Privacy Policy
This policy explains how Melkbos Auto Spa, the trading brand operated by My Auto Clinic (Pty) Ltd ("we", "us" or "our"), handles personal information when you use our website, book a vehicle-care service, sign in to view your bookings, make a payment, or communicate with us. It is written with South Africa's Protection of Personal Information Act, 2013 ("POPIA") in mind.
The short version
- We collect what we need to book, deliver and get paid for your wash.
- We send you WhatsApp messages about your booking. Marketing messages only if you tick the box for that channel, and you can switch them off at any time.
- Card details are entered on Yoco's payment page. They never reach our website.
- We do not share your information with partners for their marketing unless you switch that on yourself, separately.
- You can ask us to delete your information. We keep booking and payment records the law requires us to keep.
1. Who is responsible
The responsible party is My Auto Clinic (Pty) Ltd, trading as Melkbos Auto Spa, Melkbosstrand, Western Cape.
Our Information Officer is the head of the business, as POPIA provides: Matthew, the director of My Auto Clinic (Pty) Ltd.
Privacy contact: matthew@machettegroup.com.
2. Information we handle
When you book
- Contact details: your full name and mobile number (required), and your email address if you give it.
- Booking details: the branch, service, vehicle type, date and time you choose, the price, any coupon code, your booking reference, booking and payment status, and any notes you type. If you cancel, we record when and why.
- Vehicle details: your vehicle type (car, SUV / bakkie, bus or bike) and, only if you give them, its make, model, colour and registration number.
- Your privacy choices: your answer to each marketing question, the version of this policy you were shown, when you answered, and the internet (IP) address the answer came from. We keep a history of these choices.
When you sign in to your account
- There is no password. You sign in with your mobile number and a one-time code we send you on WhatsApp, and also by email if we have your email address. We keep a record of the codes sent (stored in a form that cannot be read back), the sign-in attempts, and your signed-in session.
When you pay
- Payment records: the amount, payment status, method, and the checkout, payment and refund references. Payment card details are entered on Yoco's hosted checkout and are not received or stored by Melkbos Auto Spa.
When we message each other
- Messages: the content of WhatsApp messages between you and us, your phone number, message identifiers, timestamps, and sent, delivered, read or failed status information supplied by Meta.
Records of what happened
- Our system keeps an audit record of important actions on your booking or account (for example a booking made, a cancellation, a payment, a change to your privacy choices), with the time and the IP address it came from.
3. Why we use it
We use personal information where reasonably necessary to:
- show availability and create, manage, reschedule or cancel bookings;
- identify you when you sign in and show you your own bookings and vehicles;
- prepare for and deliver the requested vehicle-care service;
- validate coupons, start and confirm payments, keep transaction records, and process refunds where applicable;
- send operational WhatsApp updates (section 4);
- receive and respond to messages and maintain a staff inbox with the relevant booking context;
- send marketing, only on the channels you agreed to (section 5);
- protect accounts and services, investigate errors, and meet legal, accounting or dispute-handling obligations.
Our processing may be based on performing or preparing to perform our agreement with you, complying with legal obligations, our legitimate interests in operating and protecting the service, or your consent where POPIA requires it. Marketing is always based on your consent.
4. WhatsApp messages about your booking
Because you booked, we send these service messages to the mobile number you gave us. They are part of the service and are not marketing:
- your booking confirmation;
- a reminder about one hour before your appointment;
- a message when our team starts on your vehicle, and when it is ready for collection;
- a message if your booking is cancelled, and when a payment or refund is processed;
- one-time sign-in codes, only when you ask for one.
Our staff may also reply to messages you send us. WhatsApp is provided by Meta, which handles the messages under its own terms.
5. Marketing: your choice, per channel
- When you book, we ask two separate questions: may we send you marketing on WhatsApp, and may we send you marketing by email. Both boxes start unticked. If you leave a box unticked, we do not send you marketing on that channel.
- If you leave a box unticked on a later booking, we treat that as withdrawing your earlier agreement for that channel.
- You can change your mind at any time:
- sign in at book.myautospa.co.za/account and switch either channel off (or on);
- reply STOP to any of our WhatsApp messages; or
- use the unsubscribe link in any marketing email.
- Marketing only goes to people whose latest choice for that channel is "yes".
6. Sharing with partners: a separate choice, off unless you switch it on
Sharing your information with partner businesses for their own offers is a separate choice from marketing. It is never ticked for you, it is not part of the booking form, and it is never carried over from old records. You can only switch it on yourself, in your account, and you can switch it off again there at any time.
We do not currently share information with any partner for this purpose. If we ever start, we will first update this policy to name the partners (or the kind of partner) and what they receive, and only people who switched sharing on will be included.
