HFH CRM
Privacy Policy
Last updated: 2026/08/27
1. Who we are
HFH CRM is an internal customer relationship management system operated by Home from Home, a property sales and holiday rental agency based in Plettenberg Bay, Western Cape, South Africa.
HFH CRM is used only by authorised Home from Home staff. There is no public signup and no public access to the system.
For the purposes of the Protection of Personal Information Act, 2013 (POPIA), Home from Home is the responsible party for personal information processed in HFH CRM.
Contact for privacy queries: admin@homefromhomeplett.co.za
2. Scope of this policy
This policy explains what information HFH CRM collects, how it is stored, how it is used, and how it can be deleted. It covers both:
- information about clients and properties entered into HFH CRM by staff, and
- information accessed from a staff member's Google Account, where that staff member has chosen to connect one.
3. Information entered into HFH CRM by staff
Staff record business information in HFH CRM in the ordinary course of their work. This may include client names, contact details, enquiry history, property details, appointments and internal notes.
This information is used only to operate the business of Home from Home. It is not sold, and it is not shared with third parties except where necessary to provide the system itself (see section 6) or where required by law.
4. Google Account data
Connecting a Google Account to HFH CRM is entirely optional. Staff who prefer not to connect a calendar can use HFH CRM without doing so, and nothing about their use of the system changes.
What we access
Where a staff member chooses to connect a Google Account, HFH CRM requests the following permissions:
https://www.googleapis.com/auth/calendar.events — read and write calendar events. Used for one purpose only: keeping appointments in sync between HFH CRM and the one calendar the staff member selects when connecting.
https://www.googleapis.com/auth/calendar.calendarlist.readonly — read the staff member's list of calendars (names and time zones only). Used so the staff member can choose which one calendar to sync; the contents of the other calendars are never read.
HFH CRM also receives basic sign-in identification (the connected account's email address), used only to show the staff member which account is connected.
Specifically, HFH CRM:
- creates and updates calendar events in the selected calendar when appointments are created or changed in HFH CRM; and
- reads events from the selected calendar so that they can be shown against the relevant client or property record in HFH CRM.
The data involved is limited to event titles, dates, times, descriptions and attendee email addresses for the selected calendar.
What we do not access
HFH CRM does not request or receive access to Gmail, Google Drive, Google Contacts, Google Photos, or any other Google service. It does not access the contents of any calendar other than the one the staff member selects (the calendar-list permission reads only calendar names and time zones, so that a calendar can be chosen). It does not access Google Account data belonging to anyone who has not connected their own account.
Limited Use commitment
HFH CRM's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
In particular, Google user data obtained through HFH CRM is:
- not sold to any party;
- not shared with or transferred to any third party, other than as necessary to provide or improve the calendar sync feature itself, to comply with applicable law, or as part of a merger or acquisition with the user's consent;
- not used for advertising of any kind, including personalised, retargeted or interest-based advertising;
- not used to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models; and
- not read by any person, except where a staff member has given explicit consent for specific data in order to resolve a support issue, where required for security purposes, or where required by law.
Microsoft 365 account data
Staff may alternatively connect a Microsoft 365 account. This is equally optional, works the same way, and follows the same rules as above: HFH CRM requests permission to read and write the staff member's own calendar events, to read basic account identification (name and email address), and to read the mailbox time-zone setting so appointment times display correctly. It is used for one purpose only — keeping appointments in sync between HFH CRM and that staff member's own calendar. HFH CRM does not access email, files, contacts, or any other Microsoft service, and does not access Microsoft account data belonging to anyone who has not connected their own account. A staff member may disconnect at any time from within HFH CRM, which deletes the stored credentials; access can additionally be reviewed in the Microsoft account's own app permissions.
5. Authorisation credentials
When a staff member connects a Google Account or a Microsoft 365 account, HFH CRM stores an OAuth refresh token so that calendar sync can continue without the staff member signing in repeatedly.
Refresh tokens are encrypted at rest. HFH CRM does not receive, store or have access to account passwords at any time.
6. Where information is stored
HFH CRM data is stored in a managed PostgreSQL database provided by Supabase, located in eu-central-1 (Frankfurt / EU Central). The application is hosted on Railway. Both providers act as operators processing data on behalf of Home from Home under their own security and confidentiality obligations.
Access to the database is restricted, and access within the application is controlled by individual, password-protected staff accounts, with multi-factor authentication available on every account.
Because these providers may host data outside South Africa, connected Google Account data and other personal information may be transferred across borders. Home from Home takes reasonable steps to ensure such transfers are subject to comparable levels of protection, as required by POPIA.
7. Retention and deletion
Calendar events synced into HFH CRM are retained while the connection remains active and while the associated client or property record remains in the system.
A staff member may disconnect a connected Google Account at any time from within HFH CRM. On disconnection:
- the stored refresh token is deleted;
- HFH CRM immediately stops reading from and writing to that calendar; and
- calendar events previously synced into HFH CRM are removed within 30 days.
Disconnecting from within HFH CRM revokes the application's access. A staff member may additionally review or revoke access directly at https://myaccount.google.com/permissions.
Where a staff member leaves Home from Home, their HFH CRM account is deactivated and any stored authorisation credentials are deleted.
8. Your rights
Under POPIA, individuals whose personal information is held in HFH CRM may request access to that information, request correction of information that is inaccurate or out of date, request deletion where there is no lawful basis for continued retention, and object to processing in certain circumstances.
Requests may be sent to admin@homefromhomeplett.co.za. A complaint may also be lodged with the Information Regulator of South Africa.
9. Security
HFH CRM uses encrypted connections (HTTPS) for all traffic, row-level security in the database, optional multi-factor authentication on staff accounts, and encryption at rest for stored authorisation credentials. No system can be guaranteed completely secure, but Home from Home takes reasonable technical and organisational measures appropriate to the sensitivity of the information held.
10. Changes to this policy
Any material change to this policy will be reflected here, with the "Last updated" date revised accordingly. Where a change materially affects how Google Account data is handled, affected staff will be notified.
11. Contact
Home from Home
Plettenberg Bay, Western Cape, South Africa
admin@homefromhomeplett.co.za