Privacy Policy
Effective from 12 October 2026
This policy explains what personal data Biddex collects, who processes it, where it goes, how long it is kept and how you can access or delete it. It is written in line with Bahrain’s Personal Data Protection Law (PDPL, Law No. 30 of 2018). It describes what the service actually does today.
1. Who we are
Biddex is a B2B procurement marketplace for Bahrain. It is operated by Astemir Makulov, an individual in the Kingdom of Bahrain (no company has been registered yet). In this policy “Biddex”, “we” and “us” mean the operator. Contact for anything in this policy: support@biddex.online or WhatsApp +973 3332 7347.
This policy applies to people who register a company account, act as a contact of a registered company, receive an invitation link from us, or visit our websites (buyers, suppliers and their staff).
2. Data we collect
| Category | What it includes |
|---|
| Account | E-mail address; password (stored only as a hash, never readable); role (buyer or supplier); whether the e-mail is verified; when you accepted the Terms and this policy. |
| Company | Company name, type, commercial registration (CR) number, country, address, phone; verification status and the notes of our review; your e-mail notification choices. |
| Verification documents | The files you upload to prove the company (for example a trade licence or CR certificate). Only the Biddex team can open them. |
| Catalog and stock | For suppliers: product names, prices, units and photos. For buyers: the buyer’s own stock list (never shown to anyone else). |
| Deals | Requests for quotation (title, description, quantity, budget, optional photo), quotes (prices, notes, attachments), purchase orders, orders, delivery details, documents added to an order, invoices, payments you report (amount, method, reference), chat messages on an order, reviews of suppliers, bid-credit (wallet) transactions, and, for each delivery, how many times the supplier marked it as failed. |
| Notifications | The in-app notifications and e-mails we send you about your account and your deals. |
| Phone and WhatsApp consent | For suppliers we invite: the phone number recorded by the Biddex team and a record of the consent (when, how, and any withdrawal). We use it only to send you invitation links. |
| Reorder reminders | For buyers: from your own accepted orders of the last 12 months we work out how often you usually order each item and remind you shortly before the next order is likely due. We store only which items you have switched off or snoozed (the item’s name and unit as in your last order) and a technical record that a reminder was sent for an item (a key and a date). The calculation itself is not stored, and the reminder does not contain prices. |
| Technical data | Your IP address and the details of each request are handled by our servers to run and protect the service (for example to limit repeated requests). Our request log keeps the method, the address requested (secret tokens masked), the result and the time. We do not record login times, use analytics or advertising tools, or set cookies; your browser’s local storage keeps your session, theme and language. |
| People in a company (buyers) | Name, e-mail address and role of each person who works in a buyer company’s account; invitations (the invited e-mail address, role, who invited, dates); and a history of what each person did on the company’s requests and orders (created, published or cancelled a request; shortlisted, rejected or chose a bid; confirmed receipt; opened a dispute; recorded a payment; reviewed a supplier), with the time. |
| Spending rules and approvals (buyers) | The spending limits an owner sets (an approval threshold and a monthly budget); approval requests for orders (the order, its amount, the supplier, who asked, who decided, the owner’s reason when an order is not approved, and the time); and notices about them. |
3. Why we use your data, and on what basis
- to create and run your account and company profile;
- to run the request, quote, purchase order, order, delivery, invoice and payment workflow between companies;
- to verify companies and to prevent fraud and abuse;
- to send you notifications about your account and deals;
- to contact a supplier on WhatsApp, only after its consent;
- to keep the platform secure and working;
- to meet legal obligations in Bahrain.
The basis is your consent, given when you register and recorded with the date; the need to provide the service you asked for; and our legitimate interest in operating and securing the platform. We do not sell personal data and we do not use it for advertising.
4. Who sees your data on the platform
- A buyer’s identity is hidden from suppliers until the buyer awards that supplier’s quote. Suppliers never see each other’s quotes.
- A buyer sees the company name, price and terms of every supplier that quotes on its request. After an award the two companies see each other’s company name and the data of their order (delivery, documents, chat, invoice, payments).
- A supplier’s catalog is visible to buyers once the supplier is verified.
- Buyers may see a supplier’s reliability figures, computed over all buyers for the last 12 months: completed orders, the share without problems, reviews (average stars, delivered on time, as ordered), and — on the supplier’s card — the shares of disputes, declined purchase orders and failed deliveries. A figure is shown only when it is based on at least 5 items from at least 3 different buyers; otherwise buyers see “New supplier”. Only totals and percentages are shown: no buyer is named, and the comment of a review is visible only to the reviewed supplier, to its author and to the Biddex team.
