Privacy Policy

Last updated: 4 August 2026 · Governed by the Protection of Personal Information Act 4 of 2013 (POPIA)

ARCH Impact Group (Pty) Ltd respects your privacy. This notice explains what personal information we collect through this website and in the course of our business, why we process it, who we share it with, and the rights you hold under South African law.

1. Who we are

ARCH Impact Group (Pty) Ltd (“ARCH”, “we”, “us”) is a private company incorporated in the Republic of South Africa and is the responsible party for the personal information described in this notice.

Registered name	ARCH Impact Group (Pty) Ltd
Registration number	2018/526252/07
Physical address	498 Cliff Avenue, Waterkloof Ridge, Pretoria, 0181, South Africa
Telephone	+27 (0) 12 347 2594
Email	info@archholdings.co.za
Website	www.archholdings.co.za

2. Information Officer

In terms of section 55 of POPIA, our Information Officer is responsible for encouraging compliance with the Act, dealing with requests made to ARCH, and working with the Information Regulator. Contact the Information Officer at info@archholdings.co.za or on +27 (0) 12 347 2594, marked for the attention of the Information Officer.

3. Personal information we process

Depending on how you engage with us, we may process the following categories of personal information:

• Contact and identity data — name, surname, job title, employer, email address, telephone number.
• Enquiry data — the content of messages you submit through our contact form, by email, or by telephone, and the enquiry type you select.
• Learner and candidate data — where you participate in a skills development, learnership, or placement programme delivered by ARCH or a group company, this may include identity number, date of birth, gender, race and disability status (required for statutory reporting under the Skills Development Act, the Employment Equity Act and B-BBEE codes), qualifications, academic records, employment history and programme performance.
• Client and supplier data — contracting details, banking details where required for payment, and B-BBEE or tax status documents.
• Technical data — IP address, browser type, device type, referring pages and pages viewed, collected through cookies and analytics tools.

Some of the categories above constitute special personal information under section 26 of POPIA. We process these only where the Act permits it — principally where processing is necessary to comply with an obligation of law, or with your consent.

4. How we collect it

• Directly from you, when you complete a form on this website, email or call us, attend an ARCH event, or enrol on a programme.
• From your employer or a sponsoring client, where you are enrolled on a programme we deliver on their behalf.
• From public sources and accreditation bodies, where verification of a qualification or credential is required.
• Automatically through this website, by means of cookies and similar technologies.

5. Why we process it

• To respond to your enquiry and provide the information or proposal you have asked for.
• To deliver, administer, monitor and report on skills development, talent and impact programmes.
• To meet statutory and regulatory obligations, including SETA, QCTO and SAQA reporting, B-BBEE verification, employment equity reporting and tax obligations.
• To manage our contractual relationships with clients, partners and suppliers.
• To measure and improve the performance of this website.
• To send you insights and updates where you have asked to receive them.

6. Lawful basis

We process personal information on one or more of the following bases recognised in section 11 of POPIA: your consent; the conclusion or performance of a contract to which you are a party; compliance with an obligation imposed by law; the protection of a legitimate interest of the data subject; or the pursuit of the legitimate interests of ARCH or of a third party to whom the information is supplied.

7. Sharing and operators

We do not sell personal information. We share it only where it is necessary, and subject to written agreements requiring confidentiality and appropriate security measures. Recipients may include:

• Companies within the ARCH group, where a programme is delivered jointly.
• Operators who process on our behalf — for example, hosting providers, learning-management platforms, email and CRM providers, and assessment bodies.
• Clients and funders, where you participate in a programme they sponsor, limited to the reporting they are entitled to receive.
• Statutory bodies including SETAs, the QCTO, SAQA, B-BBEE verification agencies and the South African Revenue Service, where the law requires it.
• Professional advisors, auditors and insurers, under a duty of confidentiality.

8. Cross-border transfers

Some of the service providers we use may store data outside South Africa. Where personal information is transferred across a border, we do so only on a basis permitted by section 72 of POPIA — principally where the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection substantially similar to POPIA.

9. Security safeguards

In line with section 19 of POPIA we maintain appropriate, reasonable technical and organisational measures to prevent loss of, damage to, or unauthorised access to personal information. These include access controls, encryption in transit, hosting with reputable providers, staff confidentiality undertakings and periodic review of our safeguards. Where we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected data subjects as required by section 22.

10. Retention

We keep personal information only for as long as it is needed for the purpose it was collected for, or for as long as a law requires us to retain it. Programme and training records are generally retained for the period prescribed by the relevant SETA, QCTO or statutory framework. Company, tax and contractual records are retained for the periods set out in the Companies Act 71 of 2008 and the Tax Administration Act 28 of 2011. Records that are no longer required are securely destroyed, deleted or de-identified.

11. Your rights

Subject to the conditions and exceptions in POPIA, you have the right to:

• be notified that personal information about you is being collected, or that it has been accessed by an unauthorised person;
• request confirmation of whether we hold personal information about you, and to request a record of that information (sections 23 and 24);
• request correction, deletion or destruction of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully;
• object, on reasonable grounds, to the processing of your personal information (section 11(3));
• withdraw consent, where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
• submit a complaint to the Information Regulator; and
• institute civil proceedings regarding an alleged interference with the protection of your personal information.

To exercise any of these rights, contact the Information Officer at info@archholdings.co.za. Requests for access to a record must be made on the prescribed form and are dealt with under our PAIA procedure. We may require proof of identity before acting on a request.

12. Direct marketing

We send electronic marketing communications only where you have consented, or where you are an existing customer and the communication relates to similar products or services, as permitted by section 69 of POPIA. Every such communication contains a means of opting out, and you may also unsubscribe at any time by emailing info@archholdings.co.za.

13. Cookies and analytics

This website uses cookies that are necessary for the site to function, and may use analytics cookies that help us understand how the site is used. Analytics data is aggregated and is not used to identify you personally. You can block or delete cookies through your browser settings; parts of the site may not function correctly if essential cookies are disabled.

14. Children

We do not knowingly process the personal information of a child (a person under 18 who is not legally competent) without the consent of a competent person, except where POPIA otherwise permits it — for example, where processing is necessary to comply with an obligation of law in respect of a learnership or youth programme.

15. Complaints

If you are not satisfied with how we have handled your personal information, please raise it with our Information Officer first so that we can try to resolve it. You are also entitled to lodge a complaint with:

Regulator	The Information Regulator (South Africa)
Address	JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Complaints	POPIAComplaints@inforegulator.org.za
General enquiries	enquiries@inforegulator.org.za
Website	inforegulator.org.za

16. Changes to this notice

We review this notice periodically and will publish any updated version on this page with a revised date. Material changes will be brought to your attention where the law requires it.