Privacy Policy

1. Who is responsible

The responsible party for the personal information described here is Origin Arc Labs (Pty) Ltd, a private company incorporated in South Africa.

2. What we collect

Information you send us

When you use the contact form on this website, we receive whatever you choose to enter:

• Your name and company name, both optional.
• Your email address, optional, and only needed if you want a reply.
• The type of work you are asking about, optional, chosen from a list.
• Your message, which is required. Please do not include sensitive personal information in it.

If you email us directly instead, we receive your email address and whatever the message contains.

Information collected automatically

To understand how many people visit the site and which pages they read, we record a small, fixed set of technical values when a page has been open for a couple of seconds:

• A random visitor identifier stored in a cookie. It is a random value that is not derived from anything about you.
• A random session identifier held only for the current browser session.
• The page path you viewed, for example /.
• The date and time of the visit.

3. What we do not collect

Stated plainly, because it is unusual enough to be worth saying:

• We do not store your IP address.
• We do not use Google Analytics, advertising pixels, or any third-party tracking or profiling service on this website.
• We do not sell, rent, or trade personal information to anyone, ever.
• We do not use your information for automated decision-making that produces legal consequences for you.
• We do not add you to a marketing list because you sent an enquiry. We reply to what you asked about.

4. Why we collect it

We process this information because it is necessary to respond to your request and to pursue our legitimate interest in running and improving our own website. Where we rely on your consent, you may withdraw it at any time as described below.

5. Whether you have to give it

Supplying your information is entirely voluntary. There is no legal obligation on you to provide it. The only practical consequence of withholding it is that we may not be able to answer you: if you do not give an email address, we have no way to reply, and if the message itself is blank we have nothing to respond to.

6. Cookies and local storage

This website sets one cookie and uses your browser's session storage.

These are ours alone. No third party sets a cookie through this website. If you would rather not be counted, you can block or delete cookies for this site in your browser settings, or browse in a private window. The website works normally either way.

7. Who else processes it

We use a small number of service providers, who act as our operators under POPIA. They may process your information only to provide their service to us, and may not use it for their own purposes.

We may also disclose personal information where the law requires it, or where it is necessary to establish, exercise, or defend a legal claim.

8. Processing outside South Africa

Cloudflare and Zoho operate internationally, so your information may be processed on servers outside South Africa. Section 72 of POPIA permits this where the recipient is subject to laws or binding agreements that provide protection substantially similar to POPIA, or where the transfer is necessary to perform a contract with you. Both providers offer contractual data protection terms that we rely on for this purpose.

9. How long we keep it

• Enquiries: kept for up to 3 years from your last contact with us, so that we can pick up a conversation you return to and keep a record of what was quoted.
• Client project records: kept for at least 5 years after the work ends, because tax and company law require us to retain records of transactions.
• Visit records: kept for up to 24 months, then deleted.

We delete or de-identify personal information once we no longer have a lawful reason to keep it.

10. How we protect it

The website is served only over HTTPS with strict transport security, a content security policy that blocks third-party scripts, and standard protections against clickjacking and content-type confusion. Enquiries are stored in a database that is not reachable from the public internet, and the internal page used to read them is protected by a passphrase, is rate limited against guessing, and can only read messages.

No system is perfectly secure. If a breach ever affects your personal information, we will notify you and the Information Regulator as section 22 of POPIA requires.

11. Your rights

Under POPIA you have the right to:

• Ask whether we hold personal information about you, and ask for a copy of it.
• Ask us to correct or complete information that is inaccurate, misleading, or out of date.
• Ask us to delete information we no longer have a lawful reason to keep.
• Object to our processing of your information on reasonable grounds.
• Withdraw consent where our processing relies on it, without affecting anything done before you withdrew it.
• Complain to the Information Regulator.

To exercise any of these, email hello@originarclabs.com. We will respond within a reasonable time and will not charge you for a request unless the law allows it. We may need to confirm your identity before acting, so that we do not disclose someone's information to the wrong person.

12. Complaints

Please raise a concern with us first, at hello@originarclabs.com. We would rather fix it directly. If you are not satisfied, you may complain to the Information Regulator of South Africa:

13. Children

This website and our services are meant for businesses and adults. We do not knowingly collect personal information about anyone under 18. If you believe a child has sent us personal information, tell us and we will delete it.

14. Changes to this policy

We may update this policy as our services change. The date at the top always reflects the current version. If a change materially affects how we handle information you have already given us, we will make reasonable efforts to tell you directly.