Last updated 2 September 2026
Prepared for 2Clip / Timbuk2 AI.
Using the 2Clip mobile app? Read the App Addendum →The addendum extends this policy for the app — analytics, session recording, device permissions, push notifications, and the named processors that power it.Timbuk2 AI is the responsible party for personal information processed for the 2Clip programme, unless a separate notice states otherwise.
Registered address: 155 WEST ST SANDOWN SANDTON 2031
Information Officer: Matimba Nkuna (mjnkuna@timbuk2.ai)
This policy applies to personal information processed in connection with 2Clip recruitment, screening, onboarding, messaging, missions, submissions, payments, support, analytics, reporting, and compliance.
It covers information received directly from participants, through recruitment partners, from forms and communication channels, and from mission outputs submitted to the Company.
Identity and contact details, including name, phone number, email address, age bracket, area/subplace, and ID or other verification details where needed for lawful identification or payment.
Recruitment and onboarding information, including area suitability, availability, smartphone capability, GPS/camera capability, bank or wallet details, and screening responses.
Submission and mission information, including worker ID, mission ID, timestamps, GPS coordinates, photos, notes, category labels, quality/duplicate flags, payout records, and audit artefacts.
Optional third-party business information supplied in the field, such as business names, visible contact numbers, owner names, operating notes, and proof of location where this is relevant to the task.
Technical and usage information from the channels we use, such as WhatsApp messages, exported chat records, form data, device metadata embedded in submissions, meeting attendance, and support interactions.
Directly from data subjects during applications, onboarding, Google Meet sessions, forms, messaging, or field submissions.
From recruitment or ecosystem partners where candidates have been sourced or referred through a lawful process.
From operators and service providers that help us host, store, transmit, analyse, or secure programme data.
From public-facing business observations captured lawfully in the field and from quality-assurance checks against existing datasets or maps.
To recruit, assess, onboard, allocate, manage, and support participants.
To verify submissions, calculate points or rewards, prevent fraud, manage duplicates, and administer payouts.
To create, improve, and commercialise 2Clip datasets, reports, truth packs, analytics, models, and client deliverables.
To maintain audit trails, quality assurance, operational reporting, funding or impact reporting, and legal/compliance records.
To protect the security, integrity, and lawful operation of the programme.
The Company may process personal information where:
Where consent is relied on, the data subject may withdraw it prospectively, subject to any processing that remains lawful on another basis or that is required for recordkeeping, dispute management, or legal compliance.
Participants must minimise collection of third-party personal information and should avoid capturing unnecessary faces or other personal details.
Where owner or contact information is requested as part of a mission, participants must only provide information lawfully obtained, relevant to the mission, and not excessive. The Company may delete or redact unnecessary personal information.
We may share personal information with operators or service providers that host or support communications, cloud storage, analytics, identity checks, security, or payment processes.
We may share limited information with clients, partners, auditors, funders, or regulators where required for the agreed service, lawful reporting, or impact verification, but we aim to limit personal information and favour aggregate or pseudonymised outputs where feasible.
We may disclose information where required by law, court order, regulator request, or to protect lawful rights and safety.
Some operators or cloud environments may process or store information outside South Africa. Where that happens, the Company will take steps reasonably required by applicable law to ensure adequate protection and appropriate contractual safeguards.
The specific processors used by the mobile app, and which of them process data outside South Africa, are named in the App Addendum.
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, unless a longer retention period is required or permitted by law, contract, audit needs, dispute resolution, research safeguards, or legitimate operational recordkeeping.
Audit, payout, and proof records may need to be retained after a campaign ends to support verification, complaints, client deliverables, and funding or compliance reporting.
The Company uses reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised destruction, access, or unlawful processing.
Because 2Clip uses messaging tools and field devices, absolute security cannot be guaranteed. Participants should also use secure devices, passcodes, and appropriate caution when sharing information.
Subject to applicable law, data subjects may request confirmation of whether we hold their personal information, request access, request correction or deletion, object to certain processing, withdraw consent where consent is the basis, and complain to the Information Regulator.
Access requests and some other requests may be handled through the Company’s PAIA Manual and associated request processes. App users can also request account deletion at foona.timbuk2.ai/account/delete.
The Company must maintain Information Officer details and a PAIA Manual appropriate to its legal obligations. Requests for access to records or personal information should be directed to the Information Officer or other contact listed in the PAIA Manual.
Operational onboarding, mission, safety, and payout communications are not the same as marketing communications.
If the Company wishes to send direct marketing by electronic means, this will be managed in accordance with applicable law and channel-specific opt-in requirements.
2Clip is intended for adults. The Company does not knowingly recruit minors into paid field missions without a separate lawful basis and additional safeguards.
The Company does not intend to collect special personal information unless a lawful exception applies and appropriate authorisation or safeguards are in place.
Questions or complaints should first be sent to support@timbuk2.ai or the Information Officer. Data subjects may also complain to the Information Regulator of South Africa.
This policy may be updated from time to time. The latest version should be made available in the onboarding pack, website, or other official 2Clip channel.