Privacy Policy.

1. Introduction

RMS Automotive Group operates an independent automotive service and repair network in KwaZulu-Natal, South Africa. The network includes Bosch Car Service Umhlanga, Bosch Car Service KZN Repair Centre, Bosch Car Service Cornubia, Bosch Car Service Dolphin Coast and Bosch Car Service Zululand. The exact legal entity operating the website and the legal entity responsible for each workshop must be confirmed before publication.

This Privacy Policy explains how personal information may be collected, used, stored, shared and protected when a person visits rmsbosch.co.za, submits a booking or service enquiry, contacts a workshop, communicates with RMS through telephone, email, WhatsApp or another channel, or interacts with RMS digital services.

RMS aims to process personal information responsibly and in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA), its current Regulations and other applicable South African law.

2. Responsible party

Under POPIA, a responsible party is the person or organisation that determines why and how personal information is processed. Depending on the interaction, the responsible party may be the entity operating the RMS website, the relevant workshop legal entity, or more than one entity where responsibility is lawfully shared.

The trading description “RMS Automotive Group” must not be interpreted as confirmation that every RMS workshop is operated by one registered company.

3. Information RMS Collects

3.1 Contact information

• Name and surname.
• Telephone or mobile number.
• Email address.
• Communication preferences or other contact information voluntarily supplied.

3.2 Vehicle information

• Vehicle make, model, year or variant where supplied.
• Registration details where supplied.
• Mileage where supplied.
• Service or repair history where relevant.
• Requested service, repair or inspection.
• Vehicle symptoms, warning-light information or fault descriptions.

3.3 Booking and enquiry information

• Preferred workshop and preferred appointment or service date.
• Requested service.
• Messages submitted through website forms.
• Information reasonably required to respond to the request.

3.4 Customer and service information

• Quotations or estimates.
• Workshop, job or service records.
• Authorisations and customer communications.
• Customer-service, feedback, complaint or CSI records.
• Legitimate follow-up relating to an enquiry, quotation or service.

3.5 Technical and digital information

• IP address and device/browser information.
• Website interaction and navigation information.
• Cookies or similar identifiers.
• Referral source and analytics data.
• Advertising attribution or conversion information where the relevant technologies are lawfully deployed.

4. How information is collected

RMS may collect personal information directly through website contact and booking forms, fleet enquiries, telephone calls, email, WhatsApp, workshop visits, quotation or booking discussions, customer-service interactions and information voluntarily supplied by a customer.

Technical information may also be generated automatically through website technologies such as cookies, analytics software, advertising measurement tools and security systems where those technologies are actually deployed.

Where information is obtained from another source rather than directly from the person concerned, RMS must ensure that the collection is permitted by POPIA.

5. Purposes of processing

RMS may process personal information where reasonably necessary to:

• respond to service, repair, fleet or maintenance enquiries;
• route an enquiry to an appropriate RMS workshop;
• arrange, discuss or confirm a booking;
• obtain additional vehicle information;
• prepare, discuss or follow up on quotations or estimates;
• manage service and repair leads and customer relationships;
• provide requested automotive services;
• administer workshop and customer records;
• provide customer service and appropriate CSI follow-up;
• follow up on unresolved enquiries or quotations;
• deal with complaints, disputes, fraud or security concerns;
• maintain records and comply with legal or regulatory obligations;
• analyse and improve website performance and customer journeys;
• measure advertising effectiveness and conversions where lawful; and
• send direct marketing only where legally permitted.

A communication directly connected with a requested booking, quotation, repair or current service matter is ordinarily operational. If the purpose changes to promoting additional or future services, direct-marketing rules may apply.

6. Lawful processing

RMS does not treat consent as the only legal basis for processing. Depending on the circumstances, processing may be necessary to take steps requested by a customer before entering into a contract, to perform or administer a service relationship, to comply with a legal obligation, to protect a legitimate interest, for RMS's legitimate operational interests where permitted by law, or because valid consent has been given.

For example, a mobile number supplied in a booking enquiry may be used to contact the customer about that enquiry without treating the person as having given blanket promotional consent. RMS must collect information that is adequate, relevant and not excessive for the applicable purpose.

7. Direct marketing

7.1 Operational communication is different from marketing

Submitting a booking enquiry, contact request, quotation request or request for RMS to call back does not automatically give RMS unlimited permission to send future promotional communications.

7.2 Email, SMS, WhatsApp and promotional communications

Where RMS conducts electronic direct marketing, it must comply with POPIA section 69, the current POPIA Regulations, the Consumer Protection Act and applicable direct-marketing requirements. A prospective customer who is not otherwise lawfully marketable should be given a clear and separate marketing choice where consent is required. Marketing consent should not be bundled into a compulsory booking acceptance or pre-selected by default.

7.3 Existing customers

Where RMS relies on POPIA's existing-customer exception, the contact details must have been obtained in the context of a customer relationship, marketing must concern RMS's own similar services, and the customer must receive the required opportunities to object.

7.4 Opt-outs and the Consumer Protection Act

RMS must honour valid unsubscribe or opt-out requests and maintain appropriate suppression processes. RMS management must also confirm and implement the current National Consumer Commission direct-marketing and opt-out registry requirements applicable to the relevant RMS entities. Compliance with a CPA opt-out process does not remove separate POPIA obligations.

8. Cookies and tracking technologies

The production website may use essential cookies, analytics cookies, performance or functionality technologies, and advertising or marketing technologies where lawfully configured.

8.1 Essential technologies

These may support website security, technical operation, preferences or form functionality.

