Privacy Policy

Auto-Go (Pty) Ltd ("Auto-Go", "we", "us", "our") is committed to protecting the personal information of all individuals and businesses who interact with our platform. This Privacy Policy explains how we collect, use, share, and protect personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA"), the Electronic Communications and Transactions Act 25 of 2002 ("ECTA"), and any other applicable South African data protection legislation.

This Policy applies to:

• Workshop owners, managers, and employees who register or use the Auto-Go platform;
• Supplier representatives, sales contacts, and employees who are onboarded to supply parts via the platform;
• Visitors to auto-go.co.za;
• Any other individual whose personal information is processed by Auto-Go in connection with its business operations.

By using the Auto-Go platform or registering an account, you confirm that you have read and understood this Privacy Policy and consent to the processing of your personal information as described herein.

Auto-Go operates as a B2B automotive parts procurement platform. We act as principal in all transactions, purchasing parts from suppliers at trade price and reselling them to independent workshops at a margin. We do not operate as a marketplace or agent.

To exercise your data subject rights or lodge a privacy complaint, contact us at support@auto-go.co.za.

3.1 Workshop Business Data

When a workshop registers on the Auto-Go platform or applies for a credit account, we collect:

• Business name, trading name, and company registration number;
• VAT registration number (if applicable);
• Physical and postal address of the workshop premises;
• Contact telephone numbers and email addresses;
• Banking details (for credit account refunds or reconciliation);
• Financial statements and trade references (for credit assessment);
• Credit bureau information obtained in the course of credit vetting.

3.2 Supplier Business Data

When a supplier is onboarded onto the Auto-Go platform, we collect:

• Business name, trading name, and company registration number;
• VAT registration number;
• Physical address and GPS coordinates of the supply premises;
• Contact person name, telephone number, and email address;
• Banking details for settlement payments;
• Catalogue data including part numbers, pricing, and stock levels;
• Trade references and accreditation documentation.

3.3 Order Data

In connection with every order placed on the platform, we collect and process:

• The identity of the ordering workshop and the fulfilling supplier;
• Vehicle details provided by the workshop (year, make, model, engine variant);
• Part numbers, descriptions, and quantities ordered;
• Delivery address and delivery instructions;
• Order status, timestamps, and fulfilment events;
• Payment information (full card details are not stored; payment processing is handled by our payment processor).

3.4 Customer Data Input by Workshops

Workshops may input information about their own vehicle customers when placing orders. Auto-Go processes this information solely to facilitate the order. Workshops are responsible for:

• obtaining the consent of their own customers before submitting their personal information to Auto-Go;
• ensuring that their customers are informed about this Privacy Policy or an equivalent disclosure;
• complying with POPIA in their own capacity as a responsible party in relation to their customers.

Auto-Go treats any end-customer data provided by workshops as confidential and will not use it for any purpose beyond order fulfilment.

3.5 Platform Usage Data

We automatically collect certain technical data when you use the platform, including IP address, device type, browser type, pages visited, search queries, session duration, and error logs. This data is collected via cookies and similar tracking technologies. Please refer to our Cookie Notice (published on the platform) for further detail.

3.6 Communications Data

We retain records of communications between Auto-Go and its business partners, including emails, platform messages, and voice agent call records (where applicable), for purposes of order management, dispute resolution, and service improvement.

Auto-Go processes personal information on the following lawful grounds under POPIA:

Where processing is based on consent, you have the right to withdraw your consent at any time by contacting us at support@auto-go.co.za. Withdrawal does not affect the lawfulness of processing before the withdrawal.

5.1 Platform Operations

• Creating and managing user accounts for workshops and suppliers;
• Processing, routing, and fulfilling orders;
• Communicating order confirmations, delivery updates, and invoices;
• Enabling geolocation-based supplier ranking and logistics optimisation.

5.2 Financial and Credit Management

• Invoicing and payment processing;
• Credit assessment for 30-day credit account applications;
• Settlement payments to suppliers;
• Debt collection and credit control where applicable.

5.3 Compliance and Legal

• Meeting VAT and SARS reporting obligations;
• Maintaining business records as required by law;
• Responding to regulatory enquiries or court orders;
• Fraud detection, prevention, and investigation.

