How your data is handled
Privacy notice
Aethrovia lets car garages in Cyprus check cars in with a short form and keep their customers informed by WhatsApp or SMS. This notice explains what happens to your data when you check a car in at a garage that uses Aethrovia, and to the data of the garages' own staff.
1. Who is responsible
- The garage you check your car in with is responsible for your data (the "controller"). It decides which messages you get and keeps the record of the work on your car.
- Aethrovia ([legal name], [registered address], Cyprus · support@aethrovia.com) runs the service for each garage as its "processor", under a written data processing agreement (GDPR art. 28). We only use your data to provide the service to that garage.
- Each garage's data is kept separate. If you use two garages, neither sees what the other knows about you, and each has its own record of which messages you want.
- For garage staff accounts and garage billing, Aethrovia is the controller (section 11).
2. What we keep about you
- What you type in the check-in form: your name, mobile number, your car's registration number, the language you want messages in, and whether you want them by WhatsApp or SMS.
- Your choices: that you agreed to messages about your car, whether you also want a review request and reminders, and when you made or changed those choices.
- If the garage adds them: your car's make, model and version, and your email or notes.
- The messages you send to the garage's WhatsApp number (and the name on your WhatsApp profile, which WhatsApp shares when you write), and whether the messages sent to you were delivered and read.
- What the garage records about your visits: check-in, ready and pick-up times, service notes (mileage, oil, coolant, work done, next service, MOT expiry).
- While your check-in waits for its code: the details above, the code (stored scrambled, not readable), and your device's IP address, only to stop the form being misused. Deleted within a day (section 7).
- When you scan a garage's QR code: only that a scan happened, and your browser type.
3. What it's used for, and why that's allowed
- Checking your car in and telling you when it's ready or picked up, including the code that confirms your number is yours: to carry out the service you asked for (GDPR art. 6(1)(b)).
- One review request after pick-up, and service or MOT reminders the garage sets for your car: only if you ticked the box for them (your consent, art. 6(1)(a); Cyprus Law 112(I)/2004, s.106). You can withdraw it at any time, free of charge (section 4). If the garage checked your car in by hand, it records what you told it.
- Keeping the garage's record of the work on your car: the garage's legitimate interest in its service history, warranty and possible legal claims (art. 6(1)(f)).
- Security and preventing misuse (for example, limiting how many codes a number or device can ask for): legitimate interest (art. 6(1)(f)).
Your data is never sold, never used for advertising, and never shared with other garages.
4. Stopping messages
On WhatsApp, reply STOP to the garage's number at any time. By SMS, every reminder has a link where you can stop them (an SMS can't be answered). You can also just tell the garage. That garage then won't send you review requests or reminders again; other garages aren't affected. Messages about a car you've just checked in (confirmation, ready, picked up) still reach you, since they're part of the service you asked for.
5. Who else handles your data
- The garage's staff, each with their own login.
- Aethrovia staff, only when the garage turns on support access (for example, when it asks us for help). It lasts 7 days, the garage can turn it off at any time, and every page we open is listed for the garage to see. Otherwise we see only totals, such as how many cars a garage checked in, never who its customers are.
- Meta Platforms Ireland Ltd (WhatsApp Business Platform), which delivers WhatsApp messages and codes as our sub-processor. Meta keeps message content for up to 30 days to deliver it and doesn't use it for its ads.
- BulkGate ([legal entity and address], Czech Republic), which delivers SMS messages and codes as our sub-processor, through the mobile networks.
- Our hosting provider, [provider name, data centre location in the EU], where the service and its database run.
- Google, only if you tap the review or directions link: you then go to Google's own website, under Google's privacy policy. We don't send your data to Google.
- Public authorities, only where the law requires it.
6. Transfers outside the EU
Meta may process message data outside the European Economic Area, including in the United States. Those transfers rely on the EU–US Data Privacy Framework and the European Commission's Standard Contractual Clauses. BulkGate works in the EU; an SMS to a non-EU number passes through that country's mobile networks. [Confirm the hosting provider stores data in the EU.]
7. How long it's kept
- While you're a customer of the garage.
- After 3 years with no check-in or message to that garage, your number, name, email, notes and messages are deleted. The garage keeps its record of the work done on the car (dates and service notes), without any way to contact you.
- If the garage stops using Aethrovia, all its data, including yours, is deleted 30 days after it cancels.
- A check-in form waiting for its code, with its code and IP address, is deleted within a day. Meta keeps message content for up to 30 days. Password-reset codes, failed login attempts (staff only) and the IP addresses we count to stop repeated attempts on our forms are deleted within a day. Technical server logs are deleted within 30 days, and backups of the database within 30 days.
8. Your rights
You can ask to see your data, correct it, delete it, restrict its use, object to it being used, withdraw your consent to reminders and review requests at any time (section 4), or receive a copy in a common format. Ask the garage directly, or write to us at support@aethrovia.com and we'll help the garage answer. You'll get an answer within one month.
If you think your data is mishandled, you can complain to the Commissioner for Personal Data Protection: 15 Kypranoros Street, 1061 Nicosia (P.O. Box 23378, 1682 Nicosia) · +357 22 818 456 · commissioner@dataprotection.gov.cy · www.dataprotection.gov.cy, or to the data protection authority where you live in the EU.
9. Automated processing
No decision with legal or similarly significant effects is made about you automatically. If you write to the garage on WhatsApp and mention a registration number, the service shows your message with that car; if you didn't choose a language, it picks one from how you write. The garage can correct both.
10. Security and cookies
Everything is sent encrypted (HTTPS). A garage's customers are seen by its own staff, each with a personal login, and by Aethrovia support only while the garage allows it (section 5). Passwords and codes are stored hashed, and repeated wrong passwords or codes are blocked. This website only uses the cookies it needs to work: a session cookie (which remembers your check-in form until you enter the code, and keeps staff logged in) and a security token. There are no analytics, advertising or tracking cookies, and fonts are served from our own server, so no cookie consent is needed (Cyprus Law 112(I)/2004).
11. Garage staff and owners
For garage accounts, Aethrovia is the controller. We keep each mechanic's phone number, email, name and garage, a hashed password, and which board actions they took (for example, who marked a car ready), to run the accounts and keep them secure (art. 6(1)(b) and (f)). Owner and billing details are used to run the subscription; card payments are handled by Stripe, which acts under its own terms. Accounts are deleted with the garage 30 days after it cancels; billing records are kept as long as tax law requires. The same rights and complaint route as in section 8 apply.
12. Garages that contact us
If you leave your name and number in the "Contact me" form on our home page, or give them to us in person, Aethrovia is the controller. We use them only to contact you about Aethrovia, at your request, before any contract (art. 6(1)(b)), and keep notes of our conversations. If your garage signs up, section 11 applies. Otherwise they're deleted after 12 months with no contact, or sooner if you ask at support@aethrovia.com. The same rights and complaint route as in section 8 apply.
13. Changes
If this notice changes, the new version will be published here with a new date. For any question, write to support@aethrovia.com.