🔒 Privacy Policy
Arena Professional Services Group
Last updated: 11 August 2026
1. Who We Are
This Privacy Policy explains how Arena Professional Services (PTY) LTD (“Arena”, “we”, “us” or “our”) collects, uses, stores, shares and protects personal information.
Arena Professional Services (PTY) LTD operates through its business divisions and online platforms, including Arena Stationery Supplies. This policy applies to the relevant Arena websites, online stores, electronic communications and business activities, including arenaps.co.za and stationeryarena.co.za, and other Arena platforms where this policy is published or referenced.
Arena operates from Cape Town, Western Cape, South Africa. We are committed to protecting personal information in accordance with applicable South African law, particularly the Protection of Personal Information Act 4 of 2013 (“POPIA”).
Information Officer
Name: Joe February
Email: admin@arenaps.co.za
Subject line: Privacy Enquiry / POPIA Request
This contact may be used for privacy enquiries, requests to access or correct personal information, objections to processing and other matters relating to this policy.
2. Personal Information We Collect
The information we collect depends on how you interact with Arena and which services you use.
2.1 Information You Provide
We may collect personal information when you:
Place an order, request a quotation or create an online account.
Submit an enquiry, website comment, review or contact form.
Communicate with our customer support team.
Apply for employment or submit a CV or résumé.
Contact us about business opportunities, investments, suppliers or commercial partnerships.
Register for business services or provide information to manage a business account.
This information may include your name, email address, telephone number, billing and delivery addresses, company or organisation details, order history, quotation and invoice details, employment information and the contents of your communications.
2.2 Orders, Payments and Accounting
When you purchase products or use our services, we may process information needed to manage the transaction, including order details, products purchased, payment status, delivery instructions, customer account details, quotations, invoices and relevant communications.
Our payment and financial administration processes may involve the following service providers:
PayFast — payment processing.
Ozow — payment processing.
Sage Accounting — accounting, financial administration and related record-keeping.
These providers may process relevant information under their own terms, privacy policies and security practices. The information shared will depend on the service being used.
Payment details may be processed directly by the applicable payment provider. We do not intentionally retain complete payment card details where these are handled directly by that provider.
2.3 Delivery and Fulfilment Information
To fulfil orders, we may process your name, telephone number, delivery address, order details and delivery instructions.
Delivery arrangements may involve:
The Courier Guy, for applicable courier deliveries.
Private or local delivery arrangements, using delivery personnel or service providers engaged as required from time to time.
We share only the information reasonably needed to arrange and complete delivery, manage delivery queries and resolve related issues.
2.4 Website and Technical Information
When you visit our websites, certain information may be collected automatically, depending on the website configuration and technologies in use. This may include:
Internet Protocol (IP) address.
Browser and device information.
Operating system and technical identifiers.
Pages visited, interactions and referring website addresses.
Login activity, technical logs and diagnostic information.
Cookie identifiers and similar technologies.
Approximate location inferred from technical information, such as an IP address.
We use this information where reasonably necessary to operate our websites, maintain security, troubleshoot errors, prevent misuse and improve our services.
2.5 Comments, Profiles and Uploaded Media
Where website comments or user-generated content are enabled, we may collect information entered into the relevant form and technical information used for security and spam detection.
Depending on the website configuration, an anonymised identifier derived from an email address may be sent to a profile-image service such as Gravatar. If a comment is approved, the comment and associated profile information may be publicly visible.
If you upload images or other files to a public area of a website, please consider whether the files contain location or other metadata that you do not want to disclose.
2.6 Business, Investment and Employment Information
In the course of our business activities, we may receive personal information relating to prospective employees, business contacts, suppliers, advisers, company representatives and individuals involved in potential investment or commercial transactions.
Information may be obtained directly from the individual or, where lawful and appropriate, from another organisation or source. It is processed for relevant business, recruitment, due-diligence, administrative or legal purposes.
3. Cookies and Similar Technologies
Our websites use cookies, browser storage and similar technologies to support website functionality, security, shopping-cart operations, account access, preferences and other features.
Depending on the website and its active configuration, these technologies may be used for:
Essential functionality: Supporting login, account access, shopping carts, checkout and website security.
Preferences: Remembering settings or information you choose to save.
Performance and diagnostics: Helping us understand technical issues and improve website performance, where enabled.
Third-party content and services: Supporting embedded content or features supplied by other providers.
The specific cookies used and their duration may vary according to the website, your settings and the plugins or third-party services active at the time.
