Privacy Policy · Version 2026-09-08
BidSmart Privacy Notice
BidSmart is used for RJL-managed roofing inquiries, supplier procurement bidding, and related administrative records for RJL Builders & Trading. This notice is intended to support transparent, privacy-aware handling of personal and business information within the project's operational scope.
Information collected
- Client inquiry information such as name, mobile number, optional email, project location, house or project details, roof preferences, and messages exchanged with RJL.
- Supplier company information, authorized-representative account information, and verification documents, including registration, permit, BIR, identification, proof-of-address, and authorization records when applicable.
- RJL procurement requests, Supplier quotations, bidding results, RJL client quotations, announcements, notifications, audit records, and security-related activity generated while using BidSmart.
How the information is used
Information is used to process Client roofing inquiries and consultations, verify Supplier business legitimacy, manage RJL procurement requests and private Supplier quotations, prepare RJL client quotations, send system and SMS notifications, investigate security events, maintain audit history, generate administrative reports, and support the operation of BidSmart.
Mobile number and SMS
Supplier mobile numbers may be verified through a one-time PIN during Supplier registration. Clients can submit an inquiry without creating an account; the mobile number supplied with the inquiry may be used by RJL for inquiry updates, private tracking links, consultation messages, and quotation notices through the configured SMS provider.
RJL-mediated privacy and anti-bypass rule
Suppliers receive the roofing requirements and general delivery area needed to prepare a quotation, but normal Supplier access does not expose the Client's private contact information. Clients are not shown Supplier contact details, Supplier wholesale quotation amounts, competing Supplier bids, or RJL's internal Supplier cost and margin. Project and transaction coordination remains with RJL Builders & Trading.
Private inquiry messages
Messages sent through an inquiry tracking page are intended only for the Client and authorized RJL personnel. Supplier accounts do not receive access to the private Client–RJL inquiry conversation.
Access and protection
Verification documents and quotation files are restricted by user role and ownership. BidSmart also uses role-based access, supported SMS OTP verification, audit logging, protected file delivery, and blockchain-supported audit fingerprints for security and record-integrity purposes.
Retention and account records
Information may be retained while the account or related procurement records are required for system operation, transaction history, audit, research documentation, security review, or applicable administrative obligations. Authorized administrators are responsible for managing records according to RJL's approved operational policies.
Consent
Supplier registration requires acknowledgement of the applicable privacy notice. Client inquiry submission separately asks for consent so RJL may use the submitted contact and project information to process the roofing inquiry.
Terms · Version 2026-09-08
Terms and Conditions
1. Purpose and scope
BidSmart is a roofing-procurement and quotation platform used by RJL Builders & Trading. The system supports Client inquiries, RJL recommendations, Supplier quotations, RJL client pricing, Client confirmation, award status, communication, reporting, and audit records.
2. Client use
Clients may submit a roofing inquiry without creating an account. Information and messages submitted through a private tracking page must be accurate and should relate to the roofing project. Private tracking links or tokens should not be intentionally shared with unauthorized persons.
3. Supplier company accounts
Supplier registration is for a Supplier company account. The company must provide accurate registration, contact, verification, and quotation information. Access to bidding functions may remain restricted while the Supplier account is pending, rejected, suspended, or otherwise not approved by RJL.
4. Supplier quotations
Verified Suppliers may review active procurement requirements made available by RJL and submit quotations within the applicable bidding period. Before submitting a quotation, the Supplier is responsible for confirming that it can provide the requested specifications and quantity. BidSmart is not a complete warehouse or enterprise inventory-management system.
5. RJL pricing and Client confirmation
Supplier quotations are submitted privately to RJL. RJL may select a provisional Supplier quotation and prepare a separate Client-facing price. A provisional Supplier is not treated as finally awarded merely because RJL prepared a price. Final award status occurs only after the required Client confirmation of the RJL price and completion of the system's award workflow.
6. Confidentiality boundaries
Users must not attempt to bypass system role restrictions or obtain information not intended for their role. Clients are not entitled through BidSmart to Supplier wholesale bid amounts or RJL internal margin. Suppliers are not entitled through BidSmart to Client private contact details or the Client–RJL private conversation.
