GVF IMS Privacy Policy

Effective date: 26 September 2026
Last updated: 26 September 2026

1. Who we are

Greyton Volunteer Firefighters (“GVF”, “we”, “us” or “our”) operates the GVF IMS mobile applications for iPhone and Android and their supporting incident, attendance, equipment and membership services.

This policy explains how GVF processes personal information when authorised volunteers, staff and reviewers use GVF IMS. It should be read with any applicable GVF membership, indemnity and operational rules.

Privacy contact: info@greytonfire.org
Website: https://greytonfire.org

2. Scope

GVF IMS is an adult-only, restricted-access operational app. It is not intended for the public or for children. Accounts are issued or invited by GVF; the mobile app does not offer public self-registration.

The app lets authorised users:

• sign in to a GVF account;
• receive volunteer callout notifications and respond to assistance requests;
• view incidents assigned to them;
• record arrival and departure attendance;
• view equipment issued to them;
• access membership information and documents; and
• share their location during an incident after agreeing to the attendance location-sharing requirement and granting phone permission.

3. Information we process

Account and identity information

• name and display name;
• username or email address used for the account;
• internal user and membership identifiers;
• account role, permissions, status and sign-in timestamps; and
• a one-way password hash on the server. GVF does not store the user’s password in readable form.

Volunteer and membership information

• contact details and adult-status confirmation;
• emergency-contact details;
• membership status, documents, acceptances and audit records; and
• optional emergency profile information supplied through the supporting membership service, such as medical-aid details or blood type. GVF does not ask users to submit diagnoses through GVF IMS.

Access to sensitive emergency profile information is restricted and audited.

Incident, attendance and equipment information

• incident assignments, team and incident reference;
• arrival, departure, check-in and check-out times;
• location-sharing consent and stop events;
• equipment issued, returned, condition and custody records; and
• operational audit information associated with those actions.

Location information during incident attendance

Accepting a callout or recording arrival requires the user to agree to the in-app location-sharing disclosure and grant the required phone location permission. Sharing starts automatically after the attendance action is confirmed. If the user declines the agreement or permission, that attendance action cannot be completed. Signing in, receiving a notification or opening a callout does not by itself start location sharing.

During an agreed sharing session, the app may send precise or approximate device location, accuracy and timestamps to GVF. The latest reported position, name, team, incident reference, accuracy and update time are visible to authorised GVF dispatchers and responders according to their access.

Sharing can continue while the phone is locked or the app is not visible. Android uses a visible foreground-service notification; iPhone uses the operating system’s location permission and background-location facilities. Each sharing session lasts up to 12 hours and is not extended merely by reopening the app.

The user can stop sharing through the app, sign out, check out or withdraw phone location permission. Sharing also ends when its server authorisation is ended or expires. Stopping location sharing alone does not record a departure or erase attendance records: the user must use Check out when leaving the incident. A connection is needed to confirm attendance changes and deliver location updates.

GVF IMS currently keeps only the latest location fix for the active sharing session, not a route history. The live location fields are cleared when stopping is confirmed by the server. If the phone cannot reach the server, the last confirmed location may remain available until a later stop confirmation, automatic expiry or operational reconciliation. A prior fix may remain temporarily in protected backups until those backups are overwritten in the normal backup cycle.

Callout notifications and registered devices

When a phone is registered for callout alerts, GVF processes its notification token, an app-installation or registration identifier, its association with the signed-in account, platform, registration status and relevant timestamps. GVF also records notification attempts, delivery-service outcomes and when a callout is opened or answered, to support operational follow-up. Acceptance by a push service does not prove that a person has seen an alert.

Callout alerts use Google’s Firebase Cloud Messaging and, on iPhone, Apple’s Push Notification service. These services process identifiers and notification payloads needed to route and deliver alerts. Firebase Cloud Messaging uses Firebase installation identifiers. GVF’s callout notification payload contains generic assistance-request text and internal callout, incident and registration references; it does not contain volunteer GPS coordinates or medical information.

Notification permission can be managed in the phone’s settings. Signing out initiates removal of the phone’s account-linked alert registration; server confirmation may be delayed when the phone is offline. Turning off notifications does not automatically check the user out of an incident or stop an existing location-sharing session.

