Privacy Policy
How SentraFix GH collects, uses, stores and protects the personal data of clients and visitors to this website.
1 Who We Are & This Policy
| Field | Information |
|---|---|
| Company | SentraFix GH — specialist automobile diagnosis, parts procurement and repair service based in Accra, Ghana. |
| Role | SentraFix GH is the data controller responsible for the personal data described in this policy. |
| info@sentrafix.com | |
| 233598624938 | |
| Law | Data Protection Act, 2024 (Act 1085), which replaced the Data Protection Act, 2012 (Act 843). |
This policy explains what personal data we process, why we process it, who we share it with, how long we keep it, and the choices and rights you have. It covers our website, booking forms, parts shop, customer portal, WhatsApp communications, and SMS notifications.
2 Personal Data We Collect
We collect data you give us directly and data generated while you use our services. We do not buy or scrape personal data from third parties.
| Category | Examples & Where It Comes From |
|---|---|
| Identity & contact | Your name, phone number, email address and (if given) residential address, provided through booking forms, account registration, parts orders or WhatsApp. |
| Vehicle data | Vehicle model, year, mileage, licence/registration plate, VIN and fault descriptions provided for diagnosis, VIN lookup, maintenance records and work orders. |
| Account data | Email, a securely hashed password, referral code and service history when you register for the customer portal. |
| Payment data | Order references, amounts, dates and the MoMo number or Paystack transaction ID used to pay. We never store credit or debit card numbers. |
| Notifications | Your phone number, message content and delivery records of SMS we send you through our SMS provider (MNotify). |
| Correspondence | WhatsApp chats, emails, service authorisations, photos of your vehicle and any records of verbal agreements we confirm in writing. |
| Usage data | With your consent, device type, approximate location from IP address and pages visited, collected by Umami analytics. See Section 5. |
Licence Plates & VINs
A vehicle registration number and VIN can identify an individual. We treat them as personal data and only process them to deliver diagnosis, repair and record-keeping services.
3 How We Use Your Data
| Purpose | Lawful Basis & Notes |
|---|---|
| Provide bookings & services | Processing the service you request — vehicle diagnosis, repair, parts procurement and work-order updates. Basis: contract. |
| Parts shop & orders | Processing your orders and keeping order history available in your portal. Basis: contract. |
| Payments & invoices | Collecting payment through Paystack or Mobile Money and issuing receipts/invoices. Basis: contract and tax obligations. |
| Service notifications | Sending you SMS and email confirmations, approvals, test/diagnosis results and pickup reminders for the service you booked. Basis: contract. |
| Support & authorisations | Agreeing quoted costs and work authorisation by WhatsApp/email, and resolving queries and disputes. Basis: contract and consent. |
| Customer portal | Running your dashboard (vehicles, services, orders, notifications) and the referral program. Basis: contract. |
| Vehicle history & safety | Keeping accurate service records and recalling your vehicle if a fault or safety issue is identified. Basis: legitimate interest. |
| Improving the website | Aggregated, non-identifying usage insights from analytics. Only runs with your consent (Section 5). |
| Security & fraud prevention | Protecting accounts, preventing fraud and abuse, and documenting service disputes. Basis: legitimate interest and legal obligation. |
| Legal & accounting | Keeping records required by Ghanaian tax law and the Data Protection Act. Basis: legal obligation. |
No Marketing SMS or Email Without Consent
We only send transactional messages about the service you requested or authorised. We do not send marketing or promotional messages by SMS or email without your separate, voluntary consent.
4 Your Consent Choices
- Where we process your data on the basis of consent — such as analytics cookies or marketing messages — consent is free, specific, informed and unambiguous, and you may withdraw it at any time.
- Accepting our Terms & Conditions on the booking form is separate from data-processing consent. Withdrawing data consent does not cancel a legally binding service agreement.
- You can withdraw your consent for analytics at any time by clearing the sf_consent_v1 entry in your browser's local storage and reloading the page, or by contacting us using the details in Section 13. Analytics stop running immediately.
- Refusing analytics cookies does not affect your ability to use, book, or pay for our services.