7. No online payment or legal contract execution
BidSmart does not process online payments, cryptocurrency, legal contract execution, shipment tracking, or financial settlement. Payment, formal agreements, delivery, and fulfillment coordination occur outside the platform.
8. Acceptable use
Users must not submit false documents, impersonate another company or person, interfere with the service, attempt unauthorized access, abuse messaging functions, upload malicious content, or manipulate procurement or audit records. RJL may restrict access when use threatens system security, integrity, or legitimate procurement operations.
9. Availability and changes
BidSmart may be updated, maintained, or temporarily unavailable because of deployment, security, network, database, SMS, or blockchain-service conditions. RJL may revise operational rules and these terms when the system changes.
10. Acceptance
By using BidSmart after the applicable acknowledgement or consent step, users agree to use the platform according to these Terms and the linked Privacy, Cookie, and Security policies.
Cookies · Version 2026-09-08
Cookie Policy
1. Essential session cookie
BidSmart uses a PHP session cookie to maintain secure session state for functions such as authentication, CSRF protection, OTP workflows, and other server-side session features. The session cookie is configured as a session-only cookie, uses HttpOnly, uses SameSite=Lax, and is marked Secure when the site is served through HTTPS.
2. Cookie notice preference
When you dismiss the BidSmart cookie notice, the browser may store a small local-storage preference named bidsmart_cookie_notice_ack_v1 so the same notice does not need to appear on every page visit. This value does not contain your roofing inquiry, Supplier quotation, password, or identity-document information.
3. No advertising cookies
Current BidSmart does not use advertising or behavioral-targeting cookies as part of its normal workflow.
4. Managing browser storage
You can clear cookies and local storage through your browser settings. Removing an active session cookie may sign you out or interrupt a session-dependent workflow. Blocking essential session cookies may prevent parts of BidSmart from working correctly.
5. Future changes
BidSmart offers optional first-party anonymous analytics only after the visitor chooses to allow it. The analytics record stores aggregate daily page-view counts by public page and does not store IP addresses, browser fingerprints, advertising identifiers, or third-party tracking cookies.
Security · Version 2026-09-08
Security Policy
1. Security principles
Least necessary accessClient, Supplier, RJL Staff, and Super Admin functions are separated by role and workflow.
Server-side validationImportant input and authorization rules are checked by the server, not only by the browser.
Protected authenticationSupplier and RJL authentication uses hashed passwords, secure session handling, and supported OTP or recovery checks.
Audit integrityImportant activity can be logged and selected audit fingerprints can be verified against Hyperledger Fabric provenance.
2. Session and request protection
BidSmart configures its session cookie with HttpOnly and SameSite protections and marks it Secure when HTTPS is active. Supported state-changing forms use CSRF tokens to reduce unauthorized cross-site form submissions.
3. Passwords and credentials
User passwords are stored using PHP password hashing rather than as readable plaintext. Production credentials and secrets should be stored outside public web content and must not be committed into downloadable application packages.
4. Protected files and privacy separation
Verification documents and formal quotation files are intended to be served through authorization-aware application logic. The system also enforces the RJL-mediated privacy boundary so normal Supplier access does not expose Client private information and normal Client access does not expose Supplier wholesale quotation or RJL margin data.
5. Audit logging and database monitoring
BidSmart records selected application activity and monitored database changes for accountability and investigation. Hyperledger Fabric is used as an audit-integrity layer: compact metadata and SHA-256 fingerprints can be anchored and later verified against transaction provenance. It does not replace MySQL or MariaDB and is not used for cryptocurrency or payment.
6. Production environment
The production deployment is expected to use HTTPS, restricted database access, protected environment configuration, controlled upload permissions, and server or service health checks. Internal infrastructure ports and credentials should not be publicly exposed.
7. Security limitations
No web application can guarantee absolute security. Security depends on correct server configuration, timely maintenance, strong credentials, protected administrator access, secure connected services, and appropriate operational practices.
8. Reporting a security concern
Users who observe suspicious access, a potentially exposed private tracking link, an unexpected account action, or another security concern should stop sharing the affected information and report the concern promptly to authorized RJL Builders & Trading personnel through the organization's official communication channel.
