Privacy Policy
What we collect, why, how we look after it, and the rights POPIA gives you.
This policy explains what personal information Arcivo collects, why we collect it, how we look after it, and the rights you have under the Protection of Personal Information Act, 2013 (POPIA). We are an information governance firm, so we hold ourselves to the standard we advise our clients to meet.
1. Who we are
Arcivo Information Management (trading as Arcivo) is the responsible party for the personal information described in this policy. We are based in Johannesburg, South Africa. You can reach us at [email protected].
2. Our Information Officer
Our Information Officer, Tareq Vazi, is registered with the Information Regulator and is responsible for how we handle personal information. Contact our Information Officer at [email protected] for any privacy question, request or complaint.
3. What we collect
When you use the contact form or email us, we collect your name, company name, role, email address, and anything you choose to tell us in the message field. We do not collect financial or identity-document information through this website.
When you visit the website, our hosting and security provider automatically logs standard technical information — such as your IP address, browser type, the pages you view, and the date and time of your visit. We use this only to keep the website secure, available and working correctly, not to identify you personally.
4. Cookies and consent
This website uses a consent management tool, CookieYes, to handle cookies. CookieYes sets a cookie that remembers your consent choices. Any non-essential cookies, such as analytics, are only set with your consent, which you can change or withdraw at any time through the cookie settings on this site. If we add further cookies or analytics in future, the consent banner and this policy will be updated to reflect them.
5. Why we collect it, and our lawful basis
We use your information only to respond to your enquiry, schedule and deliver a free assessment, and follow up about the services you asked about. Our lawful basis under POPIA is that this processing is necessary to take the steps you have asked us to take, and to pursue our legitimate interest in responding to you and conducting our business. We do not sell your information, and we do not use it for marketing unless you have separately and specifically agreed to that.
6. How long we keep it
We keep enquiry information for 24 months after our last contact with you, unless you become a client (in which case our client retention schedule applies) or you ask us to delete it sooner. Automatically collected server logs are kept only for the limited period our hosting and security provider retains them. We do not keep personal information for longer than is necessary for the purpose it was collected.
7. Who we share it with
To run this website and respond to you, we rely on a small number of trusted service providers who act as operators on our behalf: Web3Forms delivers contact-form submissions to us; Calendly handles any call you book through our calendar link; Cloudflare provides our website hosting, content delivery and security; CookieYes manages cookie consent; and Google Fonts serves the website's typography. Some of these providers process information on servers outside South Africa; where that is the case, we use providers that are subject to recognised data-protection safeguards. We do not share your information with any other third party except where the law requires it.
8. How we protect it
We apply the same security standards to our own information that we apply to our clients': access controls, encrypted systems, and staff training. No system is perfectly secure, but we take reasonable steps appropriate to the sensitivity of the information. If a security compromise affecting your personal information were to occur, we will notify the Information Regulator and any affected people as soon as reasonably possible, as POPIA requires.
9. Your rights under POPIA
You have the right to ask what personal information we hold about you, to have it corrected or deleted, to object to its processing, and to withdraw any consent you have given (this does not affect processing that has already taken place). You also have the right to complain to the Information Regulator. To exercise any of these rights, email our Information Officer; formal requests for access to records are dealt with through our PAIA Manual. The Information Regulator can be reached at inforegulator.org.za, and complaints are lodged through its eServices portal at eservices.inforegulator.org.za.
10. Children's personal information
Our website and services are intended for businesses and the professionals who work in them. They are not directed at children, and we do not knowingly collect personal information relating to children. If you believe a child has provided us with personal information, please contact our Information Officer and we will delete it.
11. Automated decision-making
We do not make decisions about you based solely on the automated processing of your personal information, and we do not use it to profile you.
12. Changes to this policy
We will update this policy when our practices change. The "last updated" date above always reflects the current version.