POPIA Privacy Policy and Notice

1. Responsible business and scope

N4 AUTOWERKS is the supplied company and trading name, described by the owner as a private company providing servicing, diagnostics, maintenance and mechanical repairs for all makes and models, with BMW and Porsche specialist expertise. Our business address is Amatole Street, N4 Gateway Industrial Park, Pretoria, 0081, South Africa.

This is an owner-authored draft privacy notice for enquiries, booking requests, customer accounts and workshop interactions. It is not legal certification. The website takes no online payments or deposits. The registration certificate and responsible officer details must be verified before this notice is finalised.

2. Information collected and purposes

Information comes from customers, authorised contacts, account sign-in and staff recording work on a vehicle. Required booking fields identify the requester and vehicle; additional fields and uploads provide context for assessment.

• Names, emails, mobile numbers, customer addresses, company/contact details and communication preferences: to respond to enquiries, confirm bookings, identify authorised contacts and provide requested services.
• Vehicle registration, VIN, make, model/year, mileage, engine, colour and other vehicle details: to identify the vehicle, plan diagnostics and maintain accurate service history.
• Preferred appointments, complaints, diagnostic reports and fault codes, inspection findings, repair recommendations and check-in conditions: to assess the concern, quote and carry out authorised work.
• Vehicle photographs, licence-disc images, uploaded documents, condition notes and keys/accessories records: to document condition, support diagnosis, communicate findings and manage collection. Avoid uploading unrelated sensitive information.
• Quotes, decisions, approved amounts, job costing, invoice values and payment status: to record scope, approval, charges, warranty matters and accounting. The website does not collect online card-payment details.
• Account names/emails, staff roles, assignments, timestamps, messages, notification records and audit/activity entries: to manage access, coordinate work and maintain accountability. Quote-approval records have fields for IP address and user-agent information; field availability alone does not mean every decision captures them.
• Authentication session information, browser storage and technical error/connection context: to maintain sign-in, diagnose faults and protect the service. No unnecessary technical-data collection or advertising use is authorised by this notice.

3. Lawful processing

Processing needed to respond to a requested quotation/booking and deliver authorised work is based on steps towards or performance of a contract. Applicable accounting, consumer-protection and other legal obligations may require records to be kept. Proportionate access management, fraud prevention, condition evidence and dispute handling may rely on legitimate interests, subject to the customer’s rights and a necessity assessment. Consent is used only where required for a specific purpose, not as a blanket basis for all service processing.

Submitting a booking is not marketing consent or repair authorisation. Optional uploads should be limited to what is relevant; do not provide another person’s information without an appropriate basis.

4. Access and recipients

The application uses account authentication, protected workshop pages, database row-level access policies and private upload buckets. Role-based access distinguishes owners, managers, service advisors (ADMIN), mechanics, parts staff and customers. Customers’ core customer, vehicle and job records use ownership checks; mechanic job access is assignment-restricted. Other staff access follows the existing role permissions. These measures reduce risk but do not guarantee absolute security.

Authorised providers process information to operate the service. Suppliers may receive the vehicle specifications and parts information necessary to fulfil an order, rather than unrelated customer details. Legal advisers, regulators or other recipients may receive information where lawfully required. Information is not published as public service history.

5. Providers and international processing

The website and application use Lovable hosting and Lovable Cloud for account authentication, database records and file storage. Google Fonts supplies the website fonts. Google, Apple and Microsoft are available as optional sign-in providers. The Get Directions link opens Google Maps only when selected; there is no embedded map. No app-added advertising pixel or analytics integration was identified. Website error-reporting hooks may send error context to Lovable where those hooks are active; hosting and authentication providers may also process technical connection information under their terms.

These providers may process information outside South Africa. Deployment location, operator agreements, subprocessors and transfer safeguards must be confirmed before finalisation; no South-Africa-only storage claim is made. Any international transfer must meet the applicable requirements of POPIA section 72.

6. Retention and safeguards

Records are retained according to service-history needs, accounting and legal obligations, warranty/dispute periods and justified business purposes. There is no implemented blanket automatic expiry or deletion schedule. The final schedule and secure disposal process require approval. A deletion request is reviewed against these requirements rather than automatically deleting linked workshop history.

Security incidents should be reported promptly to our contact email. The responsible person must assess and contain the incident, preserve relevant evidence and arrange notifications to the Information Regulator and affected persons as soon as reasonably possible where POPIA section 22 requires them. Officer registration and a formal incident procedure remain prepublication actions.

7. Your rights and request procedure

Send questions or requests to Admin@n4autowerks.com. Include your name, contact method and enough information to identify the relevant booking, vehicle or record. Do not email passwords or unnecessary identity documents.

You may request confirmation/access, correction of inaccurate or outdated information, deletion or destruction where permitted, objection where applicable, and withdrawal of consent for consent-based processing. We will verify identity proportionately through an agreed safe channel, identify the records and lawful basis, assess legal exceptions and retention duties, and communicate the decision and reasons. Withdrawal does not make earlier lawful processing unlawful.

For a formal request for records needed to exercise or protect a right, consult our draft PAIA Manual. You may lodge a complaint with the Information Regulator using its official channels. Do not submit other customers’ data in your request.