7. Who receives information
Authorised Melkbos Auto Spa staff may access information needed to provide the service and assist you. Staff accounts are personal, and staff linked to a branch see that branch's bookings. We also use service providers that process information to deliver parts of the service:
- Yoco provides hosted payment checkout and payment or refund processing.
- Meta and WhatsApp transmit WhatsApp messages and provide message delivery information.
- Afrihost hosts the website, booking system and database in South Africa. Our emails are sent through a mailbox at Afrihost.
- Mutch Consult built and supports the booking system. It may access the system only to maintain and support it, on our instructions, and must keep the information confidential and secure.
We no longer use Clerk: sign-in now uses a WhatsApp code and our own system.
We may also disclose information if reasonably required by law or a lawful request. Each third-party provider handles information under its own terms and privacy policy; this policy describes Melkbos Auto Spa's handling and does not replace those provider policies.
8. Cookies and browser storage
- This website and the booking pages use no advertising or analytics cookies and load no third-party tracking scripts.
- When you sign in to your account, we set one session cookie so you stay signed in. It is needed for the account to work and lasts until you sign out, or at most 30 days. We also record the session's IP address and browser type.
- Your booking's private link (which lets you view or cancel that booking) is part of your confirmation page's address, and the booking pages keep it in your browser tab's temporary storage while the tab is open. That storage is cleared when you close the tab. Treat the link like a key: anyone you share it with can view or cancel that booking.
- Yoco's payment page and WhatsApp may use their own technologies under their own policies.
9. Retention
We keep booking, customer, vehicle, payment and communication records for as long as reasonably required to provide the service, maintain business and transaction records, resolve queries or disputes, prevent misuse, and meet legal or regulatory obligations. Booking and payment records are kept for 5 years, for tax purposes. Your marketing choices are kept until you withdraw them (and the history of a choice is kept as a record that we respected it). Expired sign-in sessions and codes are deleted automatically.
10. Deleting your information
You can ask us to delete your information: sign in at book.myautospa.co.za/account and choose "Delete my information", or email the privacy contact above. When we act on it, we:
- remove your name, mobile number and email address, your vehicle details, and the notes and address you typed;
- remove the IP addresses stored with your privacy choices, and sign you out everywhere;
- keep the booking and payment records themselves (dates, service, amounts, status), no longer linked to your name or number, because the law requires us to keep financial records.
We complete a deletion request within 30 days. If you book again later, you start as a new customer.
11. Security
We use reasonable technical and organisational safeguards appropriate to the service. These include encrypted (HTTPS) connections, one-time sign-in codes that expire after 10 minutes and lock after repeated wrong attempts, personal staff logins with lockout after failed attempts, signed checks on payment and WhatsApp messages sent to our system, and a hosted payment page so Melkbos Auto Spa does not handle card details. No online service can guarantee absolute security. If a breach affects your information, we will tell you and the Information Regulator as POPIA requires.
12. Processing outside South Africa
Our hosting (Afrihost) is in South Africa, and Yoco is a South African payment provider. Meta and its supporting infrastructure may process WhatsApp messages in countries outside South Africa, and our providers may use their own service providers abroad for parts of their service. The privacy and data-protection rules in those countries may differ. Where POPIA applies to a cross-border transfer, we take reasonable steps to use a permitted basis for the transfer, which may include provider commitments, contractual safeguards or processing in a jurisdiction with comparable protection, as applicable.
13. Your choices and rights
Subject to POPIA and other applicable law, you may ask us to:
- confirm whether we hold personal information about you and request access to it;
- correct or update information that is inaccurate, irrelevant, excessive, out of date, incomplete or misleading;
- delete information where there is no lawful reason for us to keep it (section 10); or
- object to certain processing or ask us to restrict it where applicable, and object to marketing at any time (section 5).
We may need enough information to verify your identity and locate the relevant records before responding.
The Information Regulator
If you are not satisfied with how we handled your information, you may lodge a complaint with South Africa's Information Regulator:
- Website: inforegulator.org.za
- Complaints: POPIAComplaints@inforegulator.org.za
- General enquiries: enquiries@inforegulator.org.za
- Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
14. Changes to this policy
We may update this policy when our services, providers or legal obligations change. The version and effective date at the top show which version is current, and our booking system records the version you were shown when you booked. Material changes will be communicated by posting the updated policy on this page and, where appropriate, through another reasonable notice.
15. Contact us
Contact Melkbos Auto Spa about this policy or a privacy request:
My Auto Clinic (Pty) Ltd, trading as Melkbos Auto Spa
Attention: Matthew, Information Officer
matthew@machettegroup.com