Privacy policy

1. Who we are

DealerPro is operated by KIWA Ltd (“KIWA”, “we”, “us”), a company registered in Malta. You can reach us about anything in this policy at hello@dealers-pro.com.

We follow the EU General Data Protection Regulation (GDPR) and the Maltese Data Protection Act (Cap. 586). Our supervisory authority is the Information and Data Protection Commissioner (IDPC) in Malta.

2. Two roles: controller and processor

We handle personal data in two different capacities, and your rights depend on which one applies.

• As controller — for this website, for people who ask for a demo or quote, and for the contact and billing details of the dealerships that are our customers. Sections 3 and 4 cover this.
• As processor — for everything a dealership keeps inside its own DealerPro deployment: its debtors, vehicles, contracts, payments, documents and messages. The dealership is the controller of that data; we process it on the dealership's instructions under the Data Processing Addendum in our Terms of Service. Section 5 covers this.

3. Data we collect on this website

3.1 Demo requests

When you book a demo we ask for your name, dealership, email, phone number, number of branches and active agreements, a preferred time, an optional message and, optionally, the plan you have in mind. We use it to get in touch and prepare the demo. Legal basis: steps taken at your request before entering a contract (Art. 6(1)(b) GDPR) and our legitimate interest in responding to enquiries.

3.2 Checkout

When you subscribe, we ask for your dealership name and a billing email and pass you to Stripe Checkout for payment. Card details are entered on Stripe's pages and are never seen or stored by us; we receive a confirmation with the plan, usage, billing contact and Stripe's reference numbers. Legal basis: performance of a contract.

3.3 Server logs

Our hosting provider keeps short-lived request logs (IP address, time, page requested, browser) for security and to keep the site running. Legal basis: legitimate interest. We do not run advertising or behavioural analytics on this site.

4. Data about our customers

For each dealership that subscribes we keep the business contact details of the people who deal with us (names, work email, phone, role), the login identities of the users the dealership creates, billing history and support correspondence. We use it to provide and bill the service, to give support, to send notices required by the contract, and to tell you about changes to DealerPro. We do not sell it or share it for marketing.

Legal basis: performance of the contract, legal obligations (tax and accounting records), and our legitimate interest in running and securing the service.

5. Data inside a DealerPro deployment

A dealership uses DealerPro to run its book. That means personal data about the dealership's own customers and guarantors: names, identity card numbers, addresses and contact details, scanned identity documents, vehicle and contract details, instalments and payments, arrears, collection notes, promises to pay, and the WhatsApp, SMS and email messages exchanged with them.

The dealership decides what is collected and why, and is responsible for telling its customers. We act only on the dealership's instructions: to host, back up, secure and support its deployment. Our staff access a dealership's data only when needed for support, with the dealership's knowledge.

If you are a customer of a dealership and want to exercise your rights over data held about you in DealerPro, contact the dealership directly — it is the controller. If you write to us instead, we will pass your request to the dealership and help it respond.

6. Sub-processors

We use the following providers to deliver the service. Each is bound by written terms that meet the requirements of Art. 28 GDPR. We give our customers at least 30 days' notice before adding one.

WhatsApp messaging is only active for dealerships that connect their own WhatsApp Business number. Messages then pass through Meta's WhatsApp Business Platform under Meta's own terms; Meta acts as a separate provider to the dealership for that channel.

7. Where data is kept

Each dealership's database, authentication records and uploaded files are hosted by Supabase in a European Union region.

Some providers (Vercel, Stripe, Resend, Meta) are headquartered in the United States or may process data there, for example when serving the application or sending a message. Where personal data leaves the European Economic Area it is transferred under the European Commission's standard contractual clauses or, for providers certified under it, the EU–US Data Privacy Framework.

8. Security

• Every dealership gets its own isolated database and deployment; no other dealership's rows are in it.
• Row-level access control in the database, audited automatically every day.
• Multi-factor authentication, roles and permissions per user, and an audit log of who changed what.
• Nightly backups and a monthly restore drill that proves they can actually be restored.
• All traffic encrypted in transit.

If we become aware of a personal data breach affecting a dealership's data we tell the dealership without undue delay and in any case within 72 hours, with what we know and what we are doing about it.

9. Retention and deletion

• A dealership's deployment is kept for as long as the subscription runs. When it ends, for any reason, we give the dealership a complete export and delete the database, the uploaded files and the deployment within30 days. Backup copies expire on the same cycle.
• Demo and quote requests are kept for 24 months from the last contact, then deleted.
• Billing records are kept for as long as Maltese tax and company law require — currently up to ten years — and then deleted.
• Server logs are kept for no longer than 30 days.

10. Your rights

Where we are the controller (sections 3 and 4), you have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted, where we no longer need it;
• restrict or object to processing based on our legitimate interests;
• receive the data you gave us in a machine-readable format;
• withdraw consent at any time, where consent was the basis.

Write to hello@dealers-pro.com. We answer within one month. You may also complain to the Information and Data Protection Commissioner, Malta (idpc.org.mt), or to the supervisory authority where you live.

Where a dealership is the controller (section 5), address your request to the dealership; we will help it respond.

11. Cookies

This website sets no advertising or analytics cookies. If you arrive through a partner's referral link, one functional first-party cookie (dp_ref) remembers the partner's code for 90 days so that we can credit them if you become a customer; it contains no personal data. The DealerPro application sets the cookies and local storage it needs to keep you signed in and remember your settings. Stripe sets its own cookies on its checkout pages, described in Stripe's privacy policy.

12. Changes to this policy

We update this policy when our practices or providers change. The date at the top tells you the current version; we notify customers by email of any change that affects how their data is processed, and sub-processor changes with at least 30 days' notice.

13. Contact

KIWA Ltd (company number C 00000 (TODO before go-live)), Registered office (TODO before go-live), Malta. Email hello@dealers-pro.com.