You can manage cookies through your browser settings. Blocking certain cookies may affect website functionality. Where required by applicable law, we will provide appropriate information or choices concerning non-essential cookies and similar technologies.
4. How We Use Personal Information
We may use personal information for the following purposes:
Order fulfilment: Processing orders, preparing quotations, arranging dispatch and delivery, managing returns and providing order updates.
Account administration: Creating and managing customer accounts, business accounts and account permissions.
Payment and financial administration: Verifying payment status, reconciling transactions, managing invoices and maintaining accounting records.
Customer service: Responding to enquiries, investigating complaints and maintaining relevant communication records.
Business operations: Managing suppliers, commercial relationships, recruitment, business opportunities and investment-related activities.
Transactional communications: Sending order confirmations, payment-related notices, dispatch notifications, delivery updates, account messages and other communications connected with a transaction or service.
Marketing: Sending promotional communications where permitted by applicable law and where the relevant consent or other lawful conditions have been satisfied.
Website operation: Maintaining, troubleshooting, securing and improving our websites and digital services.
Fraud prevention and security: Detecting suspicious activity, protecting accounts and safeguarding our business, customers and systems.
Legal compliance: Maintaining required records, responding to lawful requests, resolving disputes and meeting legal obligations.
We aim to collect and use only information reasonably necessary for the relevant purpose.
5. Lawful Processing of Personal Information
Arena processes personal information in accordance with applicable law, including POPIA. Depending on the circumstances, processing may be necessary to:
Perform a contract or take steps requested before entering into a contract, such as fulfilling an order.
Comply with a legal obligation.
Protect a legitimate interest recognised by applicable law.
Pursue a lawful business purpose compatible with the purpose for which the information was collected.
Act on consent where consent is the appropriate legal basis.
Where processing is based on consent, you may withdraw that consent, subject to applicable law. Withdrawal does not invalidate processing that was lawful before withdrawal. We may still need to retain or process certain information to comply with legal obligations or establish, exercise or defend legal claims.
We will not use personal information for an unrelated purpose unless further processing is permitted by applicable law.
6. Transactional Messages and Future Marketing
6.1 Current Transactional Communications
At the date of this policy, Arena uses SMS and WhatsApp messaging for transactional and service-related communications only. These may include order confirmations, order-status updates, dispatch notifications and other messages directly connected with a customer’s order or service.
These messages are intended to provide information about an existing transaction or service. They are not currently used by Arena to send promotional SMS or WhatsApp campaigns.
6.2 Future Promotional Communications
Arena may introduce promotional communications in future, including offers, product announcements, seasonal campaigns or information about relevant products and services.
If we introduce these communications, we will do so in accordance with applicable law, including POPIA’s requirements for electronic direct marketing. Where consent is required, we will obtain it before sending promotional communications. Where a lawful existing-customer exception applies, we will comply with its conditions, including providing an appropriate opportunity to object.
Where appropriate, marketing preferences or consent may be managed separately from transactional messaging. Agreeing to receive promotional communications will not be a condition of receiving ordinary order updates.
6.3 Opting Out
When promotional communications are introduced, recipients will be provided with an appropriate way to opt out or request that marketing communications cease.
Opting out of marketing will not prevent Arena from sending essential transactional messages, security notices or other communications necessary to fulfil an order or meet a legal obligation.
7. How We Share Personal Information
Arena does not sell personal information as a business activity.
We may share personal information where reasonably necessary for the purposes described in this policy.
7.1 Arena Business Operations
Information may be shared within relevant Arena business operations where necessary to administer accounts, fulfil orders, respond to enquiries, provide services or manage group-level administration.
Access should be limited to information reasonably required for the relevant function.
7.2 Payment, Accounting and Technical Providers
Relevant information may be shared with PayFast, Ozow, Sage Accounting, website hosting providers, technical support providers and other service providers used to operate our business.
The information shared depends on the function performed by each provider.
7.3 Couriers and Delivery Providers
We may share relevant recipient and order information with The Courier Guy or private/local delivery providers engaged to complete a delivery.
7.4 Professional Advisers and Business Transactions
We may disclose relevant information to legal, accounting, financial, insurance or other professional advisers where necessary for legitimate business purposes, subject to applicable confidentiality and legal requirements.
If Arena undergoes a merger, acquisition, restructuring or sale of business assets, relevant information may be disclosed to parties involved in the transaction where lawful and appropriate safeguards are applied.
