Effective: March 2023

Your privacy is important to California Auction Resources (“CAR”,” “we,” or, “us”). We developed this Privacy Policy to provide you with information on how we process your personal data when you visit our websites or our mobile applications (“apps”), including when you complete forms, and when you utilize our other offerings (e.g., newsletters, discussion lists, and announcement lists). Throughout this Privacy Policy, our websites and apps may be jointly referred to as our “Sites.” This Privacy Policy applies only to Sites on which this Privacy Policy is posted.

“Personal data” is information relating to an identified or identifiable natural person.

CATEGORIES OF PERSONAL DATA PROCESSED BY CAR: When you interact with our representatives via email, telephone, online, on social media, or in person, we may collect personal data, including your name, email address, phone number, branch, stock number, and service category. We also may create event logs that are useful in diagnosing server and app performance-related issues, and capturing information relating to support or service issues. To improve customer service, subject to applicable laws, we may also record and review conversations with customer support representatives, and analyze any feedback provided through voluntary surveys. With your consent, our customer support representatives may log in to your CAR account, if appropriate, to reproduce an issue and help troubleshoot and resolve your issue. As a security precaution, our customer support representatives will issue you a password reset after being asked to log in to your customer account. If you contact us on one of our social media platforms, your interactions with us are governed by this Privacy Policy, as well as the Privacy Policy of the social media platform you use.

• Purposes and Legal Grounds: We use this information to respond to your comments and questions, provide you with customer service, and to monitor and enhance the quality and types of customer service we provide to our customers. The legal ground for processing this information for these purposes is CAR’s legitimate interests in providing quality support and customer service. The legal ground for logging in to your CAR account, if appropriate, to help troubleshoot and resolve your issue is your consent, which you may withdraw at any time.

Personal data that is processed when you register for and use a CAR Account: We offer Free Accounts, Public Buyer Accounts, and Licensed Business Buyer Accounts. When you create and use your CAR account, you will be asked to enter your email address or Login ID and password. In addition, we collect the following information when you register for an CAR Account:

• Free Accounts. When you register for a free account, we collect your name and email address.
• Public Buyer Accounts. When you register for a Public Buyer Account, we collect your name, date of birth, street address, phone number, fax number, cell number, IP address, photocopy of government issued photo ID with signature (ID), ID number, ID state or country, ID expiration date.
• Licensed Business Buyer Accounts. When you register for a Licensed Business Buyer Account, we collect your name, company name, business license address, mailing address, phone number, fax number, cell number, IP address, photocopy of government issued photo ID with signature (ID), ID number, ID state or country, ID expiration date, business license (BL), BL number, BL effective date, BL expiration date.

Additional Bidders. When additional bidders are added to a Licensed Business Buyer Account, we will also collect the account owner’s name, company name, Buyer Number, and the new bidder’s name, relationship to company (employee (W-2) or agent/broker/representative), photocopy of the new bidder’s government issued photo ID with signature (ID), ID number, date of birth, ID state or country, ID expiration date, phone number, cell number, email address, and mailing address.

• Purposes and Legal Grounds:

o    All Accounts. CAR processes your email address or Login ID and password for the purpose of enabling you to securely log in to your CAR account. The legal ground for processing this information for this purpose is CAR’s legitimate interest in protecting the security of your CAR account. CAR may also process your email address, name, and mailing address for market research purposes, or for sending you information about your CAR account, which may include material changes to this Privacy Policy. The legal ground for processing this information for these purposes is CAR’s legitimate interest in conducting market research to improve our products and services, and CAR’s legitimate interest in providing you with information about your CAR account.

o    Free Accounts. CAR processes your name and email address or Login ID and password for the purpose of permitting you to have a Free Account, which allows you to browse and search our nationwide inventory, add vehicles to your Watch List, attend auctions online as a non-bidding guest, manage email alerts and preferences, and for CAR’s internal recordkeeping purposes. The legal ground for processing this information for this purpose is CAR’s legitimate interest in offering and providing services to guests who are interested in reviewing our inventory and attending CAR auctions as non-bidding guests.

