Data protection notice

POPIA · South Africa · reviewed 6 September 2026

This notice sets out how ArrayTrace meets the Protection of Personal Information Act 4 of 2013: who is accountable, how each condition for lawful processing is satisfied, who else receives personal information and what happens if something goes wrong. It is the companion to our privacy policy, which is where the detail of what we hold and why lives.

1. Who is responsible

ArrayTrace is the responsible party for personal information processed through ArrayTrace.

Verster Street, Elarduspark, Pretoria, Gauteng, 0181

2. The Information Officer

Under section 55 of POPIA, one named person must be accountable for how personal information is handled here, and must be reachable by anybody who wants to ask about it or complain. Everything on this page, the privacy policy and our PAIA manual is owned and reviewed by them.

Registration of the Information Officer with the Information Regulator (South Africa), as section 55 of POPIA requires, is in progress.

3. The conditions, and how we meet them

the Protection of Personal Information Act 4 of 2013 sets 8 conditions for processing to be lawful. Each is below with the section that sets it and what we actually do about it.

Accountability · section 8

One named Information Officer owns this notice, the privacy policy and the access manual, and reviews them at least once a year.

Processing limitation · sections 9 to 12

We collect what running the service needs and nothing beyond it. The one place we deliberately go further is recording the address on a failed sign-in, which is declared on the privacy policy with the ground it relies on.

Purpose specification · sections 13 and 14

Every category we hold is listed on the privacy policy against the reason we hold it and how long we keep it.

Further processing limitation · section 15

What you put into the product is processed to run the service. We do not sell it, and we do not train any model on your projects, designs or client data.

Information quality · section 16

You correct your own details from your profile and your firm's from the team screens. Anything you cannot edit yourself we correct on request.

Openness · sections 17 and 18

This notice, the privacy policy and the access manual are linked from the footer of every page and readable without an account.

Security safeguards · sections 19 to 22

Encrypted in transit, passwords hashed and never recoverable, third-party credentials encrypted at rest, and every team's data separated by a filter applied at the database query rather than by each screen remembering to ask.

Data subject participation · sections 23 to 25

Your team's whole estate exports as JSON from the app, your own account data from your profile, and a team owner can erase the team outright.

4. Who else receives personal information

Every service outside this deployment that the product hands anything to is listed on the privacy policy, with exactly what it receives and which country it is in. Where one is outside South Africa, the transfer is made under section 72 of POPIA, on the ground that it is necessary to perform the contract you have with us. Each is bound by terms requiring it to protect what it receives.

5. Your rights

You can see what we hold, correct it, have it erased, object to processing, and withdraw a consent you gave. How to exercise each is set out in the privacy policy. We answer within 30 days, and we may ask you to prove who you are before we do.

Requests, questions and complaints go to the Information Officer at privacy@arraytrace.com.

6. Marketing, children, and automated decisions

Marketing. We send the messages the service itself needs to send: account, billing and the documents you generate. We do not send marketing email off the back of an account or an enquiry. If we ever do, it will be something you opt into separately, as section 69 of POPIA requires.

Children. This is a professional engineering tool and it is not directed at children. We do not knowingly process the personal information of a child, which is prohibited without specific authorisation under sections 34 and 35 of POPIA. If you believe we hold a child's information, tell the Information Officer and we will remove it.

Automated decisions. Nothing in this product takes a decision about you by automated means that has a legal effect or similarly significant consequence, which is what section 71 of POPIA governs. A simulation models a system, not a person, and a plan limit refusing an action is a term of the plan rather than a judgement about you.

7. If there is a security compromise

Under section 22 of POPIA we must notify the Information Regulator (South Africa) and every affected person as soon as we reasonably can, once we have grounds to believe personal information has been accessed or acquired by somebody not entitled to it. We work to 72 hours from establishing those grounds.

A notice will say what happened, what was involved, what we have done and what you can do. We hold a written response procedure so that the first hour of an incident is spent containing it rather than deciding who does what.

8. Complaining to the regulator

Come to us first: most things are quicker to fix than to escalate. If our answer does not satisfy you, the Information Regulator (South Africa) takes complaints directly.