Privacy Policy (POPIA)

Last updated: 2025-08-13

This Privacy Policy explains how Arcta Studio (Pty) Ltd t/a Arcta Finance (“we”, “us”, “our”) collects, uses, discloses and safeguards personal information processed through the Arcta Finance portal at arctastudio.co.za/projects/finance. It is drafted with reference to the Protection of Personal Information Act, 2013 (“POPIA”).

1. Controller and Information Officer

Responsible Party (Controller): Arcta Studio (Pty) Ltd t/a Arcta Finance
Registered address: (on file)
Information Officer: Appointed in terms of POPIA s55 (contact below)
Contact: info@arctastudio.co.za

2. Scope

This policy applies to users who access or use the Arcta Finance portal, including our clients’ personnel authorised to process accounting and related records.

3. Categories of personal information we process

• Identity & contact: name, username, email, role, company affiliation.
• Authentication: password hashes, session IDs, audit logs (timestamps, IP address).
• Business records: accounting entries, invoices, supplier/customer details (may include company representatives’ personal info).
• Support: correspondence and tickets, technical metadata (browser user‑agent, error traces).

4. How we collect personal information

• Directly from you when you register, sign in, or transact in the system.
• Automatically via strictly‑necessary cookies and security logging.
• From your employer/client entity if they onboard your user account or upload records containing your details.

5. Purposes and lawful bases of processing

We process personal information only as necessary for:

• Contractual performance: providing the accounting system and related services.
• Legal obligations: maintaining accurate records for tax/VAT, SARS filings, audit trails, and Companies Act compliance.
• Legitimate interests: platform security, fraud detection, service improvement, and quality assurance.
• Consent: cookie preferences and, where required, specific optional features. You may withdraw consent at any time (affects future processing).

6. Cookies and similar technologies

We use strictly‑necessary cookies for authentication and security, and a preference cookie to remember consent choices. For details, see our Cookie Notice.

7. Disclosures and recipients

We may share personal information, where necessary and proportionate, with:

• Our employees and authorised processors under confidentiality and data processing agreements.
• Auditors and professional advisers under confidentiality obligations.
• Regulators and authorities (e.g., SARS) to comply with legal duties.
• Service providers for hosting, backup, security and support (bound by written processing terms).

8. Cross‑border transfers

If data is transferred outside South Africa, we implement appropriate safeguards (e.g., contracts ensuring substantially similar protection to POPIA).

9. Security measures

We apply technical and organisational measures appropriate to the risk, including encryption in transit, strict role‑based access control, immutable audit trails, secure session management, and regular backups.

10. Retention

We retain records for as long as necessary for the purposes above and as required by law. Accounting and tax records are typically retained for at least 7 years under South African tax legislation, unless a longer period is justified.

11. Your rights under POPIA

You may have the right to:

• Request access to your personal information we hold.
• Request correction, update, or deletion (where legally permissible).
• Object to or restrict processing in certain circumstances.
• Withdraw consent (where processing relies on consent).

To exercise rights, contact the Information Officer at info@arctastudio.co.za. We may require verification of identity and sufficient information to locate the records.

12. Children’s information

This portal is intended for professional use and is not directed at children. We do not knowingly process children’s personal information.

13. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via this page and, where appropriate, within the portal.

14. Queries and complaints

For queries, contact info@arctastudio.co.za.
You may also lodge a complaint with the Information Regulator (South Africa).