7.5 Legal and Security Reasons
We may disclose personal information where required or authorised by law, court order or a competent authority, or where reasonably necessary to investigate fraud, enforce lawful terms, protect rights or address a security threat.
Third-party service providers may also process information under their own responsibilities and privacy policies. Our use of a provider does not mean that Arena controls every aspect of that provider’s processing.
8. International Transfers and Storage
Arena operates from South Africa. Depending on our hosting arrangements and the third-party services used, personal information may be stored or processed in South Africa or other countries.
Where personal information is transferred outside South Africa, Arena will take the steps required by applicable law, including POPIA section 72, to ensure that the transfer is permitted and that the required level of protection or other lawful conditions are met.
The privacy laws of other countries may differ from South African law. International transfers will be addressed according to the circumstances and applicable legal requirements.
9. Data Retention
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, subject to applicable legal, accounting, tax, contractual, operational and security requirements.
Retention periods may vary according to the type of information and the reason for processing it.
Examples include:
Order and financial records: Retained for the periods required by applicable law and legitimate business record-keeping requirements.
Customer accounts: Retained while the account is active and for an appropriate period afterwards where necessary for legal, security or administrative purposes.
Enquiries and support communications: Retained for as long as reasonably necessary to resolve issues, maintain relevant records and meet legal requirements.
Comments and public content: Retained while required for website operation, moderation, security or legitimate record-keeping purposes.
Technical and security logs: Retained for a period appropriate to the relevant security, diagnostic or operational purpose.
When personal information is no longer required, we will take reasonable steps to delete, destroy, anonymise or otherwise securely dispose of it, subject to any legal requirement to retain it.
Deleting an online account does not necessarily mean that every associated record can be immediately deleted. Certain records may need to be retained for legal, financial, fraud-prevention or dispute-resolution purposes.
10. Data Security
We take reasonable and appropriate technical and organisational measures to protect personal information against loss, unauthorised access, misuse, alteration, disclosure or destruction.
Measures may include website encryption, access controls, authentication, security monitoring, backups, software updates and restricting access to personnel or service providers who require the information for legitimate purposes.
The security measures used may vary according to the systems involved and the nature of the information being processed. No website, online service or method of electronic transmission can be guaranteed to be completely secure.
Where a security compromise occurs, we will respond in accordance with applicable legal requirements, including any notification obligations that apply.
11. Your Privacy Rights
Subject to applicable law and relevant limitations, you may have the right to:
Access: Request information about personal information we hold about you and request access through the applicable legal process.
Correction: Request that inaccurate, incomplete, outdated or misleading personal information be corrected or updated.
Deletion or destruction: Request deletion or destruction where permitted by law and where retention is no longer legally justified.
Object: Object to certain processing of your personal information where the law provides that right.
Withdraw consent: Withdraw consent where processing is based on consent, subject to applicable law.
Marketing opt-out: Request that promotional communications cease.
Complain: Raise a concern with Arena or lodge a complaint with the Information Regulator of South Africa where appropriate.
These rights are not absolute in every circumstance. We may need to verify your identity before responding, and certain information may need to be retained to comply with legal obligations or protect lawful interests.
To exercise a right or make a privacy-related enquiry, contact our Information Officer using the details in Section 13.
12. Third-Party Websites and Embedded Content
Our websites may contain links to external websites or embedded content supplied by third parties. Those websites and services may collect information, use cookies or process personal information under their own privacy policies.
We do not control the privacy practices of independent third-party websites. We encourage you to review the relevant privacy policy before providing information directly to those services.
This does not remove any responsibilities Arena may have under applicable law for personal information that we process or for services we provide.
13. Contacting the Information Officer
For questions about this Privacy Policy, requests to access or correct personal information, objections to processing, or other privacy-related concerns, please contact:
Arena Professional Services (PTY) LTD
Information Officer: Joe February
Email: admin@arenaps.co.za
Subject line: Privacy Enquiry / POPIA Request
Location: Cape Town, Western Cape, South Africa
Please provide sufficient information for us to understand your request. We may ask for reasonable proof of identity where necessary to protect personal information from unauthorised disclosure.
You may also contact the Information Regulator of South Africa if you believe your personal information has been handled unlawfully or wish to pursue a complaint through the appropriate regulatory process.
14. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our business, website functionality, service providers, communication practices or legal obligations.
The current version will be published on the relevant website with its update date. Where required by law, we will provide additional notice or obtain consent for changes affecting the processing of personal information.
We encourage you to review this policy periodically.
End of Privacy Policy
