KARSTATION Privacy Statement
Purpose. This Privacy Statement explains how KARSTATION collects, uses, generates, stores, shares, transfers, protects and deletes personal data when individuals visit, register for, demonstrate, purchase, access or use the KARSTATION Platform. It also explains individual choices and rights.
Copyright and rights notice. Copyright © KARSTATION. All rights reserved. This Statement may be reproduced only as necessary to understand or exercise rights relating to the Platform.
1. Scope and relationship with the Terms
1.1 This Statement applies to KARSTATION websites, applications, application programming interfaces, demonstrations, trials, support, communications, payment-enabled features and related services (Platform).
1.2 It should be read with the KARSTATION Platform User Terms and Conditions, Cookie Notice, feature notices and any signed order or data processing agreement. It does not create ownership rights in Platform data, software, workflows or confidential materials.
1.3 A mandatory privacy law prevails where it gives an individual a right or protection that cannot be restricted by contract. This Statement does not waive any such right.
1.4 Third-party services connected to the Platform have their own privacy practices. This Statement does not govern processing independently determined by a workshop, dealer, insurer, finance provider, supplier, Payment Provider or other third party.
2. Our roles and who is responsible
2.1 KARSTATION may act in different legal roles depending on why and how personal data is processed.
| Role | Responsibility |
|---|---|
| Independent controller | KARSTATION determines purposes and essential means for Account administration, subscriptions, billing records, Platform security, fraud and abuse prevention, service analytics, communications, legal compliance, product planning and the establishment or defence of claims. |
| Processor or service provider | A Business Customer determines the purpose of Customer Data used in its vehicle, workshop, repair, parts, customer, employee, invoice or transaction workflows. KARSTATION processes that data to provide the configured Services and follow documented instructions. |
| Business Customer | The relevant Business Customer is responsible for its collection notices, lawful basis, data minimisation, accuracy, user permissions, retention instructions, disclosures and responses to individuals concerning Customer Data under its control. |
| Joint or separate roles | A transaction or integration may involve several independently responsible parties. Each party remains responsible for the processing purposes and systems it controls. |
2.2 Questions about workshop records, repair history, invoices or communications should ordinarily be directed first to the Business Customer that collected or created them. KARSTATION will support that Customer where law requires.
3. Personal data we collect
3.1 Depending on the feature, relationship and jurisdiction, we may collect or generate the following categories:
| Data category | Examples |
|---|---|
| Identity and contact | Name, username, business role, organisation, branch, telephone number, email address, language and preferred contact channel. |
| Account and authentication | Account identifier, credential and authentication records, permissions, administrator actions, acceptance records and account recovery information. Passwords should be protected using appropriate cryptographic controls. |
| Business and professional | Business type, service capabilities, licences or qualifications where supplied, employment or contractor role, service coverage, subscription and customer-support history. |
| Vehicle and workflow | Vehicle identifiers, registration or chassis-related references, mileage, condition, inspections, estimates, job cards, repairs, parts, service history, photographs, approvals, warranties and related notes. |
| Customer and transaction | Customer or vehicle-custodian details, invoices, payment status, transaction references, payer and payee information, tax information and limited Payment Provider responses. |
| Communications and content | Support requests, messages, feedback, recordings where notified, uploaded documents, photographs, videos and other content submitted through the Platform. |
| Device and technical | Internet Protocol address, device and browser attributes, operating system, identifiers, timestamps, application events, error logs, diagnostic data and integration activity. |
3.2 Free-text fields must not be used to enter sensitive personal data merely because the field permits it. Users should provide only information necessary for the relevant automotive or business purpose.
4. Sources of personal data
4.1 We obtain personal data directly from individuals; from a Business Customer or its Authorised Users; automatically from Platform use; from connected devices or integrations authorised by a Customer; from Payment Providers, suppliers and service partners; from security and fraud-prevention providers; and from lawful public or commercial sources.
4.2 A Customer that supplies information about another person must have lawful authority to do so and must give any required notice. KARSTATION may request evidence of authority or refuse data that appears excessive, unlawful or unsafe.
