B2B.Africa

Privacy Policy

Last updated: 4 November 2026

This Privacy Policy explains how B2B.Africa processes information about users, business representatives, company profiles, requests, reports and other Platform activity.

1. Who we are

B2B.Africa is operated by Maya Tech Services LLC, a Delaware limited liability company, United States, with a registered address at 8 The Green, Suite A, Dover, DE 19901, USA ("Maya", "B2B.Africa", "we", "us").

For personal information that Maya determines the purposes and means of processing, Maya is the responsible party/controller/personal information processor as those concepts may apply under relevant law.

Privacy contact: support@b2b.africa.

For mainland-China users, additional information required by China's Personal Information Protection Law ("PIPL") will be provided in a PRC-specific Privacy & Cross-Border Notice, published before B2B.Africa actively scales mainland-China acquisition. Where PIPL Article 53 requires it, that notice will include the details of Maya's representative in the People's Republic of China.

2. Business-use context

B2B.Africa is designed for business and professional use.

Even in a B2B service, we process personal information about natural persons, such as: account users; company representatives; directors/officers appearing in lawful registry records; persons communicating through requests or messages; people who contact support; and persons identified in a report where the applicable source and law permit such processing.

South African law may also protect certain information relating to juristic persons. Where applicable, we handle such information in accordance with the relevant South African requirements.

3. Information we collect

Depending on how you use the Platform, we may collect:

3.1 Account and identity data

Name, where provided; business email address; authentication credentials/tokens; organisation and role; language/locale (English or Chinese); account status; evidence of authority or domain control where a feature requires it.

3.2 Company profile data

Company name, country and address, website/domain, registration number/status, industry/ categories, company description, products/services, documents or claims submitted by an authorised company representative, verification level and verification history, and profile-claim history.

3.3 Request, RFQ and matching data

Products/services sought or offered; target countries/regions; quantity/volume; budget or price range; timing/deadline; technical requirements; selected categories/HS codes where used; attachments; match and response history; request status.

3.4 Reports and research data

For Verify Company, Market Scan and related products: source URLs/references; retrieval dates; provenance/source class; publicly or lawfully available company facts; permitted registry/ government/tender records; company-published claims; licensed-provider facts where applicable; confidence labels; analyst/AI-assisted research notes; correction/dispute history.

A commissioned official-registry extract is used only within that specific report and is not copied into any public profile, catalogue, or matching data — see our data-sourcing rules (described on the Trust & methodology page) for how source terms restrict reuse.

3.5 Communications

In-platform messages; support requests; chat-assistant transcripts; email correspondence; correction/dispute submissions; consent/opt-out communications.

3.6 Payment/order information

We generally do not store full card data.

For Stripe Managed Payments transactions, we may receive information needed to provide and support the Product, such as buyer/account identifiers, order/subscription identifiers, product/plan, amount/ currency, transaction/refund status, and billing/business details made available to us by Stripe. Where Stripe processes payment information on our instructions to complete a payment, it acts as our operator/processor; where it acts for its own purposes, including as merchant of record through Sold through Link, LLC, it is an independent responsible party/controller (see section 8). For a purchase by a buyer from mainland China, payment is taken through Stripe directly with Maya Tech Services LLC as seller and merchant of record; Stripe acts as our payment processor and, for its own purposes such as fraud prevention and legal compliance, as an independent controller under the Stripe Privacy Policy; the payment information is processed by Stripe in the United States and other countries where Stripe operates (see sections 8 and 12).

For direct T/T orders, we may process invoice details, remittance records, payer details and bank references needed to reconcile the payment and meet accounting/legal obligations.

3.7 Technical, security and usage data

IP address; timestamps; browser/device/user-agent information; session identifiers; security and authentication events; rate-limit/abuse signals; product lifecycle events such as signup, request creation and profile completion; acceptance/version records for legal documents.

Visit statistics. We measure visits to public pages with our own cookie-free counter. For each page view we record the page path, the referring site, campaign tags from the link (utm_source, utm_medium, utm_campaign), the country (derived from the request), whether the visit looks automated, and a one-way hash of your IP address, browser string and the current date. The hash is computed with a secret key and changes daily; we do not store your IP address or browser string for this purpose. We use this only to understand aggregate traffic and do not share it with third parties or use it for advertising. Cloudflare, which proxies our traffic, also provides us with aggregate, cookie-free traffic statistics.

