Privacy Policy

1. Who we are and our role under POPIA

JVS Ethics Lab ("JVS Ethics Lab", "AutoAxxiz", "we", "us") owns and operates AutoAxxiz, the workshop management platform.

Under the Protection of Personal Information Act, 2013 (POPIA), we act as:

• Responsible party for personal information we collect directly from you (your account, billing, and support interactions).
• Operator for personal information you store about your customers and employees inside the platform (we process this under your instruction).

Our Information Officer is responsible for POPIA compliance. Contact: privacy@autoaxxiz.co.za

2. Personal information we collect

2.1 Account and subscriber information

• Full name, email address, mobile number (for account holders and authorised users)
• Workshop name, physical address, VAT number
• Billing information for JVS Ethics Lab invoices (name on account, payment method details — card numbers handled by PCI-compliant processors, not stored by us)
• IP address and browser/device information for security logging

2.2 Customer and vehicle data you store

When you use AutoAxxiz to manage your workshop, you store personal information about your own customers. This includes their names, phone numbers, email addresses, and vehicle details. AutoAxxiz processes this data as an operator on your behalf — we do not use it for any purpose other than providing the Service to you.

2.3 Usage and technical data

• Log data (API requests, timestamps, errors) for security and debugging
• Feature usage patterns (aggregated, not individual) to improve the product
• WhatsApp message delivery status (not message content beyond what you explicitly send)

2.4 WhatsApp message content

Messages you send to your customers via the WhatsApp Business API are transmitted through Meta's infrastructure. The content of customer WhatsApp conversations is subject to Meta's own privacy policy. We store structured message metadata (type, timestamp, delivery status, linked job card) but not raw message content beyond what you type into AutoAxxiz.

3. Why we process personal information

We process personal information for the following lawful bases under POPIA:

• Contractual necessity: to provide, operate, and support the AutoAxxiz service you subscribe to.
• Legal obligation: to issue SARS-compliant tax invoices, retain records as required by the Companies Act and VAT Act, and respond to lawful information requests.
• Legitimate interest: to send transactional emails and product updates relevant to your account, maintain security logs, and improve service quality.
• Consent: where required for marketing communications beyond transactional messages (you can withdraw at any time).

4. Where your data is stored

The production architecture is designed for South African data residency and secure object storage for workshop media. The final hosting provider and region are confirmed during production infrastructure setup.

External services may process information outside South Africa. Confirm the active providers and their processing locations during onboarding, including:

• WhatsApp message content that passes through Meta's global infrastructure — governed by Meta's Data Processing Terms.
• Billing information processed by JVS Ethics Lab payment providers.
• Aggregated, anonymised usage analytics processed by our analytics provider.

5. Sharing personal information

We do not sell personal information. We share personal information only with:

• Meta Platforms (WhatsApp Business API — to send and receive WhatsApp messages on your behalf)
• Amazon Web Services (infrastructure and hosting)
• PayFast / payment processors (billing and payment processing)
• Xero / Sage (only the invoice and customer data you explicitly sync, on your instruction)
• Regulatory and law enforcement authorities when required by South African law

All processors are bound by data processing agreements. We do not share personal information with advertisers or data brokers.

6. Retention

We retain personal information for as long as your account is active and for 3 years after account closure for legal and accounting purposes, unless a shorter period is required by law or requested by you.

Contact support to request deletion after account closure. We will confirm the scope, timing and backup retention for your deployment; records subject to legal retention obligations may need to be retained.

7. Your rights under POPIA

As a data subject under POPIA, you have the right to:

• Access: request a copy of personal information we hold about you.
• Correction: request correction of inaccurate personal information.
• Deletion: request deletion of personal information (subject to legal retention obligations).
• Objection: object to processing based on legitimate interests.
• Complaint: lodge a complaint with the Information Regulator of South Africa (inforeg.org.za).
• Restriction: request we restrict processing in certain circumstances.

To exercise any of these rights, email privacy@autoaxxiz.co.za. We will respond within 30 days.

8. Security

We implement security measures appropriate to the risk, including:

• TLS encryption for service connections
• AES-256-GCM encryption for selected sensitive customer fields
• Bcrypt password hashing — we never store plain-text passwords
• Role-based access controls with short-lived access tokens and revocable rotating refresh tokens
• Regular security reviews and vulnerability scanning
• AWS VPC network isolation and least-privilege IAM policies

No system is completely secure. In the event of a breach affecting your personal information, we will notify you and the Information Regulator as required by POPIA within 72 hours of becoming aware of the breach.

9. Cookies and tracking

The AutoAxxiz web application uses:

• Session cookies (strictly necessary): to maintain your login state. These cannot be disabled without breaking core functionality.
• Google Analytics cookies (optional): after you choose Allow analytics on the marketing website, Google receives page visits, CTA clicks and successful enquiry events. You can decline or withdraw consent using Analytics preferences in the footer. Google may process this data outside South Africa.

The marketing Google Analytics integration disables advertising signals and does not intentionally send names, phone numbers, email addresses, form contents or URL query strings. It is restricted to public marketing pages; staging and workshop screens are excluded. Limited first-party event counts are also collected without analytics cookies and honour browser Do Not Track.

10. Children

The Service is intended for business use by adults. We do not knowingly collect personal information from individuals under 18. If you believe a minor's data has been submitted, contact privacy@autoaxxiz.co.za immediately.

11. Changes to this policy

We may update this Privacy Policy. We will notify you by email and in-app notification at least 30 days before material changes take effect. The date at the top of this page shows when it was last updated.

12. Contact

Information Officer
AutoAxxiz (Pty) Ltd
Johannesburg, Gauteng, South Africa
Email: privacy@autoaxxiz.co.za

Information Regulator of South Africa
inforeg.org.za · complaints.IR@justice.gov.za