Privacy Policy

1. Overview & Applicability

This Privacy Policy ("Policy") describes how NAF CAR SPA (trading as NAF AUTOSPA, hereinafter referred to as "we", "us", "our", or "the Company") collects, uses, stores, processes, and protects the personal data and sensitive personal data or information (SPDI) of individuals ("Data Principals", "you", "your") who:

• Visit our website at nafautospa.in;
• Avail our car wash, detailing, or any other automobile care services at our premises;
• Contact us via phone, WhatsApp, email, or social media;
• Engage with our online content or promotions.

By using our website or services, you consent to the collection and use of your personal data as described in this Policy. If you do not agree, please discontinue use of our website and services.

2. Who We Are

Business Name: NAF CAR SPA (trading as NAF AUTOSPA)
Nature of Business: Car Wash, Automobile Detailing, Paint Protection & Related Automotive Care Services
Address: Chithranjali Studio Complex, Edapally–Panvel Highway, Perumba, Payyanur, Kerala — 670307, India
Phone / WhatsApp: +91 81390 40653
Email: nafautospaa@gmail.com
Instagram: @nafautospa

NAF CAR SPA is a registered business entity operating under applicable laws of the State of Kerala and the Republic of India.

3. Personal Data We Collect

We collect only the minimum personal data necessary to provide our services. The categories of personal data we may collect include:

3.1 Data You Provide Directly

• Name — for booking identification and communication.
• Phone Number — for appointment booking, WhatsApp communication, and service updates.
• Vehicle Information — make, model, colour, and registration/number plate, for service records and vehicle identification.
• Photographs of the Vehicle — taken before and after service for quality control, proof of condition, and promotional use (with your consent, where applicable).
• Email Address — if voluntarily provided for correspondence.

3.2 Data Collected Automatically (Website)

• IP Address — collected automatically by web servers and third-party analytics tools.
• Browser type and device information — for website optimisation.
• Pages visited and time spent — for improving user experience.
• Referring website or link — to understand how users find us.

We do not collect financial data such as credit/debit card numbers, bank account details, Aadhaar numbers, PAN numbers, or any other Sensitive Personal Data or Information (SPDI) as defined under Rule 3 of the IT (SPDI) Rules, 2011, unless expressly required and with explicit prior consent.

4. Purpose of Data Collection

Your personal data is collected and processed for the following lawful purposes:

• To book, confirm, and manage your service appointments;
• To provide car wash, detailing, and related automotive care services;
• To contact you regarding your booking, service status, or any queries;
• To maintain service records and vehicle condition documentation;
• To send service reminders, offers, or promotional messages (you may opt out at any time by informing us via WhatsApp or email);
• To improve our services, website, and customer experience;
• To comply with applicable laws and regulations;
• To resolve disputes and enforce our terms;
• To share before/after photographs on social media for promotional purposes — only with your explicit verbal or written consent.

5. Legal Basis for Processing

Under the Digital Personal Data Protection Act, 2023 (DPDPA 2023), we process your personal data on the following legal bases:

• Consent (Section 7, DPDPA 2023): You have given us your free, specific, informed, and unambiguous consent for processing your personal data when booking a service or contacting us.
• Legitimate Uses (Section 8, DPDPA 2023): Processing is necessary for the performance of a contract for services you have requested (car wash, detailing, etc.).
• Legal Obligation: Where required by Indian law, court orders, or regulatory authorities.
• Vital Interests: In rare emergency situations requiring disclosure to protect life or safety.

You may withdraw your consent at any time by contacting us. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.

6. Disclosure & Sharing of Data

We do not sell, rent, or trade your personal data to third parties for their marketing purposes. We may share your data only in the following limited circumstances:

• Service Providers: With trusted third-party service providers (e.g., cloud hosting, analytics) who assist in our operations and are bound by contractual data protection obligations.
• Legal Requirements: When required by applicable Indian law, court order, government agency, or competent authority, including law enforcement agencies.
• Business Transfer: In the event of a merger, acquisition, or sale of assets, your data may be transferred with prior notice to you.
• Social Media: Vehicle photographs may be shared on our Instagram (@nafautospa) or other platforms only with your express prior consent.

We do not transfer your personal data outside the territory of India without your explicit consent, except as permitted under the DPDPA 2023 and applicable cross-border data transfer rules.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law, whichever is longer.