Campaign source of a request or order. If you reach a request or order page through a link carrying campaign tags (utm_source, utm_medium, utm_campaign), we keep those tags with your draft, in your browser and, where a draft is saved with us, on our servers, and with the request or order that follows. Unlike the visit statistics above, this record is linked to you or your company. Our team uses it to see which campaign or event page a customer came from and to follow up on that request or order. We do not sell it or use it for advertising; the service providers in section 8 may process it as part of the request or order. It is kept for as long as the draft, request or order it belongs to.

Source link clicks. Links to a tender's official source, such as a government notice or tender document, on our site and in our emails pass through our own address before taking you to the source. When you follow one, we record the tender, the type of link, where you followed it from (for example, a tender page or the weekly tender email), the tender's country and the time. If you are signed in, this record is linked to your account, and authorised members of our team can see which tenders you opened and when; each time they view that list, the access is logged. If you are not signed in, we ask you to sign in first and record the same details with the daily one-way hash described under "Visit statistics" instead of your account; we do not link that hash to your account. We use these records to understand which tenders and sources are useful, including which signed-in users are interested in which tenders, and to improve the Platform. We do not sell them or use them for advertising, and we do not use them to send you promotional email unless you have agreed to receive it. The hosting providers in section 8 process them on our behalf. You can object to this processing as described in section 15.

Analytics with your consent. If you choose "Accept" in our cookie banner, we also use Google Analytics 4 to understand how visitors use public pages (pages viewed, approximate location, device and browser type, how you arrived, time on page). Google Analytics sets its own cookies (see section 11) and processes this data on our behalf. We have turned off Google signals and ad personalisation, and we do not use Google Analytics data for advertising. If you choose "Reject" or make no choice, Google Analytics is not loaded and no data is sent to Google; only our cookie-free counter described above runs. You can change your choice at any time through "Cookie settings" at the bottom of our public pages.

We also receive aggregate statistics from Google Search Console and Bing Webmaster Tools about how our pages appear in search results (search queries, impressions, clicks and positions). These statistics do not identify individual users.

We do not use third-party advertising trackers.

3.8 Consent and suppression records

We maintain records of the consent/notice version shown; purpose; acceptance or refusal; date/ time; withdrawal; unsubscribe; suppression/opt-out status; and direct-marketing screening evidence where applicable.

Suppression records may be retained longer than other account data where reasonably necessary to ensure we do not contact a person who opted out.

4. Where information comes from

Information may come from: you; your organisation; another authorised user in your organisation; a company website; official public registries; official government/tender/ sanctions sources; public professional/business sources used consistently with applicable law and source terms; licensed providers; permitted secondary sources; matching/request counterparties; Stripe or other payment providers; and service providers supporting Platform operation.

We do not treat a secondary source or registry aggregator as an official registry merely because it contains registry-like information.

5. Why we process information

We process information for the following purposes, using the legal basis required by the law that applies to the particular processing.

5.1 Provide the service / perform an agreement

For example: create and secure accounts; provide purchased reports; operate subscriptions; process requests; match companies; provide messages/notifications; fulfil verification orders; provide customer support.

5.2 Consent

Where required, we rely on specific consent for marketing and promotional email (product news, offers and partner promotions); optional emails you turn on yourself (for example, request notifications, tender alerts you set up, or the weekly tender email); certain disclosures/transfers; mainland-China cross-border transfers or other processing requiring separate consent under PIPL; and any sensitive-personal-information processing that requires consent.

Consent captured for each purpose is unbundled: agreeing to one type of communication (for example, request notifications) does not bundle-in another (for example, marketing); consent checkboxes are not pre-ticked; and consent can be withdrawn where the law gives that right.

The weekly tender email stays off until you turn it on by pressing the button to turn it on, either on the screen we may show before you open a tender's source or under Tender filters in your account. Declining or closing that screen leaves it off and still takes you to the source. We record which button you pressed, the version of the wording shown and the time. Turning it on does not sign you up for any other email: product news is a separate, unticked, optional box. When you unsubscribe or remove it, we stop sending it and keep the record of your choice and of its withdrawal.

5.3 Legitimate/business interests where recognised by applicable law

For example: prevent fraud/abuse; secure the Platform; improve product usability; maintain audit evidence; protect legal rights; analyse aggregate product performance; understand which campaigns bring requests and orders; see which tender sources our users open (section 3.7). We use this basis only where applicable law recognises it and after considering affected rights.