5 Cookies & Analytics
We use a small number of cookies (and localStorage entries). They fall into two groups: essential cookies that keep the site secure and functional, and privacy-friendly analytics (Umami, which sets no cookies) that only run after you click "Accept" on our cookie banner.
| Name | Purpose | Type | Duration |
|---|---|---|---|
| PHPSESSID | Keeps you logged into your customer portal and holds your booking/cart state. | Essential | Session |
| _csrf | Protects forms against cross-site request forgery. | Essential | Session |
| sf_consent_v1 | Records your cookie consent choice (stored in browser localStorage, not a cookie). | Essential | Until you clear it |
| Umami (cloud.umami.is) | Cookieless, hashed usage statistics. It does not identify you personally. | Analytics | No cookies |
Consent First
Umami analytics only runs after you consent. Essential cookies are required for the site to work and are used without your consent because they are strictly necessary.
6 Third-Party Processors
We engage the following providers to deliver our services. Each processes only the minimum data needed for its role, under a data-processing agreement.
| Processor | What They Handle | Data |
|---|---|---|
| Paystack | Online card and payment processing | Order reference, amount, name, email, phone |
| MTN MoMo / AT Money (Tigo Cash) | Mobile Money payment collection | Phone number, amount, payment reference |
| MNotify | SMS delivery for service notifications | Phone number, message content, delivery status |
| Umami Cloud | Website usage statistics (with consent only) | Hashed, non-identifying usage events |
| Google (Fonts & Maps) | Page fonts and the contact map embed | Device, IP address |
We never sell personal data and never share it with advertisers or third parties for their own marketing.
7 Data Sharing & Retention
- We disclose personal data only (a) to the processors listed in Section 6, (b) to your authorised representatives or the vehicle's owner, (c) where required by a court, regulator or tax authority in Ghana, or (d) with your consent.
- Customer accounts, vehicles, orders and notifications are kept for as long as your account is active. You may ask us to delete your account and its data as described in Section 10.
- Booking, work-order and payment records used for accounting and tax are retained for at least six years in line with Ghana Revenue Authority requirements.
- SMS delivery logs held by our provider are retained only as long as needed to confirm delivery and to handle disputes or re-sends.
- When data is no longer required, it is securely erased or anonymised.
8 International Transfers
Most of your personal data is stored by providers located in Ghana or Africa (Paystack, MNotify, telecoms). Where data is transferred outside Ghana — for example, usage data sent to Umami cloud servers — we rely on contractual safeguards to ensure the data remains protected.
When You Opt In
Consent to analytics is also consent to the reasonable, standard international data flows required to provide those analytics. If you decline, no usage data is transferred at all.
9 Data Security
- All data sent between your browser and our site is protected using TLS/HTTPS encryption.
- Passwords are stored as salted hashes only — we can never read or recover your password, and we will never ask you for it by phone, SMS or WhatsApp.
- Forms are protected against cross-site request forgery and our customer portal requires login for access to your data.
- Access to records within the business is limited to staff who need it to complete your service.
- Please be aware that WhatsApp and standard SMS are not encrypted end-to-end where government providers may lawfully access messages. We recommend against sending sensitive payment details through WhatsApp or SMS.
10 Your Legal Rights
Under the Data Protection Act, 2024 (Act 1085) you have the following rights:
- Access. Obtain a copy of the personal data we hold about you.
- Rectification. Ask us to correct inaccurate or incomplete data (including on your vehicle records).
- Erasure. Ask us to delete personal data we no longer have a lawful reason to keep.
- Restriction. Ask us to limit processing while a request is being resolved.
- Portability. Receive the data you gave us (where technically feasible) in a structured, machine-readable format.
- Objection. Object to processing based on legitimate interest, unless we demonstrate compelling grounds.
- Withdraw consent. Withdraw any consent at any time without affecting the lawfulness of earlier processing.
- Lodge a complaint. Complain to the Data Protection Commission (DPC) of Ghana at www.dataprotection.org.gh.
How to Exercise Your Rights
Send your request to info@sentrafix.com with the subject "Data Subject Request". We verify identity, respond within 30 days, and may extend by up to 30 more days if the request is complex.
11 Children
Our services are not directed at anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.
12 Changes to This Policy
- We may update this policy as our services, technology or the law change. The "Effective" date at the top of this page shows when it was last revised.
- Material changes will be announced on our website and, where they affect your data rights, we will contact you using the contact details we hold.
- Continued use of our services after a material change takes effect constitutes acceptance of the updated policy, unless the law requires fresh consent, in which case we will obtain it.
13 Contact & Complaints
| Channel | Information |
|---|---|
| info@sentrafix.com | |
| 233598624938 | |
| Data Protection Commission | Data Protection Commission, Accra, Ghana — www.dataprotection.org.gh |
If you are unhappy with how we handle your personal data, please contact us first — we will do our best to resolve it. You also have the right to lodge a complaint with the Data Protection Commission at any time.