I would use http for both as it is the easiest to handle.
For receiving notification can poll in regular intervals.
- With SSL, encryption is quite easy
- If the mobile phone looses the connection to the server, you don't have to reconnect or something else
- Easy to implement (for C# you could use HttpListener, for android maybe this could help[^]
- Well-defined protocol for file-transfer
- Polling could cause some network traffic... But if you send only some bytes, I don't think this would be a big problem as for receiving notification with raw tcp you will cause some network traffics too (e.g. for checking whether the connection is still alive)