Privacy Policy

1. Business identity and responsibility

Luckstar Mercedes operates the workshop at 14 Lancaster Avenue, Belvedere, Harare, Zimbabwe. The independent website developer is separate from the operating garage. The business must confirm its legal entity and privacy contact before publication. Contact Luckstar Mercedes at lucksondub@gmail.com, 078 639 8403, or 14 Lancaster Avenue, Belvedere, Harare, Zimbabwe.

2. Booking and quotation information

Booking requests include name, phone, vehicle model, requested service, preferred date/time and privacy acknowledgement. Email, vehicle year, registration and notes are optional. Quotation and callback enquiries include name, phone, vehicle model, description, preferred contact method, optional email/year and an optional service selection. Email is required if email contact is requested.

Submitting a valid request transmits these details to the website server, which saves the request in PostgreSQL. A confirmation and reference appear only after a successful save. Requests do not confirm workshop availability, a final price or authorisation to repair. Avoid sensitive personal information, payment cards or identity documents.

3. Purpose and proposed lawful grounds

The workshop uses enquiry details to respond, assess what service you are seeking, discuss estimates, contact you through your selected method and manage requests. The proposed grounds include steps you request before a possible contract, performance of agreed services, applicable legal obligations and consent where required. The acknowledgement is not permission for unrelated marketing. The business and its Zimbabwe-qualified adviser must validate the lawful grounds and operational practices before launch.

4. Luckstar Assistant

The assistant is deterministic and consults the current database service catalogue and business settings. Chat messages are sent to this website server to generate a reply. This implementation does not save chat transcripts in the database, analytics or browser storage; the visible conversation exists in the current open website session and is lost on reload or closure. Please do not type personal details into ordinary chat.

Quotation and callback forms opened within the assistant are different: after your acknowledgement and a successful save, their details are stored as enquiries in PostgreSQL, with CHATBOT or CALLBACK as their source. The assistant does not use an external paid AI provider and does not diagnose vehicles or guarantee services, prices or availability.

5. Optional WhatsApp and other third parties

Saving an enquiry does not automatically send anything to WhatsApp. After a booking is saved, you may open an optional prepared WhatsApp message, review it and send it there. Opening that link transfers the prepared text in the destination URL to WhatsApp, and may leave it in browser history. WhatsApp applies its own terms and privacy practices. Contacting the workshop through WhatsApp, telephone or email also involves the providers you choose.

Authorised staff can initiate follow-up links from the dashboard, including WhatsApp messages. They should respect your preferred contact method. The business must confirm its account access and communications practices. Maps and social profiles are outbound links, not embedded tracking interfaces.

6. Storage, administrative access and recipients

Customer enquiries are stored in PostgreSQL and retrieved through server-side code that checks administrator sessions and permissions. There is no public customer-record lookup. Administrator authentication uses database sessions, password hashes and HTTP-only cookies. Administrative status, quotation and price changes are audited; customer descriptions and internal notes are not copied into audit entries.

Authorised administrators can view, update, export and contact customers. Owners can delete live customer records after considering applicable retention obligations. CSV exports are downloads under the recipient administrator?s responsibility. The operating business must identify authorised staff, the production host, database/backup providers and any other processors before launch. This draft does not independently certify staff behaviour or hosting controls.

7. Cookies, technical information and anti-abuse

No advertising pixels or analytics are installed. Administrators receive necessary authentication cookies; sessions expire after eight hours unless renewed through activity. Public enquiry forms do not create customer accounts. The application does not use browser localStorage or sessionStorage for customer records or chat transcripts.

Rate limits use short-lived database records with a hashed network identifier, and additional hashed email identifiers for login protection. When a trusted reverse proxy is enabled, it must replace the configured client-IP header. Authentication sessions may also contain IP/user-agent metadata. Hosting providers may keep technical access logs: the production logging policy must be confirmed, with request bodies and enquiry data excluded. Database-backed abuse records require periodic operational cleanup.

8. Retention and deletion

No arbitrary retention period for enquiries has been set by this implementation. The business must document an appropriate schedule considering enquiry purpose, completed services, legal obligations and disputes. Contact the business to ask about your information, request correction, or request deletion where available.

An authorised owner can remove an enquiry from the live database after identity and retention checks. A minimal audit event retains the administrator, action, internal record identifier and date without copying the deleted customer details. Deletion from the application does not automatically remove WhatsApp correspondence, previously downloaded exports or backup copies. The operator must manage those copies under its approved retention and backup rotation procedures and reapply approved deletions after a restore.

9. Security, processors and international transfers

Server validation, role checks, origin checks for mutations, password hashing, rate limits, restricted admin access and safe CSV formatting are implemented. They do not provide an absolute security guarantee. The operator must configure HTTPS, secrets, database access, staff device security, backups and incident response and assess applicable notification duties.

Hosting location is not fixed by this portable deployment. WhatsApp and other providers may process information outside Zimbabwe. The business must identify processors and assess applicable cross-border transfer conditions, safeguards and agreements under Zimbabwean law before launch. Choosing a link is not a certification that all transfer requirements are met.

10. Your rights, requests and children

Subject to applicable law, ask for access, correction, deletion where available, or objection/restriction where provided. You may withdraw consent for processing based on consent without undoing earlier lawful processing. Contact lucksondub@gmail.com; describe your request and provide only proportionate information needed to identify the relevant record. The business may need identity verification and may retain information lawfully required.

You may also raise a concern through the current official channels of POTRAZ as Zimbabwe?s Data Protection Authority. Rights, exceptions and procedures require local legal review. The site is intended for adults arranging vehicle care and does not intentionally request children?s information. A parent or guardian should contact the business about information supplied by a child.

11. Approval, updates and contact

The business should review this notice when functionality, providers or practices change, including before adding any LLM integration or analytics. Contact Luckstar Mercedes at lucksondub@gmail.com, 078 639 8403, or 14 Lancaster Avenue, Belvedere, Harare, Zimbabwe. This is a draft requiring business and Zimbabwe-qualified legal approval before public launch.