Radar

Legal

Privacy Policy

In force since .

This is an English translation provided for convenience. The Portuguese version at radar.ao/privacidade is the binding text; where the two differ, the Portuguese prevails.

Describes the data Radar processes during the beta, as the service works today.

1. Data controller

Exponencial – Comércio e Prestação de Serviços, Lda., taxpayer no. 5002076772, with registered office at Rua da Samba, Condomínio Corimba Residence A7.1, Bairro Corimba, Província de Luanda, Angola. Contact for personal data matters: info@radar.ao.

2. Three types of data, handled differently

  • Access request data — the data you give us when you ask to join the beta, before any account exists. Section 3.
  • Your account data — the data the subscriber gives us in order to use the service. Section 4.
  • Content of public notices — names of contracting entities, persons in charge and contacts that appear in the tender notices published by the entities themselves. This is public information, reproduced as it was published, with the source indicated. We do not cross-reference it with other databases, nor use it for commercial contact.

3. Request for access to the beta

The “Request access” form has three steps, and the request is saved as early as the first: if you stop there, we have already received it and can reply to you. The following steps add what you send to the same request. We collect:

  • Required: name, company and email address (step 1); the areas in which you supply and a description of what you supply (step 2). Without these we cannot assess the request or reply to you.
  • Optional: phone or WhatsApp and your role (step 1); who you sell to and where you work (step 2); and, in step 3, what you find hardest about tenders, whether you heard about a tender too late and which one, how you find tenders today, how many bids you submit per year, how many people would use Radar, how you heard about us, and whether you agree to a conversation during the beta. They serve to prepare your search profile before the first conversation; leaving them blank does not affect your request.

We also record the date of the request and of each step, the language in which you filled in the form, the page from which it was sent, that you indicated you had read this policy and when, which version of this policy was published at that moment (with a fingerprint of its text, so that it cannot be altered without this being noticed), and a technical identifier generated by your browser, which allows the steps to be joined to the same request. To stop automated submissions we use Cloudflare Turnstile, which analyses your browser’s interaction, and we keep a temporary pseudonym of the IP address — a value encrypted with a key of ours, which expires on its own and serves only to limit the number of submissions. We do not keep the IP address in clear.

Legal basis: the processing is necessary for the steps prior to entering into a contract, taken at your request. We do not ask for your consent for this, and the box you tick on the form declares only that you have read this policy — it authorises nothing. The reason is simple: consent would have to be freely withdrawable at any time, and withdrawing it would oblige us to stop processing the very request you made to us.

What for: to assess and reply to your request, and — if it is accepted — to prepare the profile with which the service selects tenders for you. We do not use this data for anything else.

For how long: we keep the request while it is under review and, after the decision, for a maximum of 12 months, so that we know whom we have already replied to and why. If you become a subscriber, the data is then governed by section 4. You may request erasure before then (section 9).

Two details we would rather state than omit. The request is stored in a Cloudflare D1 database whose “Time Travel” feature retains copies of deleted rows for 7 to 30 days, so erasure takes effect within that period and not at the moment of the request. And the notification that alerts us to your request arrives in a mailbox of ours, so a second copy of the data you sent exists there; when you request erasure, we delete both.

4. What account data we keep

  • Email address and password (stored only in encrypted form, by our authentication provider).
  • The preferences you configure: sectors, topics, provinces, entities, keywords, alert rules and saved tenders.
  • The record of the emails we have sent you (date, type, tenders included), so that we can answer “did I receive this or not?”.
  • Technical logs of access to the application (date, IP address, browser), kept by the hosting and authentication providers according to each one’s retention periods.

We do not use audience-analytics cookies or tracking services: neither this site nor the application loads Google Analytics, Meta Pixel or equivalent. The application’s authentication session is stored in your browser only to keep you signed in.

5. What for

Exclusively to provide the service: to select the tenders that match your profile, to send you the digest and the alerts, and to let you sign in to the application. We do not sell, rent or pass on your data to third parties, and we do not use it for advertising — ours or anyone else’s. The only third parties that touch it are the providers in section 7, which process it on our behalf and according to our instructions.

6. Legal basis

Depending on the stage: the pre-contractual steps you take when requesting access (section 3), and afterwards the performance of the contract for the provision of the service to which you subscribe. The legal framework is Law No. 22/11 of 17 June (Personal Data Protection Law) and the regulations of the Angolan Data Protection Agency (Agência de Protecção de Dados, APD).

7. Who processes the data for us

We use providers that process personal data on our behalf, under their respective service contracts and data processing terms:

  • Supabase — database and authentication (your account and preferences). Servers in Ireland (eu-west-1).
  • Cloudflare — hosting of this site and of the application, delivery network, protection against automated submissions (Turnstile) and the access-request database, the latter hosted in Western Europe.
  • Hetzner — the server that runs the collection and the application. Server in Helsinki, Finland.
  • SMTP2GO — sending of the service’s emails. Account hosted in the European Union.
  • Microsoft 365 — the mailbox that receives access requests. The subscription is registered in Angola; Microsoft does not operate data centres on Angolan territory, so hosting takes place in Microsoft data centres outside Angola.
  • Microsoft Azure — automated processing of the text of public notices, in the South Africa North region. It receives no data from your account or from your access request.

8. Transfers outside Angola

As the list above shows, the data is processed outside Angola: none of these providers offers hosting on Angolan territory. We chose them because there is no local alternative with equivalent safeguards, and we are completing with the APD the formalities that Law No. 22/11 requires for these transfers. We say so here because we would rather you know where your data is than find out afterwards.

9. Your rights

You may, at any time, request access to your data, its rectification or its erasure, or object to its processing, by writing to info@radar.ao. We reply within a maximum of 30 days. This applies both to a request for access to the beta and to a subscriber account. You also have the right to lodge a complaint with the Angolan Data Protection Agency (APD).

10. Changes

This policy will be reviewed before the end of the beta. Changes are dated on this page, and the “Request access” form records which version was published when you submitted.