BidSmart Privacy Notice

BidSmart is used for RJL-managed roofing inquiries, supplier procurement bidding, and related administrative records for RJL Builders & Trading. This notice is intended to support transparent, privacy-aware handling of personal and business information within the project's operational scope.

Information collected

• Client inquiry information such as name, mobile number, optional email, project location, house or project details, roof preferences, and messages exchanged with RJL.
• Supplier company information, authorized-representative account information, and verification documents, including registration, permit, BIR, identification, proof-of-address, and authorization records when applicable.
• RJL procurement requests, Supplier quotations, bidding results, RJL client quotations, announcements, notifications, audit records, and security-related activity generated while using BidSmart.

How the information is used

Information is used to process Client roofing inquiries and consultations, verify Supplier business legitimacy, manage RJL procurement requests and private Supplier quotations, prepare RJL client quotations, send system and SMS notifications, investigate security events, maintain audit history, generate administrative reports, and support the operation of BidSmart.

Mobile number and SMS

Supplier mobile numbers may be verified through a one-time PIN during Supplier registration. Clients can submit an inquiry without creating an account; the mobile number supplied with the inquiry may be used by RJL for inquiry updates, private tracking links, consultation messages, and quotation notices through the configured SMS provider.

RJL-mediated privacy and anti-bypass rule

Private inquiry messages

Messages sent through an inquiry tracking page are intended only for the Client and authorized RJL personnel. Supplier accounts do not receive access to the private Client–RJL inquiry conversation.

Access and protection

Verification documents and quotation files are restricted by user role and ownership. BidSmart also uses role-based access, supported SMS OTP verification, audit logging, protected file delivery, and blockchain-supported audit fingerprints for security and record-integrity purposes.

Retention and account records

Information may be retained while the account or related procurement records are required for system operation, transaction history, audit, research documentation, security review, or applicable administrative obligations. Authorized administrators are responsible for managing records according to RJL's approved operational policies.

Consent

Supplier registration requires acknowledgement of the applicable privacy notice. Client inquiry submission separately asks for consent so RJL may use the submitted contact and project information to process the roofing inquiry.

Terms and Conditions

1. Purpose and scope

BidSmart is a roofing-procurement and quotation platform used by RJL Builders & Trading. The system supports Client inquiries, RJL recommendations, Supplier quotations, RJL client pricing, Client confirmation, award status, communication, reporting, and audit records.

2. Client use

Clients may submit a roofing inquiry without creating an account. Information and messages submitted through a private tracking page must be accurate and should relate to the roofing project. Private tracking links or tokens should not be intentionally shared with unauthorized persons.

3. Supplier company accounts

Supplier registration is for a Supplier company account. The company must provide accurate registration, contact, verification, and quotation information. Access to bidding functions may remain restricted while the Supplier account is pending, rejected, suspended, or otherwise not approved by RJL.

4. Supplier quotations

Verified Suppliers may review active procurement requirements made available by RJL and submit quotations within the applicable bidding period. Before submitting a quotation, the Supplier is responsible for confirming that it can provide the requested specifications and quantity. BidSmart is not a complete warehouse or enterprise inventory-management system.

5. RJL pricing and Client confirmation

Supplier quotations are submitted privately to RJL. RJL may select a provisional Supplier quotation and prepare a separate Client-facing price. A provisional Supplier is not treated as finally awarded merely because RJL prepared a price. Final award status occurs only after the required Client confirmation of the RJL price and completion of the system's award workflow.

6. Confidentiality boundaries

Users must not attempt to bypass system role restrictions or obtain information not intended for their role. Clients are not entitled through BidSmart to Supplier wholesale bid amounts or RJL internal margin. Suppliers are not entitled through BidSmart to Client private contact details or the Client–RJL private conversation.

7. No online payment or legal contract execution

8. Acceptable use

Users must not submit false documents, impersonate another company or person, interfere with the service, attempt unauthorized access, abuse messaging functions, upload malicious content, or manipulate procurement or audit records. RJL may restrict access when use threatens system security, integrity, or legitimate procurement operations.

9. Availability and changes

BidSmart may be updated, maintained, or temporarily unavailable because of deployment, security, network, database, SMS, or blockchain-service conditions. RJL may revise operational rules and these terms when the system changes.

10. Acceptance

By using BidSmart after the applicable acknowledgement or consent step, users agree to use the platform according to these Terms and the linked Privacy, Cookie, and Security policies.

Cookie Policy

1. Essential session cookie

BidSmart uses a PHP session cookie to maintain secure session state for functions such as authentication, CSRF protection, OTP workflows, and other server-side session features. The session cookie is configured as a session-only cookie, uses HttpOnly, uses SameSite=Lax, and is marked Secure when the site is served through HTTPS.

2. Cookie notice preference

When you dismiss the BidSmart cookie notice, the browser may store a small local-storage preference named bidsmart_cookie_notice_ack_v1 so the same notice does not need to appear on every page visit. This value does not contain your roofing inquiry, Supplier quotation, password, or identity-document information.

3. No advertising cookies

4. Managing browser storage

You can clear cookies and local storage through your browser settings. Removing an active session cookie may sign you out or interrupt a session-dependent workflow. Blocking essential session cookies may prevent parts of BidSmart from working correctly.

5. Future changes

BidSmart offers optional first-party anonymous analytics only after the visitor chooses to allow it. The analytics record stores aggregate daily page-view counts by public page and does not store IP addresses, browser fingerprints, advertising identifiers, or third-party tracking cookies.

Security Policy

1. Security principles

2. Session and request protection

BidSmart configures its session cookie with HttpOnly and SameSite protections and marks it Secure when HTTPS is active. Supported state-changing forms use CSRF tokens to reduce unauthorized cross-site form submissions.

3. Passwords and credentials

User passwords are stored using PHP password hashing rather than as readable plaintext. Production credentials and secrets should be stored outside public web content and must not be committed into downloadable application packages.

4. Protected files and privacy separation

Verification documents and formal quotation files are intended to be served through authorization-aware application logic. The system also enforces the RJL-mediated privacy boundary so normal Supplier access does not expose Client private information and normal Client access does not expose Supplier wholesale quotation or RJL margin data.

5. Audit logging and database monitoring

BidSmart records selected application activity and monitored database changes for accountability and investigation. Hyperledger Fabric is used as an audit-integrity layer: compact metadata and SHA-256 fingerprints can be anchored and later verified against transaction provenance. It does not replace MySQL or MariaDB and is not used for cryptocurrency or payment.

6. Production environment

The production deployment is expected to use HTTPS, restricted database access, protected environment configuration, controlled upload permissions, and server or service health checks. Internal infrastructure ports and credentials should not be publicly exposed.

7. Security limitations

No web application can guarantee absolute security. Security depends on correct server configuration, timely maintenance, strong credentials, protected administrator access, secure connected services, and appropriate operational practices.

8. Reporting a security concern

Users who observe suspicious access, a potentially exposed private tracking link, an unexpected account action, or another security concern should stop sharing the affected information and report the concern promptly to authorized RJL Builders & Trading personnel through the organization's official communication channel.