Template text. Have it reviewed by a lawyer before launch.

Privacy policy

Car Workshop is a system that car workshops use to handle bookings, work orders and invoices. Each workshop is the controller of its customers' personal data. Car Workshop is the processor and handles that data only on the workshop's instructions.

What we store

Account details for workshop staff (name, email, the devices they sign in from). Customer data the workshop enters: name, contact details, address, personal or organisation number, vehicles, work done, invoices, photos and files.

Why, and for how long

To carry out the work agreed with the customer (GDPR art. 6.1 b) and to meet bookkeeping law (art. 6.1 c). Invoices are kept for 7 years. Other customer data is kept while the customer relationship lasts, or until the workshop erases it.

Your rights

You have the right to access, correct, export and erase your data, and to complain to your data protection authority (in Sweden, IMY). Contact the workshop that serves you. The workshop can export or anonymise your data directly in the system.

Security

Data is encrypted in transit. Each workshop's data is kept separate from every other workshop's, and access only works from computers the workshop has approved.

Data processing agreement

1. The processor handles personal data only to provide the service and only on the workshop's documented instructions.
2. Everyone with access is bound by confidentiality.
3. Suitable technical and organisational security measures are in place (GDPR art. 32).
4. Sub-processors (cloud hosting within the EU, and later email/SMS providers) are used only under equivalent terms. The workshop is told about any change.
5. The processor helps the workshop answer requests from data subjects and reports personal data breaches without undue delay.
6. When the agreement ends, data is returned through the exports and then deleted, except what the law requires us to keep.

The workshop accepts these terms when it creates an account.