Privacy Policy
Founded on a simple belief: every car owner in Abu Dhabi deserves dealership-grade service at honest, transparent prices.
1. About This Privacy Policy
This Privacy Policy explains how Grace Auto Repair Workshop ("Grace", "we", "our" or "us") collects, uses, stores, shares and protects personal data when you visit our website, contact us, request a quotation, make a booking, use our automotive repair or maintenance services, communicate with us, or otherwise interact with us.For the purposes of applicable UAE personal data protection law, Grace Auto Repair Workshop acts as the controller of the personal data described in this Privacy Policy, except where another party independently determines how and why personal data is processed.This Privacy Policy is intended to be read together with any specific notices, consent language or terms presented to you at the point where personal data is collected.
2. Personal Data We May Collect
Depending on how you interact with us, we may collect the following categories of personal data:
- Identity and contact information, such as your name, telephone or mobile number, email address and contact preferences.
- Vehicle information, such as vehicle make, model, year, registration details, vehicle identification information where required, mileage and service history provided to us.
- Service information, including repair or maintenance requirements, diagnostic information, quotations, estimates, job-card information, parts requested or fitted, booking details and service history.
- Payment and transaction information, including payment status, invoice details, transaction references and other information necessary to process or record payments. We do not intend to store complete payment-card credentials unless this is expressly required and lawfully handled through an authorised payment provider.
- Communications, including information you provide through telephone, email, WhatsApp, website forms or other communication channels.
- Website and device information, such as IP address, browser type, device information, pages visited, date/time information, cookie identifiers and similar technical information where collected.
- CCTV and premises security information. We use CCTV surveillance at our premises for safety, security, incident investigation and the protection of customers, staff, vehicles and property. CCTV footage is ordinarily retained for 30 days and is then overwritten or securely deleted, unless a longer period is reasonably required in connection with an incident, investigation, legal claim or applicable legal requirement.
- Any other information you voluntarily provide to us in connection with our services.
We seek to collect only personal data that is relevant and reasonably necessary for the purposes described in this Privacy Policy.
3. How We Collect Personal Data
We may collect personal data directly from you when you contact us, request a quotation, make a booking, visit our premises, provide your vehicle for inspection or repair, make a payment, submit a website form, or communicate with us through telephone, email, WhatsApp or other channels.
We may also receive personal data from service providers, authorised representatives or other parties where this is lawful and relevant, including payment providers, booking platforms, insurers, fleet operators, vehicle owners or other parties involved in providing or arranging services for you.
Certain technical information may be collected automatically when you use our website through cookies, server logs and similar technologies.
4. Why We Use Personal Data
We may process personal data for the following purposes:
- to respond to enquiries and requests;
- to prepare quotations, estimates and service information;
- to schedule and manage appointments;
- to inspect, diagnose, repair and maintain vehicles;
- to communicate with you about your vehicle, appointment, repair status, collection or delivery;
- to process payments, issue invoices and maintain accounting records;
- to provide customer support and handle complaints;
- to maintain service, warranty and business records;
- to improve our services, website and customer experience;
- to operate, maintain and secure our systems, premises and business;
- to prevent, detect and investigate fraud, misuse, security incidents or unlawful activity;
- to comply with legal, regulatory, tax, accounting, court, law-enforcement or governmental requirements;
- to establish, exercise or defend legal claims; and
- to send marketing communications where permitted by applicable law and, where required, with appropriate consent.
Where applicable law requires consent for a particular processing activity, we will seek consent in a clear manner. Where processing is based on consent, you may withdraw that consent using the contact details in Section 17, subject to any processing we are legally permitted or required to continue.
5. Service Communications and Marketing
We may contact you without treating the communication as marketing where the communication is necessary or appropriate to respond to your enquiry or to provide a service you requested. Examples include appointment confirmations, quotation updates, repair-status updates, collection notifications, invoices, payment information and customer-support messages.
Promotional or marketing communications are treated separately. Where required by applicable UAE law, we will obtain the necessary consent or otherwise ensure that the communication is permitted before sending marketing messages or making marketing calls.
You may ask us to stop sending promotional communications at any time by using any unsubscribe or opt-out method provided in the communication or by contacting us. We will also seek to comply with applicable UAE telemarketing requirements, including requirements relating to consumer preferences and the Do Not Call Registry where they apply to our activities.
6. Cookies and Similar Technologies
Our website may use cookies and similar technologies to operate correctly, remember preferences, understand website traffic, improve performance and support third-party features.
Depending on the tools actually enabled on our website, cookies or similar technologies may be categorised as strictly necessary, functional, analytics or advertising/marketing technologies.
Where required by applicable law, we will seek the appropriate choice or consent before placing non-essential cookies or similar technologies. You may also be able to control certain cookies through your browser settings, although disabling cookies may affect website functionality.
7. When We Share Personal Data
We do not sell or rent personal data.
We may share personal data where reasonably necessary and lawful with the following categories of recipients:
- website, cloud-hosting and IT service providers, to host, maintain and secure our systems;
- booking or appointment platforms, to manage appointments and service requests;
- payment service providers, banks or financial service providers, to process and reconcile payments;
- communications and messaging providers, including services used for email, SMS, telephone or WhatsApp communications;
- analytics, website-support or technology providers, where enabled and lawfully used;
- professional advisers, auditors and accountants, where necessary for professional, accounting or legal purposes;
- insurers, fleet operators, vehicle owners or authorised representatives where relevant to the requested service and lawful;
- competent government authorities, regulators, courts or law-enforcement bodies where disclosure is required or permitted by law; and
- other third parties involved in a corporate transaction or restructuring, subject to appropriate safeguards and legal requirements.
