Privacy policy

ARCA is a South African business. You can reach our Information Officer, who is responsible for how ARCA handles personal information, at privacy@arca.africa.

We play two different roles under POPIA:

• For ARCA accounts (the people who sign in to run a House), we are the responsible party: we decide how that information is used.
• For the bookings a House manages (its schools, teachers, tour operators, groups and visitors), the House is the responsible party and ARCA is its operator: we process that information only on the House's instructions, to provide the service. Questions about a booking should go to the House first; we will help them answer.

People who use ARCA to run a House: name, work email address, phone number, job title, profile photo (optional), the Houses and roles you belong to, and records of important actions you take (for example issuing an invoice or changing a setting), kept as an activity log.

Booking information a House collects through ARCA: the name and details of the school or organisation, contact people and their email addresses and phone numbers, billing and postal details, the visit date and programme, group sizes and grades, accessibility or dietary notes the booker chooses to give, messages sent through the client portal, survey answers, and documents such as proof of payment or purchase orders. ARCA asks for group numbers, not individual learners' names.

Payments: quotations, invoices, credit notes and payment records. For card payments taken at a venue we record the card type, the last four digits, the approval code and (where the House requires it) a photo of the signed slip. We never store full card numbers. ARCA does not hold or move money; payments happen directly between the client and the House.

Connected mailboxes: when a House connects a Microsoft 365 or Google mailbox so ARCA can send its booking emails, we store the mailbox address and an access token. See section 05.

Technical information: sign-in sessions, device and browser type, and server logs needed to keep the service secure and working. ARCA does not use advertising or tracking cookies, and we do not sell personal information.

If you contact us (for example to ask for a demo or for support), we keep your message and contact details to reply to you.

• To provide the service: taking booking requests, scheduling visits, sending confirmations, quotations, invoices, reminders and Visit Passes, running the client portal, and recording attendance and payments.
• To keep accounts secure: sign-in, permissions, and an activity log of sensitive actions.
• To support Houses and fix problems, including when a House gives our support team temporary access.
• To meet legal duties, such as keeping financial records for tax purposes.
• To tell account holders about changes to the service. We do not send marketing to a House's clients.

We rely on the lawful grounds POPIA allows: performing our agreement with the House, the legitimate interests of running a secure service, complying with the law, and consent where we ask for it.

Only the service providers we need to run ARCA, each bound to protect the information and use it only for us:

• Supabase — database, file storage and sign-in (servers in London, United Kingdom).
• Vercel — hosting of the ARCA app and this website.
• Microsoft and Google — only when a House connects its own mailbox, to send that House's emails.

Within ARCA, a House's information is visible only to that House's team, according to the permissions the House sets, and to ARCA support staff when the House allows it. We may disclose information where the law requires it.

Outside South Africa: because our database is hosted in the United Kingdom, personal information is stored outside South Africa. The UK has data protection law that gives protection comparable to POPIA, and our providers are contractually bound to protect it, as section 72 of POPIA requires.

ARCA sends a House's emails from the House's own mailbox, never from an ARCA address. To do this we ask only for permission to send email:

• Google: the gmail.send permission, plus your email address to show which mailbox is connected.
• Microsoft: Mail.Send and Mail.Send.Shared (to send from a shared mailbox you have rights to), your basic profile, and continued access so emails can go out while you are away.

ARCA cannot read your inbox, contacts or calendar. Replies from clients go straight to your own mailbox. Access tokens are stored encrypted and used only to send the emails the House has set up or a team member chooses to send. A House can disconnect a mailbox at any time in ARCA, or revoke access in its Microsoft or Google account.

ARCA's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, and do not use it to train AI models.

We keep account information while your account is active. Booking information is kept for as long as the House keeps its account, so the House can see its history. Financial records are kept for as long as tax law requires (in South Africa, generally five years). When a House leaves ARCA, its account stays available read-only for 60 days so it can export all of its booking, client and financial records; after that its information is deleted, except records we must keep by law.

Information is encrypted in transit, each House's data is kept separate and checked on every request, team members only see what their role allows, sensitive actions are logged, and mailbox tokens are stored encrypted. If a security breach affects your personal information, we will tell the Information Regulator and the people affected as POPIA requires.

Under POPIA you may ask to see the personal information held about you, ask for it to be corrected or deleted, and object to how it is used. For a booking, contact the House first — it controls that information — or write to us at privacy@arca.africa and we will help. For your ARCA account, write to us directly.

If you are unhappy with how we handled your information, you may complain to the Information Regulator (South Africa) at inforeg.org.za.

ARCA is used by adults: venue staff, teachers and group organisers. Bookings record learner numbers and grades, not learners' names. If a House chooses to collect a child's personal information, it is responsible for having the consent POPIA requires.

We will update this policy when the service changes, and tell account holders about significant changes. For anything about your personal information, contact our Information Officer at privacy@arca.africa.