5. Purposes and lawful bases
5.1 We process personal data only where a lawful basis or permitted business purpose applies. The available basis depends on the individual, jurisdiction and processing context.
| Purpose | Use and basis |
|---|---|
| Provide and administer Services | Create and secure Accounts; authenticate Users; execute vehicle and business workflows; store and retrieve records; enable communications and integrations; provide support; and perform subscriptions or transactions. Basis: contract, steps requested before contract, legitimate interests, consent where required, or processor instructions. |
| Security and integrity | Detect, prevent, investigate and respond to unauthorised access, malware, fraud, abuse, policy violations and threats; maintain logs; test controls; and protect Users and the Platform. Basis: legitimate interests, legal obligation, substantial public interest or permitted security purpose. |
| Improve and develop | Measure performance; diagnose errors; allocate capacity; conduct research; test and develop features; evaluate usability; create analytics; and understand service demand. Basis: legitimate interests, consent where required, or use of aggregated or de-identified information. |
| Communicate | Send contractual, operational, billing, support, safety and security notices; answer requests; and provide marketing selected by or relevant to the recipient. Basis: contract, legitimate interests or consent, with opt-out where applicable. |
| Payments and records | Facilitate authorised payments; reconcile transactions; maintain invoices and audit records; manage disputes, chargebacks, fraud and tax records. Basis: contract, legal obligation and legitimate interests. |
| Legal and corporate | Comply with law and binding requests; conduct audits; protect rights; preserve evidence; establish or defend claims; manage restructurings, financing or transfers of business subject to safeguards. Basis: legal obligation and legitimate interests. |
5.2 Where legitimate interests are used, KARSTATION considers necessity, reasonable expectations and the effect on individuals. Consent may be withdrawn for future processing but withdrawal does not invalidate earlier lawful processing or processing supported by another lawful basis.
5.3 If required data is not provided, KARSTATION may be unable to register an Account, verify authority, provide a requested feature, complete a transaction, protect the Platform or meet a legal obligation.
6. Customer Data processed on behalf of Business Customers
6.1 When KARSTATION acts as processor, it processes Customer Data only under the Agreement, authorised configuration, support requests and other documented instructions, unless law requires otherwise.
6.2 KARSTATION may refuse or suspend an instruction that reasonably appears unlawful, outside the Services, technically unsafe, likely to infringe another person's rights or inconsistent with the Customer's authority.
6.3 Subprocessors may be used under written data-protection and security obligations. Where required, a Business Customer will receive notice and an opportunity to object on substantiated data-protection grounds.
6.4 The processing description, data subjects, categories and deletion arrangements in Schedule 1 of the Terms apply to processor data and are incorporated into this Statement for explanation.
7. Usage data analytics and de-identified information
7.1 KARSTATION may use Usage Data to operate, secure, measure, troubleshoot, support, develop and improve the Platform; detect fraud and misuse; allocate capacity; and produce service and commercial analytics.
7.2 KARSTATION may create aggregated, statistical, benchmarked or de-identified information and use it for lawful business purposes, including research, product development, industry insight, performance comparison and commercial analytics, provided it does not reasonably identify a Customer or individual.
7.3 We will apply reasonable measures to prevent re-identification and will not attempt to re-identify protected de-identified information except where law permits testing the effectiveness of de-identification or investigating unlawful activity.
7.4 Nothing in this section permits KARSTATION to use identifiable processor data for an unrelated purpose prohibited by law or the Agreement.
8. When personal data is disclosed
8.1 We may disclose personal data only as reasonably necessary and lawful to:
- hosting, cloud, communications, customer-support, analytics, security, identity, professional-advisory and other service providers acting under appropriate restrictions;
- Payment Providers, banks, card networks and transaction participants for an authorised payment, reconciliation, fraud check or dispute;
- integrations, suppliers, insurers, finance providers, workshops or other recipients selected or authorised by the Customer;
- affiliates and personnel who need access for the purposes in this Statement and are subject to confidentiality duties;
- regulators, courts, law-enforcement bodies or other competent authorities where required or lawfully permitted;
- a purchaser, investor, financier or successor in a proposed or completed corporate transaction, subject to confidentiality and lawful-use safeguards; or
- another person where the individual directs, consents or law otherwise permits disclosure.
8.2 KARSTATION does not sell Customer personal data or share it for cross-context behavioural advertising as those terms are defined by applicable California law. If our practices change in a jurisdiction requiring an opt-out, we will provide the required notice and choice before the change applies.
