Privacy Policy
This privacy policy explains how Stratos Technologies AG ("we", "us") processes personal data in connection with Garage Booster (https://www.garage-booster.com), a web application that garages use to create offers for their customers and send them for approval. It is based on the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR).
Did you receive an offer from your garage? Then section 4 is the part that concerns you.
1. Who is responsible
Garage Booster is provided by:
Stratos Technologies AG
Technoparkstrasse 1, 8005 Zürich
Switzerland
Email: info@stratos-tech.ch
UID: CHE-168.261.229
Our role depends on the data:
- We are the controller for data about the people who use Garage Booster (garage staff), for the technical data needed to run and secure the application, and for communication with our support.
- We act as a processor for the data that garages enter about their customers, such as names, contact details, licence plates and offers. We process this data only on behalf of, and according to the instructions of, the company that has contracted Garage Booster with us (the "Client") and the garages connected to it, on the basis of our agreement with the Client and its data protection provisions. They are responsible for this data. See section 4.
2. Using Garage Booster
2.1 Technical data and security
When you use Garage Booster, technical data is processed automatically: IP address, date and time of access, pages and functions requested, browser type and version, and operating system. We use this data to provide the application, protect it against misuse and attacks, and analyse and fix errors.
If an error occurs, an error report is sent to Sentry. It contains technical details about the error and the request concerned, which may include your user ID and IP address. Error reports are deleted after 90 days at the latest.
The legal basis is our legitimate interest in secure and reliable operation of the application (Art. 6(1)(f) GDPR).
2.2 User accounts
Garage staff, such as mechanics, service advisors and administrators, need a user account. We process your name, email address, phone number (optional), role, the garage you belong to, your login credentials (passwords are stored only in hashed form) and your activity in the application, such as the offers you create and send.
Accounts are set up by the Client or by your garage. We use this data to give you access, keep your account secure, send you system emails (for example password resets and notifications) and provide support. The legal basis is the performance of our contract with the Client and our legitimate interest in providing the application to its users (Art. 6(1)(b) and (f) GDPR).
We delete account data when the account is deleted or our contract with the Client ends, unless we are legally required to keep it longer.
2.3 Contacting our support
If you contact us by email or phone, we process your contact details and your message to handle your request. The legal basis is our contract with the Client and our legitimate interest in answering requests (Art. 6(1)(b) and (f) GDPR). We delete this correspondence once it is no longer needed, unless we are legally required to keep it.
3. Cookies and local storage
Garage Booster only uses cookies and similar technologies that are strictly necessary for the application to work. We do not use cookies for analytics or advertising.
| Cookie | Provider | Purpose | Duration | Category |
|---|---|---|---|---|
garageboosteradmin_session |
Garage Booster | Keeps you logged in | 8 days | Necessary |
XSRF-TOKEN |
Garage Booster | Protects forms against cross-site request forgery | 8 days | Necessary |
cf_clearance |
Cloudflare | Confirms that a security check has been passed | 30 minutes | Necessary |
_cfuvid |
Cloudflare | Distinguishes visitors who share an IP address, for rate limiting | Session | Necessary |
The application may also store interface settings, such as your time zone or region, in your browser's local storage or session storage. This data stays on your device.
Because these technologies are strictly necessary, they do not require consent. They are based on our legitimate interest in a secure, functioning application (Art. 6(1)(f) GDPR). If you block them in your browser, you may not be able to log in.
4. Information for customers of garages
This section is for vehicle owners and other customers of garages that use Garage Booster.
What happens. Your garage uses Garage Booster to prepare offers, for example for repairs or parts, and to send them to you. For this, the garage enters your name, your vehicle's licence plate, your email address and/or phone number, and the content of the offer (work, parts and prices). You receive a link to the offer by SMS and/or email. When you open the offer page and approve or reject the offer, we record your decision together with the date, time and technical data such as your IP address, so that your garage receives your answer and can document it.
Who is responsible. Your garage, together with the Client it is connected to, is the controller for this data. We process it only on their behalf, on the basis of our agreement with the Client, and do not use it for our own purposes. Any agreement that results from your approval is made between you and your garage.
Messages. SMS and emails are sent via Esendex, an SMS and messaging service contracted by the Client, and via Mandrill (email).
Parts and prices. To show suitable parts and prices, we retrieve parts and price data from TecAlliance GmbH, Germany. For this, we send TecAlliance only its own vehicle identifier, which we determine in advance from the vehicle data. Your name, contact details, licence plate and VIN are not sent to TecAlliance.
How long. Your garage and the Client decide how long this data is kept. When our agreement with the Client ends, the data is returned or deleted as agreed.
Your rights. Please contact your garage to exercise your rights (see section 9). If you contact us instead, we will forward your request to your garage.
5. Service providers and other recipients
We use carefully selected service providers who process personal data on our behalf, or on behalf of the Client, and are contractually bound to protect it:
- Amazon Web Services (AWS): hosting, with data centres in Germany and Sweden
- Cloudflare, Inc., USA: content delivery network, security and performance
- Functional Software, Inc. (Sentry), USA: error monitoring
- The Rocket Science Group LLC (Mandrill, part of Intuit Mailchimp), USA: sending emails
- Esendex: sending SMS and emails to garages' customers, contracted by the Client
- TecAlliance GmbH, Germany: parts and price data
We may also disclose personal data to authorities, courts or our professional advisers where we are legally required to or where it is necessary to protect our rights. We do not sell personal data.
6. Transfers abroad
The application and its data are hosted in the EU (Germany and Sweden). Switzerland and the EU/EEA recognise each other as providing an adequate level of data protection.
Some service providers are based in the USA (Cloudflare, Sentry, Mandrill). Cloudflare operates a global network, so data may be processed in the data centre closest to you. For transfers to countries without an adequate level of data protection, we rely on the EU–U.S. and Swiss–U.S. Data Privacy Framework where the recipient is certified under it, or on the European Commission's standard contractual clauses, which are also recognised in Switzerland.
7. How long we keep data
We keep personal data only for as long as it is needed for the purposes described in this policy, or for as long as we are legally required to keep it. After that, we delete or anonymise it. The retention periods for specific processing activities are described in sections 2 and 4.
8. Data security
We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. These include encrypted transmission (HTTPS), access controls based on user roles, hashed passwords and hosting in professionally operated data centres.
9. Your rights
Under the FADP and, where applicable, the GDPR, you have the right to:
- request access to the personal data we hold about you;
- have incorrect data corrected;
- have your data deleted;
- restrict or object to the processing of your data, in particular processing based on legitimate interests;
- receive the data you have provided in a commonly used electronic format;
- withdraw your consent at any time with effect for the future, where processing is based on consent.
For data for which we are the controller, contact us at info@stratos-tech.ch or by post at the address in section 1. For data that your garage has entered about you, contact your garage (section 4). We may ask you to prove your identity. We respond within 30 days.
You also have the right to lodge a complaint with a data protection authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch). In Sweden, it is the Swedish Authority for Privacy Protection (IMY, www.imy.se). In other EU/EEA countries, you can contact the supervisory authority in your country of residence.
10. Automated decision-making
We do not use automated individual decision-making or profiling that has legal or similarly significant effects on you.
11. Changes to this policy
We may update this privacy policy when Garage Booster or the law changes. The version published on this page applies. The date of the last update is shown at the top.