Privacy Policy

1. Data controller

The data controller for the Service is Fast OTA Diag. For privacy requests, contact the administrator named on our Contact page (email below).

If you access the Service through a workshop, fleet operator, or partner organisation, that organisation may also act as an independent controller for data it collects in its own systems (for example workshop customer records).

2. Scope

This policy covers: engineer and admin accounts on the portal; workshop Client and engineer Server agents; diagnostic jobs and live sessions; licensing and subscription records; support and email communications; and technical logs needed to operate and secure the Service.

It does not cover third-party OEM diagnostic tools, Windows, antivirus, or websites you open outside Fast OTA Diag. Those have their own policies.

3. Personal data we process

Account data: full name, email address, password hash, role, email verification status, language preference, and account status.

Organisation / commercial data: workshop or company name where provided, subscription and seat/licence information, activation codes, and billing-related metadata needed to manage access.

Job and session data: job titles and descriptions, customer/workshop references you enter, vehicle identifiers you choose to record (for example VIN, brand, model, registration), connection codes, session status, approvals, timestamps, and audit events (who did what, when).

Technical data: IP address, user agent, approximate device/OS information, application version, error diagnostics, and security logs (sign-in attempts, CSRF tokens, session cookies).

Communications: messages you send us by email or through support channels.

4. Purposes and legal bases

Provide the Service (create accounts, authenticate users, run jobs, bridge Client and Server, enforce licences) — contract performance (Art. 6(1)(b) GDPR).

Secure the platform (fraud prevention, abuse detection, audit trails, incident response) — legitimate interests and, where required, legal obligation (Art. 6(1)(f) and 6(1)(c)).

Communicate about the account (verification, password reset, service notices) — contract and legitimate interests.

Improve reliability and support (aggregate diagnostics, troubleshooting) — legitimate interests. We do not sell personal data or use it for third-party advertising.

Comply with law (tax, accounting, lawful requests) — legal obligation.

5. Remote diagnostics and vehicle-related data

Remote diagnostics may involve vehicle-related information entered by the workshop or engineer. You must only enter data you are allowed to process and must obtain any customer consent required under local law before starting a session.

The live bridge is intended to carry diagnostic traffic between authorised endpoints. We may retain session metadata and audit events for security, dispute handling, and service quality. Do not use the Service to capture unnecessary personal data of vehicle owners.

6. Sharing and processors

We use infrastructure and email providers to host and operate the Service (for example cloud hosting and transactional email). They process data only on our instructions under appropriate agreements.

We may share limited data with payment or licensing partners when you purchase or redeem a subscription, and with professional advisers or authorities when legally required.

We do not sell personal data. Engineers on a shared organisation may see job and session information according to their role permissions.

7. International transfers

Primary processing is intended for EU/EEA operation. If a processor stores or accesses data outside the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses and supplementary measures where required.

8. Retention

Account data is kept while the account is active and for a reasonable period afterwards for security, billing, and legal claims (typically up to the periods required by applicable commercial and limitation laws).

Job, session, and audit records are retained as long as needed for operations, security investigations, and licence compliance, then deleted or anonymised.

Email verification and password-reset tokens expire after a short period.

You may request deletion where applicable; we may retain limited data when required by law or to establish, exercise, or defend legal claims.

9. Security

We use industry-standard measures appropriate to a remote-diagnostics platform, including encrypted transport (HTTPS/WSS), hashed passwords, session cookies, CSRF protection, role-based access, and operational logging.

No method of transmission or storage is 100% secure. You must protect your credentials, devices, and workshop PCs, and report suspected unauthorised access promptly.

10. Your rights

Subject to GDPR and local law, you may request: access; rectification; erasure; restriction; data portability; and objection to processing based on legitimate interests.

Where processing is based on consent (for example optional cookies), you may withdraw consent at any time without affecting prior lawful processing.

You may lodge a complaint with your local supervisory authority. We encourage you to contact us first so we can resolve the issue.

11. Children

The Service is intended for professional automotive use by adults. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this Privacy Policy when the Service or the law changes. The “Last updated” date at the top of this page will change. Material changes may also be communicated through the portal or by email where appropriate.

13. Contact

For privacy questions or requests, email the administrator listed on the Contact page. Please include enough detail for us to verify your identity and respond.