Technical and security information

The service may process information needed to deliver and protect the service, such as IP address, request time, device or browser information, session identifiers, security events and error information. The iPhone and Android apps do not use advertising or behavioural analytics.

4. Why we process information

GVF processes information only where reasonably necessary to:

• authenticate users and protect accounts;
• deliver callout notifications, record responses, provide incident assignments and coordinate authorised response activities;
• maintain attendance, safety, accountability and operational records;
• manage equipment custody and returns;
• administer volunteer membership and required documents;
• display the latest position shared by an attending volunteer to authorised GVF operations personnel during an active incident;
• maintain service security, prevent misuse and investigate faults;
• comply with applicable law and GVF’s legitimate record-keeping obligations; and
• establish, exercise or defend legal rights.

Where consent is the appropriate basis, users may withdraw it prospectively. Stopping location sharing withdraws consent for further location updates without deleting attendance or other records that GVF must legitimately retain.

5. Who may receive information

Personal information is available only as necessary to:

• authorised GVF administrators, dispatchers, incident personnel and reviewers according to role;
• authorised GVF responders who need current operational information;
• service providers that host, secure, back up or support GVF systems and act under GVF’s instructions;
• Google and Apple, for the identifiers and notification information needed to provide callout alerts as described in section 3; and
• regulators, emergency services, law-enforcement bodies or other parties when disclosure is authorised or required by law, or is necessary to protect a person’s vital interests.

GVF does not sell personal information. GVF IMS does not use personal information for advertising or behavioural profiling.

Some service providers may process information outside South Africa. Where this occurs, GVF will use appropriate contractual, organisational or legal safeguards required by the Protection of Personal Information Act 4 of 2013 (POPIA).

6. Storage, security and retention

GVF uses reasonable technical and organisational safeguards appropriate to the sensitivity of the information. These include encrypted network transport, access controls, role-based permissions, audit records, password hashing, protected backups and restricted access to emergency profile information.

On Android, GVF IMS stores its authentication session using encryption backed by Android security facilities, and app data is excluded from Android cloud backup. On iPhone, the app stores authentication and related session information in the device Keychain. The apps do not persist the user’s password or a route history on the phone.

GVF retains information only for as long as reasonably required for the purposes in this policy, including operational accountability, incident reporting, equipment custody, membership administration, security, legal compliance and dispute resolution. In particular:

• live location is limited as described in section 3;
• account and profile information is retained while the account or membership is active and afterwards only where still required;
• attendance, incident, equipment, acceptance and audit records may be retained as official GVF operational or legal records; and
• backups and technical logs are retained only for their security, continuity and recovery purpose and are overwritten or deleted in the normal maintenance cycle.

When information is no longer required, GVF will delete it, de-identify it or securely restrict it from further use, as appropriate.

7. Your choices and rights

Subject to applicable law and legitimate record-retention duties, a person may ask GVF to:

• confirm whether GVF holds personal information about them;
• provide access to that information;
• correct or update inaccurate information;
• delete information that GVF is no longer authorised or required to retain;
• object to certain processing; or
• stop location sharing at any time through the app or by withdrawing phone location permission.

To make a privacy, correction or deletion request, email info@greytonfire.org with the subject GVF IMS privacy request. Include enough information for GVF to identify the relevant account and request. Do not send a password, one-time PIN or unnecessary medical information. GVF may need to verify the requester’s identity before acting.

Deleting or deactivating an account may not erase incident, attendance, equipment, acceptance, security or audit records that GVF must retain for a lawful operational, safety, evidentiary or compliance purpose. In that case, GVF will limit the retained information and its further use to that purpose.

A person may also lodge a complaint with South Africa’s Information Regulator. Current contact and complaint information is available at https://inforegulator.org.za.

8. Children

GVF IMS is restricted to authorised users aged 18 or older. GVF does not knowingly use GVF IMS to collect personal information from children. If GVF learns that a child has obtained an account or provided information through the service, GVF will investigate and take appropriate action.

9. Changes to this policy

GVF may update this policy when the app, supporting services or legal requirements change. The current version will remain available on the GVF website and will show its effective date. Material changes will be communicated where reasonably appropriate.