1. Introduction

Catalyst Arc Holdings (Pty) Ltd, trading as Catalyst Hub (“Catalyst Hub”, “we”, “us” or “our”), provides a community driven, AI enabled platform that helps South African SMEs, entrepreneurs and creators build, market and grow their businesses. This includes our website, marketplace, mobile app, membership programmes (Spark, Build, Grow), community features and any events we run.

This Privacy Policy explains what personal information we collect, why we collect it, how we use, share and protect it, and what choices and rights you have. It applies to everyone who uses Catalyst Hub, whether you’re a customer, a business owner listing on our marketplace, a corporate partner, or simply visiting our website.

This policy is written to comply with the Protection of Personal Information Act 4 of 2013 (POPIA), and, where relevant, other South African legislation such as the Promotion of Access to Information Act 2 of 2000 (PAIA), the Electronic Communications and Transactions Act 25 of 2002 (ECTA), and the Consumer Protection Act 68 of 2008 (CPA).

By using Catalyst Hub, you acknowledge that your personal information will be processed as described in this policy.

2. Your information at a glance

Here’s a quick summary. Full detail is in the sections below.

  • Account details: name, email, phone number and password, collected to create and manage your account or membership. Shared with our hosting provider (Supabase).
  • Business and vendor details: business name and registration info, product and service listings, banking details, and ID verification, collected to run your marketplace profile and pay you out for sales. Shared with Net Cash and our banking partners.
  • Transaction details: orders, purchases, and delivery and billing addresses, collected to fulfil purchases and manage subscriptions. Shared with the relevant vendor and our payment gateway.
  • Payment details: card token, DebiCheck mandate, and billing details, collected to process once-off and recurring payments. Shared with our payment gateway and your bank.
  • Community content: reviews, ratings, posts, and event bookings, collected to run the marketplace and community. Visible to other users where you choose to publish.
  • Communications: email and WhatsApp interactions and your marketing consent, collected to send service messages and, where you’ve agreed, marketing. Shared with Brevo and ManyChat.
  • Technical and usage data: IP address, device type, cookies, and app usage, collected to keep the platform secure, understand usage, and improve it. Shared with our hosting and analytics providers.
  • AI assistant interactions: messages to our AI assistant and inputs used for recommendations, collected to power our AI assistant and personalise recommendations. Shared with ALLI AI, and Anthropic’s Claude API once integrated.

3. Who we are

Under POPIA, Catalyst Arc Holdings (Pty) Ltd is the “responsible party” for the personal information described in this policy. That means we decide why and how your personal information is processed, and we’re accountable for that under South African law.

  • Registered name: Catalyst Arc Holdings (Pty) Ltd, trading as Catalyst Hub
  • Registration number: 2024/707126/07
  • Registered address: Corner of Oxford and Queen, Durbanville, 7550, South Africa
  • Website: www.catalysthub.co.za
  • Contact and privacy queries: support@catalysthub.co.za / +27 77 360 8999
  • Information Officer: Craig Schrickker, registered with the Information Regulator of South Africa

Where marketplace vendors or corporate partners process personal information for their own purposes (for example, once they receive an order from a buyer), they become a separate responsible party for that processing, and this policy doesn’t cover how they use your information from that point on. We’d encourage you to check a vendor’s own privacy practices where relevant.

4. Information we collect

We’ll let you know at the point of collection which fields are required and which are optional. If you choose not to provide an optional field, this may limit what we can offer you, for example, we can’t process a payout without your banking details.

4.1 Information you give us directly

  • Account and registration details: name, surname, email address, phone number, password, and business name.
  • Membership details: your chosen tier (Spark, Build or Grow), business category, business description and goals.
  • Marketplace vendor details: business registration information, product and service listings, pricing, banking details for payouts, and identity verification documents where our payment partners require these for anti-money-laundering and verification purposes under FICA.
  • Transaction details: purchase history, order details, delivery address and billing address.
  • Payment details: card details, which are tokenised and processed through our payment gateway rather than stored by us directly, plus DebiCheck mandate details and banking information for subscription debit orders.
  • Community and content details: reviews, ratings, forum posts, comments, event bookings, and any photos, video or written content you choose to submit or publish on the platform.
  • Support and enquiry details: anything you share with our support team, or when you interact with our AI assistant.
  • Corporate partner and Distribution Layer details: where you resell a partner’s products, refer leads, or earn commission through our Distribution Layer, we collect the information needed to track and pay out those transactions.

