About this policy
This policy explains how MARSH COMMERCIAL CC trading as 24hr Media ("24hr Media", "we") handles personal information in Homebase, our staff app for Android ("the app"). It adds to our website privacy policy, which covers our website and our dealings with customers. We follow South Africa's Protection of Personal Information Act (POPIA).
Who the app is for
The app is for 24hr Media employees and contractors who have a Homebase account. We create the accounts; nobody can sign up in the app. It is not meant for anyone under 18.
What the app collects, and why
Your account. Your email address and password when you sign in (the password is checked by Homebase and never stored on the phone), and the account and phone sign-in each request is made with. Why: to know it is you and to show what your role allows.
Your work. What you record in the app for your work: production steps you sign on to, the time you start and stop, quantities, job notes, tasks and their status, trip arrivals and delivery or collection outcomes, and problem reports you send. Why: to run production, deliveries and tasks, and to keep the records the business depends on.
Messages, photos, voice notes and files. Chat messages, reactions and mentions; photos you take or choose; voice notes you record; and PDFs and other files you attach. Why: so you can work with colleagues and keep the conversation with the job.
Information about customers. At a delivery or collection you may record the name of the person receiving or collecting the goods, their signature drawn on the screen, a courier's name and reference, and photos of the goods, the site or a signed paper note. Why: proof of what was delivered or collected, which we and our customers rely on.
Your phone and the app. The app version, so Homebase can keep older versions working or ask you to update. If you switch notifications on: your phone's notification token and a random install number, so we can tell you when something needs you. A random install number that our update provider uses to deliver app updates. With every change you make while signed in, Homebase records the time, your account, and the network (IP) address and app it came from, in its audit trail. Why: notifications, updates, and security: knowing who changed what, and spotting misuse.
What the app does not collect. Your location, your contacts, your phone's calendar, call logs or messages, your browsing, other apps on your phone, or an advertising ID. The app shows no adverts and contains no analytics or advertising tools.
Permissions on your phone
The app asks for a permission only when you use the feature that needs it, and you can say no or change it later in Android's settings:
• Camera: to take a photo for a chat or as delivery evidence.
• Microphone: to record a voice note.
• Photos and files: chosen through Android's own picker; the app sees only what you pick.
• Notifications: to tell you when something needs you. Notifications only say "Open Homebase to see your update"; the detail stays inside the app.
Who receives the information
• People at 24hr Media, according to their role: colleagues you message, and the managers and administrators who run production, deliveries and staff.
• Our service providers, who process it only on our instructions: our hosting provider, our database and file storage provider, Google (Firebase Cloud Messaging, to deliver notifications), Expo (to deliver app updates) and Google Play (to install and update the app).
• Customers, where their own delivery or collection record is shared with them.
• Authorities, when the law requires it.
We do not sell personal information and do not share it for advertising.
Some of these providers store or process information outside South Africa. We use providers that protect it to a standard comparable to POPIA.
How long we keep it
• Work records (production, deliveries and collections, tasks, signatures and evidence): for five years after the job, or longer when the law requires it.
• Chat messages, photos, voice notes and files: kept with our business records, and deleted when they are no longer needed for the business or by law.
• Sign-ins: a phone stays signed in while it is used and signs itself out after six hours without use. An administrator can sign a phone out at any time.
• Notification tokens: stop being used when the sign-in ends or you switch notifications off. The record of them is kept with the audit trail.
• Audit trail: kept as a permanent record of changes, because it cannot be edited or deleted.
How we protect it
All traffic between the app and Homebase is encrypted (HTTPS). Your sign-in is kept in Android's encrypted storage, and the app is excluded from phone backups. Each person sees only what their role allows, and every change is recorded. If a phone is lost, tell your manager and the sign-in can be ended from Homebase.
Your rights
You can ask to see the personal information we hold about you, ask us to correct it, ask us to delete it, or object to how we use it. Some work records must be kept by law or for the business; when we cannot delete something, we will tell you why. Email our Information Officer at info@24media.co.za. If you are not happy with our answer, you can complain to the Information Regulator (South Africa): inforegulator.org.za, enquiries@inforegulator.org.za.
Changes
We will update this page when the app changes what it collects, and change the date at the top.
Contact
MARSH COMMERCIAL CC T/A 24hr Media, Unit 1, Atlas Gardens, 40 Sycamore Cres, Cape Farms, Cape Town, 7550, South Africa. Information Officer: info@24media.co.za. Phone: 021 207 3936.