Privacy Policy

Version 1 | Effective 28 May 2026

1. Introduction 2. Who is responsible for your personal information 3. Personal information we collect 4. How we collect personal information 5. Purposes and lawful basis for processing 6. When we act as an operator (customer tenant data) 7. Sharing your personal information 8. Cross-border transfers 9. Security of your personal information 10. Retention 11. Your rights 12. Direct marketing and cookies 13. How to contact us and complaints 14. Changes to this Policy 15. Validity and document management

01Introduction

Arcaidea (Pty) Ltd (registration number 2022/611739/07), a private company incorporated in the Republic of South Africa (“Arcaidea”, “we”, “us” or “our”), respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, share and protect personal information in the course of our business, through our website at www.arcaidea.ai (the “Website”) and in connection with the Arcaidea software platform (the “Platform”).

We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and other applicable law. Capitalised terms such as “personal information”, “processing”, “responsible party” and “operator” carry the meanings given to them in POPIA.

02Who is responsible for your personal information

For personal information that we determine the purpose and means of processing, Arcaidea is the responsible party. Our Information Officer is responsible for ensuring our compliance with POPIA and can be contacted as follows:

Information Officer: Jacques van Niekerk (Chief Executive Officer)
Email: jacques@arcaidea.ai (general enquiries: info@arcaidea.ai)
Registered office: 81 Pomegranate Street, Monaghan Farm, Lanseria, Gauteng, 1739

03Personal information we collect

We collect only the personal information we reasonably need for the purposes set out in this Policy. Depending on how you interact with us, this may include:

Identity and contact information, such as your first and last name, company name, job title, email address and telephone number;
Account and authentication information, such as username, log-in credentials, authentication tokens and role and permission assignments;
Marketing preferences and communication choices;
Demographic information, such as country and preferred language;
Technical and usage information collected automatically when you use the Website or Platform, including IP address, device and browser type, session metadata, audit-log activity, the pages you visit and the links you follow;
Business information relating to representatives of our customers, suppliers and partners; and
Recruitment and employment information, where you apply for a position or are engaged by us.

We do not ordinarily collect special personal information (such as information about your health, race, religion, political beliefs or sexual orientation), except with your consent or where the law requires or permits it. Where we link other data to your personal information, we treat the combined data as personal information.

04How we collect personal information

We collect personal information directly from you when you engage us, create or use a Platform account, contact us, subscribe to our communications, register for our events, apply for employment, or otherwise interact with us. We also collect certain information automatically through the Website and Platform using cookies and similar technologies (see clause 14), and we may receive information from third parties such as public sources and business partners, to the extent permitted by law.

05Purposes and lawful basis for processing

We process personal information for the following purposes:

To provide, operate, maintain, develop and improve the Platform, our services and the Website;
To authenticate users and manage access and security on the Platform;
To establish and manage our relationships with customers, suppliers and partners;
To respond to your enquiries, requests and complaints;
To send you communications and, where permitted, marketing about our services;
To recruit and administer staff and contractors;
To maintain the security, integrity and availability of our systems; and
To comply with our legal, regulatory and contractual obligations.

We rely on one or more of the lawful bases recognised in section 11 of POPIA, namely: your consent; that processing is necessary to conclude or perform a contract with you; that processing is necessary to comply with a legal obligation; or that processing is necessary to pursue a legitimate interest of you, of Arcaidea or of a third party, balanced against your rights.

06When we act as an operator (customer tenant data)

The Platform is provided to subscribing customers (tenants) on a multi-tenant basis. Where you use the Platform as a user within a customer's tenant, Arcaidea processes your personal information as an operator on behalf of, and on the documented instructions of, that customer. In those cases the customer is the responsible party, and that processing is governed by the subscription agreement and data processing agreement between Arcaidea and the customer, together with the customer's own privacy notice.

Personal information processed in this capacity may include username, email address, hashed credentials, authentication tokens, role and permission assignments, IP address, session metadata and audit-log activity, together with any further data captured under the relevant customer's instructions. This Policy governs the personal information for which Arcaidea is itself the responsible party.

