Last updated: July 2026

This policy explains how The Media Farm (Pty) Ltd collects, uses, stores, and protects personal information in the course of providing our services, in accordance with the Protection of Personal Information Act, 2013 (POPIA).

1. WHO WE ARE

The Media Farm (Pty) Ltd (“The Media Farm”, “we”, “us”, “our”) is a South African marketing and advertising agency. Farmdash is a proprietary internal platform used to aggregate client analytics data for reporting and performance monitoring purposes.

Information Officer: The designated Information Officer responsible for POPIA compliance is reachable at jh@mediafarm.co.za.

2. WHAT PERSONAL INFORMATION WE COLLECT

Staff accounts:
– Email address and full name (used to create and manage your Farmdash login)
– Login timestamps and activity logs (for security and audit purposes)
– Role and permission level within the platform

Client platform data:
– Facebook Page performance metrics (impressions, reach, engagement, follower counts)
– Instagram Business Account metrics (reach, profile views, follower counts)
– YouTube channel analytics (views, watch time, subscriber counts)
– Google Analytics 4 data (sessions, users, conversions — aggregated, not individual)
– LinkedIn Page analytics (impressions, clicks, follower counts)
– Podcast statistics from Buzzsprout (downloads, episode performance)
– Other platform analytics as authorised in writing by each client

We do not access private user data, personal messages, or any data beyond what is required for analytics reporting. All platform connections are made using OAuth tokens provided and consented to by each client.

3. HOW WE COLLECT INFORMATION

Staff information is collected directly when accounts are created by a system administrator. Client analytics data is retrieved via official APIs provided by each platform (Meta Graph API, Google Analytics Data API, YouTube Data API, LinkedIn API, etc.) using access tokens authorised by the client.

4. WHY WE COLLECT IT – LAWFUL BASIS

Under POPIA, we rely on the following grounds for processing personal information:

– Legitimate interest: Aggregating platform analytics to fulfil our contractual obligations to clients as a marketing agency.
– Consent: Clients explicitly connect their accounts to Farmdash and can revoke access at any time.
– Contract: Staff personal information is processed to manage employment and system access.

5. THIRD-PARTY PROCESSORS

We use the following sub-processors to operate Farmdash. Each is bound by their own data processing agreements:

– Supabase Inc. (database and authentication hosting) — data stored on servers in the EU region
– Vercel Inc. (frontend hosting and deployment) — servers in the USA and EU
– Anthropic PBC (AI report generation, if enabled) — data processed in the USA
– Meta Platforms Inc. (Facebook and Instagram API access)
– Google LLC (YouTube and Google Analytics API access)
– Microsoft / LinkedIn Corp. (LinkedIn API access)

We do not sell, share, or distribute your data to any other third parties.

6. CROSS-BORDER TRANSFERS

Some of our sub-processors are based outside South Africa. Where personal information is transferred internationally, we ensure appropriate safeguards are in place consistent with POPIA’s requirements, including relying on the data processing agreements and standard contractual clauses of those processors.

7. DATA RETENTION

– Analytics snapshots: Retained for as long as the client relationship is active, and deleted within 90 days of account closure or written request.
– Staff accounts: Retained for the duration of employment and deleted within 30 days of departure.
– Sync logs and audit trails: Retained for 12 months.

8. YOUR RIGHTS UNDER POPIA

As a data subject, you have the right to:
– Request access to the personal information we hold about you
– Request correction of inaccurate personal information
– Request deletion of your personal information (subject to legal obligations)
– Object to the processing of your personal information
– Lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, contact our Information Officer at jh@mediafarm.co.za. We will respond within 30 days.

The Information Regulator can be reached at www.justice.gov.za/inforeg.

9. SECURITY

Farmdash implements row-level security on all database tables, encrypted connections (TLS), and access controls restricting data to authorised staff only. Client data is logically separated by client account. We conduct regular reviews of access permissions and security configuration.

10. COOKIES

Farmdash uses a single session cookie to maintain your authenticated login. We do not use tracking cookies, advertising cookies, or any third-party analytics cookies within the platform.

11. META PLATFORM COMPLIANCE

Our use of Meta Platform data (Facebook and Instagram) complies fully with Meta’s Platform Terms and Developer Policies. Meta data is used solely to generate analytics reports for the account holder and is not used for advertising, targeting, or any purpose beyond what is explicitly disclosed in this policy.

12. CHANGES TO THIS POLICY

We may update this policy from time to time. The “Last updated” date at the top of this page will reflect any changes. Material changes will be communicated to staff via email.

CONTACT

The Media Farm (Pty) Ltd
Sun Park, Unit 8, 178 Smit St
Fairland, Johannesburg, 2170
South Africa

Information Officer: jh@mediafarm.co.za