- The Biddex team can see accounts, verification documents, deals and order chats, in order to verify companies, support users and resolve disputes.
- People in the same buyer company see each other’s names, e-mail addresses and roles, and the history of who did what on the company’s requests and orders. Suppliers and other companies never see the names of a buyer’s people.
- Approval requests and the owner’s answers are visible only to the people of the buyer company who may decide on bids (owners and managers). The supplier sees nothing about an approval until the owner approves and the purchase order is issued.
5. Service providers that process data for us
We use the following providers. They process data on our behalf under their own standard terms (see section 6).
| Provider | What it does for us | Data involved | Where |
|---|
| Neon | Database | All account, company and deal data, notification texts | USA — AWS US East 2 (Ohio) |
| Railway | Application server; private file storage; scheduled backups of the files and of the database | Everything the server handles; uploaded files (verification documents, order documents, quote attachments, product and request photos); a daily copy of the Biddex database; request logs | USA — servers and main file storage: US East (Virginia); backup copies of the files and of the database: US West (California) |
| Resend | Sending e-mail | Recipient e-mail address and the text of the e-mail (for example request titles, amounts, the start of a chat message, verification and password-reset links) | Japan — Tokyo (ap-northeast-1) |
| Sentry | Error monitoring | Technical details of errors; a report can include parts of the request that failed (for example a company name or a text you entered) | European Union |
| GitHub Pages | Hosting the websites biddex.online and app.biddex.online | Your IP address and browser details when you open a page | Global network of GitHub |
| Google Fonts | Fonts used by our pages | Your IP address and browser details when a page loads | Google’s global network |
| jsDelivr | Delivers the interface library of the app (and, only when you import an Excel catalog, a spreadsheet library) | Your IP address and browser details when the app loads | Global content-delivery network |
| WhatsApp | Only when the Biddex team sends an invitation link to a supplier that agreed to it: the team opens a WhatsApp chat by hand | The supplier’s phone number and the message | Under WhatsApp’s own terms |
6. Transfers outside Bahrain
None of these providers stores your data in Bahrain. Your data is processed in the United States (Neon, Railway and the file backup), in Japan (Resend) and in the European Union (Sentry); the website, font and library providers serve pages from their global networks. We cannot offer the service without these transfers.
By registering and accepting this policy you consent to these transfers. We have not signed separate data-processing agreements with these providers: they process data under their own standard terms and security commitments. You can ask us about this at any time and you can withdraw your consent by deleting your account (section 8); we will then no longer process your data except as section 9 describes.
7. How we protect data
- passwords are stored as hashes only, and an account is protected against repeated login attempts;
- every request is checked for the signed-in company: you can open only your own data and the data of your own deals;
- verification documents and order files are private and are opened only through short-lived links, after the system has checked that you are allowed to see them;
- connections to our websites and servers are encrypted (HTTPS).
No system is completely secure.
8. Your rights and how to use them
Under the PDPL you may have rights over your personal data. In the app (sign in, then open Settings) you can do the following yourself:
- Access. Settings → Privacy & data → “Download my data” gives you a file with your profile, company, uploaded-file list (names, types, dates), requests, quotes, purchase orders, orders, invoices and payments, notifications, stock, phone and consent records, invitation links, reviews and reorder reminder settings.
- Correction. In Settings you can edit your company name, CR number, country, address and phone (changing the name or CR number sends a verified company back to review). To correct anything else, including your e-mail address, contact us.
- Deletion. Settings → Privacy & data → “Delete account” (you confirm with your password and company name). It erases your personal data as described in section 9. It is refused while the company has open orders, a dispute, an unpaid invoice or a payment waiting for confirmation, and any remaining bid credits are lost. A purchase order that the supplier has not accepted yet is cancelled automatically and the other company is told.
- Deactivation. Ask us (support@biddex.online). A deactivated account cannot sign in; this alone does not delete data. It is normally refused while there are open orders.
- E-mail choices. In Settings you can switch off e-mails about new requests and e-mails about other notifications. E-mails needed for your account (verification, password reset, account notices) are always sent.
- WhatsApp consent. A supplier can withdraw it on the invitation page or by telling us.
