PRIVACY POLICY &
POPIA PRIVACY NOTICE
Applicable to Protec Auto Electrical CC and Protec Auto and Electrical (Pty) Ltd

1. Purpose and scope
This Privacy Policy and POPIA Privacy Notice explains how Protec Auto Electrical CC and Protec Auto and Electrical (Pty) Ltd collect, use, store, share, protect and otherwise process personal information. It is intended to provide a single, clear public notice for the Protec Auto Electrical website and the customer-facing activities conducted under the Protec Auto Electrical name.

 

It applies to customers, prospective customers, website visitors, suppliers, service providers, representatives of corporate and fleet customers, warranty and insurance contacts, and other persons who interact with either entity. It should be read together with the applicable entity's PAIA Manual and any transaction-specific terms, job card, quotation, consent or notice.

This notice does not merge the two legal entities. The entity that determines the purpose and means of a particular processing activity is the responsible party for that activity. Where both entities are involved in a legitimate shared business process, each entity will remain responsible for complying with POPIA to the extent applicable to its own processing.

2. Who is responsible for your information
Depending on the branch, transaction, account, service or business relationship concerned, the responsible party is
Protec Auto Electrical CC or Protec Auto and Electrical (Pty) Ltd. Both entities use the Protec Auto Electrical trading name
and the shared website.

 

The designated Information Officer reflected in the current PAIA Manuals is:
Information Officer: Enrique Louw
Telephone: 011 979 3313
Email: protecautoelectrical@gmail.com
Head Office 270 Pomona Road, Kempton Park, Gauteng, South Africa

 

3. Key definitions
In this notice, terms such as personal information, processing, data subject, responsible party, operator and special personal information have the meanings assigned to them in POPIA. In practical terms:

•  Personal information is information relating to an identifiable living natural person and, where applicable, an identifiable existing juristic person.

•  Processing includes collecting, receiving, recording, organising, storing, updating, retrieving, using, sharing, transmitting, restricting, erasing or destroying personal information.

•  An operator is a person or service provider that processes personal information for a responsible party in terms of a mandate or contract without coming under the direct authority of that responsible party.

 

4. Personal information we may collect
The information collected depends on the nature of the interaction. It may include:

•  identity and contact information, including name, surname, telephone number, email address, physical or postal address and, where reasonably required, identity or passport information;

• information, contact persons, purchase-order information and billing details;

• business and account information, including company or close corporation name, registration number, VAT

• mileage/odometer reading, key information, service history and information recorded on job cards;

• vehicle information, including registration number, VIN/chassis number, engine number, make, model, derivative,

• calibration/programming records and service records; test results, photographs, videos, technician findings, quotations, repair instructions, parts fitted,  workshop and technical information, including customer complaints, diagnostic trouble codes, diagnostic reports,

• financial and transaction information, including invoices, payment status, bank details where legitimately required, account history and information reasonably required for refunds, credit administration or debt recovery;​

• communications and correspondence, including email, telephone, SMS, WhatsApp or other communications with us, subject to applicable law;

• website information, such as information submitted through contact or enquiry forms and technical information generated by the website or its hosting/security tools; and

• information concerning suppliers, service providers and their representatives, including contact, registration, banking, quotation, invoice and purchase-order information.

 

5. How and where we collect information
We may collect personal information:

• directly from you when you make an enquiry, request a quotation, book a vehicle, sign a job card, approve work, make payment, communicate with us, submit a website form or otherwise deal with us;

• from a person authorised to act for you, such as a driver, employer, fleet manager, broker, insurer, warranty administrator, dealership or representative;

• from suppliers, service providers and business partners where reasonably necessary for the transaction or service;

• from vehicle systems, diagnostic equipment and workshop inspections where the information is reasonably necessary to diagnose, quote, repair, programme, calibrate, test or document work on a vehicle;

• from lawful public sources or official records where permitted by law; and

• automatically through website technologies where used, subject to this notice and any cookie controls made available on the website.

 

Where POPIA requires personal information to be collected directly from the data subject, we will do so unless a lawful exception applies.

