Privacy & Cookie Policy
How ARS Financial handles personal information — yours, your customers’ and your debtors’ — in plain language and in line with POPIA.
Version 2.3 · Effective 29 October 2026
- We use personal information only to run our services: recovering debts, following up invoices, and looking after your account.
- We never sell it, and we never use your customers’ details for our own marketing.
- When we contact your customers or debtors, we do it on your instruction and protect their information.
- Connected accounting systems are read-only, and saved logins are encrypted.
- You can ask what we hold about you, have it corrected or deleted, or complain to the Information Regulator.
This summary helps you find your way. The full policy below is what applies.
01Who we are and what this covers
ARS Financial (Pty) Ltd (“ARS”, “we”, “us”) provides commercial Debt Recovery and Credit Control to South African businesses through our website, client portal and accountant portal. This policy explains how we handle personal information, in line with the Protection of Personal Information Act, 2013 (POPIA).
Questions or requests go to our Information Officer at contact@arsfinancial.co.za. Our full details are at the end of this page, and our Terms of Use explain how the services work.
02Our role: responsible party or operator
- For information about our own clients, accountants, applicants and website visitors, ARS decides how it is used and is the responsible party.
- For information about a client’s customers and debtors, the client is the responsible party and ARS processes it on their instruction as their operator: to follow up their invoices and recover what they are owed.
03The information we collect
- Clients: business details (name, trading name, registration and VAT numbers, address), the contact details of the people we deal with, portal logins, your letterhead (logo, colours, accounts contact details), and your banking details with the bank letter you send to confirm them.
- Customers and debtors (from our clients): name, email, phone number, invoices and amounts owed, payments, and any messages or calls with us about the account.
- Accountants and bookkeepers: name, firm, email, phone number, login details, and which clients have given them access.
- Connected accounting systems: when a client connects Xero, QuickBooks Online, Zoho Books or Sage, we read their unpaid sales invoices, payments and customer contact details. For Sage, we also hold the separate login the client creates for ARS.
- Enquiries and applications: what you send us through the contact form, the Partner Programme application, email, WhatsApp or by phone.
- Payments to us: invoices and payment records. Card payments are handled by PayFast; we never see or store full card details.
- Technical: the basic information needed to keep the website and portals secure and working, such as your session cookie and server logs.
- The ARS app: if you turn on notifications, your phone’s notification token (from Apple or Google) and whether it is an iPhone or Android phone, so we can tell you when money comes in, when a customer replies or when something needs you. Face ID and fingerprint unlock happen on your phone only; we never receive your face or fingerprint data.
04How we use it, and why we may
- To provide Debt Recovery and Credit Control: contacting customers and debtors by email, text message and phone, sending reminders and statements, recording replies, promises and payments, and preparing reports for our client.
- To run your account: logins, security, billing, support, and service messages about your account.
- To keep your book accurate, by syncing with the accounting system you have connected.
- To read uploaded invoices automatically, so you don’t have to type them in.
- To check banking details before they appear on documents, which protects you and your customers from payment fraud.
- To meet our legal, tax and accounting obligations, and to establish or defend legal claims.
Our lawful bases under POPIA are performing our contract with our client, the legitimate interest that we and our client have in recovering money lawfully owed, complying with the law, and, where needed, consent.
05If a business has asked us to contact you
If you received a reminder, statement, text message or call from us about an invoice, the business you deal with gave us your details and asked us to follow up on its behalf. We use them only for that purpose.
- Pay the business directly. ARS never asks you to pay into a different account. If you are ever asked to change where you pay, call the business first.
- If you have paid, dispute an amount, or think we contacted you in error, simply reply to our message and we will look into it and pause reminders while we do.
- You can ask us what information we hold about you and have inaccurate details corrected.
06If an unpaid account may be reported to a credit bureau
If an amount stays unpaid after our final letter of demand, the business you owe may instruct us to report the unpaid account to a registered credit bureau. We never do this without that instruction, and never without warning you first.
- Notice first: we send you a written notice of our intention to report the account, and give you at least 20 business days to pay, arrange payment or dispute the amount, as the National Credit Regulations require.
- What is shared: your name, ID number (or company registration number), address, the amount owed, the account reference and the business you owe. We report through SearchWorks, a registered reseller of credit information, to TransUnion, a registered credit bureau.
- Disputes: we do not report an amount you have disputed while the dispute is being looked into. Tell us in writing before the date in the notice.
- Once you pay: we update the listing to show the account has been paid.
- How long it stays on record: the credit bureau keeps it for the period the National Credit Regulations allow. We keep a record of the listing, and of when it was updated, with the case.
- You can get your own credit report free once a year from each credit bureau and dispute anything on it with the bureau directly, or ask us at contact@arsfinancial.co.za.
07If a business has asked us to check you before giving you credit
A business you are dealing with (for example a contractor about to start work on a deposit) may ask us to check you before giving you credit. We only do this after you have signed our consent form.
- What we look at: your credit report from a registered credit bureau, property records at the Deeds Office, company records at the CIPC and court judgments. We obtain these through SearchWorks, a registered reseller of credit information.
