Privacy policy

PamojaBid SARL, a company incorporated under Congolese law, with its registered office in Lubumbashi, Haut-Katanga, Democratic Republic of the Congo, is the controller of the processing described here.

For any question about your data or to exercise your rights: privacy@pamojabid.com.

This policy applies Ordinance-Law No. 23/010 of 13 March 2023 on the Digital Code (Code du numérique), in particular its provisions on the protection of personal data.

• PamojaBid is the controller for accounts, sign-in, security, suppliers’ document vaults and their verification, and the audit log.
• When a supplier submits a bid, the buying company that receives it becomes, on its side, the controller of how it uses that bid for its tender.
• For a buying company’s tenders, evaluations and decisions, PamojaBid processes the data on that buyer’s behalf and only on its instructions (a processor in the data-protection sense only), under the software licence agreement between them. PamojaBid performs no part of the buyer’s own activity.

• Account: name, verified email address or phone number, language, roles in organisations, two-factor settings.
• Sign-in and security: one-time codes (stored as a hash), sessions, the browser used, IP address stored as a hash.
• Organisations: legal identity, official identifiers (RCCM, national identification, tax number, ARSP certificate), address, and the documents uploaded to the vault — which may contain data about third parties: managers, shareholders and their nationality (to check the Congolese majority required by law), identity documents, signatories’ mandates.
• Tenders and bids: dossiers, questions, bids, prices, documents and evaluations, with the name of the person who acted.
• Audit log: who did what and when, with identifiers and codes — never your contact details.
• Conversations with the Glory assistant and working documents, private to their author or shared with their team as they choose.

As soon as the sign-in code is entered, an account is created with your verified address or number; it can only be used after accepting the terms of use at the next step.

An organisation that uploads documents about other people undertakes to have informed them. PamojaBid is for professionals: we do not knowingly process data about minors.

• Creating and securing your account, signing you in, managing organisations and their members — performance of the contract (the terms of use).
• Verifying supplier organisations and their documents, publishing tenders, receiving, sealing and then opening bids — performance of the contract with you and with the buyer.
• Keeping a tamper-proof audit log and preventing fraud — the legitimate interest of PamojaBid and buyers in proving who did what, and compliance with their legal obligations.
• Sending you service messages (codes, invitations, security alerts, outcomes) — performance of the contract.
• Using artificial intelligence for the features you or your organisation choose to use — performance of the contract; these features remain optional.
• Responding to authorities when the law requires it — legal obligation.

We do not sell your data or use it for advertising.

When you use an artificial intelligence feature (Glory, reading a dossier, drafting a bid, comparing bids or checking prices), we send the model provider the content the request needs: the tender’s text and documents, your organisation’s documents, your question and, for a buyer, bids that have already been opened.

A bid is never sent before it is opened. Data is sent to produce the answer, not to train models, under the data-processing agreement signed with the provider, which also sets how long the provider keeps it.

The model proposes drafts and suggestions; no decision about you (verification, award, exclusion) is made solely by automated means. A person always decides.

Every call to the model is recorded in the audit log, without the content of the request.

• Members of your organisation, according to their role.
• The authorised members of the buyer you submit a bid to, after it is opened.
• The public, only for the information a buyer makes public about a tender (never your documents or bids).
• The PamojaBid team, for verification and support, every view of a document being recorded in the audit log.
• Our technical processors, listed below, only for the service they provide to us.
• Authorities, when the law obliges us.

We use the following providers, bound by contract to confidentiality and security:

• Hosting, database and document storage: Hetzner Online GmbH — Germany and Finland (European Union).
• Artificial intelligence: Anthropic PBC (Claude models) — United States.
• Artificial intelligence, only for writing tender summaries when that feature uses it: DeepSeek — China.
• Sending emails: Postmark (ActiveCampaign, LLC) — United States.
• Sending text messages: Africa’s Talking Ltd — Kenya.

These providers therefore process data outside the Democratic Republic of the Congo. We make these transfers only to providers offering sufficient safeguards, set out by contract, and in line with the conditions the Digital Code sets for international transfers.

The current list of our processors is available on request at privacy@pamojabid.com.

• Sign-in codes: valid for 10 minutes; only their hash is kept.
• An account opened but never completed (no name, terms not accepted): it holds only the verified address or number, and you can ask for its deletion at any time.
• Sessions: closed after 30 days without activity, and at the latest 90 days after sign-in.
• Account: as long as it is open. When it is deleted, your name, contact details and two-factor settings are erased; the account is then only an anonymous identifier.
• Organisation documents: as long as the organisation keeps them in its vault, then as long as needed to prove the verifications carried out.
• Tenders, bids and evaluations: for as long as buyers’ legal and contractual obligations require, in particular for keeping accounting records (up to 10 years).
• Audit log: without time limit. It holds only identifiers and codes, never contact details, and can be neither changed nor erased — that is what makes it proof.

Bids are encrypted, and the platform only lets them be opened after the deadline; the sealing keys are kept separately. Documents are encrypted at rest, connections are protected (HTTPS), authentication secrets are encrypted, IP addresses are stored as hashes, and sensitive roles require two-factor authentication.

If a data breach puts you at risk, we inform the data-protection authority and the people concerned as required by law.

We only use session cookies, needed for your sign-in (one for the application, a second for the area reserved for the PamojaBid team). We use no advertising cookies and no audience-measurement tools.

The application also keeps your language choice in your browser and, during a two-step sign-in or while accepting an invitation, the current step or link. None of this is shared with third parties.

• to be informed of how your data is used;
• to access your data and obtain a copy;
• to have inaccurate data corrected — your name and language can be changed directly from “My account”;
• to have your data erased — from “My account” or by writing to us, within the limits described above for bids and the audit log; if you refuse a new version of the terms, write to us to close your account;
• to object to processing based on our legitimate interest, on grounds relating to your situation;
• not to be subject to a decision based solely on automated processing.

Write to privacy@pamojabid.com. We may ask you to confirm your identity, and we reply within one month. For tender data processed on a buyer’s behalf, we pass your request on to that buyer.

If you believe your rights are not respected, you may refer the matter to the personal-data protection authority established by the Digital Code.

Each version of this policy is dated. A new version is shown to you at your next sign-in, together with the terms of use.

PamojaBid SARL — Lubumbashi, Haut-Katanga, Democratic Republic of the Congo — privacy@pamojabid.com.