8.3 We may disclose aggregated or de-identified information where it does not reasonably identify an individual or Customer.
9. International processing and transfers
9.1 The Platform and its providers may process personal data in countries other than the country where it was collected. Laws and government-access rules may differ between those countries.
9.2 Where required, KARSTATION will use an applicable transfer mechanism, such as an adequacy decision, approved standard contractual clauses, a recognised certification or another permitted safeguard. We may conduct transfer-risk assessments and apply supplementary technical, contractual or organisational measures.
9.3 A Business Customer is responsible for the lawfulness of transfers it initiates through Users, exports, recipients and integrations. The parties will reasonably cooperate where a transfer assessment or additional term is required.
10. Retention, deletion and preservation
10.1 We retain personal data for no longer than reasonably necessary for the purposes described in this Statement, including providing the Services, maintaining records, securing the Platform, complying with law and establishing or defending claims.
| Record | Retention approach |
|---|---|
| Active Account and Customer Data | For the Account or applicable service term and any export period, subject to Customer instructions, plan limits and legal retention. |
| Account billing and transaction records | For applicable accounting, tax, anti-fraud, audit, limitation and regulatory periods. |
| Security and audit logs | For a period proportionate to security, investigation and evidentiary needs, with longer preservation where an incident, legal hold or claim requires. |
| Support and communications | For operational follow-up, quality, dispute and legal-record purposes, considering the nature of the communication. |
| Backups | Until overwritten or securely retired through protected backup cycles. Backup data is not ordinarily available for active use. |
| De-identified information | May be retained while it remains protected against reasonable re-identification and serves a lawful purpose. |
10.2 Following termination, KARSTATION may provide an export period and then delete or de-identify Customer Data, subject to law, security, backups, disputes, legal holds and the Terms. Customers must export records they are required to retain independently.
10.3 We may preserve information necessary to investigate misuse, comply with a binding request, protect Users or establish, exercise or defend legal claims. Preservation does not authorise unrelated use.
11. Security and shared responsibility
11.1 KARSTATION uses technical and organisational measures proportionate to the nature, context and risk of processing. Depending on the Services, these may include access control, least privilege, authentication, encryption where appropriate, logging, secure development, vulnerability management, backups, recovery testing, personnel confidentiality and incident response.
11.2 Security is shared. KARSTATION is responsible for the Platform environment under its control. Customers are responsible for their devices, local networks, browsers, email and identity systems, credentials, permissions, exports, integrations, personnel, independent backups and lawful use.
11.3 No internet-connected service can be guaranteed immune from attack, vulnerability, interruption or data loss. Security features reduce risk but do not guarantee that every incident will be prevented, detected or restored without loss.
11.4 Users must promptly report suspected credential compromise, unauthorised access, security weakness or misuse through the support or privacy facility in the Platform and must not publicly disclose a vulnerability before KARSTATION has had a reasonable opportunity to investigate and mitigate it, except for a protected disclosure required by law.
12. Security incidents
12.1 KARSTATION will assess suspected incidents and take reasonable containment, investigation, remediation and recovery measures appropriate to the circumstances.
12.2 When acting as processor, KARSTATION will notify the affected Business Customer without undue delay after becoming aware of a confirmed Security Incident involving that Customer's processor data. Information may be supplied in phases as it becomes reasonably available.
12.3 When KARSTATION is responsible for direct notification, it will notify affected individuals or authorities as required by applicable law. An incident notice, investigation, remedial action or cooperation is not an admission of fault or liability.
12.4 Customers must cooperate, preserve relevant evidence, mitigate harm and avoid statements that could compromise an investigation or mislead affected persons.
13. Individual rights and choices
13.1 Depending on applicable law and KARSTATION's role, an individual may have rights to receive information; request access, correction, completion, deletion, restriction or portability; object to processing; withdraw consent; opt out of certain marketing, sale, sharing, profiling or automated decision-making; and complain to a regulator.
13.2 Rights are not absolute. We may need to verify identity and authority and may refuse, limit or charge for a request where law permits, including where it is manifestly unfounded or excessive, conflicts with another person's rights, concerns protected security information, or retention is required for a transaction, law, fraud prevention or legal claim.