 

6. Why we process personal information

We process personal information only for reasonably necessary, specific and lawful business purposes, which may

include:

• responding to enquiries and providing quotations;

• opening and administering customer, supplier, fleet or business accounts;

• booking vehicles and managing workshop workflow;

• diagnosing, inspecting, servicing, repairing, programming, calibrating, testing and road-testing vehicles where authorised;

• identifying vehicles and matching parts, technical information, warranties and service records;

• communicating progress, approvals, findings, collection arrangements and payment requirements;

• processing payments, invoicing, accounting, audit, tax and record keeping;

• administering warranty, maintenance-plan, insurer, fleet and third-party claims or authorisations where applicable;

• managing supplier and service-provider relationships and purchase orders;

• protecting our legal rights, preventing fraud, maintaining security, handling complaints and resolving disputes;

• complying with legislation, lawful regulatory requirements, court orders and other legal obligations;

• maintaining and improving our website, systems, customer service and business operations; and

• conducting lawful direct marketing in accordance with POPIA and the customer's rights described below.

 

7. Lawful grounds for processing

We will process personal information where a lawful basis recognised by POPIA applies. Depending on the circumstances, this may include consent; processing necessary for the conclusion or performance of a contract; compliance with an obligation imposed by law; protection of a legitimate interest of the data subject; or pursuit of our or a third party's legitimate interests, subject to POPIA.

 

Consent is not treated as the only lawful basis for ordinary workshop administration. Where processing is necessary to perform authorised work, administer a transaction, comply with law or protect legitimate interests, we may process the information on that basis even where separate marketing consent has not been given.

 

8. Special personal information and children's information

We do not seek to collect special personal information or children's information as a routine part of vehicle repair and related services. If such information is received or must be processed, we will do so only where POPIA permits it and only to the extent reasonably necessary for the relevant lawful purpose. Special personal information may include information concerning health, race or ethnic origin, religious or philosophical beliefs, political persuasion, trade union membership, sex life, biometric information and certain criminal-behaviour information.

 

9. Vehicle, workshop and diagnostic information

Vehicle and workshop records can contain both technical data and personal information. We may record or retain VIN/chassis numbers, registration numbers, engine numbers, mileage, customer complaints, fault codes, control-unit information, test results, photographs, videos, estimates, job cards, technician notes, repair history, programming or calibration information and related correspondence.

 

We use this information to identify the vehicle, diagnose faults, obtain correct parts or technical information, provide quotations, perform authorised work, substantiate findings, administer warranties or claims, maintain service records, respond to disputes and meet legal or accounting obligations. Where diagnostic or technical data is shared with a manufacturer, technical support provider, parts supplier, insurer, warranty administrator or specialist, we will limit the information to what is reasonably necessary for the relevant purpose.

 

10. Sharing personal information

We do not sell customer personal information. We may disclose information where reasonably necessary to:

• our accountants, auditors, legal advisers, debt-recovery providers or other professional advisers;

• insurers, warranty administrators, fleet operators, dealerships or claim administrators involved in a customer's authorised transaction;

• parts suppliers, manufacturers, technical-support providers, specialists or subcontractors where information is required to identify parts, diagnose a fault or complete authorised work;

• payment, banking, accounting, payroll, CRM, communications, hosting, security, backup or IT service providers acting for us;

• law-enforcement bodies, regulators, government authorities, courts or other persons where disclosure is required or permitted by law;

• a purchaser, successor or adviser in connection with a lawful restructuring, sale or transfer of a business or assets, subject to appropriate confidentiality and legal requirements; or

• another person where the data subject has authorised the disclosure or another lawful basis exists.

 

Where practical and appropriate, we minimise the personal information disclosed. A third-party operator that

processes information on our behalf is not authorised by us to use that information for its own unrelated purposes.

 

11. Operators, service providers and cloud systems

We may use third-party systems or operators to host data, manage customer relationships, send communications, maintain backups, provide cybersecurity, process transactions or support business administration. We remain responsible for selecting service providers appropriate to the nature of the processing and for taking reasonable steps to require confidentiality and security safeguards where POPIA requires this.

 

Service-provider access does not by itself give that provider ownership of the personal information or permission to sell it, market independently to our customers, or use it for an unrelated purpose. Their processing must be limited to the service, lawful instructions and applicable legal obligations.

 

12. Direct marketing and communications

We may communicate with customers about quotations, bookings, repairs, approvals, payments, collections, safety matters, warranty matters and other service-related issues. These operational communications are not treated as marketing merely because they are sent electronically.
 

For direct marketing by electronic communication, including email, SMS and similar electronic channels, we will apply section 69 of POPIA. Where a person is not an existing customer, consent will be obtained in the prescribed manner where required. Existing customers may be contacted about our own similar products or services where the statutory requirements are met, provided they were given a reasonable opportunity to object when the details were collected and in each marketing communication.

 

Marketing communications will identify the sender and provide a reasonable, free and uncomplicated method to opt out. An objection or withdrawal from marketing will not prevent us from sending communications that are necessary to administer an existing booking, repair, account, warranty, claim, legal obligation or other non-marketing business relationship.

