Privacy Policy
In short: we collect what we need to do IT work for you (who you are, how to reach you, and what you need), we keep it secure, and we never sell it.
You own your data, systems and domains. We are a service provider, not a data broker.
1. Who we are
AutoWerke | IT ("we", "us") is an IT support and consulting business based in Harare, Zimbabwe. For the personal information described here, we are the data controller under Zimbabwe's Cyber and Data Protection Act [Chapter 12:07], and the responsible party under South Africa's Protection of Personal Information Act 4 of 2013 (POPIA).
Data Protection Officer / Information Officer: contact our Data Protection Officer at services@autowerkeit.com.
2. What we collect
- Contact details: name, company, position, email address and phone number.
- Request details: what you tell us about your support issue, project, domain or consultancy question, and any screenshots you attach.
- Work records: scopes, quotes, time logs, progress updates, sign-offs, invoices and receipts.
- Signing records: when you sign online, your typed or drawn signature, the time, your IP address and browser, and a fingerprint of the document you signed. This is the evidence that the signature is genuinely yours.
- Payment documents you choose to upload, such as purchase orders or proof of payment. We do not collect card or bank account numbers.
- System access details you give us to do the work, such as admin logins or domain registrar accounts. These are encrypted and used only for the work you've asked for (see section 6).
- Website data: essential cookies that keep secure sessions working, and, only if you agree, Google Analytics (see our Cookie Policy).
3. Why we use it, and on what basis
| Purpose | Basis |
|---|---|
| Responding to your request, quoting, doing and billing the work | Performing a contract with you, or steps you asked for before one |
| Sending you updates, sign-off documents, invoices and reminders | Performing the contract |
| Verifying your identity with one-time codes, preventing fraud, keeping the site secure | Our legitimate interests, and legal obligations |
| Keeping financial and tax records | Legal obligation |
| Understanding how visitors use the website (Google Analytics) | Your consent, which you can withdraw at any time |
We do not send marketing emails unless you've opted in, and we never sell or rent personal information.
4. Who we share it with
Only service providers that help us run the business, whose terms require them to protect it:
- Supabase: our secure database and private file storage.
- Render: hosting for this website and portal.
- Resend: sending our emails to you.
- Anthropic (Claude): an AI service that reads your request text and any screenshots to help us draft a scope or a first response. A person at AutoWerke | IT always reviews it before anything reaches you. Under Anthropic's commercial terms, this data is not used to train their models.
- Google Analytics: only if you accept analytics cookies.
- Authorities, where the law requires it.
5. Transfers outside Zimbabwe and South Africa
Some of these providers store or process data outside Zimbabwe and South Africa, for example in the United States or the European Union. Where that happens, we rely on providers that apply strong security (encryption in transit and at rest, access controls) and contractual commitments to protect personal information, as both Zimbabwe's Act and POPIA require for cross-border transfers.
6. How we protect it
- Encrypted connections (HTTPS) throughout, and private file storage: documents open only through short-lived, checked links.
- Passwords and access details you give us are encrypted (AES-256) and only revealed to authorised staff when needed for your work.
- Our admin systems require a password plus an emailed one-time code, and sessions time out after inactivity.
- Access is limited to authorised AutoWerke | IT staff who need it for your work.
7. How long we keep it
| Information | How long |
|---|---|
| Requests, work records, sign-offs, invoices and receipts | Up to 6 years after the work ends, for legal, tax and dispute purposes |
| System and registrar access details | Deleted within 30 days of the work or management ending, or sooner on request |
| Requests that don't go ahead | Up to 12 months |
| Security logs (sign-ins, codes) | Up to 12 months |
| Google Analytics data (if you agreed) | 14 months |
8. Your rights
You can ask us to: tell you what we hold about you and give you a copy; correct it; delete it, where we don't need to keep it by law; object to or restrict how we use it; and withdraw consent (for example to analytics) at any time. Email services@autowerkeit.com. We'll reply within 30 days.
You can also complain to a regulator: in Zimbabwe, the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), acting as the Data Protection Authority; in South Africa, the Information Regulator.
9. If something goes wrong
If a security breach affects your personal information, we will notify POTRAZ within 24 hours of becoming aware of it, notify the Information Regulator where South African data is involved, and tell you promptly what happened and what you should do.
10. Children
Our services are for businesses and adults. We don't knowingly collect information from anyone under 18.
11. Changes
If we change this policy, we'll update the date above and, for significant changes, tell current clients by email.