Privacy Policy

1. Data We Collect

We may collect the following categories of personal data:

• Contact information: name, company name, email address, phone number, and office location (when you submit an enquiry or register for an event).
• Transaction data: payment details and order history (processed via Razorpay; KaM Auto does not store card details).
• Event registration data: name, company, and contact information provided when registering for seminars or workshops.
• Usage data: IP address, browser type, pages visited, time on page, and referring URLs collected via Google Analytics 4.
• Cookie data: preferences and analytics identifiers stored in browser cookies (see Section 6).
• Correspondence: the content of enquiries or messages you send us by email, phone, or the contact form.

2. How We Use Your Data

We use personal data for the following purposes:

• To respond to service enquiries and provide the testing, inspection, or certification services you have requested.
• To process event registrations and, where applicable, payment transactions.
• To send you newsletters and regulatory updates where you have subscribed (you may unsubscribe at any time).
• To improve our website and services through aggregated, anonymised analytics data.
• To comply with legal obligations under Indian law, GDPR, or other applicable regulations.
• To maintain records of our business relationships and communications as required for legitimate business administration.

3. Legal Basis for Processing

For individuals in the EEA or UK, our legal bases for processing personal data are:

• Consent (GDPR Article 6(1)(a)): for newsletter subscriptions and analytics cookies.
• Contract (GDPR Article 6(1)(b)): to deliver services you have requested or to fulfil event registrations.
• Legal obligation (GDPR Article 6(1)(c)): where processing is required by applicable law.
• Legitimate interests (GDPR Article 6(1)(f)): for business administration, fraud prevention, and improving our services.

For individuals in India, our processing is conducted in accordance with the India Digital Personal Data Protection Act 2023 (DPDP Act) under the relevant lawful bases including consent and legitimate uses as defined in that Act.

4. Data Sharing

We do not sell your personal data. We may share personal data with:

• Service providers: third-party processors who assist us in operating our website, processing payments (Razorpay), and providing analytics (Google Analytics 4). These parties are contractually bound to process data only as instructed.
• Partnership organisations: VCA UK and Kiwa Netherlands, where the provision of certification services requires sharing relevant client and project information.
• Legal authorities: where required by law, court order, or government regulation.

5. Data Retention

We retain personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Specifically: enquiry and service records are retained for 7 years; event registration data is retained for 3 years following the event; newsletter subscriber data is retained until you unsubscribe; analytics data is retained in anonymised form. You may request deletion of your data at any time (see Section 7).

6. Cookies

Our website uses the following types of cookies:

• Essential cookies: required for the website to function. These cannot be disabled.
• Analytics cookies: used by Google Analytics 4 to collect anonymised data about how visitors use our website. These are only set with your consent.
• Preference cookies: used to remember your cookie consent choice.

You may withdraw your consent to non-essential cookies at any time by clearing your browser cookies and declining consent when you next visit the site.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right of access: to request a copy of the personal data we hold about you.
• Right to rectification: to request correction of inaccurate data.
• Right to erasure: to request deletion of your personal data where there is no compelling reason for its continued processing.
• Right to data portability: to receive your data in a structured, machine-readable format.
• Right to object: to object to processing based on legitimate interests.
• Right to withdraw consent: to withdraw consent for processing based on consent at any time.

These rights apply under GDPR, UK GDPR, and the India DPDP Act 2023 (where applicable). To exercise any of these rights, please contact us at the address below.

8. Contact for Data Requests

For all data protection enquiries, requests to exercise your rights, or complaints regarding our privacy practices, please contact our Data Protection Officer:

If you are located in the EEA and are not satisfied with our response to a data protection complaint, you have the right to lodge a complaint with your local supervisory authority. If you are located in India, you may raise complaints with the Data Protection Board of India once established under the DPDP Act 2023.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will post any changes on this page and, where appropriate, notify you by email. The "Last updated" date at the top of this page indicates when this policy was most recently revised.