5.4 Publicly disclosed / legally permitted business information

Where applicable law permits, we may reasonably process information that has been lawfully made public, including certain business/directorship information, for report/profile purposes. We still apply data-minimisation, provenance and correction controls.

5.5 Legal obligations and legal claims

We process information where necessary to comply with law/regulator/court requirements; maintain tax/accounting records; respond to lawful requests; establish, exercise or defend legal claims; and comply with sanctions/trade or consumer-protection obligations.

6. AI-assisted and automated processing

We may use AI or automated tools to assist with classification, translation, summarisation, matching, research drafting, fraud/rate-limit signals, and chat assistance.

Our product design is intended to distinguish source facts from model-generated analysis.

We do not intend to use a fully automated process to make a decision about a natural person that has legal or similarly significant effects without the safeguards required by applicable law. Where PIPL or other applicable law requires an impact assessment for automated decision-making, we will perform and retain it as required.

Where an account/verification decision materially affects a person and applicable law provides a right to explanation or human review, a request can be submitted through the privacy/support contact channel.

7. Public profiles and research subjects

A public business profile can include information obtained from permitted sources even before a representative has claimed it. An Unclaimed status expressly means no authorised representative has yet claimed the profile.

The public facts of a company profile — company name, country, business categories, public-procurement award history and Maya's short factual description — are also released as open data under CC BY 4.0, as described in section 5.4 of the Terms. Contact details, verification evidence and anything a company keeps private are never part of that release.

For information about natural persons in a public company record, we limit publication to what is reasonably relevant to the business purpose and permitted by the source/law.

If you believe a public profile or report contains inaccurate personal or company-identifying information, you may request correction or challenge the source using the Platform's correction mechanism. We may preserve a version/audit history where reasonably required for integrity, disputes and legal compliance.

8. Who receives or processes information

We use service providers and counterparties only to the extent reasonably necessary for Platform operation.

  • Stripe (Stripe, Inc. and its affiliates, including the Stripe payments entity that processes the payment and Sold through Link, LLC as merchant of record for self-serve purchases) — processes your payment and billing information. Where Stripe processes it on our instructions to complete a payment, it acts as our operator/processor. Where it acts for its own purposes — as merchant of record, for fraud prevention, for a Link account you create, and to meet its own legal obligations — it is an independent responsible party/controller under the Stripe Privacy Policy (https://stripe.com/privacy) and, for Link accounts, the Link Privacy Policy (https://link.com/privacy). Receipts, invoices and refund notices for self-serve purchases billed by Sold through Link, LLC are sent to you by Link.
  • Hosting — Hetzner (server infrastructure, Germany) and Neon (database, EU/Frankfurt); traffic is proxied through Cloudflare.
  • Web analytics — Google LLC (Google Analytics 4), only for visitors who accept analytics cookies. Google processes this data as our service provider under its data processing terms.
  • AI model provider — Anthropic, used to help draft report content, power the AI chat assistant, and support internal quality checks. Conversation and request content may be sent to this provider to generate a response. We do not rely on an AI provider as an authoritative source for a factual verification claim.
  • Email delivery — Resend (Plus Five Five, Inc., United States) sends our emails, including sign-in links, request and tender notifications and the weekly tender email. It receives your email address, the message content and delivery events (for example, delivered, bounced or marked as spam), and acts as our operator/processor.
  • Licensed data / verification / inspection providers — where a product uses a contracted data provider or inspection partner, that provider receives only the information reasonably needed for the relevant service, subject to the applicable contract and legal role. None are under contract at present; this policy will be updated if that changes.
  • Matched companies / users — a request's permitted content is shared with selected potential counterparties as the feature describes. Requester identity/contact data is disclosed only under the feature's stated rules.
  • Professional advisers / legal requirements — information may be disclosed to lawyers, accountants, insurers, auditors, regulators, courts or authorities where reasonably required and lawful.

We require each processor to handle data only on our instructions and only for the purpose we engaged them for.

9. South Africa: POPIA and juristic-person data

Where the Protection of Personal Information Act, 2013 ("POPIA") applies to Maya or to a specific processing activity, we process relevant information in accordance with POPIA's applicable conditions.

South African identifying information about a juristic person may fall within POPIA's definition/scope. This may include a South African company profile or company-related verification data.

