GDPR and data protection

Workshops keep data about their customers and their cars in Lessora Auto. This page sums up how Lessora Auto helps Workshops meet the General Data Protection Regulation (GDPR). The binding documents are our Data Processing Agreement and Privacy Policy.

Who is responsible for what

• Your Workshop is the controller of the data it keeps in Lessora Auto: customers, vehicles, bookings, jobs, estimates and approvals, intake photos and signatures, invoices, payments, stored tyres and reminders. It decides what to record and why, and informs its customers with its own information clause.
• Lessora Auto is the processor. We process that data only to run the service for the Workshop, under a Data Processing Agreement (Art. 28 GDPR) that every owner accepts when creating a Workshop.
• For our own website, sign-up, billing and support, we are the controller, as described in the Privacy Policy.

A registration number or VIN is personal data when it can be linked to a person, for example a private car owner. Lessora Auto treats vehicle data with the same care as the customer's details.

Where the data is

Lessora Auto runs on servers in the European Union. The companies that help us run it are listed in the Data Processing Agreement, with what they do and where. We tell Workshops at least 30 days before adding a new one.

How the data is protected

• Encrypted connections (HTTPS with HSTS) and encrypted daily backups, kept for 30 days.
• Each Workshop's data is separated; one Workshop can never see another's.
• Roles and permissions inside each Workshop: owner, manager, desk and mechanic each see what their work needs.
• Two-factor authentication for every member of the Workshop's staff, and passkeys.
• Links sent to customers (estimate, job status, booking) are long and random and open only that job or booking; estimate links expire.
• Intake photos and invoices are stored privately and shown only to the Workshop's users.
• An audit log of changes to customers, roles, settings, money, invoices, stock and approvals, kept for 730 days.
• Our support staff can sign in to a Workshop only with a stated reason. Every such access shows in the Workshop's audit log.
• Crash reports from the mobile app are stripped of personal data.

Consents and messages

For each customer, the Workshop can record consents for text message reminders, email reminders and marketing, with where each consent came from. Reminders and other messages that need consent are sent only to customers who have given it. Messages about a job in progress, such as an estimate to approve or "your car is ready", are part of the service the customer ordered.

Tools for data subject rights

Workshops can answer requests from their customers directly in Lessora Auto:

• Access and portability: export everything about one customer (their details, bookings and the records linked to them), or the whole Workshop, as a ZIP file. Download links are valid for 7 days.
• Rectification: edit customer and vehicle details at any time.
• Erasure: erase a customer. Who they are and how to reach them is removed at once; their vehicles, jobs and payments stay as anonymous history, and issued invoices stay with a company buyer's details but without a private buyer's. The Workshop keeps the accounting copies of its invoices that tax law requires.
• Staff can download their own data from their profile.

How long data is kept

• While the Workshop uses Lessora Auto, data stays until the Workshop changes or erases it. The Workshop decides how long it keeps customer data, within its own legal duties (for example keeping invoices as tax law requires).
• Uploaded import files are deleted after 30 days. Files sent to our support for a data migration are deleted once the import is done, at the latest 30 days after they were sent.
• When a Workshop is deleted, it can be restored for 30 days, then everything is permanently deleted, including from backups within 30 days.
• If a Workshop stops paying, it becomes read-only, and its data is deleted 90 days later. The owner is reminded by email beforehand and can export the data until then.

Data breaches

If a personal data breach affects a Workshop's data, we tell the Workshop without undue delay, and where possible within 48 hours, so it can meet its own 72-hour duty to notify the authority.

Questions

Email [email protected]. Lessora sp. z o.o., ul. Stanisławowska 47, 54-611 Wrocław, Poland.