07Sharing your personal information

We may share personal information, for the purposes described above, with:

Operators and sub-processors that process personal information on our behalf under written agreements, including cloud hosting and infrastructure providers (Amazon Web Services, Microsoft Azure, Google Cloud Platform), source-code hosting (GitHub), observability and security tools (for example Sentry and Snyk), and accounting, payroll and collaboration service providers;
Thentic Labs B.V. (Netherlands), our intra-group entity that holds the Platform intellectual property and from which Arcaidea licenses the Platform, whose personnel support and maintain the Platform under binding intra-group arrangements;
Professional advisors and auditors bound by a duty of confidentiality;
Statutory and regulatory authorities where required by law, including the South African Revenue Service, the Companies and Intellectual Property Commission and the Information Regulator;
A third party in connection with a merger, sale, restructuring or financing of all or part of our business; and
Any party to whom you consent that we disclose your personal information.

We do not sell, rent or trade your personal information.

08Cross-border transfers

Some of the recipients above may host or process personal information in countries outside the Republic of South Africa. In particular, our cloud infrastructure providers may host data in regions outside South Africa, and Thentic Labs B.V. processes limited personal information in the Netherlands for development, support and maintenance of the Platform. Where we transfer personal information across borders, we do so in accordance with section 72 of POPIA, on the basis that the recipient is subject to a law, binding corporate rules or a binding agreement (such as standard contractual clauses) providing a level of protection substantially similar to POPIA, or with your consent, or where the transfer is otherwise permitted under POPIA. The Netherlands provides a level of data protection substantially similar to that required under POPIA.

09Security of your personal information

We maintain an Information Security Management System aligned to ISO/IEC 27001:2022 and apply a combination of organisational, technical and physical safeguards to protect personal information against loss, misuse and unauthorised access, alteration or disclosure. These include multi-tenant role-based access control on a least-privilege basis, multi-factor authentication on privileged accounts, encryption of data in transit and of sensitive data at rest, a secure software development lifecycle, logging and monitoring, and contractual security obligations on our operators. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10Retention

We retain personal information for only as long as is necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, contractual or reporting obligations, to resolve disputes and to enforce our agreements. Personal information processed on behalf of a customer is retained and deleted in accordance with the relevant subscription and data processing agreement. When personal information is no longer required, we will delete, destroy or de-identify it in a secure manner.

11Your rights

Subject to POPIA, you have the right to:

Be notified that we are collecting your personal information, and where it has been accessed without authorisation;
Request confirmation of, and access to, the personal information we hold about you;
Request that we correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
Object, on reasonable grounds, to the processing of your personal information;
Object to processing for purposes of direct marketing; and
Submit a complaint to the Information Regulator.

Where Arcaidea processes your personal information as an operator on behalf of a customer, requests to exercise these rights should ordinarily be directed to that customer as the responsible party, and we will assist the customer as required. Otherwise, please contact our Information Officer using the details in clause 13. A formal request for access to a record may be made under the Promotion of Access to Information Act 2 of 2000, in the manner set out in our PAIA Manual, which is available on the Website.

12Direct marketing and cookies

Direct marketing

We will only send you electronic marketing communications where you have consented or where you are an existing customer and the law permits. You may opt out of marketing at any time by following the unsubscribe instructions in any message or by emailing info@arcaidea.ai.

Cookies and similar technologies

The Website uses cookies and similar technologies (such as scripts, web beacons and local storage) to enable core functionality, authenticate users, remember your preferences, and compile aggregated statistics about how the Website is used. Some cookies are strictly necessary for the Website to function. You can manage or disable cookies through your browser settings, although doing so may affect the functionality of the Website.

13How to contact us and complaints

If you have any questions about this Policy or how we handle your personal information, or wish to exercise your rights or lodge a complaint, please contact our Information Officer at jacques@arcaidea.ai or info@arcaidea.ai. If you are not satisfied with our response, you may lodge a complaint with the Information Regulator (South Africa) at https://inforegulator.org.za, where details of the complaints process and the relevant forms are available.

14Changes to this Policy

We may update this Policy from time to time. The current version will be posted on the Website with a revised effective date, and, where the changes are material, we will take reasonable steps to notify you. Unless stated otherwise, the updated Policy supersedes all previous versions.

15Validity and document management

Version 1. This Policy is effective from 28 May 2026.