4.2 Information collected automatically

  • Device and usage information: IP address, browser type, device identifiers, operating system, pages viewed, time spent on the platform, and referring pages.
  • Mobile app information: device model, app version, crash logs and push notification tokens.
  • Cookies and similar technologies: see section 10 below.

4.3 Information from other sources

  • Publicly available business information, such as company registration details.
  • Information shared by a marketplace vendor, buyer or corporate partner where it relates to a transaction or referral involving you.
  • Information from integrated channels, such as WhatsApp, where you choose to interact with us there.

4.4 Special personal information

POPIA defines certain categories, such as health, race, religious or political beliefs, trade union membership, or biometric data, as “special personal information” needing extra protection. We don’t intentionally collect special personal information. If you choose to include this kind of detail in a business profile, review, or piece of content you publish, that’s voluntary on your part. If we ever need to collect special personal information for a specific purpose, we’ll ask for your explicit consent first, or rely on another basis permitted under POPIA.

5. Why we use your information

We use your personal information to:

  • create, verify and manage your account or membership;
  • operate the marketplace, including listings, purchases, order fulfilment and reviews;
  • process payments, subscriptions and vendor payouts, including through WooCommerce, our card payment gateway, and DebiCheck debit orders;
  • provide customer support and respond to your questions;
  • personalise service and business recommendations, including through our business sorting algorithm and AI assistant;
  • communicate with you about your account, orders, membership or platform updates;
  • send marketing communications, only where you’ve consented or as permitted under POPIA for existing customers;
  • maintain the security, integrity and performance of our platform;
  • meet our legal, regulatory and tax obligations;
  • improve our products, services and features; and
  • feature businesses or community members in Catalyst Hub or The Clueless Founder content, only where you’ve separately agreed to this (for example, through a Partner Spotlight feature or podcast appearance).

6. Our lawful basis for processing

POPIA requires us to have a lawful basis for processing your personal information. Depending on the situation, we rely on:

  • your consent, for example for marketing communications;
  • performance of a contract with you, for example your membership terms or a marketplace purchase;
  • compliance with a legal obligation, for example tax, exchange control or anti-money-laundering requirements;
  • our legitimate interests, balanced against your rights, for example fraud prevention and platform security; or
  • protection of a legitimate interest of you as the data subject.

7. How we share your information

We don’t sell your personal information. We share it only where necessary, with the following categories of recipient:

  • Marketplace vendors and buyers. When you buy from a vendor, we share the order and delivery details needed to fulfil that purchase. Once a vendor receives this information, they’re responsible for how they use it, under their own obligations as a responsible party.
  • Payment service providers. Our payment gateway and Net Cash process your card, DebiCheck and payout details to complete transactions and vendor payouts.
  • Service providers who process information on our behalf (“operators” under POPIA), bound by written agreements to protect your information and use it only on our instructions. This currently includes Supabase (database and backend hosting), Brevo (email communications), Make (workflow automation), ManyChat (WhatsApp and chat-based communication), ALLI AI (our AI assistant and booking tool), and, once integrated, Anthropic’s Claude API (AI-powered features).
  • Corporate partners, only where you’ve opted into a specific partnership, referral or Distribution Layer arrangement.
  • Professional advisors, such as our accountants, generally at an aggregated or business level rather than as individual personal information, unless individual-level detail is specifically required for compliance.
  • Regulators, law enforcement and courts, where required or permitted by law.
  • A new owner, if Catalyst Hub is ever sold, merged, or restructured, in which case your information may transfer as part of that transaction, subject to the same protections described in this policy.

8. Cross-border transfers

Some of the service providers listed above may store or process personal information outside South Africa, for example on international cloud infrastructure. Section 72 of POPIA sets out when this is allowed. We only transfer personal information outside South Africa where:

  • the recipient is bound by a law, binding corporate rules, or a written agreement that provides a level of protection substantially similar to POPIA; or
  • another basis under section 72 applies, such as your consent, or the transfer being necessary to perform our contract with you.

We’re in the process of formalising written data protection terms with each of our international service providers and confirming exactly where each one stores information. We’ll update this section as that work is completed.