- People in a company. A person invited to a company can leave it themselves (Settings → People → “Leave the company”, confirmed with their password). Their account is then deleted and their personal data erased as described in section 9; the company keeps its business records, which show them as a former member. A company owner can remove a person with the same effect. A manager or staff member’s “Download my data” contains their own profile, role and actions. Each person sets their own e-mail choices. One person belongs to one company. An approval request you made or decided stays with the order as a business record; your name is then shown as a former member (the owner’s reason for a rejection stays with it).
- Anything else, including objecting to a use of your data or asking a question about it: contact us. We will reply as soon as we can.
9. How long we keep data
- Active account: as long as the account exists.
- After you delete your account: we erase your name, your e-mail address (replaced by a technical address), phone, address, our verification notes, the verification documents and catalog photos (deleted from file storage), your notifications, your stock list, your reorder reminder settings and records, your phone and consent records, the text of reviews you wrote or answered, and your invitation links stop working.
- What stays after deletion: the company name, CR number and country, and the records shared with the other company — purchase orders, orders, delivery details, invoices, payments, chat messages, documents added to an order, and review ratings (without your comments); and the history of actions on requests and orders, without the person’s name (shown as “former member”), and approval requests with their amounts, without the name of the person. They stay for as long as the other company needs them and the law requires; there is no automatic clean-up yet.
- Deactivated accounts keep their data until deletion is requested.
- Backups: a second copy of uploaded files and a daily copy of the Biddex database are kept in separate private storage (US West, California). A file that changes or is deleted stays in the backup for 30 more days; each database copy is kept for 30 days. We do not encrypt these copies separately. Data you erase can therefore remain in these copies for up to 30 days.
- The providers’ own database backups and logs: kept according to the settings of the providers (Neon, Railway, Sentry).
- Log of administrator actions: when a Biddex administrator acts on an account or an order (for example verifies or suspends a company, adds credits, resolves a dispute), and also when an administrator opens private material (the chat of an order, a document of an order, a bid attachment, a verification document or a supplier’s recorded contact details), we record who did it, what, which record it concerned and when. The log holds identifiers, types of action, dates and codes (for example a status or an amount); it does not hold names, e-mail addresses, message texts, file names, passwords, access links or phone numbers. A free text an administrator writes (such as a reason or a note) is kept with the record it belongs to, not in the log. We keep the log for 24 months for security, resolving disputes and meeting legal requirements; entries older than that are due for removal, and the automatic clean-up is not in place yet. The log is a technical record that cannot be edited, so it is not changed when a company deletes its account, and afterwards it holds only internal identifiers. Whether an identifier can still be linked to a company depends on what remains of the company: if the company and its records are deleted or anonymized, nothing in the log points to a name; if the company name, CR number and country remain because other companies still need the shared records (see “What stays after deletion”), the identifier can be linked to that company record. Entries made before this version of the policy may also contain a company name, the administrator’s e-mail address or a short note by the administrator; they are kept for the same period. The database operator can technically alter the log, which is why we also keep it in our daily backups.
- Short-lived data: an e-mail verification link works for 24 hours, a password-reset link for one hour, a supplier invitation link for at most 14 days.
- Team invitations: the link works for 7 days; the invitation record (invited e-mail address, role) is deleted 30 days after it expires, whether it was accepted, cancelled or never used.
- History of actions: stays with the requests and orders it belongs to; when a person leaves or is removed, their name is erased and the entries show “former member”. When a company is deleted, the accounts of all its people are erased.
- Approval requests: an unanswered request expires after 3 days; every request is kept with its order after that as a business record, without the name of a person who has left.
- Personal notices (answers to a manager’s request) are deleted when that person leaves or is removed.
- Budget warnings (80 % and 100 % of the monthly budget) are kept like other notifications.
- Reliability figures are calculated from the orders and reviews of the last 12 months; the underlying records are kept as described above, the figures themselves are not stored separately.
- Reorder reminders: the record that a reminder was sent is deleted after 13 months. The items you switched off stay until you turn them on again or delete the account.
10. Changes to this policy
We may update this policy. The date at the top shows when the current version took effect. If we start to use your data in a materially different way, we will say so here and, where we can, in the app.
11. Language
This policy is published in English and Arabic. If they differ, the English version prevails.
Questions about this policy or your data: support@biddex.online · WhatsApp +973 3332 7347
Terms of Service