Who we are (Data Fiduciary / Controller)
This vehicle-service CRM platform is operated by Cyepro Solutions Private Limited (registered office: First Floor, Shritan Govardhana Giri, Plot No.3-6, Sy No.58/1, Gopana Palli Road, Hyderabad, Rangareddy, Telangana 500046, India), acting as the data fiduciary (controller) for the personal data described below. The service centre, dealership, or workshop that uses this platform processes your data within it. The platform operator acts as the data processor on their behalf for hosting, security, and the services described here. We are governed by the laws of India, including the Digital Personal Data Protection Act, 2023.
Personal data we collect
When you enquire about a vehicle service, book a service appointment, ask us to pick up and drop your vehicle, or bring it in to our service centre, we collect the following categories of personal data:
- Name
- Mobile / phone number
- Alternate mobile / phone number
- Second alternate mobile / phone number
- Email address
- Alternate email address
- Second alternate email address
- Postal address
- Vehicle registration number
- Vehicle chassis number
- Vehicle engine number
- Vehicle insurance number
- Postal PIN code
- Vehicle details (make, model, variant, year)
- Service details (service type, workshop/branch, appointment date and time)
- Pick-up and drop addresses, and your vehicle’s location while it is with our driver
- Photographs of your vehicle taken at our security gate when it arrives and when it leaves, and photographs taken in the workshop while it is being serviced
- Visitor identity at the gate — the name and mobile number(s) of the person who brings the vehicle in and of the person who takes it out, which may be you or someone acting for you, and the vehicle registration number recorded at the gate
- Interaction and service history (enquiries, follow-ups, appointments, completed services)
Why we use your data (Purposes)
- Reminding you when your vehicle is due for a service
- Booking your service appointment and confirming its date, time and workshop
- Arranging pick & drop of your vehicle, including the pick-up and drop addresses and the vehicle location while it is with our driver
- Recording your vehicle in and out of our premises at the security gate, identifying who brought it in and who took it out, and photographing its condition at entry, during the service and at exit, so that its condition is documented and it is released only to the right person
- Maintaining your service history and responding to your requests
Our legal bases for processing
- Your consent, where you have given it for a specific purpose (you can withdraw it at any time)
- Performance of a contract — to provide the vehicle service, booking, and pick & drop you requested
- Legitimate uses permitted under the DPDP Act, 2023 and legitimate interests under GDPR Art 6(1)(f)
- Compliance with a legal obligation, where applicable
How long we keep your data (Retention)
We retain your personal data only as long as necessary. Inactive enquiries are purged after 365 day(s) of inactivity, soft-deleted records are permanently removed 30 day(s) after deletion, bulk-import batches after 90 day(s), and audit logs on their own expiry date. Erasure removes the record and its attachments together, including the gate and workshop photographs of your vehicle.
Your rights as a data principal
Under the DPDP Act, 2023 and the GDPR you have the right to:
- Access — request a summary of the personal data we hold about you
- Correction — request that inaccurate or incomplete data be corrected or updated
- Erasure — request deletion of your personal data, subject to legal retention
- Withdraw consent — withdraw any consent you previously gave, at any time
- Grievance redressal — raise a complaint about how your data is handled
- Nominate — nominate another person to exercise these rights in the event of death or incapacity
How to exercise your rights
To access, correct, or erase your data, or to withdraw consent, contact our Grievance Officer: Cyepro Grievance Officer (support@cyepro.com). We will respond within the timelines required by applicable law. If you are not satisfied, you may escalate to the Data Protection Board of India or your local supervisory authority.
Where we obtained your data (indirectly collected data)
Some data is provided directly by you. In other cases your data may have been provided to us by the service centre, dealership, or workshop that services your vehicle, or uploaded in bulk from their records (for example, a vehicle whose next service is due). Where your data was not collected directly from you, this notice serves as the disclosure required under GDPR Art 14, and the categories and purposes above apply.
Children’s data
Our services are intended for adults (18 years and older). We do not knowingly collect or process the personal data of children. If you believe a child’s personal data has been provided to us, please contact our Grievance Officer and we will delete it.
How we protect your data (Security measures)
- Personal data is encrypted at rest using database-level encryption (pgcrypto / AES)
- Access is restricted by row-level security so staff only see data within their authority
- Your data is hosted in India (Supabase, ap-south-1 region)
- All access to your records is audit-logged
- We maintain a personal-data breach register and notification process
Grievance Officer / contact
Grievance Officer: Cyepro Grievance Officer. Contact: support@cyepro.com.