9. Direct marketing and your choices

Under section 69 of POPIA, we can only market to you electronically (by email, SMS or WhatsApp, for example) if:

  • you’ve given us opt-in consent; or
  • you’re an existing customer, and we’re marketing our own similar products or services to you, having given you the chance to opt out both when we first collected your details and on every marketing message since.

We send marketing communications through tools like Brevo and ManyChat on this basis. You can opt out or withdraw consent at any time, free of charge, by:

  • clicking “unsubscribe” in any marketing email;
  • replying “STOP” to a WhatsApp or SMS message; or
  • contacting us directly using the details in section 17.

Opting out of marketing won’t affect your ability to use the platform, or stop you receiving transactional messages, such as order confirmations or account notices.

10. Cookies and tracking technologies

Our website and marketplace use cookies and similar technologies to:

  • keep the platform functioning correctly (strictly necessary cookies);
  • remember your preferences and settings (functional cookies);
  • understand how people use the platform, so we can improve it (analytics cookies); and
  • measure and personalise marketing, where applicable (marketing cookies).

When you first visit our website, you’ll be asked to accept or decline non-essential cookies. You can change your preferences at any time through your browser settings or our cookie settings tool. Declining non-essential cookies won’t stop you using the core platform.

11. Automated decision-making

Catalyst Hub uses a business sorting algorithm and AI assistant (ALLI AI, with Claude API integration planned) to personalise service and product recommendations based on your business size, needs and activity on the platform. These tools support recommendations, they don’t make final decisions about your access to the platform or your membership status.

Under POPIA, you have the right not to be subject to a decision based solely on automated processing that significantly affects you, without the chance to make representations about it. If you’d like a human to review a recommendation or decision generated by one of these tools, contact us using the details in section 17.

12. How we protect your information

We take reasonable technical and organisational measures to protect your personal information against loss, unauthorised access, interference or disclosure, in line with section 19 of POPIA. This includes access controls, encryption where appropriate, and requiring our service providers to maintain their own security safeguards under written agreements.

No system is completely secure. If we become aware of a security compromise that has affected your personal information, we’ll notify the Information Regulator and you, as soon as reasonably possible, along with information about the likely consequences and what we’re doing about it.

13. How long we keep your information

We keep personal information only for as long as it’s needed for the purpose we collected it for, or as required by law, for example financial and tax record retention periods under the Companies Act and SARS requirements. After that, we securely delete or anonymise it.

14. Your rights under POPIA

You have the right to:

  • be told that we’re collecting your personal information, and why;
  • confirm whether we hold personal information about you, and access it;
  • ask us to correct or update personal information that’s inaccurate, incomplete or outdated;
  • ask us to delete or destroy personal information we no longer have a lawful reason to keep;
  • object to the processing of your personal information, on reasonable grounds;
  • withdraw consent you’ve previously given, at any time;
  • ask us to restrict how we process your information in certain circumstances;
  • not be subject to a decision based solely on automated processing that significantly affects you, without an opportunity to make representations (see section 11); and
  • lodge a complaint with the Information Regulator (see section 18).

To exercise any of these rights, contact us using the details in section 17. We may need to verify your identity before acting on your request.

15. Children’s information

Catalyst Hub is built for business owners, entrepreneurs and SMEs, and isn’t intended for use by children. We don’t knowingly collect personal information from children without the consent of a parent or guardian, as POPIA requires. If we become aware that we’ve collected a child’s information without the appropriate consent, we’ll delete it.

16. Changes to this policy

We may update this Privacy Policy from time to time, for example as our platform, services or the law changes. We’ll post the updated version here with a new “last updated” date. Where changes are material, we’ll take reasonable steps to let you know, such as an email or an in-app notice.

17. Contact us

If you have questions, requests or concerns about how we handle your personal information, contact our Information Officer:

  • Email: support@catalysthub.co.za
  • Phone: +27 77 360 8999
  • Postal address: Corner of Oxford and Queen, Durbanville, 7550, South Africa

18. Complaints to the Information Regulator

If you’re not satisfied with how we’ve handled your personal information or responded to your request, you have the right to complain to South Africa’s Information Regulator:

 

  • General enquiries: enquiries@inforegulator.org.za
  • POPIA complaints: POPIAComplaints@inforegulator.org.za
  • Phone: 010 023 5200 (toll free: 0800 017 160)
  • Website: inforegulator.org.za

 

19. Governing law

This Privacy Policy is governed by the laws of South Africa, including POPIA, PAIA, ECTA and the CPA where applicable.