5.4 Service Improvement and Communication

• Analysing platform usage to improve features and performance;
• Sending operational communications (order updates, account notices);
• Sending promotional communications to registered users (with consent and subject to opt-out).

5.5 Warranty and Dispute Resolution

• Processing warranty claims by channelling them to the originating supplier;
• Maintaining records of claims, outcomes, and communications;
• Resolving disputes between parties.

Auto-Go does not sell personal information. We share personal information only as follows:

All third-party operators who receive personal information are required by contract to process such information only for the specified purpose, to maintain appropriate security measures, and to comply with POPIA.

Auto-Go’s platform infrastructure may be hosted on cloud services with data centres located outside South Africa (for example, servers operated by Vercel or Supabase). Where personal information is transferred outside South Africa, Auto-Go will ensure that:

• the recipient country provides an adequate level of protection equivalent to POPIA; or
• appropriate safeguards are in place, such as standard contractual clauses; or
• the data subject has consented to the transfer after being informed of the relevant circumstances.

Details of Auto-Go’s key infrastructure providers and their data processing locations are available on request from support@auto-go.co.za.

In terms of POPIA, data subjects have the following rights:

To exercise any of the above rights, submit a written request to our Information Officer at support@auto-go.co.za. We will respond within 30 days of receipt of a valid request. We may request proof of identity before processing your request.

Auto-Go implements appropriate technical and organisational security measures to protect personal information against loss, unauthorised access, unlawful processing, and disclosure, including:

• Encryption of data in transit (TLS/HTTPS) and at rest where applicable;
• Role-based access controls limiting employee access to personal information on a need-to-know basis;
• Row Level Security (RLS) policies enforcing data isolation between workshops and suppliers on the platform;
• Regular security assessments;
• Secure API key management and environment variable controls;
• Incident response procedures for data breaches.

In the event of a personal information security compromise, Auto-Go will notify the Information Regulator and affected data subjects as soon as reasonably practicable, in accordance with section 22 of POPIA.

Auto-Go retains personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

Upon expiry of the applicable retention period, personal information will be destroyed or de-identified securely.

Auto-Go may send promotional and marketing communications to workshops and suppliers registered on the platform. In terms of section 69 of POPIA:

• We will only send direct marketing communications where we have consent, or where we are communicating with existing customers about our own similar products and services;
• Every marketing communication will include a clear and easy opt-out mechanism;
• We will honour all opt-out requests promptly and without penalty.

To opt out of marketing communications at any time, email support@auto-go.co.za with the subject line "UNSUBSCRIBE", or use the unsubscribe link in any marketing email.

Auto-Go uses automated processes for the following purposes:

• Geolocation-based supplier ranking: suppliers are algorithmically ranked per order based on distance to the workshop and total cost. Suppliers may contest ranking decisions by contacting Auto-Go.
• AI-powered voice agents (where implemented): Auto-Go may use AI voice agent technology to contact suppliers to confirm stock availability. Call recordings and transcripts are retained for the period specified in clause 10.

Auto-Go does not use fully automated profiling to make decisions with significant legal or financial consequences without human review.

The Auto-Go platform uses cookies and similar tracking technologies for authentication and session management, platform performance and analytics (with consent), and security and fraud prevention. You may manage cookie preferences via your browser settings or through the cookie consent mechanism on the platform. Auto-Go’s full Cookie Notice is published on the platform and forms part of this Privacy Policy.

Where workshops use the Auto-Go platform to process personal information relating to their own customers or employees, the workshop operates as a responsible party under POPIA. Auto-Go processes such information as an operator solely for the purpose of fulfilling the relevant order.

Workshops confirm by using the platform that they have obtained all necessary consents from their own customers for the submission of their personal information to Auto-Go, and that they will indemnify Auto-Go against any claim arising from the workshop’s failure to comply with POPIA in relation to their customers’ personal information.

The Auto-Go platform is a B2B service and is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that personal information has been collected from a minor, we will take steps to delete it promptly.

Auto-Go may update this Privacy Policy from time to time. Material changes will be communicated to registered platform users via email or platform notification at least 14 days before the change takes effect. The updated Policy will be published on auto-go.co.za with the revised effective date. Continued use of the platform after the effective date constitutes acceptance of the amended Policy.