How PAPAN handles information shared through its website and business channels.

Website enquiries covered by this policy: project enquiries, quotation requests, site visits, donor and partnership discussions, procurement reviews, vendor registration, registration, tax, compliance, reference and publication requests.

Where this policy applies: This policy applies to information shared through PAPAN’s website forms, email, telephone, WhatsApp and related business communication channels.

1. Who we are

PAPAN South Sudan Ltd is an engineering, procurement and consultancy company operating mainly in South Sudan and Uganda, with capacity to undertake suitable assignments elsewhere in East Africa.

2. Information we may collect

Depending on the enquiry or communication, PAPAN may collect:

• Name, organisation, job title, email address, telephone number and WhatsApp contact.
• Project location, required service, scope, expected timeline, budget range, tender reference or procurement stage.
• Drawings, photographs, project briefs, bills of quantities, specifications, concept notes, logframes or other supporting documents.
• Document-request details, including the requesting organisation, purpose, document category, reference number, deadline and submission instructions.
• Vendor, registration, tax, compliance, partnership or due-diligence information voluntarily provided as part of the request.
• Messages submitted through website forms, email, telephone or WhatsApp.
• Technical information such as IP address, device type, browser, server logs and pages visited where hosting or analytics services record it.

3. Different forms for different requests

Project Enquiry Form

This form is for engineering, infrastructure, consultancy, donor, partnership, quotation, site-visit and implementation enquiries.

Document Request Form

This form is for company profiles, capability statements, registration, tax, compliance, vendor-registration, membership, reference, completion and related company-document requests.

Links from the Resource Centre and Procurement Centre may preselect a document category and add a suggested checklist. The requester must review and correct the list before submitting it.

4. Uploaded files

A form may allow one supporting file, such as a project brief, tender checklist, vendor form, bill of quantities, drawing, photograph or due-diligence schedule.

• Only upload information necessary for the stated request.
• Do not upload passwords, private banking credentials or sensitive personal information unless PAPAN has specifically requested it through an appropriate channel.
• Do not upload files containing malicious code or content you are not authorised to share.
• When a file contains personal or confidential information, the sender must have authority to provide it.

5. Generated email requests

The Document Request Form may prepare an email subject and message using information entered by the requester. The requester can review and edit the text before copying it or opening it in an email application.

PAPAN does not guarantee that a suggested checklist will cover every tender, donor, procurement or vendor-registration requirement.

6. How information is used

• Responding to project, quotation, partnership and document requests.
• Assessing technical scope, site-review requirements, procurement needs and submission deadlines.
• Preparing quotations, capability responses, vendor-registration packs or requested company-document submissions.
• Confirming that requests for registration, tax, compliance, reference or completion documents are legitimate and relevant.
• Managing legitimate business communication, contracts, project files and statutory records.
• Protecting the website, forms and communication systems against misuse or malicious activity.
• Improving website performance, security, accessibility and content.

7. Basis for processing

PAPAN may process information to respond to a request, take steps before entering into a contract, perform a contract, meet a legal or regulatory obligation, protect legitimate business interests or act with consent where appropriate.

8. Non-public company and procurement documents

Some documents may contain signatures, registration details, tax information, banking confirmation, client references, recommendation letters, completion certificates or other non-public information.

• PAPAN may confirm the requesting organisation, purpose and intended recipient before sharing a document.
• Some documents may be redacted, watermarked, certified or shared through a secure channel.
• Client references or recommendation letters may require client permission.
• PAPAN may decline a request that is unclear, excessive, unrelated to a legitimate purpose or likely to create a security or confidentiality risk.

9. Sharing information

Information may be shared, where reasonably necessary, with authorised PAPAN personnel, professional advisers, hosting or communication providers, project partners, lead contractors, clients, regulators or public authorities.

PAPAN does not sell personal information to advertisers.

10. Hosting, forms and communication providers

Website hosting, form processing, email, telephone, WhatsApp and cloud-storage providers may process information under their own terms and privacy practices. PAPAN aims to configure these services to collect and retain only what is reasonably required.

11. Cookies, server logs and analytics

The website may use essential technologies for security and functionality. Server logs or privacy-conscious analytics may record technical information about website use. Any non-essential tracking should be disclosed and, where required, offered through an appropriate consent mechanism.

12. International handling

PAPAN operates across South Sudan and Uganda and may work with organisations elsewhere in East Africa or internationally. Information may therefore be accessed or stored in more than one country, subject to reasonable safeguards.

13. Retention

Information is kept only for as long as reasonably necessary for the enquiry, quotation, tender, due-diligence review, contract, project, statutory, security or record-keeping purpose for which it was collected.

Unsuccessful or incomplete enquiries may be kept for a limited period where necessary to maintain a communication record, manage risk or respond to follow-up questions.

14. Security

PAPAN applies reasonable organisational and technical measures to protect information. No website, form, email or messaging platform can be guaranteed completely secure.

Visitors should avoid sending unnecessary sensitive information through open email or messaging channels and should follow any secure-submission instructions provided by PAPAN.

15. Your choices and requests

Subject to applicable law and legitimate record-keeping requirements, a person may request access to, correction of, deletion of or restriction on their personal information, or withdraw consent where processing relies on consent.

16. Third-party links and platforms

External websites, tender portals, social-media platforms, WhatsApp and other third-party services have their own privacy practices. PAPAN is not responsible for how those services process information.

17. Children and vulnerable groups

The website is intended for professional and public information and is not designed to collect personal information directly from children. Project or media information involving children or vulnerable groups should be handled in line with appropriate safeguarding and consent requirements.

18. Changes to this policy

PAPAN may update this policy when website features, forms, hosting arrangements, business practices or legal requirements change.

19. Contact

Privacy questions, correction requests or concerns may be sent to info@papangroup.com.