13.3 Requests concerning data controlled by a Business Customer should ordinarily be made to that Customer. If KARSTATION receives such a request, we may refer it to the Customer and provide reasonable assistance.
13.4 Requests concerning KARSTATION's independent-controller processing may be submitted through the privacy-request facility in the Platform or Account. We will respond within the period required by applicable law and will not unlawfully discriminate because a person exercised a privacy right.
13.5 An authorised agent may submit a request where local law permits. We may require evidence of the agent's authority and direct verification with the individual.
14. Regional privacy provisions
| Region | Additional provisions |
|---|---|
| Sri Lanka | Rights and duties apply under the Personal Data Protection Act No. 9 of 2022 and operative amendments, regulations, directives and commencement orders. Required lawful processing, transparency, rights, security, impact-assessment, breach and cross-border requirements apply as brought into force. |
| European Economic Area | Where the EU GDPR applies, individuals may exercise GDPR rights and complain to the competent supervisory authority. Controller and processor roles, lawful bases, Article 28 terms, security, breach, impact assessment and Chapter V transfer safeguards apply according to scope. |
| United Kingdom | Where UK law applies, UK GDPR, the Data Protection Act 2018 and electronic-marketing rules govern relevant processing. Restricted transfers use an available adequacy route, approved contractual mechanism or other lawful safeguard. |
| California | Where the CCPA applies, California residents may request to know, access, correct or delete covered personal information; opt out of sale or sharing; limit certain uses of sensitive information; and receive equal treatment. KARSTATION does not sell Customer personal data or share it for cross-context behavioural advertising. |
14.2 Where local law requires a specific privacy link, opt-out preference signal, appeal method, toll-free number, representative, data protection officer or regulator contact, KARSTATION will provide it through the relevant website, application, Account or regional notice.
15. Cookies, tracking and communications
15.1 KARSTATION may use cookies, software development kits, local storage and similar technologies that are necessary for authentication, security, preferences and Platform operation. Analytics, personalisation or advertising technologies will be used subject to required notice and choice.
15.2 A separate Cookie Notice or consent interface may identify the technologies, providers, purposes and durations applicable to a particular website or application. Browser or device controls may affect Platform functionality.
15.3 Essential contractual, billing, operational, safety and security messages cannot ordinarily be opted out of while an Account remains active. Marketing messages may be declined through the message, Account settings or other offered mechanism.
16. Artificial intelligence and automated processing
16.1 Some features may use artificial-intelligence-assisted processing to organise information, suggest classifications, produce draft estimates or insights, detect anomalies, support security or improve workflows. Feature notices will describe material uses where required.
16.2 Customer Data will not be used to train a generally available third-party model unless the Customer has been clearly informed and an applicable lawful basis and required choice have been provided.
16.3 Outputs are informational aids and may be incomplete or inaccurate. A suitably qualified person must provide meaningful review where an output may materially affect an individual, vehicle, transaction or legal right.
16.4 Where applicable law grants rights concerning significant automated decisions, KARSTATION or the responsible Business Customer will provide required notice, information, review or opt-out mechanisms.
17. Sensitive data and children
17.1 The Platform is not intended for children and individuals must ordinarily be at least eighteen years old to create an Account. KARSTATION does not knowingly seek children's personal data for independent commercial purposes.
17.2 Customers must not upload health, biometric, genetic, criminal-offence, precise-location, government-identifier, payment-authentication or other legally sensitive data unless an expressly supported feature, written agreement and lawful authority permit it.
17.3 If we learn that unsupported children's or sensitive data was submitted, we may restrict, return, delete or otherwise protect it, subject to law and evidentiary needs.
18. Vehicle records and other individuals
18.1 A Vehicle Record can contain personal data about owners, custodians, drivers, technicians, customers, payers or other persons. A vehicle identifier is treated as personal data where it identifies or can reasonably be linked to an individual under applicable law.
18.2 Business Customers must ensure appropriate authority before creating, linking, transferring or disclosing Vehicle Records, especially where ownership or service providers change. Access must be limited to personnel with a genuine need.
18.3 KARSTATION does not decide the accuracy of a technician's diagnosis, a workshop's record, an invoice or a Customer's disclosure. Individuals should request substantive correction from the Business Customer responsible for the record; audit history may be retained where required for safety, warranty, billing, insurance or evidence.
