TendeX Privacy Statement

1. Personal information we collect

We may collect personal information that is reasonably necessary for our functions and activities or otherwise required to provide and operate the Services.

Depending on how you interact with TendeX, this may include:

• Account and identity information: your name, organisation or business name, position or job title, email address, telephone number, account information and authentication information.
• Billing and transaction information: billing name and address, subscription information, transaction records and payment status. Payment card details may be processed by third-party payment providers and are not intended to be stored directly by TendeX.
• Buyer and supplier information: personal information contained in procurement activities, supplier records, expressions of interest, requests for proposal, requests for quotation, tenders, evaluations, procurement documentation and other material entered into or uploaded to the Services.
• Customer Content: information, documents, data and other material submitted, uploaded, generated or otherwise made available through the Services. Customer Content may include personal information as well as confidential, commercial or other information that is not personal information.
• Usage and technical information: IP address, browser and device information, log information, access times, pages or functions accessed, interactions with the Services, diagnostic information and information collected through cookies and similar technologies.
• Communications: information contained in communications with our support, sales, partnership or other teams, including enquiries, feedback and survey responses.
• Campaign and access information: where you use a personalised invitation, referral or access code, we may record its use and associate it with the relevant campaign, referral or account.

You are responsible for ensuring that personal information and Customer Content you provide to TendeX has been collected and disclosed lawfully and that you have all necessary rights, authorities, permissions and consents to provide that information to us and permit its processing through the Services.

You must not upload or provide personal information or Customer Content through the Services where doing so would breach applicable law, confidentiality obligations or the rights of another person.

2. Customer Content and confidential information

Customer Content may include procurement documentation, pricing, commercial information, supplier submissions, methodologies, intellectual property, evaluation material, business information and other information that may not constitute personal information under applicable privacy legislation.

This Privacy Statement applies to Customer Content only to the extent that it contains personal information.

The ownership, permitted use, confidentiality, intellectual property rights and other obligations relating to Customer Content are governed by the TendeX Terms and Conditions and any other applicable agreement between TendeX and the relevant customer.

Nothing in this Privacy Statement transfers ownership of Customer Content to TendeX or alters any rights or obligations relating to Customer Content established under the TendeX Terms and Conditions or another applicable agreement. In this Privacy Statement, 'Customer Content' has the same meaning as 'Content' in the TendeX Terms and Conditions.

3. How we collect personal information

We may collect personal information:

• directly from you when you create an account, subscribe to the Services, complete forms, upload or enter information, participate in procurement activities or contact us;
• automatically when you access or use the Services, including through logs, cookies and similar technologies;
• from your organisation, where your organisation establishes or administers your access to TendeX;
• from other users of the Services, including buyers or suppliers participating in procurement activities;
• from channel or referral partners, including where you are introduced to or access TendeX through a third party;
• from service providers supporting the operation of the Services; and
• from publicly available sources where reasonably necessary for our functions or activities.

Where reasonably practicable, we will collect personal information directly from the individual concerned.

4. Why we collect, hold, use and disclose personal information

We may collect, hold, use and disclose personal information where reasonably necessary to:

• create, authenticate, administer and secure user accounts;
• provide, operate and maintain the Services;
• facilitate procurement activities and workflows;
• provide AI-assisted functionality, including document drafting, procurement routing, structuring, analysis and suggestions;
• process subscriptions, transactions and billing;
• communicate with users regarding their accounts and the Services;
• provide technical support and respond to enquiries;
• monitor, maintain, troubleshoot and secure the Services;
• detect, investigate and prevent misuse, fraud, security incidents or unlawful activity;
• analyse the operation and performance of the Services;
• develop, test and improve the Services, subject to the limitations described in this Privacy Statement and our contractual obligations;
• administer referrals, partnerships and campaigns;
• send marketing communications where permitted by law;
• establish, exercise or defend legal rights;
• comply with legal, regulatory, accounting and reporting obligations; and
• otherwise perform activities with your consent or as permitted or required by law.

We will use and disclose personal information for the purpose for which it was collected, for related purposes permitted under applicable law, with consent where required, or where otherwise authorised or required by law.

5. Disclosure of personal information

We may disclose personal information to third parties where reasonably necessary to operate or support the Services.

These third parties may include:

• our platform and infrastructure providers, including Supabase, Vercel, Anthropic, Stripe, and Google;
• hosting, database, storage and infrastructure providers used in connection with the Services;
• artificial intelligence service providers used to provide AI-assisted functionality;
• authentication, communications, analytics, monitoring, security and technical service providers;
• payment processors and billing providers including Stripe (payment processing);
• channel, referral or implementation partners, where relevant to your relationship with TendeX or where disclosure is otherwise authorised;
• professional advisers, including lawyers, accountants, auditors and insurers;
• prospective purchasers, investors, financiers or advisers in connection with an actual or proposed corporate transaction, financing, merger, acquisition, restructure or sale of all or part of our business, subject to appropriate confidentiality arrangements where applicable;
• regulators, courts, government agencies and law enforcement bodies, where required or authorised by law; and
• other persons where you have authorised the disclosure or where disclosure is otherwise permitted or required by law.