o    Public Buyer Accounts. CAR processes your name, date of birth, street address, phone number, fax number, cell number, IP address, photocopy of government issued photo ID with signature (ID), ID number, ID state or country, and ID expiration date for the purposes of verifying that you meet the requirements to upgrade to a Public Buyer Account, which provides you with a Buyer Number and permits you to browse and search our nationwide inventory, add vehicles to your Watch List, attend auctions online, manage email alerts and preferences, access public auctions, bid online, on site, and via proxy at CAR branches in certain states in the U.S., buy instantly via Buy Now, and for CAR’s internal recordkeeping purposes. We also may process your name, date of birth, and address for purposes of meeting our regulatory obligations. The legal ground for processing this information for these purposes is CAR’s legitimate interests in offering and providing services to Public Buyers; permitting Public Buyers to bid and make purchases; and complying with applicable legal requirements.

o    Licensed Business Buyer Accounts. CAR processes your name, company name, business license address, mailing address, phone number, fax number, cell number, IP address, photocopy of government issued photo ID with signature (ID), ID number, ID state or country, ID expiration date, business license (BL) type, BL number, BL state of issue, BL effective date, BL expiration date, and tax identification number (e.g., social security number or employer identification number) for the purpose of verifying that you meet the requirements to upgrade to a Licensed Business Buyer Account, which provides you with a Buyer Number and permits you to browse and search our nationwide inventory, add vehicles to your Watch List, attend auctions online, manage email alerts and preferences, access all auctions where your license permits you to bid, bid online, on site, and via proxy at CAR branches where your license permits you to bid, buy instantly via Buy Now, add bidders to your account, and for CAR’s internal recordkeeping purposes. We also may process your name, date of birth, and address for purposes of meeting our regulatory obligations. The legal ground for processing this information for these purposes is CAR’s legitimate interests in offering and providing services to Licensed Business Buyers; permitting Licensed Business Buyers to bid and make purchases; and complying with applicable legal requirements.

o    Additional Bidders for Licensed Business Buyer Accounts. CAR processes the Licensed Business Buyer Account owner’s name, company name, Buyer Number, and the new bidder’s name, relationship to company (employee (W-2) or agent/broker/representative), photocopy of the new bidder’s government issued photo ID with signature (ID), ID number, date of birth, ID state or country, ID expiration date, phone number, cell number, email address, and mailing address for purposes of verifying that the new bidder meets the requirements to act as an authorized bidder on a Licensed Business Buyer Account and for CAR’s internal recordkeeping purposes. We also may process the names, dates of birth, and addresses of the Licensed Business Buyer Account owner and the new bidder for purposes of meeting our regulatory obligations. The legal ground for processing this information for these purposes is CAR’s legitimate interests in permitting multiple bidders to make purchases on a Licensed Business Buyer Account; protecting the security of Licensed Business Buyer Accounts; and complying with applicable legal requirements.

Personal data that is processed when you register for and attend one of our Tradeshows, Buyer Forums, or Buyer Seminars: When you register for and attend one of our tradeshows or an industry tradeshow, Buyer Forums, or Buyer Seminars, we may collect your name, telephone number, email address, Buyer Number, and the topics upon which you would like to receive additional information.

