend via email and in your dashboard

This automated processing is necessary for the performance of our contract with you to provide personalized tender recommendations. You can influence these recommendations by updating your business profile preferences at any time. No decisions with significant legal effects are made solely through automated means without human oversight.

4. Third-Party Services

4.1 Amazon Web Services (AWS)

  • Hosting: Our website is hosted on AWS servers located in Cape Town, South Africa.
  • Emails: We also use AWS for sending emails; these services are hosted in the same region.
  • AWS Privacy Policy

4.2 OpenAI

We use OpenAI's API for integrating AI functionalities into our software.

4.3 AWS Cognito

We use AWS Cognito for secure user authentication and account management. This service handles user authentication, login credentials, and session management. We do not store passwords on our servers.

4.4 Payment Providers (Stripe)

We use third-party payment providers to process subscriptions and payments. Currently, we use Stripe for payment processing. We do not store or process your payment information (e.g., credit card details) on our servers. Any payment information you provide is handled directly by these third-party payment processors.

We only share information with these third-party services as necessary to provide the service (e.g., processing payments or sending emails).

4.5 Google Workspace

We use Google Workspace for business email communications (e.g., responding to support inquiries, sending announcements). When you email us, your message is processed and stored by Google as part of our email infrastructure.

4.6 Google Forms

We may use Google Forms to conduct surveys, collect feedback, or gather information through questionnaires. When you submit a response, the data is processed and stored by Google on our behalf.

4.7 Cloudflare Turnstile

We use Cloudflare Turnstile on certain public forms (such as our contact and support pages) to protect against automated abuse. This service may process your IP address and browser characteristics to distinguish legitimate users from bots. No cookies are stored for this purpose.

4.8 PostHog

We use PostHog Inc. for product analytics and session replay (see §2.2 for what is captured and what is masked). PostHog acts as a data processor on our behalf under a signed Data Processing Agreement. Data is collected and stored on PostHog's EU Cloud, with infrastructure located in Frankfurt, Germany.

4.9 International Data Transfers

Some of our service providers, including OpenAI, Stripe, Google, Cloudflare, and PostHog, process data outside of South Africa. When we transfer personal information internationally, we ensure appropriate safeguards are in place as required by POPIA, including verifying that recipients maintain adequate data protection standards. Our AI functionality may send business profile information to OpenAI's servers in the United States for processing tender recommendations. Google processes email and survey data in its global data centers. Cloudflare processes limited technical data (IP address, browser characteristics) for bot protection. PostHog stores product-analytics events and session recordings in Frankfurt, Germany (EU Cloud), a jurisdiction that maintains adequate data protection standards under the EU General Data Protection Regulation.

5. Legal Basis for Processing (POPIA Compliance)

Under POPIA, we process personal information based on the following grounds:

  • Performance of Contract: We process your data to provide our services as per the agreement when you create an account or use BidWunder.
  • Legitimate Interests: We process your data to optimize our services, ensure security, and maintain our business operations.
  • Consent: Where required, we obtain your consent for specific data processing activities (e.g., marketing emails).

6. Data Retention

We keep your personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy or to comply with legal obligations. If you request deletion of your data, we will securely delete it unless we are required by law to keep it for a specified period. Where personal data has also been recorded by our analytics processor PostHog (for example, for signed-in users), we propagate the deletion to PostHog as part of the same request.

For operational and service fulfillment purposes, we may retain customer information on our systems as necessary to provide our services.

7. Data Security

We take reasonable administrative, technical, and physical measures to protect the information we collect from loss, theft, misuse, unauthorized access, disclosure, alteration, and destruction. These measures include:

  • Secure hosting with AWS
  • Encryption of data where applicable
  • Regular software updates and security patches
  • Limited access to personal data by employees on a need-to-know basis

However, no method of transmission or electronic storage is 100% secure. Therefore, we cannot guarantee absolute security.

7.1 Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Regulator and affected individuals as soon as reasonably possible after becoming aware of the breach, in accordance with POPIA requirements. Such notification will include the nature of the breach, the likely consequences, and the measures taken to address it.

8. Age Requirement

Our services are intended for business users and are not directed at individuals under 18 years of age. We do not knowingly collect personal information from individuals under 18. If you believe we may have accidentally collected such information, please contact us immediately at info@bidwunder.com, and we will delete it.

9. Your Rights Under POPIA

Under POPIA, you have the right to:

  • Access Your Information: Request confirmation of whether we hold your personal information, and request access to it.
  • Correct Your Information: Request that we correct or delete your personal information if it is inaccurate, irrelevant, or incomplete.
  • Object to Processing: Object to the processing of your personal information under certain circumstances.
  • Withdraw Consent: Where processing relies on your consent, you may withdraw that consent at any time.
  • Complain: Lodge a complaint with the Information Regulator if you believe your personal information has been processed unlawfully.

For more information on how to exercise these rights, please contact us at info@bidwunder.com.

10. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. The updated version will be posted on this page with an updated “Last Updated” date. We encourage you to review this Privacy Policy periodically for any changes. Your continued use of our service constitutes acceptance of the updated Privacy Policy.

11. Contact Us

If you have any questions, concerns, or requests related to this Privacy Policy or your personal information, please contact us:

The responsible party for the processing of your personal information under POPIA is Alexander Fischer-Brandies, Waldpromenade 57A, 82131 Gauting, Germany.

We are committed to resolving any issues you may have regarding your privacy and data protection.

12. Information Regulator – South Africa

If you believe that we are not adequately addressing your concerns regarding the processing of your personal information, you have the right to lodge a complaint with the Information Regulator of South Africa:

Thank you for entrusting BidWunder with your personal information.

Back to Home