BidsEval.AI

Privacy Policy

Last updated: 19 August 2026

1. Who we are

BidsEval.AI is a trading name of Nuru Fintech Limited, a company registered in Kenya. In this policy, "we" means Nuru Fintech Limited.

This policy explains how we handle personal data. It is written to meet our obligations under the Data Protection Act, 2019 (Kenya) and its Regulations.

Contact for privacy matters:

2. The two roles we play

This distinction matters, because different obligations attach to each.

We are a data controller for the personal data of people who hold BidsEval accounts: the procurement staff and evaluation committee members who sign in and use the platform. We decide why and how that data is processed.

We are a data processor for the personal data contained in bid submissions. That data belongs to the procuring entity that runs the evaluation. They decide what to collect and why; we process it on their documented instructions in order to provide the service. Bidders' rights in respect of that data are exercised against the procuring entity, and we assist them in responding.

3. Data we process as a controller

For account holders:

We use this to authenticate you, to give you the right level of access, to maintain the audit trail that a procurement evaluation requires, and to communicate with you about the service.

Our lawful basis is the performance of our contract with your organisation, and our legitimate interest in maintaining a secure and auditable system.

4. Data we process as a processor

Bid submissions contain personal data. Depending on what the tender requires, this may include:

We process this only to carry out the evaluation the procuring entity has asked us to support. We do not use it to train models, we do not sell it, and we do not use it for any purpose the procuring entity has not instructed.

We do not use bid submissions, evaluation records, or any customer data to train artificial intelligence models, and we require the same of every provider we use.

Some of the above is sensitive personal data under the Act. We process it only where a tender's own published criteria require it, and only for the purpose of verifying eligibility against those criteria.

5. How the evaluation works, and what it means for your data

BidsEval uses artificial intelligence to read bid documents and assess them against the criteria a procuring entity has set. The system produces findings and supporting evidence. It does not make the award decision.

Every evaluation is reviewed by the procuring entity's evaluation committee, which remains responsible for the outcome. Where the system cannot establish something with confidence, it is designed to say so and refer the matter to a human rather than decide it.

Bid documents are sent to Anthropic's API for analysis. Anthropic processes them on our instructions and does not use them to train its models.

You can ask us how a finding was reached, and any finding can be overridden by a member of the evaluation committee.

6. Who else processes your data

We use the following providers, each of which processes data on our instructions:

7. Transfers outside Kenya

Our infrastructure is hosted outside Kenya, principally in the European Union and the United States. Where personal data is transferred outside Kenya, we rely on the grounds available under section 48 of the Act, in most cases that the transfer is necessary for the performance of our contract with the procuring entity, or is made subject to appropriate safeguards.

We keep a record of these transfers, including the date, the recipient, the justification and a description of the data, and produce it to the Office of the Data Protection Commissioner on request.

8. How long we keep data

Evaluation records. We keep the records of an evaluation while the procuring entity needs them, and in any case for no longer than seven years from the date the evaluation is signed off. At the end of that period we delete the personal data within those records. The evaluation itself, its scores, its reasoning and its audit trail are kept without the personal data, so the decision remains defensible.

A procuring entity may ask us to remove the personal data from an exercise sooner, at any time.

Account data. We keep account data while the account is active and for twelve months after it is closed, after which it is deleted.

We review retained data periodically against this schedule, and delete anything that no longer needs to be held.

9. Your rights

Under the Data Protection Act, 2019 you have the right to:

To exercise any of these, contact . We will respond within the period the Act requires.

If your personal data reached us through a bid submission, the procuring entity is the controller and you should direct your request to them. If you contact us instead, we will tell you who to approach and assist them in responding.

You also have the right to complain to the Office of the Data Protection Commissioner.

10. Security

We protect data through access controls, encryption in transit, and an audit log of actions taken in the system. Access to evaluation data is limited to people authorised by the procuring entity that owns it.

11. Data breaches

If a breach occurs that is likely to result in a risk to your rights, we will notify the Office of the Data Protection Commissioner and, where the Act requires it, the people affected.

12. Changes to this policy

We will post any changes on this page and update the date above. Where a change is significant, we will tell account holders directly.

13. Contact


Nairobi, Kenya