- Why: only to help that business decide whether, and how much, credit to give you for that job (a purpose allowed by regulation 18(4)(e) of the National Credit Regulations). If money for the job is later not paid, the same information may be used to recover it.
- What the business is told: our conclusion (go ahead, be careful, or don’t give credit) and the main reasons. The credit report itself is never passed on.
- How long we keep it: the credit report is deleted 30 days after the check. Your ID number, contact details, the signed consent form and our findings are deleted 12 months after the check (30 days if the check is cancelled). We keep only your name, the outcome and the date, for our accounting records.
- You can ask us what information we used and have anything inaccurate corrected by emailing contact@arsfinancial.co.za. You can also get your own credit report free once a year from each credit bureau and dispute anything wrong with them directly.
09Service providers, and information outside South Africa
We use a small number of trusted providers:
- Hosting: our servers and database are hosted in South Africa.
- Email and encrypted backups: Google.
- Text messages: SMSPortal (South Africa).
- Card payments: PayFast (South Africa).
- App notifications: Apple (iPhone) and Google Firebase Cloud Messaging (Android) deliver the ARS app’s notifications to your phone.
- Reading uploaded invoices: Anthropic’s AI service, which extracts details such as the amount and due date from an invoice you upload.
- Accounting systems you connect: Xero, Intuit (QuickBooks), Zoho or Sage, under your own agreement with them.
- Customer checks, debtor tracing and credit-bureau listings: SearchWorks (South Africa), a registered reseller of credit information, which supplies the credit bureau, Deeds Office, CIPC and court records we use, and through which we report unpaid accounts to TransUnion (South Africa), a registered credit bureau.
Some of these providers process information outside South Africa (for example Google and Anthropic). We only use providers that are bound by data-protection obligations giving protection substantially similar to POPIA, as section 72 of POPIA requires.
10Connected accounting systems
- Read-only. We read unpaid invoices, payments and customer contact details. We never create, change or delete anything in your accounting system.
- Access tokens, and for Sage the login you create for ARS, are stored securely; Sage logins are encrypted.
- Disconnecting, from your portal or the accounting system, stops all access and deletes the stored tokens or login. Invoices already imported stay on your book.
11How we protect it
Everything travels over encrypted (HTTPS) connections. Passwords are stored with strong one-way hashing and are never visible to us. Saved third-party logins are encrypted, access to client and customer records is restricted and authenticated, and our backups are encrypted.
If a security breach affecting personal information ever occurred, we would act on it promptly and notify those affected and the Information Regulator, as POPIA requires.
12How long we keep it
We keep personal information only as long as needed for the purpose we collected it for, and to meet our legal, tax and accounting obligations (generally up to five years after a matter or account ends). After that it is deleted or anonymised.
When a client’s instruction or subscription ends, their customers’ and debtors’ information is deleted or returned unless the law requires us to keep records for longer. Accounting-system tokens and logins are deleted as soon as the connection is ended.
13Marketing
We never use a client’s customers’ or debtors’ details for our own marketing. If you have spoken to one of our representatives and asked for information about our services, we may email it to you, and occasionally follow up. Every such email lets you opt out, and you can also simply reply or email contact@arsfinancial.co.za.
15Your rights
Under POPIA you may:
- ask whether we hold personal information about you, and for a copy of it;
- ask us to correct or delete information that is inaccurate, out of date or no longer needed;
- object to processing, including direct marketing; and
- complain to the Information Regulator of South Africa (inforegulator.org.za).
To use any of these rights, email contact@arsfinancial.co.za. We may need to confirm who you are first, and will respond within a reasonable time. Requests for records can also be made under the Promotion of Access to Information Act, 2000, using our PAIA manual, which is available on request.
16Deleting your account
You can ask us to delete your ARS Financial account at any time, from the website or the ARS app: sign in, open Settings and tap Delete my account. You can also email contact@arsfinancial.co.za from the address you sign in with.
We close your login and delete your personal details (name, email, phone number, saved logins to accounting systems and app settings such as notification tokens), normally within 30 days, and confirm by email. Records we must keep by law, such as cases, payments, invoices and signed agreements, are kept securely for up to five years and then deleted, as described under “How long we keep it”. Deleting your login does not cancel cases already with us; your signed agreement still applies.
17Changes to this policy
We may update this policy as our services change. The version and date at the top show when it last changed. Material changes will be shown here and, where they affect you, we will tell you by email or in the portal.
18Our details
Who we are and how to reach our Information Officer.
- Company
- ARS Financial (Pty) Ltd, a private company
- Registration number
- 2026/112551/07
- Debt collector registration
- Council for Debt Collectors no. 00130149/26 (company) and 00188053/26 (director)
- Director
- Kyle Ethan Zorger
- Address for legal notices
- 5 St Andrews Drive, St Francis Links, St Francis Bay, Eastern Cape, 6312
- Telephone
- 077 471 6623
- Website
- arsfinancial.co.za
- Information Officer (POPIA)
- Kyle Ethan Zorger · Information Regulator ref. 2026-067321
- VAT
- Not registered for VAT