Privacy Policy

1. Who we are and how this policy applies

Compliance0 Pty Ltd (ACN 687 131 479, ABN 32 687 131 479), trading as Tendor, handles personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This policy explains our collection, use, disclosure, security and retention of personal information and how to contact us about it.

For personal information in a customer's documents, prompts, connected systems and outputs, we act on that customer's documented instructions under its agreement and the incorporated Data Processing Addendum. This policy does not expand our contractual rights to use customer data. We independently handle account, billing, security, support and public-source information for the purposes described below.

2. Information we collect

We collect information reasonably necessary for the relevant activity, including:

• Names, business contact details, employer, role and professional information supplied when you enquire, request a demo, register or work with us.
• Account details, authentication and access records, billing contacts, transaction information and payment information needed by the selected payment service.
• Device, browser and network information, service interactions, preferences, security logs and support correspondence.
• Personal information in customer-provided tender packs, project records, staff profiles, qualifications, evidence, prompts, drafts and authorised connected systems.
• Professional and contact information in public tender, grant, procurement, contract award and related public records.
• Information you provide in feedback or a job application.

Sensitive information is not intended for routine customer processing. A customer must agree a specific processing scope, purpose and safeguards before submitting it. We collect sensitive information only where permitted by law, including with consent where required.

3. How we collect information

We collect information directly when you use our services or website, complete a form, communicate with us or authorise a connection. We may also receive it from your employer or another authorised customer, connected service providers, professional contacts and public sources. We take reasonable steps to provide collection notices where required.

Website cookies and similar technologies are described in our Cookie Policy, including the available consent and preference controls. Optional analytics and marketing choices are separate from the data processing needed to provide the service.

If we receive unsolicited personal information that we could not lawfully collect, we will destroy or de-identify it where lawful and reasonable. You may make general enquiries anonymously or under a pseudonym where practicable. We may need identifying information to provide an account, verify a request or process a transaction.

4. Why we use information

We use personal information to provide agreed services; administer accounts and billing; respond to enquiries and support requests; secure and monitor systems; prevent misuse; meet legal obligations; resolve disputes; and consider job applications. Public-source information supports procurement discovery, research and related platform functions.

Customer content is processed to perform the customer's authorised tasks. We do not sell customer data, use it for advertising or use one customer's confidential material to support another customer. We may use operational information to understand service performance and improve the service, subject to purpose, access and confidentiality limits. Aggregated or de-identified information must not reasonably identify a customer or individual or reveal confidential content or pricing, and we do not attempt to re-identify it.

We send marketing communications only where permitted by applicable law. You can unsubscribe through the message or contact us. Unsubscribing does not stop necessary account, security or service notices. We may retain limited suppression information to respect your choice.

5. AI processing and connected services

AI features send task-relevant material to approved providers to analyse documents, extract information and prepare drafts. We use business or API services and available data controls appropriate to the task. We do not use identifiable customer data, prompts, files or outputs to train, fine tune, evaluate or improve a model or service available to other customers or the public, or enable provider model training or data sharing for customer personal data.

Customers control the accounts, permissions and material connected to Tendor and can revoke access. Their selected providers operate under their own privacy terms. Tendor accesses only authorised information and performs external actions only within the customer's authority. Customers review outputs and make their own technical, commercial and submission decisions.

6. Who receives information and where it is processed

We disclose personal information to personnel and providers who need it for an authorised purpose, including hosting, authentication, communications, AI, payment, support and website services. We also disclose it to professional advisers or public authorities where necessary and lawful. Access is limited by role, purpose and suitable confidentiality or data-protection obligations.

Core application compute and primary customer storage are in Sydney, Australia. Other processing can occur overseas, including in the United States for enabled AI and email services and through global network, support and resilience functions. The DPA provider schedule identifies customer-processing providers and principal locations. Website analytics and advertising services are described in the Cookie Policy.

Where Australian Privacy Principle 8 applies, we take reasonable steps in the circumstances to ensure overseas recipients handle personal information consistently with the Australian Privacy Principles. This includes appropriate contracts, provider review and limits on access and use. We do not treat use of our website or services as consent to waive those protections. Any agreed customer-specific location restriction must be recorded in the service agreement.

7. Security and retention

We use reasonable technical and organisational measures to protect information against misuse, interference, loss and unauthorised access, modification or disclosure. These include individual authentication, scoped access, private storage, encrypted connections, managed storage protection, personnel confidentiality and incident procedures. Our security overview describes these measures.

We retain information for the service, security and legal purposes that require it, then take reasonable steps to destroy or de-identify it. Customer return and deletion requests follow the applicable agreement and DPA. Deletion covers active records, files and associated derived records; backups remain protected until expiry through their lifecycle. Information retained by law is restricted to that purpose. Account and transaction retention depends on the applicable accounting, tax, dispute and recordkeeping requirements.

We assess suspected data breaches and notify affected customers, individuals and the Office of the Australian Information Commissioner where required by the applicable agreement and Notifiable Data Breaches scheme. Contractual customer notices and statutory notification duties are separate obligations.

8. Access, correction and other requests

Contact our Privacy Officer to request access to or correction of personal information we hold about you. We may verify your identity and authority. We aim to respond within 30 days; if more time is needed, we will explain why. If a lawful exception prevents access or correction, we will explain the reason and available complaint process where required.

There is no charge to make an access request or request a correction. A reasonable charge may apply to providing access, with details given in advance. If the information belongs to a customer's workspace, we may refer the request to that customer and assist it under the DPA. We also consider deletion and restriction requests subject to applicable law and the customer's instructions.

9. Complaints

Send privacy complaints to privacy@tendor.ai, with enough detail for us to investigate. We will acknowledge and investigate the complaint and aim to respond within 30 days. If we need more time, we will explain the next steps.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner or call 1300 363 992.

10. Policy changes and external websites

We publish updates with a new date and provide an additional notice for material changes where appropriate or required. A policy update does not amend an accepted customer agreement or create consent where the law requires it. External websites and independently selected services have their own privacy practices.

11. Contact

Privacy Officer, Compliance0 Pty Ltd trading as Tendor

ACN 687 131 479 · ABN 32 687 131 479

Privacy: privacy@tendor.ai

General enquiries: info@tendor.ai