1. About this policy

Harmac Automotive (Garvey Enterprises Pty Ltd ABN 11 097 043 064) respects your privacy. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what personal information we collect, why we collect it, and how we use, store and share it. It also explains how you can access or correct it or make a complaint.

2. Information we collect

Customers

• Contact and identity details: name, phone, email and address; business name and ABN for account and fleet customers.
• Vehicle details: registration, VIN, make and model, odometer, service and repair history, and photos or video of your vehicle and its condition.
• Data from your vehicle: when we connect diagnostic equipment, we may access data stored in the vehicle, such as fault codes, module data and connected-device information (for example paired phones). We only access what we need to diagnose, program and repair the vehicle.
• Transaction details: quotes, invoices, payments and account history. Card payments are processed by our payment provider. We do not store full card numbers.
• Communications: recordings of phone calls, SMS, emails, web chat, messages, reviews and booking details.

Call recordings

We record all phone calls to and from our workshop. We tell you this at the start of each call. We use recordings to keep an accurate record of your bookings, quotes and approvals of work; to resolve disputes; and for quality and training. If you do not want your call recorded, please tell us and we can communicate with you by email or in person instead. Access to recordings is limited to staff who need it. Recordings are kept for 7 years unless needed for a dispute or legal reason.

Alcohol interlock customers

If we install, service or remove an alcohol interlock for you, we also collect your driver licence details, interlock program details, and data downloaded from the device (such as breath test results, events and tamper records). Some of this may be sensitive information under the Privacy Act because it may reveal information about offences or licence conditions. We collect it only with your consent, and only because it is necessary to provide the service and meet program and legal requirements. Access within our business is limited to staff who need it.

Visitors and others

• CCTV: we operate security cameras that record images of people and vehicles on and around our premises. Signs are displayed.
• Website: https://www.harmacauto.com.au/ enquiry form details, and technical data such as IP address, browser type and pages visited (via cookies or analytics).
• Job applicants: information in your application, used to assess it.

3. How we collect it

We collect most information directly from you: in person, by phone, SMS, email, online bookings or forms. We also collect it:

• from your vehicle, as described above;
• from third parties acting for you or connected to the job, such as your employer or fleet manager, insurer, finance company, the interlock supplier, the Department of Transport and Main Roads (TMR), other repairers, and parts suppliers; and
• from our CCTV system.

If you do not give us the information we ask for, we may not be able to book, repair or release your vehicle, or provide interlock services. You can make general enquiries without identifying yourself, but we need your name and contact details to do work on your vehicle.

4. Why we use it

• to quote, book, carry out and manage work on your vehicle;
• to contact you about your job, including approvals for additional work, and to keep a record of those approvals (including call recordings);
• to invoice, take payment and recover overdue amounts;
• to handle warranty claims with manufacturers and parts suppliers;
• to send service and registration reminders (you can opt out);
• to meet interlock program requirements and other legal obligations (for example tax and record-keeping);
• for security and to protect people and property (CCTV);
• to ask for feedback or reviews and improve our service; and
• for marketing, but only if you have opted in (see section 5).

5. Marketing

We only send marketing (offers, newsletters, promotions) if you have opted in, or where otherwise permitted by the Spam Act 2003 (Cth) and the Privacy Act. Every marketing message includes a simple way to unsubscribe, such as an unsubscribe link or replying STOP. You can also contact us to opt out. We do not sell your personal information.

6. Who we share it with

We only share personal information as needed for the purposes above, or as required or permitted by law. This may include:

• Service providers that run our systems: Mechanic Desk (workshop management), Xero (accounting), Podium (customer messaging and reviews), Google Workspace (email), Calendly (bookings), payment processors, and IT support providers;
• Software tools, including AI-assisted tools, that help us manage email, scheduling and business administration. These providers process information for us and are not permitted to use it for their own marketing;
• our accountant and professional advisers;
• parts suppliers and manufacturers (for example your VIN, for ordering and warranty);
• specialist subcontractors working on your vehicle;
• the interlock supplier and TMR, as required by the interlock program;
• your insurer, fleet manager or employer, where they arranged or are paying for the work;
• debt collectors and lawyers, if an account is overdue; and
• police, regulators or courts, where required or authorised by law.

7. Overseas disclosure

Some of our service providers store or process information outside Australia. These locations are likely to include the United States, U.K, N.Z and may include other countries where those providers operate. Providers in this category include Xero, Podium, Calendly and Google, and the providers of AI-assisted tools. Before disclosing information overseas, we take reasonable steps to ensure it is handled in line with the APPs.

8. How we store and protect it

We store information electronically in cloud-based systems and on paper job cards at our premises. We protect it through:

• individual logins, and multi-factor authentication where available;
• access limited to staff who need it, with stricter limits on interlock data;
• secure storage for paper records; and
• staff confidentiality obligations and training.

We keep information only as long as we need it for business or legal purposes. For example, we keep financial records for at least five years as required by tax law. After that, we securely destroy or de-identify it. CCTV footage is kept for about [30] days, unless it is needed to investigate an incident.

9. Data breaches

We comply with the Notifiable Data Breaches scheme. If we suspect a data breach, we will act quickly to contain it and assess it within 30 days. If it is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC).

10. Accessing and correcting your information

You can ask to see the personal information we hold about you, or ask us to correct it. Contact us using the details below. There is no charge to make a request. We will respond within a reasonable time, usually within 30 days. If we refuse access or correction, we will explain why in writing and tell you how to complain.

11. Complaints

If you have a concern about how we have handled your personal information, please contact us in writing. We will acknowledge your complaint within [5] Business Days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can contact the OAIC at www.oaic.gov.au or on 1300 363 992.

12. Contact us

13. Changes to this policy

We may update this policy from time to time. The current version, with its effective date, is available on our website at https://www.harmacauto.com.au/or on request.