Maya will maintain the Information Officer / local-authorisation / PAIA arrangements required if South African law applies those requirements to Maya's current operations. If a South African Information Officer/local authorised person is required, their legally required contact/ registration details will be published in the appropriate notice/manual.

10. South Africa: outbound communication and direct marketing

We distinguish operational/request communications from marketing. We will not intentionally send electronic direct marketing to a South African recipient unless the legal preconditions applicable to that communication are satisfied.

The weekly tender email goes only to people who turned it on. It lists tenders and contains no promotion of paid plans, reports, partners or other goods or services. Each email identifies the sender and carries a one-click unsubscribe (RFC 8058); stopping it does not close your account. Promotional email is sent only to recipients who gave a separate, unticked, specific consent, which can be withdrawn at any time. For free accounts we do not rely on the "existing customer" provision in POPIA section 69(3).

Where required, controls include: a lawful permission/consent mechanism; the applicable POPIA section 69 process; screening/cleansing against the CPA Opt-Out Registry; registration as a direct marketer where required; sender identification; a simple opt-out/unsubscribe; suppression- list checks; and audit records.

Currently, for South African companies we use a once-off consent-request message, aligned with POPIA section 69(2)/Form 4, sent at most once per company across the Platform's entire history; every message type includes a one-click unsubscribe mechanism (RFC 8058); and for Kenyan/Nigerian companies, only role-based addresses (e.g. info@, sales@) are used — never a named individual's address obtained without their own consent.

A recipient who opts out is added to a suppression mechanism so the opt-out can be respected. A "real RFQ" or match does not automatically exempt a message from direct-marketing law; the classification depends on the actual message and purpose.

11. Cookies

Without your consent, we use only first-party cookies necessary or functional for the Platform to function:

  • b2b_session — necessary. Keeps you signed in to your account.
  • b2b_anon — necessary/functional. A random identifier that lets an unregistered visitor continue a draft request across visits.
  • chat_session — necessary/functional. Binds an AI chat-widget conversation to your browser session so the conversation continues correctly across messages and, if escalated, reaches the right human follow-up.

Our own visit counter described in section 3.7 sets no cookies.

Analytics cookies — only with your consent. If you choose "Accept" in our cookie banner, Google Analytics sets:

  • _ga — analytics. Distinguishes visitors. Expires after 2 years.
  • _ga_<container-id> — analytics. Keeps the session state. Expires after 2 years.

If you choose "Reject" or make no choice, these cookies are not set. Your choice itself is stored in your browser's local storage (b2b_consent), not in a cookie, so that we do not ask again on every page; it is asked again if this section changes. You can change or withdraw your choice at any time through "Cookie settings" at the bottom of our public pages; withdrawing stops further collection.

We set no advertising cookies.

12. Cross-border data transfer

Maya Tech Services LLC and its processing infrastructure are based in the United States and the European Union.

12.1 South Africa

Where POPIA section 72 applies to a transfer outside South Africa, we use the permitted mechanism applicable to the transfer, which may include a recipient subject to adequate protection, contractual safeguards/binding agreement, consent where valid and appropriate, or another statutory ground. We maintain the underlying contracts/assessment needed to support the statement we make publicly; a policy sentence alone is not treated as a transfer mechanism.

12.2 Mainland China

If PIPL applies to Maya's processing of personal information of natural persons within mainland China, before actively scaling that acquisition: a specific Chinese-language notice will be provided; separate consent for an overseas transfer will be obtained where Article 39 requires it; that notice will identify the overseas recipient(s), contact information, purposes/methods/ categories and how individuals may exercise rights; the applicable Article 38 transfer route or a documented exemption under then-current CAC rules will be assessed; a personal-information protection impact assessment will be performed/retained where required; and the Article 53 PRC representative/specialised-agency requirement will be implemented where applicable.

Our zh-CN registration flows present a separate, specific checkbox for consenting to cross-border transfer of personal information, as required by PIPL, alongside the Chinese- language privacy notice, once that notice is live.

12.3 Web analytics

If you accept analytics cookies, Google Analytics data is processed by Google LLC, including in the United States. Your consent in the cookie banner is the basis for this transfer. Visitors from mainland China are not shown the banner and Google Analytics is not loaded for them.

13. Mainland-China PIPL representative

If Maya is a foreign personal-information processor within PIPL Article 3(2) and Article 53 applies, Maya will appoint or establish the required representative/agency in the People's Republic of China and submit the required details to the competent authority before actively scaling mainland-China acquisition. Once determined, the representative's name and contact details will be published here and in the PRC-specific notice referenced in §1. We do not publish invented representative details.

