Privacy Policy

Bid2Buy Africa (“we”, “us”, “our”) operates the bid2buy.africa auction platform. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our Platform.

2.1 Information you provide

• Account registration: name, email address, phone number, password.
• Seller registration: business name, business registration number, bank account details, physical address.
• Bidder registration: name, ID/passport number, phone number, address (as required by the Seller).
• Deposit proof: bank transfer receipts or payment confirmations uploaded during the deposit verification process.
• Listing content: item descriptions, photographs, videos.

2.2 Information collected automatically

• Usage data: pages visited, actions taken (bids placed, lots viewed), timestamps.
• Device data: IP address, browser type, operating system.
• Cookies: authentication cookies to keep you signed in. We do not use tracking or advertising cookies.

We use your information to:

• Create and manage your account.
• Process bids, auctions, and settlements.
• Verify Seller and Bidder identities.
• Send transactional emails (deposit verified, outbid notifications, winning notifications, password resets).
• Calculate and invoice Platform Commission.
• Detect and prevent fraud, abuse, and violations of our Terms of Service.
• Improve the Platform and develop new features.
• Comply with legal obligations.

We do not sell your personal information to third parties.

• Sellers and Bidders: When you win a bid, your contact information is shared with the Seller so they can arrange payment and collection. When you are a Seller, your business name and contact details are visible to registered Bidders on your auction site.
• Service providers: We use third-party services to operate the Platform, including:
  • Supabase (database and authentication hosting, EU region)
  • Vercel (website hosting)
  • Resend / Amazon SES (transactional email delivery)
  These providers process data on our behalf under strict data processing agreements.
• Legal requirements: We may disclose information when required by law, court order, or government request, or to protect the rights, safety, or property of Bid2Buy or others.

Your data is stored in secure cloud infrastructure (Supabase, hosted in the EU). We implement industry-standard security measures including:

• Encryption in transit (TLS/SSL) and at rest.
• Row-Level Security (RLS) ensuring tenant data isolation — one Seller cannot access another Seller's data.
• Secure password hashing (bcrypt via Supabase Auth).
• Signed URLs for private files (deposit proofs are not publicly accessible).
• Audit logging of all administrative actions.

While we take reasonable measures to protect your data, no system is completely secure. You are responsible for keeping your login credentials confidential.

• Active accounts: We retain your data for as long as your account is active.
• Closed accounts: If you close your account, we retain transaction records (bids, settlements, audit logs) for 7 years for legal and tax compliance. Personal profile data is deleted within 30 days of account closure.
• Deposit proofs: Retained for 12 months after the related auction closes, then deleted.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate information.
• Delete your account and associated personal data (subject to our retention requirements for transaction records).
• Export your data in a portable format.
• Object to certain processing activities.

To exercise any of these rights, contact us at hello@bid2buy.africa. We will respond within 30 days.

We use essential cookies only — specifically, authentication session cookies that keep you signed in. These are strictly necessary for the Platform to function and cannot be declined.

We do not use analytics, advertising, or third-party tracking cookies.

The Platform is not intended for use by anyone under 18 years of age. We do not knowingly collect personal information from children. If we become aware that a child has registered, we will delete their account promptly.

Your data may be processed in countries outside your country of residence (including the EU, where our database is hosted, and the US, where some service providers operate). We ensure appropriate safeguards are in place for such transfers.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice on the Platform. The “Last updated” date at the top indicates the most recent revision.

For questions about this Privacy Policy or your personal data, contact us at:

• Email: hello@bid2buy.africa