8.2 Analytics and performance technologies

Where enabled, these may help RMS understand website traffic, navigation patterns, device usage, performance and conversion journeys.

8.3 Advertising technologies

Where enabled, these may support campaign measurement, conversion attribution or related advertising functions. Advertising technology must not be described as essential merely because it is commercially useful.

8.4 Cookie controls

The website developer must verify the technologies actually deployed and provide appropriate notice and preference or consent controls where required. Disabling optional cookies should not be represented as making the entire website unusable unless this is technically true.

9. Third-party service providers

RMS may use service providers for hosting, website administration, security, analytics, advertising measurement, communications, email distribution, form processing, CRM or lead management, booking and workshop administration, maps/location functionality, review functionality and related technology infrastructure.

This does not mean that every platform in those categories is currently used. RMS and the website developer must identify the actual providers processing production website data. Personal information should only be disclosed where there is an appropriate lawful purpose and suitable data-protection arrangements.

RMS does not sell personal information as part of its ordinary website and automotive-service operations.

10. Google Analytics & Ads

If Google Analytics 4, Google Tag Manager, Google Ads conversion measurement or similar Google technologies are enabled, they may process technical identifiers and information about website interactions to help RMS understand website performance, measure advertising effectiveness, identify conversions and improve marketing and user experience.

Analytics information does not necessarily tell RMS the real-world identity of every website visitor. The website developer must verify which tags are live, when they fire, which cookies or identifiers they use, whether advertising features are enabled, retention settings and whether information is transferred outside South Africa.

11. WhatsApp and social media

Where a customer chooses to communicate with RMS through WhatsApp, Meta or another third-party service, that platform may process information independently under its own privacy terms. RMS remains responsible for its own processing of the communication once received, but does not control all processing undertaken independently by the platform.

A customer who does not wish to use WhatsApp may use another available RMS contact channel.

12. Sharing between RMS locations

Where a customer selects a particular RMS workshop, RMS may direct the enquiry and relevant information to that workshop so that it can respond, confirm availability, obtain further information or manage the requested booking. A central enquiry may similarly need to be directed to an appropriate workshop.

Information should only be available to RMS entities or personnel with a legitimate reason to access it. This Policy does not imply unrestricted information access across every RMS business or legal entity.

13. Information security

RMS should implement appropriate and reasonable technical and organisational measures to protect personal information against loss, unauthorised access, unlawful processing, unauthorised disclosure, alteration and destruction. Measures should be appropriate to the information, risks and systems involved.

No internet transmission, communications platform or electronic storage system can be guaranteed to be completely secure. Where a reportable personal-information security compromise occurs, RMS must follow POPIA and the Information Regulator's current notification requirements.

14. Retention of information

RMS should keep personal information only for as long as reasonably necessary for the purpose for which it was collected, customer and workshop administration, applicable legal or regulatory requirements, record-keeping, resolving complaints or disputes, or another legitimate purpose permitted by law.

Different record types may require different retention periods. RMS should not publish an arbitrary universal retention period until its retention schedule has been verified. Where RMS is no longer authorised or required to keep personal information, appropriate deletion, destruction, de-identification or restriction measures should be used.

15. Cross-border processing

Some cloud, communications, analytics, hosting or technology providers may process information outside South Africa. Where personal information is transferred to another country, RMS must ensure that the transfer satisfies POPIA section 72, including through appropriate legal, contractual, consent-based or other permitted safeguards.

RMS must verify which current providers involve cross-border processing.

16. Children's information

The RMS website and automotive services are not specifically directed at children. RMS does not intend to solicit children's personal information for marketing. Where information relating to a child is processed, RMS must ensure that the processing is permitted under POPIA, including where the authorisation of a competent person or another lawful basis is required.

17. Data-subject rights

Subject to applicable law and reasonable identity verification, a person may have the right to:

• ask whether RMS holds personal information about them;
• request access to applicable personal information;
• request correction or updating of inaccurate information;
• request deletion or destruction where legally applicable;
• object to certain processing on grounds permitted by POPIA;
• withdraw consent where consent is the basis relied upon;
• opt out of direct marketing; and
• complain to RMS or the Information Regulator.

Access to records may also be governed by PAIA and the applicable PAIA Manual.

18. Information Regulator

A person who believes that their POPIA rights have been infringed may lodge a complaint with the Information Regulator of South Africa.

19. Information Officer

If separate RMS workshop entities are separate responsible parties, RMS must confirm the applicable Information Officer arrangements for each entity.

20. Privacy Policy Updates

RMS may update this Privacy Policy to reflect changes in law, RMS operations, website functionality, technology providers or processing activities. The current version should always display its effective date and last-updated date. Where a material change significantly affects how personal information is used, RMS should take reasonable steps to make affected persons aware of the change where appropriate.

Information RMS Must Confirm

• Registered company name, registration number and registered/business address of the website operator.
• Legal entity operating each RMS workshop and the responsible-party structure for central enquiries.
• Registered Information Officer and privacy contact details.
• Actual form destination systems, CRM, lead-management and workshop-management systems.
• Actual Google Analytics, Tag Manager, Google Ads, Meta, Mailchimp or other marketing technologies deployed.
• Hosting provider, server location, cross-border processing and operator agreements.
• Actual cookies, local storage and advertising identifiers used in production.
• Data-retention schedule and security-compromise procedure.
• Direct-marketing consent, opt-out, suppression and current National Consumer Commission registry processes.
• Current PAIA Manual requirements and links for each relevant legal entity.