POPIA & Commercial Data Privacy

Procurement Privacy & Vendor Data Governance Policy

Statutory privacy policy governing the processing, confidentiality, and statutory protection of vendor business information, B-BBEE affidavits, SARS tax compliance PINs, and director identities under the Protection of Personal Information Act (POPIA Act 4 of 2013).

Licensor: TVB Network (Pty) Ltd POPIA Role: Section 21 Operator Effective Date: 1 January 2026 Location: Johannesburg, South Africa

COMMERCIAL VENDOR DATA PROTECTION SupplierPro processes natural and juristic person data (CIPC records, director ID numbers, banking tokens, VAT numbers, and confidential tender quotations). The purchasing enterprise serves as the statutory Responsible Party, and TVB Network operates strictly as the Operator (Section 21 POPIA) executing instructions within encrypted BigQuery operational tables.

1. Categories of Procurement Data Collected

To facilitate supplier verification and automated purchase order flows, SupplierPro processes:

Vendor Juristic Records: Registered company name, CIPC enterprise number, physical warehouse addresses, VAT registration certificates, and Central Supplier Database (CSD) MAAA numbers.
Director & Signatory Identifiers: Identity numbers or passport credentials of company directors, authorized procurement signatories, and conflict-of-interest declarations (SBD 4 forms).
Compliance Credentials: B-BBEE verification scorecards, Exempted Micro Enterprise (EME) sworn affidavits, and SARS Tax Compliance Status (TCS) PINs.
Commercial Documents: Request for Quotation (RFQ) responses, unit pricing lists, Purchase Orders, Goods Received Notes (GRN), and SARS-compliant Tax Invoices.

2. Vendor Pricing & Tender Confidentiality

2.1. Tender Secrecy: SupplierPro maintains strict multi-tenant isolation. No vendor can view rival supplier bids, negotiated item prices, or tender responses submitted to the Buyer.

2.2. Zero Commercial Monetization: TVB Network does not resell, aggregate, or expose supply chain pricing indices to third-party data brokers or marketing affiliates.

3. Banking Detail Security & Tokenization

3.1. PCI-DSS & Tokenized Gateways: Banking details transmitted for automated supplier payments are tokenized via Paystack. Plaintext bank account numbers and payment cards are never stored unencrypted.

3.2. Change Notifications: Any modification to a supplier's nominated banking profile generates mandatory real-time cryptographic audit events and dual-approval alerts to prevent redirection fraud.

4. Statutory Record Retention Schedules

In compliance with the Tax Administration Act (Act 28 of 2011) and South African procurement regulations:

Purchase orders, invoices, and payment receipts are retained for a mandatory minimum of five (5) years.
Tender evaluation scores and bidder disqualification logs are archived for five (5) years following contract conclusion.

5. Information Officer Contact

For inquiries regarding SupplierPro privacy architecture, data subject access requests, or B-BBEE compliance data:

Information Officer — TVB Network (Pty) Ltd:
Email: privacy@tvbnet.co.za / popia@supplierpro.co.za
Physical Address: Sandton, Johannesburg, South Africa