Privacy Policy & Cookie Notice

1. Who we are

Chad Lim operates the TenderLah platform, which helps Singapore businesses discover and track tenders and business opportunities, and is the data controller responsible for your personal data. This notice explains what we collect, why, and the rights you have under Singapore's Personal Data Protection Act (PDPA) and, where it applies to you, the EU/UK General Data Protection Regulation (GDPR).

2. What we collect

• Account details — your name, email address, and password (stored only in hashed form), provided when you sign up or sign in.
• Company profile — organisation and business name, description, industry, company size, geographic coverage, preferred contract size, and an optional logo, provided during onboarding.
• Usage data — pages you visit and basic analytics events, collected through cookies only if you accept analytics (see section 6).

3. Why we use it & legal basis

We use account and company-profile data to provide the service, authenticate you, and personalise tender matches — on the basis of performing our contract with you (GDPR Art. 6(1)(b)) and the consent you give us under the PDPA. We use analytics data, where you consent, to understand and improve how the site is used (GDPR Art. 6(1)(a) / PDPA consent). We do not sell your personal data.

4. Who we share it with

We use PostHog as our analytics processor. If you accept analytics cookies, your usage data is processed by PostHog on our behalf. We do not otherwise disclose your personal data except where required by law.

5. International transfers

Our analytics processor (PostHog) currently stores data on servers in the United States. Where this involves transferring personal data out of Singapore or the EU/UK, we rely on the processor's contractual safeguards (data-processing agreement and standard contractual clauses) to ensure a comparable standard of protection, as required by the PDPA Transfer Limitation Obligation and GDPR Chapter V.

6. Cookies & analytics

We use a small number of strictly necessary cookies to keep you signed in and remember interface preferences; these are required for the site to work and are always on.

Analytics cookies (PostHog) are optional and load only after you accept them in the cookie banner. If you decline, no analytics cookies are set and no usage data is collected. You can change your mind at any time by clearing the ph_consent value in your browser storage, which brings the banner back.

7. How long we keep it

We keep your account and company-profile data for as long as your account is active. When you close your account, or when the data is no longer needed for the purpose it was collected, we delete or anonymise it in line with the PDPA Retention Limitation Obligation.

8. Your rights

Subject to the PDPA and (where applicable) the GDPR, you can:

• access a copy of the personal data we hold about you;
• correct inaccurate or incomplete data;
• withdraw consent (including for analytics) at any time;
• request deletion of your data, and — under the GDPR — request a portable copy of it.

To exercise any of these, contact our Data Protection Officer (section 9). We will respond within the timeframes the applicable law requires.

9. Contact our DPO

For any privacy question or to exercise your rights, contact our Data Protection Officer at chadlimjinjie@gmail.com.

10. Changes to this notice

We may update this notice from time to time. The "last updated" date above reflects the most recent change.