19. Third party sites, services and integrations
19.1 Links and integrations may connect to services operated independently by third parties. Their terms and privacy notices apply to their processing. KARSTATION is not responsible for a third party's independent decisions, security or data use.
19.2 Enabling an integration authorises the exchange of information reasonably necessary to operate it. Customers must review permissions and disable access that is no longer required.
20. Changes to this Privacy Statement
20.1 General reference and Account version. This is a general reference statement. The most current version applicable to you, its effective date and any country-specific or feature-specific notice are available in your personal Account. The Account version prevails over this general document, subject to a signed agreement and mandatory law.
20.2 Right to amend. KARSTATION may change, add, remove, replace or update any detail in this Statement at any time to reflect legal, regulatory, security, technical, operational or commercial developments, changes to the Platform or data practices, or clarification of existing processing, subject to mandatory law.
20.3 Login notification. When changes take place, KARSTATION will present a notice at or following the User's next login or through another prominent Account notice. The notice may summarise the changes and link to the revised Statement. The Platform may record display and acknowledgement of the notice.
20.4 Material changes. Where law requires advance notice, consent or a new choice for a materially different purpose, KARSTATION will provide it before that processing begins. Earlier versions and acceptance records may be retained where necessary for compliance and legal evidence.
21. Privacy requests, questions and complaints
21.1 Privacy requests and questions may be submitted through the privacy-request or contact facility displayed in the Platform, Account or applicable KARSTATION website. This avoids publishing personal contact information in this general document and directs the request to the appropriate responsible team.
21.2 We may request information reasonably necessary to identify the relevant data, verify identity and authority, prevent fraud and protect other persons. Do not send passwords, full payment-card credentials or unnecessary identity documents.
21.3 If a response does not resolve a concern, an individual may request internal review where available and may complain to the competent privacy or data-protection authority. Nothing in this Statement restricts a mandatory right to contact a regulator or seek a lawful remedy.
22. General provisions
22.1 Definitions used in the Terms have the same meanings here unless the context requires otherwise. References to law include amendments, replacements, regulations and binding guidance applicable to the processing.
22.2 If a provision is invalid or unenforceable, it will be limited only to the minimum extent necessary and the remaining provisions continue. Headings assist navigation and do not limit interpretation.
22.3 Copyright © KARSTATION. All rights reserved. KARSTATION reserves all rights in this Statement, the Platform and related materials except for non-waivable rights and the limited rights expressly granted to Users.
Schedule A — Processing summary
This Schedule provides a concise operational summary. Actual processing depends on enabled features, Customer instructions, local law and the current Account notice.
| Activity | Data, purposes, bases and recipients |
|---|---|
| Account administration | Identity, contact, credentials, role, acceptance and device data | Account creation, authentication, authority and support | Contract, legitimate interests and legal obligation | Identity, hosting and support providers. |
| Vehicle and workshop workflows | Vehicle, customer, technician, job, parts, inspection, estimate and invoice records | Provide configured Services | Processor instructions; contract; Customer's lawful basis | Customer-authorized recipients and service providers. |
| Payments | Payer, payee, invoice, status and limited transaction references | Facilitate and reconcile payments; prevent fraud | Contract, legal obligation and legitimate interests | Payment Providers, banks and transaction participants. |
| Security | Credentials, device, network, log, audit, threat and incident data | Protect Accounts, Platform and Users; investigate misuse | Legitimate interests, legal obligation and permitted security purposes | Security, infrastructure, advisers and authorities where lawful. |
| Analytics and development | Usage, diagnostic, performance, feedback and de-identified data | Improve reliability, features, capacity and insight | Legitimate interests, consent where required, and de-identified use | Analytics and development providers under controls. |
| Communications | Contact, preferences, support and message records | Service notices, support and selected marketing | Contract, legitimate interests and consent | Communications providers and authorised recipients. |
| Legal compliance | Relevant account, transaction, communication, security and evidence records | Meet law, binding requests, audits and claims | Legal obligation and legitimate interests | Regulators, courts, professional advisers and transaction successors. |
Version and acknowledgement record
The Platform may record the Statement version, effective date, Account identifier, User, date and time, Internet Protocol address, notice display and acknowledgement as evidence of transparency and Account administration. You may download or print this Statement for your records.