Privacy notice (POPIA)
Last updated: September 2026
Arke Technologies (Pty) Ltd, a Johannesburg technology company, processes personal information under the Protection of Personal Information Act, 2013 (POPIA). This notice explains what we collect and why, who receives it, how long we keep it, how we protect it and how to exercise your rights through our Information Officer.
Privacy notice (POPIA)
Last updated: September 2026, 15 min read
Arke Technologies (Pty) Ltd, a Johannesburg technology company, processes personal information under the Protection of Personal Information Act, 2013 (POPIA). This notice explains what we collect and why, who receives it, how long we keep it, how we protect it and how to exercise your rights through our Information Officer.
Last updated: September 2026, 15 min read
On this page
When we act for your organisation
When we manage IT, security or software for an organisation, that organisation is the responsible party for the personal information in its systems, and we act as its operator under sections 20 and 21 of POPIA. In practice:
We process the information only on the organisation's instructions, under a written agreement that requires confidentiality and security safeguards.- Every remote session is approved and logged, and everyone with access to client systems is bound by confidentiality and our security controls.
- We notify the organisation immediately if we have reasonable grounds to believe that its personal information has been accessed or acquired by an unauthorised person, so that it can meet its own duties.
- We never train AI models on client data without the client's explicit consent.
- The organisation owns its data, credentials and documentation, and we hand them back in order when an engagement ends.
If your personal information sits in a system we manage for your employer, your school or another organisation, send your request to that organisation; we help it respond. Organisations that want support with their own obligations can read about our POPIA compliance service.
Who we share it with
We share personal information only where a purpose in this notice requires it, and only as much as that purpose needs. We do not sell or rent personal information. Recipients fall into these categories:
- Our team, on a need-to-know basis and bound by confidentiality.
- Service providers that process information for us, such as cloud hosting, email, accounting and payroll systems, under written agreements that require confidentiality and security safeguards.
- Banks and payment service providers, to collect payments and debit orders.
- Network operators, when you order connectivity from Fibre Boyz, so that your service can be connected and activated.
- Couriers, when we deliver equipment you ordered.
- Software and cloud vendors, when we register licences, subscriptions or support cases in your organisation's name.
- Professional advisers, such as accountants, auditors and attorneys, who owe us a duty of confidentiality.
- Regulators, courts and law enforcement, where the law requires it, for example the South African Revenue Service or the Information Regulator.
- A buyer or successor, if all or part of our business is sold or restructured, under confidentiality and only as far as the transaction requires.
Transfers outside South Africa
Some of the cloud services we use may store or process information outside South Africa. We transfer personal information across borders only where section 72 of POPIA allows it, which means that one of these conditions applies:
- The recipient is bound by a law, binding corporate rules or a binding agreement that gives protection substantially similar to POPIA's.
- You consent to the transfer.
- The transfer is necessary to perform a contract with you, or to take steps you asked for before one.
- The transfer is necessary for a contract concluded in your interest between us and a third party.
- The transfer is for your benefit, it is not reasonably practicable to obtain your consent, and you would be likely to give it.
How we protect it
Section 19 of POPIA requires appropriate, reasonable technical and organisational measures. Ours include:
- Encryption of personal information in transit and at rest.
- Access controls that limit information to the people who need it.
- Audit logging, including the approval and logging of every remote session on our own remote-access platform, which runs on our own servers in Johannesburg.
- Data minimisation: we collect and keep only what a purpose needs.
- Confidentiality obligations for everyone with access to personal information.
- Written agreements with the service providers that process information for us.
- Security controls aligned with ISO/IEC 27001, the NIST Cybersecurity Framework and CIS Controls. We work to these frameworks; we do not hold certification.
If something goes wrong. If we have reasonable grounds to believe that personal information we are responsible for has been accessed or acquired by an unauthorised person, we notify the Information Regulator and the people affected as soon as reasonably possible (section 22), with enough detail for them to protect themselves. Where the information belongs to a client, we notify the client immediately.
Your rights under POPIA
You have the right to:
- Be told what personal information we collect about you and why, as this notice sets out (section 18).
- Access it: ask us to confirm, free of charge, whether we hold personal information about you, and ask for a copy or description of it, including who has had access to it (section 23).
- Correct or delete it where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, or where we are no longer authorised to keep it (section 24).
- Object to processing based on a legitimate interest, and to direct marketing at any time (sections 11(3) and 69).
- Withdraw consent you have given, at any time.
- Not be subject to a decision based solely on automated processing that has legal consequences for you or affects you to a substantial degree (section 71).
- Complain to the Information Regulator (section 74), and institute civil proceedings (section 99).