Privacy Policy
1. Who we are
Tenderbox is a construction tendering platform operated from Dubai, United Arab Emirates by [Legal entity name & address — GRAHAM TO CONFIRM] ("Tenderbox", "we", "us"). We are the data controller for the personal data described in this policy. We process personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL").
2. What we collect
- Contact form data — name, company, work email, phone number, and your area of interest, when you request a demo or register interest.
- Account data — name, work email, role, company details, and login records, when you or your organisation creates a Tenderbox account.
- Tender and bid data — tender documents, bills of quantities, bid submissions, and related business information uploaded to the platform. This is primarily business data, but may include contact details of individuals (e.g. named representatives of contracting firms).
- Technical data — basic usage and log information needed to run and secure the service.
3. Why we process it
- To respond to enquiries and demo requests.
- To provide, operate, and support the platform, including sealed-bid handling, bid analysis, and audit trails.
- To maintain security, prevent misuse, and meet legal obligations.
- To send service communications, and — only with your consent — occasional product updates. You can opt out at any time.
4. No sale of personal data
We do not sell personal data, and we do not share your tender or bid data with other clients. Client data is used solely to provide the service to that client. We use trusted service providers (e.g. hosting) only as needed to run the platform, under appropriate contractual safeguards, including where data is transferred outside the UAE as permitted by the PDPL.
5. Retention
We keep personal data only as long as needed for the purposes above: contact enquiries for up to 24 months after our last interaction; account and tender data for the life of the client relationship plus any period required for legal, audit, or dispute-resolution purposes; after which data is deleted or anonymised.
6. Your rights
Under the PDPL you have the right to access, correct, and request deletion of your personal data; to restrict or object to certain processing; to request a portable copy of your data; and to withdraw consent where processing is based on consent. To exercise any of these rights, contact us at hello@tenderbox.ae. You may also lodge a complaint with the UAE Data Office.
7. Contact
Questions about this policy or our data practices: hello@tenderbox.ae, or write to [Legal entity name & address — GRAHAM TO CONFIRM], Dubai, UAE.
We may update this policy from time to time; the latest version will always be posted here with a revised date.