TendeX does not sell personal information.

Our third-party service providers may change from time to time as the Services develop. Where appropriate, we require service providers handling information on our behalf to do so consistently with their contractual obligations and applicable law.

6. Overseas processing and disclosure

TendeX uses technology and service providers that operate internationally.

As a result, personal information may be stored, accessed, processed or disclosed outside Australia, including in countries in which our platform provider, infrastructure providers, artificial intelligence providers and their respective sub-processors operate.

These countries include the United States and may include other countries in which our service providers and their sub processors operate. The specific countries and providers may change from time to time and are identified in the sub-processor directories maintained by our platform and service providers

The location of processing and storage may change as our service providers, infrastructure and available hosting regions change.

Where the Australian Privacy Principles apply to an overseas disclosure, TendeX will take reasonable steps as required by applicable law in relation to the handling of personal information by overseas recipients.

Those steps may include contractual protections, due diligence regarding relevant service providers, security requirements and reliance on the privacy and data-processing arrangements maintained by our platform and infrastructure providers.

Information processed outside Australia may also be subject to the laws of the jurisdiction in which it is processed.

7. Payment information

Payments for the Services may be processed by third-party payment providers.

TendeX does not intend to directly store complete payment card details. Payment information may instead be provided directly to and processed by the relevant payment provider in accordance with that provider's terms and privacy practices.

We may retain transaction information such as payment status, subscription details, invoices, transaction identifiers and accounting records where reasonably necessary for billing, administration, taxation, accounting, audit and legal purposes.

8. Artificial intelligence and automated processing

The Services use artificial intelligence provided by Anthropic PBC, via its API, to support specific, user triggered functionality only the AI does not run automatically or continuously.

AI functionality may assist users with activities including:

• identifying or suggesting appropriate procurement pathways, such as an EOI, RFP, RFQ or tender;
• drafting, structuring and reviewing procurement documentation;
• organising and analysing information;
• generating summaries and suggestions;
• assisting with procurement workflows; and
• providing other decision-support functionality.

AI is assistive

TendeX's AI functionality is intended to assist users and support human decision-making.

Unless expressly stated otherwise, AI-generated outputs are suggestions, drafts or decision-support material and are not intended to constitute final or binding procurement decisions.

Users remain responsible for reviewing AI generated outputs and determining whether those outputs are appropriate, accurate and suitable for their intended use.

TendeX does not represent that AI generated content will always be complete, accurate, current, error-free or suitable for a particular procurement activity or purpose.

Additional conditions governing reliance on AI-generated outputs, procurement decisions and use of the Services are contained in the TendeX Terms and Conditions.

AI processing of Customer Content

Where a user submits information to an AI-enabled function, relevant Customer Content may be transmitted to and processed by the third party technology providers necessary to provide that functionality.

TendeX configures available platform and service-provider controls to restrict the use of Customer Content for training third party general purpose AI models where such controls are available and applicable to the Services.

The precise processing arrangements applicable to AI functionality may depend on the underlying technology, service provider, contractual arrangements and configuration in use from time to time.

We do not represent that every third-party technology provider operates under identical data-processing arrangements.

Improving TendeX

Subject to applicable law and our contractual obligations, we may use aggregated or de-identified information that does not reasonably identify an individual or customer to analyse, test, maintain, develop and improve the Services.

Where information has been appropriately de-identified so that it is no longer personal information, it may not be subject to the same requirements that apply to identifiable personal information.

Automated decisions

TendeX is designed primarily as a decision-support platform rather than as a substitute for human procurement judgement.

Where TendeX uses automated processing involving personal information in circumstances requiring specific transparency or other protections under applicable law, we will provide information and safeguards as required by that law.

9. Data security

We take reasonable steps to protect personal information we hold from misuse, interference, loss, unauthorised access, modification and disclosure.

TendeX operates using third-party infrastructure and technology services, including Supabase, Vercel, Anthropic, Stripe, and Google.

• encryption of information in transit and at rest;
• authentication and access controls;
• restricted administrative access;
• infrastructure and application monitoring;
• logging and security monitoring;
• vulnerability management and testing; and
• security controls maintained by our underlying technology providers.

Responsibility for security is shared between TendeX, its technology providers and users.

TendeX is responsible for matters within its control, including the configuration and administration of the TendeX application. Our infrastructure and technology providers are responsible for security controls relating to the services and infrastructure they operate, subject to their applicable contractual arrangements.

Users are responsible for maintaining the confidentiality and security of their login credentials, implementing appropriate internal access controls and promptly notifying TendeX if they become aware of suspected unauthorised access to their account.

