Effective 23 September 2026

Privacy policy

This notice describes how the Thobekile tender workspace handles information. It is an internal tool operated for the organisation that grants your staff access. Contact your company administrator through your usual internal contact channel about this notice or your information.

Information held in the workspace

• Staff email addresses, display names, roles, department assignments and account status.
• Password hashes, temporary password invitations and sign-in sessions. Passwords are not stored as readable text.
• Tender references, client names, deadlines, source documents, departmental evidence, comments, analysis results, review decisions and compiled submission packs.
• Activity records identifying who performed recorded workflow actions and when, notification records and technical information used to operate and protect the service. Sign-in attempt controls use a hashed identifier derived from the client IP address or email address.

Uploaded documents may contain information about employees, clients, suppliers or other people. Only upload information you are authorised to use for the tender.

Why information is used

The workspace uses this information to authenticate staff, restrict departmental access, analyse tender requirements, collect evidence, review responses, prepare submission packs, record decisions and support service operation and recovery.

Who can access it

Administrators manage staff access and can view the workspace records. Estimators can view tenders and review evidence. Department users can access tenders assigned to their department and their permitted requests and submissions. Server administrators can access stored information when operating or maintaining the service.

AI analysis and service providers

When an estimator starts analysis, the source tender documents are sent to Google’s Gemini API. Office documents may first be converted to PDF. BOQ extraction sends only the selected source PDF pages. The returned analysis or extracted rows are saved for staff review. Departmental evidence and priced returns are not automatically sent for AI analysis when uploaded.

AI requests use stateless Gemini interactions with response storage disabled. This does not override Google’s terms, account settings or operational logging.

The application requests deletion of temporary Gemini file uploads after the analysis finishes or fails. Google documents a 48-hour storage period for Files API uploads. This does not mean that all provider logs or other processing records are deleted at the same time. Google’s data handling also depends on its terms and the account configuration. See Google’s Files API documentation and Gemini API terms.

Workspace records, private files and backups are stored on the server used to operate this service. Hosting and AI processing may take place outside Zimbabwe. Your organisation must authorise the use of these services before submitting restricted or confidential information.

In-app notifications are enabled. Outgoing email notifications are not currently configured. If email delivery is enabled, the policy should be updated to identify the provider and the information shared with it.

Cookies

The website uses an essential sign-in cookie named thobekile_session. It identifies a server-side session and expires after 12 hours, or is cleared when you sign out. It is marked HttpOnly, Secure on HTTPS, and SameSite=Strict. The application does not include advertising cookies or a marketing analytics service.

Retention and backups

There is no automatic deletion schedule for tender records or daily server backups at present. Records may be needed for tender administration, audit and contractual recordkeeping. Approved evidence and compiled pack versions are retained as historical records; archiving a tender does not delete it. Ask your administrator to review retention and any request for removal. Copies in backups may remain until those backups are removed under the organisation’s retention arrangements.

Security and requests about your information

The service uses HTTPS, access checks, password hashing and private file storage. These controls reduce risk but do not eliminate it. Protect your password and invitation links, and report suspected unauthorised access to your administrator.

You can ask your company administrator about access to, correction of, or deletion of your information and raise concerns about how it is handled. Requests must be assessed against applicable obligations and the need to preserve legitimate tender and audit records.

Changes to this notice

The effective date above will be updated when this notice changes. Material changes in providers, data use or retention should be communicated to affected staff.