TVB Network (Pty) Ltd ("TVB Network", "we", "us", or "our") acts as the Responsible Party under Section 1 of the Protection of Personal Information Act No. 4 of 2013 (POPIA) for personal data processed through TMS Messenger.
This Privacy Policy outlines how we collect, store, minimize, and protect personal information when you use TMS Messenger, and details your statutory rights under South African law.
02 Adherence to the 8 POPIA Processing Conditions
POPIA Condition
TMS Messenger Architectural Implementation
1. Accountability
Appointed registered Information Officer oversees security measures and compliance audits.
2. Processing Limitation
Lawful processing based on contractual necessity and explicit user consent. Zero unnecessary data capture.
3. Purpose Specification
Personal data is processed strictly to route real-time messages and deliver push notifications.
4. Further Processing Limitation
No secondary monetization, ad targeting, behavioral profiling, or external data broker resale.
5. Information Quality
Centralized SSO identity verification guarantees authenticated, accurate user profile records.
6. Openness & Transparency
Full transparency into encryption keys, zero-knowledge architecture, and data deletion workflows.
7. Security Safeguards
End-to-end Signal Protocol cryptography, TLS 1.3 transport security, AES-256 encryption at rest.
8. Data Subject Participation
Immediate self-service data export and irreversible account deletion via SSO settings.
03 Categories of Personal Information Processed
To provide high-performance messaging with minimal digital footprints, we strictly limit collection to the following categories:
Account Credentials: South African or international mobile phone number (used for SMS OTP authentication), centralized 16-digit AccountID (altYYYYMMDDHHMMSSNN), display name, and optional avatar image.
Public Encryption Keys: Pre-keys, signed identity keys, and one-time ephemeral public keys uploaded by your client device to facilitate peer-to-peer cryptographic handshakes.
Push Notification Tokens: Firebase Cloud Messaging (FCM) or Apple Push Notification Service (APNs) device registration tokens required to wake up background apps for incoming message alerts.
Transient Relay Metadata: Temporary connection tokens and IP addresses during active WebSocket connections, strictly for rate-limiting and DDoS mitigation.
TMS allows you to discover which of your phone contacts are registered on TMS without disclosing your complete address book to TVB Network:
Client-Side Hashing: When contact discovery is enabled, phone numbers in your address book are formatted into E.164 standard, cryptographically salted, and hashed using SHA-256 on your local device before transmission.
Zero Plaintext Contacts: Plaintext phone numbers from your device contact list are never transmitted to or stored on TVB Network servers. The server matches hashed numbers against registered user hashes in memory and discards the query set immediately.
05 Zero-Knowledge Content Security
Our Zero-Knowledge Guarantee: Message text, audio memos, documents, images, video recordings, and call signaling payloads are end-to-end encrypted before leaving your device. TVB Network possesses zero technical capability to read, inspect, monetize, or decrypt your private communications.
Server nodes operate as blind packet forwarders. Once an encrypted packet is acknowledged by the recipient client, it is purged from in-flight server buffers.
06 Google Cloud BigQuery Storage Architecture
All core infrastructure operates on enterprise-tier Google Cloud BigQuery datastores (Project: tvb-network-379518):
Zero SQLite Fallback: All storage is centralized and strictly governed by Google Cloud security policies.
Single-Row Profile Isolation: User profiles are maintained on a strictly isolated single row per user, avoiding fragmented personal data dispersion.
Encrypted at Rest & in Transit: All data is encrypted using Google-managed or customer-managed AES-256 keys, with TLS 1.3 encryption across all network boundaries.
07 Cross-Border Data Transfers (POPIA Section 72)
Cloud infrastructure nodes may process encrypted payloads within Google Cloud data centers located outside the borders of South Africa. In accordance with Section 72 of POPIA:
Google Cloud infrastructure maintains ISO/IEC 27001, 27017, and 27018 certifications, and provides binding data protection agreements upholding standards substantially similar to POPIA.
All cross-border data is end-to-end encrypted ciphertext; recipient host jurisdictions cannot read or reconstruct personal information.
08 Data Retention & Automated Pruning
In-Flight Queues: Undelivered encrypted messages waiting for an offline device are retained for a maximum of 30 days, after which they are permanently expunged.
Ephemeral Messages: Messages sent with self-destruct timers are wiped locally from user devices upon expiration.
Account Deletion: When an account is deleted, the corresponding profile row, public key certificates, and session tokens are purged immediately across BigQuery tables.
09 Data Subject Rights under POPIA
Under Sections 23 and 24 of POPIA, South African users possess enforceable legal rights regarding their personal information:
Right of Access (Section 23): You may request confirmation of whether TVB Network holds personal information concerning you, and receive a copy thereof.
Right to Rectification (Section 24(1)(a)): You may request the correction or update of inaccurate, irrelevant, excessive, or out-of-date personal information.
Right to Erasure / Destruction (Section 24(1)(b)): You may request the irreversible destruction or de-identification of personal information that TVB Network is no longer authorized to retain.
Right to Object (Section 11(3)): You may object at any time on reasonable grounds to the processing of your personal information.
To exercise any of these rights, submit a written notice to our Information Officer at privacy@tvbnet.co.za.
10 Information Regulator Recourse
If you believe that your personal information has been processed in contravention of POPIA, you have the right to lodge a formal complaint with the South African Information Regulator:
The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
PO Box 31533, Braamfontein, Johannesburg, 2017
Complaints Email: POPIAComplaints@inforegulator.org.za
General Inquiries: enquiries@inforegulator.org.za