Legal
Data Retention Policy
Last updated: 24 February 2026
This Data Retention Policy describes how VANGOV (Pty) Ltd retains, archives, and disposes of data collected through the BidThinker platform, in compliance with the Protection of Personal Information Act (POPIA) and industry best practices.
1. Retention Periods
| Data Category | Retention Period | Basis |
|---|---|---|
| Account information | Duration of account + 12 months | Contractual obligation |
| Project data & analysis | Duration of account + 24 months | Professional record-keeping |
| Uploaded PDF documents | Duration of account + 24 months | Audit trail |
| Generated reports | Duration of account + 36 months | Regulatory compliance |
| Session & authentication logs | 90 days | Security monitoring |
| Activity & audit logs | 12 months | Operational integrity |
| Comments & annotations | Duration of account + 24 months | Project context |
2. Account Deletion
When you request account deletion:
- Your account is immediately deactivated and you lose access to the Platform
- Personal identification data (name, email) is anonymized within 30 days
- Project data and uploaded documents enter a retention hold period as specified above
- After the retention period expires, all data is permanently and irreversibly deleted
3. Data Export
Before deletion, you may request a full export of your data, which includes:
- All project metadata and configuration
- Uploaded PDF documents (original files)
- Analysis results and extracted data in JSON/CSV format
- Generated reports in PDF format
- Comments and activity history
Export requests are processed within 5 business days. Contact support@vangov.com to request an export.
4. Third-Party Data Processing
4.1 Microsoft Azure
Documents submitted for analysis are processed by Microsoft Azure AI Document Intelligence. Microsoft does not retain document data after processing is complete. Azure processes data within the selected region and adheres to its own data processing agreements.
4.2 Database Hosting
All persistent data is stored in managed PostgreSQL databases with encryption at rest and automated backups. Database backups are retained for 30 days and then permanently deleted.
5. Data Disposal
When data reaches the end of its retention period:
- Database records are permanently deleted using secure deletion methods
- File storage (uploaded PDFs, generated reports) is purged from all storage systems
- Backups containing expired data are overwritten within the 30-day backup cycle
- Deletion is logged for audit purposes (the log entry records that deletion occurred, not the deleted data)
6. Legal Holds
Retention periods may be extended if data is subject to a legal hold due to pending or anticipated litigation, regulatory investigation, or audit. In such cases, the data will be preserved until the hold is lifted.
7. Your Rights
Under POPIA, you have the right to request information about how your data is retained and to request early deletion (subject to any legal obligations requiring continued retention). See our Privacy Policy for full details on your rights.
8. Contact Us
For questions about data retention, please contact:
- Email: privacy@vangov.com
- Company: VANGOV (Pty) Ltd
- Country: South Africa