 

13. Cookies and website technologies

Our website may use essential cookies or similar technologies required for security, functionality, session management or technical operation. If analytics, advertising or other non-essential tracking technologies are used, the website should provide appropriate notice and controls consistent with the technologies actually deployed.

 

Because website technologies can change, this notice does not claim that a specific analytics or advertising service is in use unless it is actually implemented. The website administrator should keep the cookie notice and consent configuration aligned with the live website.

 

14. Cross-border processing

Our current PAIA Manuals state that personal information is not planned to be transferred outside South Africa. If it becomes necessary for a lawful business purpose to transfer personal information to a recipient in another country, we will do so only where a condition permitted by section 72 of POPIA is satisfied, for example where adequate protection applies, the data subject consents, or the transfer is necessary for a qualifying contract or for the data subject's benefit as contemplated by POPIA.

 

This wording is intended to accommodate legitimate use of technology or service providers without representing that every provider necessarily stores information outside South Africa.

 

15. Retention and destruction

We retain personal information only for as long as there is a lawful or reasonably necessary purpose for doing so, including providing services, maintaining workshop and warranty records, meeting tax, accounting, employment or other statutory requirements, resolving disputes, enforcing agreements, preventing fraud and maintaining security.

 

When information is no longer required and no lawful basis exists to retain it, we will delete, destroy or de-identify it in a manner appropriate to the record and the risk. Different categories of records may therefore have different retention periods.

 

16. Information security

We take reasonable and appropriate technical and organisational measures to protect personal information against loss, damage, unauthorised destruction, unlawful access or unlawful processing. Measures may include access controls, password and account controls, device and network security, secure communications, backups,

confidentiality obligations, controlled physical access, secure disposal practices, monitoring and incident-response procedures.

 

No system can be guaranteed to be completely secure. Our obligation is to implement safeguards that are appropriate having regard to generally accepted information-security practices, the nature of the information and the risks involved.

 

17. Security compromises

If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will assess the incident and take the steps required by POPIA, including notification to the Information Regulator and affected data subjects where required by law, subject to any lawful delay or exception.
 

18. Your rights under POPIA

Subject to POPIA and other applicable law, a data subject may have the right to:

• ask whether we hold personal information about them and request access to it;

• request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, or request destruction/deletion where we are no longer authorised to retain it;

• object, on reasonable grounds where applicable, to processing based on certain lawful grounds;

• object to direct marketing and withdraw marketing consent;

• request information about the identity of third parties who have had access to their information where the law provides for this;

• submit a complaint to the Information Regulator; and

• exercise any other right available under POPIA.

 

Requests should be sent to protecautoelectrical@gmail.com. We may require reasonable proof of identity and

sufficient information to identify the relevant records. Rights are subject to lawful limitations, including PAIA grounds of

refusal, legal retention duties and the rights of other persons.

 

19. PAIA and access to records

Access to records is governed by the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended. Protec Auto Electrical CC and Protec Auto and Electrical (Pty) Ltd each maintain a separate PAIA Manual because each is a separate private body.

 

The relevant PAIA Manual explains the categories of records held, the procedure for requesting access, applicable prescribed forms and fees, and the contact details of the Information Officer. Copies should be made available on the website and at the relevant premises as required. Website publication: Publish this consolidated Privacy Policy together with separate downloadable links titled “PAIA Manual - Protec Auto Electrical CC” and “PAIA Manual - Protec Auto and Electrical (Pty) Ltd”.

 

20. Third-party websites and services

Our website or communications may contain links to third-party websites or services. A third party's own privacy terms apply when a person leaves our environment or deals directly with that third party. We are not responsible for an independent third party's privacy practices merely because we provide a link or contact route.

 

21. Changes to this notice

We may update this notice when our business practices, technology, service providers or legal obligations change. The current version should be published on the website with its effective or last-updated date. Material changes should be communicated in an appropriate manner where required.

 

22. Contact details and complaints

Privacy, POPIA and PAIA queries may be directed to:

Information Officer: Enrique Louw

Email: protecautoelectrical@gmail.com

Telephone: 011 979 3313

Address: 270 Pomona Road, Kempton Park, Gauteng, South Africa

 

A person may also lodge a complaint with the South African Information Regulator. Current Regulator contact channels should be checked on the Information Regulator's official website before publication because contact details can change. At the date of this notice, the Regulator's eServices portal lists Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, telephone 010 023 5200 and enquiries@inforegulator.org.za.