14. Retention

We retain information only for as long as reasonably necessary for the purpose and applicable legal obligations.

  • Account data. For the life of the account and ordinarily up to 24 months after account closure, unless a longer period is needed for legal, tax, fraud, dispute or security reasons.
  • Requests/messages. For the life of the account/service and ordinarily up to 24 months after closure or the end of the relevant business relationship, subject to legal/dispute needs.
  • Reports/provenance. For as long as needed to deliver/support the report and ordinarily up to 24 months after delivery/account closure, except where source terms require earlier deletion or law/dispute/audit obligations require longer retention.
  • Visit statistics. Page-view records from our own visit counter are kept for up to 26 months and then deleted.
  • Source link clicks. Records of clicks on tender source links (section 3.7) are kept for up to 12 months and then deleted.
  • Google Analytics. Data collected with your consent is kept in Google Analytics for 14 months and then deleted by Google.
  • Consent/acceptance/audit records. For as long as reasonably needed to demonstrate compliance. Where PIPL requires an impact-assessment/processing record to be kept for at least three years, we retain it for at least that period.
  • Suppression/opt-out records. As long as reasonably necessary to respect the opt-out and demonstrate compliance. We may retain a minimal hashed/suppression identifier rather than a full marketing profile.
  • Payment/tax/legal records. For the period required by the applicable accounting/tax/ payment law or to resolve disputes.
  • Official-registry extracts. Used only within the report they were purchased for and not retained for reuse outside it.

15. Your rights

Subject to applicable law (POPIA for South African data subjects; comparable rights are extended to other users), you may have rights to: access or obtain confirmation of personal information; receive a copy; correct/supplement inaccurate information; request deletion; object to/restrict processing (for example, marketing); withdraw consent; opt out of marketing; request information about automated processing; request human review where required; and complain to a competent regulator.

To exercise a right, contact us at support@b2b.africa. We may need to verify identity/ authority before disclosing or changing data. Access to personal data is logged in an internal audit log.

We will respond within the period required by applicable law. Where no shorter mandatory deadline applies, our operational target for routine verified access/correction/deletion requests is 30 days.

We may lawfully retain information despite a deletion request where retention is required for legal obligations, security, fraud prevention, suppression, records of consent/withdrawal or legal claims.

16. Security

We use reasonable administrative, technical and organisational safeguards appropriate to the nature of the Platform, including access control, authentication, rate limiting, logging, private/restricted storage where appropriate, secure transport, limited provider access, and incident response. Access to a company's data on the Platform is restricted to members of that company.

No internet service can guarantee absolute security. If a personal-information security compromise occurs, we will take reasonable remedial steps and make regulatory/data-subject notifications where and when applicable law requires.

17. Sensitive personal information

The self-serve Platform is not designed to collect unnecessary sensitive/special-category personal information. Do not upload identity documents, financial-account details, health data, precise location data or other sensitive personal information unless the relevant verification/ order flow expressly requests it and provides the required notice/security controls.

Where a specific verification service legitimately requires sensitive information, we apply the additional legal basis/consent, minimisation and safeguards required by applicable law.

18. Children

The Platform is intended for business users aged 18 or older and is not directed to children. We do not knowingly invite children to create accounts.

19. Data quality, adverse information and correction

Because B2B.Africa publishes business-verification information, data quality is a core control. We distinguish official facts, company-published claims, secondary facts, analysis, and confidence level.

For adverse or disputed information: wording should describe the source fact rather than make an unsupported accusation; absence of a record is not proof of absence; a subject may submit a correction/challenge; we may mark a materially disputed fact while reviewing it; and corrected reports/profiles may carry a version history.

20. Governing law and complaints

Privacy-related disputes are subject to the same governing law and forum as the Terms of Service §25, without limiting any mandatory data-protection rights you hold in your own jurisdiction or the right to complain to a competent data-protection authority. Where Stripe acts as an independent responsible party/controller for payment data (section 8), the Stripe Privacy Policy and, for Link accounts, the Link Privacy Policy govern that processing.

21. Changes to this policy

We will update this policy as the Platform and its data practices evolve, and will note the date of the latest revision at the top of this page. Material changes will be announced on this page and, for registered users, by email. Where new consent is legally required, we will request it rather than treating silence as consent.