Privacy Policy

• “Client” / “Workshop” means any independent automotive workshop, bodyshop, dealership, or other business entity that subscribes to and uses the SerCarZ Platform under a service agreement with SerCarZ.
• “End Customer” means an individual whose vehicle, service, or insurance data is entered into, or generated on, the Platform by a Client in the ordinary course of that Client's business (e.g., a workshop's walk-in or repeat customer).
• “Client User” means employees, staff, or authorised representatives of a Client who access the Platform to perform their duties.
• “Personal Data” has the meaning given under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and includes any data about an individual who is identifiable by or in relation to such data.
• “Process” and “Processing” refer to any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.

SerCarZ provides a business-to-business CRM and workshop management SaaS platform. SerCarZ is not a party to the relationship between a Client (workshop) and that Client's End Customers, and does not itself solicit, sell to, or independently market to End Customers.

In relation to End Customer Personal Data entered onto the Platform by a Client (such as vehicle details, service history, contact numbers, and insurance information), SerCarZ acts solely as a service provider / data processor, processing such data only:

• on the documented instructions of the Client;
• to operate, maintain, and provide the core features of the Platform to the Client (including AI-based service recommendations, lead tracking, employee productivity tracking, ad-lead integration, and credit/outstanding balance tracking); and
• to the extent reasonably necessary to keep an accurate record of customer interactions conducted by our Clients, which is required to deliver the core functionality of the Services (e.g., lead journey tracking, service history, and communication logs) and to maintain the integrity, security, and auditability of the Platform.

Each Client is solely and independently responsible for:

• obtaining all consents, permissions, and authorisations required under applicable law (including the DPDP Act, the Information Technology Act, 2000, and any sector-specific regulation) from its End Customers before entering their Personal Data onto the Platform or using the Platform to communicate with them;
• providing its End Customers with appropriate notice regarding the collection and use of their Personal Data, including where such data will be processed using a third-party platform such as SerCarZ;
• ensuring that the Personal Data it uploads or generates on the Platform is accurate, lawfully obtained, and processed only for legitimate, disclosed purposes;
• honouring any requests made by its End Customers to access, correct, or delete their Personal Data, and promptly relaying such requests to SerCarZ where the Client requires our assistance to give effect to them; and
• using any Meta advertising or lead-generation integrations available on the Platform (including Meta Lead Ads, Meta Pixel, or Conversions API connections) in compliance with Meta's Business Tools Terms, Meta's Advertising Standards, and applicable law.

• to provide, operate, and maintain the Platform and its core features, including AI-supported service recommendations, lead journey tracking, employee productivity tracking, multi-platform ad-lead integration, and credit/outstanding-balance tracking;
• to authenticate Client Users and secure accounts;
• to generate aggregated, de-identified analytics and benchmarking insights for Clients and for SerCarZ's own product development;
• to send transactional notifications (SMS, WhatsApp, email) triggered by Platform workflows on behalf of Clients;
• to bill and manage subscriptions with Clients;
• to comply with applicable law, respond to lawful requests from authorities, and enforce our agreements; and
• to detect, investigate, and prevent fraud, abuse, or security incidents.

SerCarZ processes Personal Data in accordance with applicable Indian law, including the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and rules made thereunder (including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as applicable), and any successor or related legislation.

Each Client is responsible for ensuring that its own use of the Platform — including data collection, marketing communications, and use of digital advertising tools — independently complies with all applicable Digital Laws defined by the Government of India, including but not limited to the DPDP Act, the IT Act, the Consumer Protection (E-Commerce) Rules, 2020 (where applicable), the Telecom Commercial Communications Customer Preference Regulations (TRAI/DLT) for SMS and WhatsApp messaging, and any sector-specific regulation applicable to the Client's business. SerCarZ provides tools to support compliance (such as DLT-registered messaging templates) but does not assume the Client's regulatory obligations.

• Within the Client's organisation: Client Users of a given Client can access End Customer data entered by that Client, subject to the Client's own internal access controls.
• Service providers: cloud hosting, SMS/WhatsApp gateway providers, payment processors, and analytics providers who process data on our behalf under confidentiality and data-processing obligations.
• Meta Platforms, Inc.: where a Client connects Meta Lead Ads, Meta Pixel, or Conversions API to the Platform, relevant event or lead data is shared with Meta in accordance with Meta's Business Tools Terms, for the purpose of ad delivery, measurement, and lead routing.
• Legal and regulatory disclosures: where required by law, court order, or governmental authority, or to protect the rights, property, or safety of SerCarZ, our Clients, or the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to continued protection of Personal Data under this Policy or an equivalent standard.

Our website and web application use cookies, pixels, and similar technologies to operate core functionality, remember preferences, measure website and advertising performance, and support integrations such as the Meta Pixel and Conversions API. Categories of cookies used include strictly necessary, performance/analytics, and advertising/targeting cookies. Users can control non-essential cookies through their browser settings or, where provided, a cookie-consent banner on our website.

SerCarZ retains Client and End Customer data for as long as the Client's subscription is active, and thereafter for such period as is reasonably necessary to comply with legal, accounting, tax, or regulatory retention requirements, resolve disputes, and enforce agreements. Upon termination of a Client's subscription and a valid request, SerCarZ will delete or anonymise the Client's data within a commercially reasonable period, except where retention is required by law.

SerCarZ implements reasonable technical and organisational security measures — including access controls, encryption in transit, and role-based permissions — designed to protect Personal Data against unauthorised access, alteration, disclosure, or destruction. No method of transmission or storage is completely secure, and SerCarZ cannot guarantee absolute security.

Subject to applicable law, individuals may have the right to access, correct, update, or request erasure of their Personal Data, and to withdraw consent previously given. End Customers should direct such requests to the relevant Client (workshop) in the first instance, as the Client controls the underlying relationship and consent. Where a Client requires SerCarZ's assistance to fulfil a verified request, SerCarZ will provide reasonable support. Client Users may contact SerCarZ directly using the details in Section 15 below.

The Platform is intended for business use by workshops and their authorised personnel and is not directed at children. SerCarZ does not knowingly collect Personal Data from individuals under the age of 18 for its own purposes.

Personal Data collected through the Platform is primarily stored on servers located in India. Where data is processed by sub-processors located outside India (for example, certain cloud infrastructure or analytics providers, including Meta Platforms, Inc.), SerCarZ takes reasonable steps to ensure such transfers are subject to appropriate safeguards consistent with the DPDP Act and other applicable law.

SerCarZ may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or Meta's platform policies. The “Last Updated” date at the top of this Policy indicates when it was last revised. Material changes will be notified to Clients through the Platform or via email.

In accordance with applicable Indian law, SerCarZ has designated a Grievance Officer to address queries and complaints regarding this Privacy Policy and the processing of Personal Data.

For any privacy-related queries, including requests relating to Personal Data or this Policy, please contact us using the details above.