• Service Records & Vehicle Data: Retained for a minimum of 3 years from the date of last service for warranty, dispute, and quality-assurance purposes.
• Communication Records (WhatsApp/Email): Retained for up to 2 years.
• Photographs of Vehicles: Retained for up to 1 year unless shared on social media with consent (in which case governed by the platform's retention policy).
• Website Analytics Data: Retained in anonymised/aggregated form. Identifiable data is not stored beyond 12 months.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with our data disposal practices.

8. Security of Personal Data

We implement reasonable security practices and procedures as mandated by the IT (Reasonable Security Practices and Procedures and SPDI) Rules, 2011 to protect your personal data from unauthorised access, disclosure, alteration, or destruction. These measures include:

• Access controls limiting data access to authorised personnel only;
• Use of encrypted communication channels (HTTPS) on our website;
• Secure storage of digital records;
• Regular review of data access practices.

While we take commercially reasonable steps to secure your data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security. In the event of a personal data breach, we will take steps as required under applicable law, including notifying affected individuals where required.

9. Your Rights as a Data Principal

Under the Digital Personal Data Protection Act, 2023 (DPDPA 2023), you have the following rights:

• Right to Access (Section 11): You have the right to obtain confirmation from us about whether your personal data is being processed and to access such data.
• Right to Correction & Erasure (Section 12): You may request correction of inaccurate or outdated personal data, or erasure of personal data where it is no longer necessary for the purpose for which it was collected.
• Right to Grievance Redressal (Section 13): You have the right to have grievances addressed by our Grievance Officer within the timelines specified under the Act.
• Right to Nominate (Section 14): You have the right to nominate another individual to exercise your rights in the event of your death or incapacity.
• Right to Withdraw Consent: You may withdraw your consent to processing at any time, without affecting the lawfulness of prior processing.
• Right to Opt-Out of Promotional Communication: You may opt out of receiving promotional messages at any time by informing us via WhatsApp or email.

To exercise any of these rights, please contact our Grievance Officer at the details provided in Section 14 below. We will respond to verified requests within 30 days as required by applicable law.

10. Cookies & Third-Party Services

Our website may use cookies and similar tracking technologies to improve user experience and gather analytics.

10.1 Cookies

• Essential Cookies: Necessary for the website to function properly.
• Analytics Cookies: Used to understand website traffic and usage patterns (e.g., Google Analytics). Data is anonymised where possible.

You may disable cookies through your browser settings; however, some website features may not function as expected.

10.2 Third-Party Services

Our website integrates the following third-party services, each governed by their own Privacy Policies:

• Google Maps — for location display. Governed by Google Privacy Policy.
• Instagram — for embedded social media content. Governed by Meta Privacy Policy.
• Font Awesome & Google Fonts — for website icons and typography. These services may collect anonymous usage data.
• WhatsApp (Meta): Governed by WhatsApp Privacy Policy.

We are not responsible for the privacy practices of third-party services. We encourage you to review their respective policies.

11. Children's Privacy

Our services are not directed at or intended for use by children under the age of 18 years. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected personal data from a child under 18 without verifiable parental consent, we will take immediate steps to delete such information. If you believe we have collected data from a minor, please contact our Grievance Officer immediately.

12. Third-Party Links

Our website may contain links to third-party websites, including Instagram, WhatsApp, and Google Maps. We are not responsible for the privacy practices or content of such external websites. We recommend reviewing the privacy policies of any third-party site you visit. The inclusion of a link on our website does not constitute our endorsement of the linked site.

13. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time. Changes will be posted on this page with a revised Effective Date. Continued use of our website or services after such changes are posted constitutes your acceptance of the revised Policy.

For material changes that affect your rights or how we handle your data, we will make reasonable efforts to notify you via WhatsApp, email, or a notice on our website, as appropriate.

14. Grievance Officer

In accordance with the Information Technology Act, 2000 (Section 43A read with Rule 5(9) of the SPDI Rules, 2011) and the Digital Personal Data Protection Act, 2023, we have designated a Grievance Officer to address your concerns regarding your personal data.

You may contact the Grievance Officer with any complaints, concerns, or queries relating to this Privacy Policy or our data processing practices. We shall endeavour to acknowledge all complaints within 3 working days and resolve them within 30 days of receipt.

15. Contact Us

If you have any questions, requests, or concerns about this Privacy Policy or our data practices, you may contact us through any of the following means:

• Phone / WhatsApp: +91 81390 40653
• Email: nafautospaa@gmail.com
• Address: NAF CAR SPA, Chithranjali Studio Complex, Edapally–Panvel Highway, Perumba, Payyanur, Kerala — 670307, India
• Instagram: @nafautospa