POPIA Privacy & Data Protection Policy

1. Commitment to South African Privacy Law

ChAile Workshop (Pty) Ltd ("ChAile", "we", "us") is committed to safeguarding personal information in strict compliance with the South African Protection of Personal Information Act 4 of 2013 (POPIA) and the Promotion of Access to Information Act (PAIA).

2. Information We Process on Behalf of Workshop Tenants

When workshop principals, technicians, and customer service desks utilize ChAile Workshop OS, we process:

• Workshop Entity Data: CIPC company registration number, SARS VAT registration, physical workshop address, and banking details for payment integrations.
• Customer Contact Details: Names, mobile telephone numbers, email addresses, and billing addresses necessary for WhatsApp quote approvals and SARS tax invoices.
• Vehicle & Telemetry Data: Vehicle Identification Numbers (VIN), license plate numbers, odometer readings, and timestamped 360° inspection damage photographs.
• Employee & Labor Records: Technician clock-in/out timestamps and labor durations for BCEA 45-hour compliance.

3. Multi-Tenant Data Isolation & Security Standards

All workshop databases are partitioned using strict multi-tenant Row-Level Security (RLS) keys and encrypted at rest using AES-256 standards. Workshop data is never shared, aggregated, or disclosed between competing automotive workshops.

4. Payment Gateway Security

ChAile does not store raw credit/debit card numbers. All payment transactions initiated via in-store Speedpoint POS or Ozow instant EFT are processed directly through PCI-DSS Level 1 certified gateway partners (PayFast, Yoco, Ozow, Peach Payments).

5. POPIA Right to Erasure & SARS 5-Year Ledger Retention

In accordance with POPIA Section 24, data subjects have the right to request deletion of their personal information. To balance this with South African Tax Administration Act mandates (which require automotive workshops to retain financial transaction records and VAT invoices for 5 years), ChAile executes Cryptographic Shredding:

• Customer personal identifiers (full name, personal telephone, residential address, ID number) are permanently purged and overwritten with anonymized tokens.
• Financial line items, parts cost, labor hours, and VAT calculations are retained in an immutable, de-identified ledger for SARS auditing compliance.

6. Edge Bot Mitigation & Threat Defense

All web requests are evaluated at the network edge via Cloudflare Bot Management and Turnstile verification. Automated scraping bots and unauthorized AI indexers are challenged or blocked before accessing tenant databases.

7. Information Officer & Inquiries

For POPIA inquiries, data subject access requests, or deletion requests, please contact our registered Information Officer at compliance@chaileworkshop.co.za or write to our registered office in Pretoria, Gauteng.