No internet-based or electronic system can be guaranteed to be completely secure. Accordingly, while we take reasonable steps to protect information, we cannot guarantee absolute security.

10. Data breaches

We maintain processes for responding to suspected data breaches and security incidents.

Where we become aware of a data breach involving personal information, we will investigate and assess the incident and take steps we consider reasonably necessary to contain and remediate it.

Where the Privacy Act 1988 (Cth), including the Notifiable Data Breaches scheme, applies and requires notification, we will notify affected individuals and the Office of the Australian Information Commissioner ("OAIC") as required by law.

Nothing in this Privacy Statement requires TendeX to provide notification where notification is not required by applicable law.

11. Retention and deletion

We retain personal information for as long as reasonably necessary for the purposes for which it was collected, to provide the Services, to meet our contractual obligations, or to satisfy legal, regulatory, taxation, accounting, dispute-resolution or legitimate business requirements.

Retention periods may vary depending on the nature of the information and the purpose for which it is held.

When personal information is no longer required to be retained, we will take reasonable steps to destroy or de-identify it where required by applicable law.

Information may remain temporarily within backups, archives, logs or disaster-recovery systems after deletion from active systems where immediate deletion is not reasonably practicable. Such information will remain subject to applicable security controls until it is deleted or overwritten in accordance with relevant retention processes.

Retention and deletion of Customer Content may also be governed by the TendeX Terms and Conditions or an agreement with the relevant customer.

12. Cookies, analytics and similar technologies

We may use cookies and similar technologies to:

• operate and secure the Services;
• maintain user sessions;
• remember preferences;
• understand how the Services are used;
• diagnose technical issues;
• measure and improve performance;
• support analytics and other functionality; and
• measure the effectiveness of our advertising and show TendeX advertisements to people who have visited our website, including through Google Ads.

Third-party service providers may process technical or usage information on our behalf in connection with these functions.

Advertising providers such as Google may use cookies to show our advertisements on other websites based on your previous visits to our website. You can opt out of personalised advertising through Google's My Ad Center at myadcenter.google.com.

You may be able to disable or restrict cookies through your browser settings. However, doing so may affect the availability or functionality of parts of the Services.

Where consent to particular cookies or tracking technologies is required by applicable law, we will seek that consent where required.

13. Direct marketing

We may use personal information to communicate with you about TendeX products, services, features, events or offers where permitted by applicable law.

Electronic marketing communications will include a method for opting out or unsubscribing where required.

You may ask us to stop sending direct marketing communications at any time by using the unsubscribe functionality provided in the communication or by contacting us using the details below.

We will process direct marketing communications in accordance with applicable laws, including the Spam Act 2003 (Cth).

Service, security, billing and other administrative communications relating to your account or use of the Services are not necessarily marketing communications and may continue where reasonably necessary to provide or administer the Services.

14. Access and correction

You may request access to personal information we hold about you and ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.

Requests may be made using the contact details in section 17.

We will respond to requests within a reasonable period and in accordance with applicable law.

In some circumstances, applicable law may permit or require us to refuse access or correction. Where required, we will provide reasons for the refusal.

We may take reasonable steps to verify your identity before providing access to personal information.

Where your personal information is controlled by an organisation using TendeX, we may refer your request to that organisation where appropriate.

15. Third-party websites and services

The Services may contain links to integrate with or otherwise interact with third-party websites, applications or services.

Except to the extent required by applicable law or expressly agreed by TendeX, we are not responsible for the privacy practices, content or information handling practices of third-party websites or services that operate independently of TendeX.

You should review the privacy policies and terms applicable to third-party services before providing personal information to them.

The use of third party technology providers by TendeX to operate the Services remains subject to the provisions of this Privacy Statement and any applicable contractual arrangements.

16. Complaints

If you have a question or concern about how we handle personal information, please contact us using the details below.

We will consider privacy complaints and respond within a reasonable period.

We may request additional information where reasonably necessary to investigate or respond to a complaint.

If you are not satisfied with our response and the Privacy Act 1988 (Cth) applies, you may be entitled to lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

17. Contact us

For privacy enquiries, access or correction requests, or complaints, please contact:

Privacy Officer Woodington Holdings Pty Ltd trading as TendeX

Email: info@tendex.com.au

18. Changes to this Privacy Statement

We may amend this Privacy Statement from time to time, including to reflect changes to:

• the Services or TendeX functionality;
• our technology infrastructure or service providers;
• artificial intelligence functionality;
• our information handling practices; or
• applicable legal or regulatory requirements.

The current version will be made available through the TendeX website or platform and will identify the date on which it was last updated.

Where we make material changes that significantly affect how personal information is handled, we may provide additional notice through the Services, by email or by another reasonable means where appropriate.

Changes to our third-party service providers or their sub-processors may occur from time to time and do not necessarily require amendment of this Privacy Statement unless the change materially affects the information provided in it.