Customer Data Retention and Security Policy

1. Retention criteria

Customer, vehicle, booking, repair, quotation, approval and service-history records are maintained as linked operational records. Retention considers contractual/service-history needs, applicable accounting and legal duties, warranty periods, disputes and proportionate accountability needs. The owner must approve a category-specific schedule; no fixed statutory retention period is asserted without identifying the relevant obligation.

There is no implemented general automatic deletion schedule. Deactivation of an account/customer is not deletion of historical records. A request for deletion may be limited by a legal obligation or justified ongoing purpose; explain the reasons and restrict further unnecessary use where appropriate.

2. Access, correction and disposal procedure

Send questions or requests to Admin@n4autowerks.com. Include your name, contact method and enough information to identify the relevant booking, vehicle or record. Do not email passwords or unnecessary identity documents.

Verify identity proportionately; locate linked records; assess rights, third-party information, legal holds and retention duties; document the decision; correct inaccurate records using authorised access; arrange lawful deletion/anonymisation or secure disposal where permitted. Consider related files, exports and provider backups under the confirmed retention process. Do not promise immediate deletion from every backup.

3. Access and incident handling

The application uses account authentication, protected workshop pages, database row-level access policies and private upload buckets. Role-based access distinguishes owners, managers, service advisors (ADMIN), mechanics, parts staff and customers. Customers’ core customer, vehicle and job records use ownership checks; mechanic job access is assignment-restricted. Other staff access follows the existing role permissions. These measures reduce risk but do not guarantee absolute security.

If you suspect unauthorised access or disclosure, contact us promptly. The responsible person should contain the event, assess affected data, preserve evidence, limit further disclosure and organise legally required notification and follow-up. No absolute security, unverified encryption or registered-officer claim is made.

These providers may process information outside South Africa. Deployment location, operator agreements, subprocessors and transfer safeguards must be confirmed before finalisation; no South-Africa-only storage claim is made. Any international transfer must meet the applicable requirements of POPIA section 72.