Privacy policy

This policy explains what personal information the Arbor Portal collects, why, and what rights you have over it. Arbor Inc (“Arbor”, “we”, “us”) is the responsible party under the Protection of Personal Information Act, 2013 (“POPIA”). The portal is built and operated on Arbor’s behalf by Rain Analytics, acting as an operator that processes information only on Arbor’s instruction.

1. What we collect

The portal holds two kinds of information:

• Account information — your name, email address, password, optional profile photo, and a record of when you signed in.
• Report content — the management accounts and financial figures Arbor prepares for the organisation your account is linked to. This is your organisation’s financial information, scoped to the companies and reports your account has been granted.

2. Why we process it

Account information is processed to let you sign in securely and to show you the right reports for your organisation and nothing else. Report content is processed to deliver the accounting work Arbor has already agreed to do for your organisation under a separate engagement. We do not use your information for marketing, and we do not sell it.

3. Who can see what

Access inside the portal follows your account’s role: a client account sees only its own organisation’s companies and the reports Arbor has granted it; Arbor’s own staff see the client organisations they work on. Arbor decides these grants, and they can be changed or removed at any time.

4. Who we share it with

Rain Analytics operates the portal’s infrastructure on Arbor’s behalf and can access information only to build, run, and support it. We do not share your information with any other third party, except where the law requires it.

5. Cookies

The portal uses your session cookie to keep you signed in, and one further cookie, arbor_nav, which remembers whether you last left the sidebar open or collapsed. Neither is used for tracking or advertising, and no third-party analytics run on the portal.

6. Security

Passwords are stored hashed, never in plain text, and access to every report is checked against your account’s grants on every request. We take reasonable technical and organisational measures to protect your information against loss, unauthorised access, and disclosure, as POPIA requires.

7. How long we keep it

We keep account information for as long as your account is active, and report content for as long as Arbor is required to retain accounting records under South African law. If your organisation stops being an Arbor client, we retain what the law requires and delete the rest.

8. Your rights

Under POPIA, you may ask to see the personal information we hold about you, ask us to correct or delete it, and object to how it is processed, subject to Arbor’s obligation to keep accounting records. To exercise any of these rights, contact our Information Officer below.

9. Children

The portal is a business tool for Arbor’s clients and is not directed at children. We do not knowingly collect personal information from children.

10. Changes to this policy

We may update this policy from time to time. Material changes will be brought to your attention the next time you sign in.

11. Contact

To reach Arbor’s Information Officer about this policy or a request under POPIA, email privacy@arborinc.co.za. You may also complain to the Information Regulator (South Africa) if you believe your information has been mishandled.