Where a service provider processes personal data on our behalf, we seek to use providers that offer appropriate confidentiality, security and data-protection safeguards and to put suitable contractual or other protections in place where required.
8. Third-Party Websites and Independent Services
Our website or communications may contain links to third-party websites or services. If you choose to visit or use an independent third-party service, that third party may process your information under its own privacy terms. We encourage you to review those terms.
This does not limit our responsibilities for personal data that we ourselves disclose to or process through service providers acting on our behalf.
9. International Transfers
Some of our service providers or technology platforms may process, host or access personal data outside the United Arab Emirates. This may occur, for example, where cloud, hosting, communications, messaging, analytics or support providers operate infrastructure in other countries.
Where personal data is transferred outside the UAE, we will seek to ensure that the transfer is carried out in accordance with applicable UAE personal data protection requirements and that appropriate safeguards or other lawful transfer mechanisms are used where required.
You may contact us for available information regarding applicable safeguards for cross-border transfers, subject to legal and confidentiality limitations.
10. Data Security
We take reasonable technical and organisational measures designed to protect personal data against unauthorised or unlawful access, disclosure, alteration, loss, destruction or misuse. Measures may include access controls, device and account security, backups, staff controls, secure service providers and other measures appropriate to the nature of the information and our operations.
No website, communication channel, electronic transmission or storage system can be guaranteed to be completely secure. You should therefore take reasonable care when sending personal information electronically.
11. Personal Data Breaches
If a personal data breach occurs, we will assess the incident and take appropriate steps to contain, investigate and remediate it. Where required by applicable UAE law, we will make notifications to the competent authority and/or affected individuals within the applicable requirements.
12. Data Retention
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and for any additional period required or permitted by applicable law.
When determining retention periods, we may consider the type and sensitivity of the information, service and warranty needs, customer-service history, accounting and tax requirements, legal limitation periods, dispute-resolution needs, fraud and security requirements, and other regulatory or legitimate record-keeping obligations.
When personal data is no longer required, we will seek to delete, anonymise or otherwise dispose of it securely, subject to applicable legal and operational requirements.
[LEGAL/OPERATIONS: CCTV retention is confirmed as 30 days. Please confirm and document appropriate retention periods for customer, vehicle, invoice, website, marketing and communication records.]
13. Your Privacy Rights
Subject to the UAE Personal Data Protection Law, other applicable UAE laws and any lawful exceptions or limitations, you may have rights in relation to your personal data, including the right to:
- obtain information about the processing of your personal data;
- request access to personal data we hold about you;
- request correction or completion of inaccurate or incomplete personal data;
- request deletion or erasure of personal data where applicable;
- request restriction or cessation of certain processing where applicable;
- object to certain processing where applicable;
- withdraw consent where processing is based on consent, without affecting processing already lawfully carried out;
- request the transfer or receipt of qualifying personal data in a structured, machine-readable format where applicable; and
- raise a complaint or concern regarding the way your personal data is processed.
We may need to verify your identity before acting on a privacy request, and we may request information reasonably necessary to locate the relevant records or confirm authority where a request is made on behalf of another person.
Certain rights are subject to exceptions under applicable law and may not apply in every circumstance. If we cannot fulfil a request, we will seek to explain the reason where required and permitted.
14. Complaints
If you have a concern about our handling of personal data, please contact us first using the details in Section 17 so that we can review the matter.
You may also have the right to submit a complaint to the UAE Data Office or another competent UAE authority in accordance with applicable law.
15. Automated Decision-Making
We do not currently use personal data to make decisions about customers based solely on automated processing or profiling that produces legal or similarly significant effects.
16. Children’s Privacy
Our automotive repair and maintenance services are not intended to be purchased directly by children. We do not knowingly seek to collect personal data from children except where lawful and necessary, for example where information is provided by or with the involvement of a parent, guardian or authorised adult.
17. Contact Us
If you have questions, concerns or requests relating to this Privacy Policy or your personal data, please contact:
Grace Auto Repair Workshop, P.O. Box: 37511, Store 2, Plot No. 26, Mussafah M-33, Abu Dhabi, UAE
Phone: +97125544140
Privacy email: Info@graceauto.ae
Privacy requests sent to the above email address should be monitored and handled in accordance with applicable legal requirements and Grace Auto Repair Workshop’s internal procedures.
18. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, technologies, legal requirements or business practices. The updated version will be posted on our website with a revised “Last Updated” date. Where appropriate or legally required, we may provide additional notice of material changes.
19. Governing Framework
This Privacy Policy is intended to operate in accordance with applicable laws and regulations of the United Arab Emirates, including Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data, as applicable to our activities. Grace Auto Repair Workshop is located in mainland Abu Dhabi. The Abu Dhabi Global Market Data Protection Regulations 2021 are a separate data-protection regime and are not intended to apply merely because a business is located elsewhere in the Emirate of Abu Dhabi; legal counsel should confirm scope if Grace carries out processing in the context of an ADGM establishment or otherwise falls within that regime.