Vendergate Privacy Policy
Version: 1.0 · Last updated: [COMPLETE — publication date]
This notice is provided to satisfy the requirements of section 64 of the Zambia Data Protection Act, 2021 (Act No. 3 of 2021). Fields highlighted below must be completed by Vendergate before publication.
1. Who we are (the Data Controller)
[COMPLETE — registered legal entity name](“Vendergate”, “we”, “us”) operates the Vendergate sealed-bid procurement marketplace. We are the Data Controller for the personal data described in this policy, registered with the Data Protection Commission of Zambia under registration number [COMPLETE — DPC registration no. once issued].
- Registered address: [COMPLETE — physical address in Zambia]
- Contact for privacy matters / Data Protection Officer: [COMPLETE — DPO name], [COMPLETE — dpo@…email], [COMPLETE — phone]
If you believe we have handled your personal data unlawfully, you may complain to us using the contact above, and you have the right to complain to and seek redress from the Data Protection Commissioner (sections 68–69 of the Act).
2. What personal data we collect
We collect only what we need to run a procurement marketplace:
| Category | Examples | Where it comes from |
|---|---|---|
| Account identity | Full name, email address, password (stored encrypted) | You, at sign-up |
| Organisation details | Company name, PACRA registration number, ZRA TPIN, organisation type (buyer/supplier) | You, when you create or join an organisation |
| Verification documents | Certificate of incorporation, tax clearance, NAPSA registration, professional certificates (e.g. EIZ), and identity documents you upload | You, during verification |
| Procurement activity | Tenders you publish, bids you submit (amount, notes), award records, questions & answers, delivery locations | You, as you use the marketplace |
| Payment data | Mobile-money phone number, payment provider references, transaction records | You and our payment provider, when you pay |
| Communications | In-app notifications, invitations, support correspondence | Generated as you use the service |
| Technical data | Log data needed to keep the service secure and available | Automatically, when you use the service |
We do not knowingly collect the personal data of children. The marketplace is for registered businesses and their authorised representatives.
3. Why we process it, and our lawful basis
Under section 13 and section 15 of the Act, we rely on the following lawful bases:
| Purpose | Lawful basis |
|---|---|
| Creating and securing your account | Performance of our contract with you (our Terms of Service) |
| Verifying that organisations are genuine (anti-fraud) | Our legitimate interest in a trustworthy marketplace, and legal obligation |
| Running tenders, bids, awards, and Q&A | Performance of our contract with you |
| Processing payments and keeping billing records | Performance of our contract, and legal obligation (tax/accounting) |
| Sending you service notifications | Performance of our contract |
| Sending you marketing or product updates | Your consent (which you can withdraw at any time — see section 7) |
| Meeting record-keeping, tax, and procurement-audit obligations | Legal obligation |
| Transferring data to our hosting/payment providers outside Zambia | Your consent plus safeguards — see section 6 |
You give consent when you tick the consent box at sign-up. Consent is freely given, specific, and informed, and you may withdraw it at any time (section 15(6)); withdrawal does not affect processing that already happened or that rests on another lawful basis.
4. How your data is shared inside the marketplace
Confidentiality is core to sealed-bid procurement. By design:
- Bids are sealed. Until a tender closes, no one — including the buyer — sees bid amounts or bidder identities.
- Questions & Answers are anonymous to other participants, and our system blocks contact details and prices from being posted in them.
- A buyer sees a supplier’s identity only where the process requires it — for example when the supplier is invited to a selective tender, or when a tender is awarded.
- Losing bidders’ prices and identities are not disclosed to competitors.
5. Who else we share data with
We share personal data only with:
- Service providers acting as our data processors — our hosting provider (Supabase) and our payment provider(s) — under contracts that require them to protect your data and act only on our instructions.
- Authorities, where we are required by law or to establish, exercise, or defend legal claims.
We do not sell your personal data.
6. Transfers outside Zambia
Section 70 of the Act requires personal data to be stored on servers in Zambia, and requires sensitive personal data to remain in Zambia. Some of our service providers currently host data outside Zambia. Where that happens, we transfer data under section 71 — on the basis of your consent together with [COMPLETE — describe the safeguard actually in place: a Data-Protection-Commissioner-approved standard contract / intra-group scheme, or a specific DPC approval].
Internal note (remove before publishing):This clause is only accurate once Vendergate has (a) obtained the data subject’s transfer consent, and (b) put a DPC-approved transfer mechanism in place, or moved hosting into Zambia. Until then, this section describes an intended state, not a completed one. Sensitive verification documents in particular may need to be hosted in Zambia to satisfy section 70(3).
7. Your rights
Under Part IX of the Act you have the right to:
- Access your personal data and receive a copy (section 58). You can download a copy of your data yourself from your Account page, in a commonly used electronic format.
- Rectify inaccurate data (section 59) — edit your profile and organisation details, or contact us.
- Erase your data (section 60) — delete your account from your Account page. Where the law or an ongoing contract requires us to keep certain records (for example completed procurement transactions and payment records), we anonymise them rather than deleting them, so they can no longer be linked to you.
- Object to processing, including objecting to marketing at any time (section 61) — toggle marketing off on your Account page.
- Restrict processing (section 63) and request data portability (section 65) — use the export feature or contact us.
- Withdraw consent (section 15(6)) at any time.
We respond to rights requests without undue delay. The first copy of your data is free.
8. How long we keep your data
We keep personal data only as long as needed for the purposes above, then delete or anonymise it. In summary:
- Account data: while your account is active, then deleted/anonymised on account deletion.
- Procurement records (tenders, bids, awards): retained after account deletion in anonymised form for marketplace integrity and legal/audit obligations.
- Payment and tax records: retained for the period required by Zambian tax and accounting law.
- Verification documents: retained while your organisation is active and for a limited period afterward, then deleted.
9. How we protect your data
We use technical and organisational measures required by section 47, including row-level access controls that enforce the confidentiality rules above, encryption of credentials, restricted staff access, and audit logging. If a breach affects your rights, we will notify you and the Data Protection Commissioner without undue delay (section 49).
10. Changes to this policy
We may update this policy to reflect changes in the law or our service. We will post the new version here with an updated date and, where changes are significant, notify you.
11. Contact
Questions or requests: [COMPLETE — DPO name / email / phone], or write to us at [COMPLETE — registered address].