• Purposes and Legal Grounds: CAR processes this information for the purpose of planning for and hosting its tradeshows and industry tradeshows, Buyer Forums, and Buyer Seminars, and marketing CAR’s goods and services. The legal ground for processing this information for these purposes is CAR’s legitimate interest in effectively marketing CAR’s goods and services. CAR also processes this information for the purposes of sending you marketing communications and allowing our Marketing Alliance Partners (also known as Authorized Representatives and Licensed Brokers) to follow up with you (via email or telephone) to assist you with purchasing vehicles from CAR auctions, and making necessary transportation and shipping arrangements.

o    The general legal ground for processing this information for this purpose is CAR’s legitimate interest in providing our customers and our potential customers with marketing materials to effectively promote CAR’s products and services, and to follow up with potential customers who may need assistance purchasing vehicles from CAR auctions and arranging for transportation and shipping services.

o    If you provide your consent to receive marketing communications and allow our Marketing Alliance Partners (also known as Authorized Representatives and Licensed Brokers) to follow up with you (via email or telephone), the legal ground for processing your personal data for this purpose is your consent, which you may withdraw at any time.

Personal data that is processed when you allow CAR to access your mobile device location: With your consent, we may access the location of your mobile device for the purpose of offering you technology services, and monitoring and enhancing customer experience and service.

• Purposes and Legal Grounds: CAR processes your mobile device location in connection with geofencing technology services for the purposes of: (1) Identifying when you are close to an CAR auction location; (2) Sending you welcome messages when you arrive at an CAR auction; (3) Permitting you to avoid lines by electronically checking in at an CAR auction; (4) Sending you marketing messages tailored to your location; and (5) Identifying how many auction attendees have the CAR buyer app enabled at an CAR auction. The legal ground for processing this information for these purposes is your consent, which you can withdraw at any time by adjusting your mobile device settings within the CAR app.

Personal data that is processed when you search for, bid on, and purchase vehicles: When you search for, bid on, and purchase vehicles through our Sites, we receive information concerning your searching, bidding, and purchasing practices (e.g., vehicle segment, actual cash value (ACV), vehicle class, mileage, vehicle age). If you provide your consent, we may access the microphone on your mobile device to allow you to use voice controls when searching for vehicles. If you provide your consent, we may access the camera on your mobile device, so you can scan vehicle identification number (VIN) barcodes and request information about particular vehicles.

• Purposes and Legal Grounds:

o    We process your searching, bidding, and purchasing history for the purpose of better understanding your preferences, so we can identify vehicles that may be of interest to you, optimize your search results, and send you marketing information based on your vehicle preferences. The legal ground for processing this data for these purposes is CAR’s legitimate interest in understanding your vehicle preferences, so we can identify vehicles that are likely to be of the most interest to you, and our legitimate interest in reducing the number of marketing communications sent to customers by selecting which customers receive a particular marketing communication rather than sending every marketing communication to every customer.

o    We process statements you make through the microphone on your mobile device for the purpose of allowing you to conduct vehicle searches using voice commands. We process the images you take using the camera on your mobile device for the purpose of identifying VIN barcodes and providing you with information about particular vehicles. The legal ground for processing this data for these purposes is your consent, which you can withdraw at any time by adjusting your mobile device settings within the CAR app.

Personal data that is processed when you purchase a product or pay your annual account fee: When you purchase a product from CAR or pay your annual account fee, we collect your name, email address or Login ID, password, and Buyer Number to identify your account. For purchases, we use a shopping cart feature that safeguards your order information using industry standard SSL (Secure Socket Layer) encrypted connections. SSL encodes the information transferred between you and the server, rendering it unreadable to anyone trying to intercept the information. We use electronic payment vendors to process credit card data and to utilize I-Pay, which enables qualified buyers with company check writing privileges to make payments directly from a U.S.-based bank account via the Internet. If you authorize your bank to release your information to CAR (to obtain check-writing privileges), we may collect certain banking information, including your bank name, bank account number, bank address, date bank account opened, average balance of bank account, non-sufficient funds history, and whether your account has been maintained in an excellent, satisfactory, or other manner. If you decide to transport a vehicle using CAR Transport, we also collect your shipping address.

• Purposes and Legal Grounds:

o    We process your name, email address or Login ID, password, and Buyer Number for the purposes of enabling you to securely log in to your CAR account to make a payment, and allowing us to process your transaction and notify you of your purchase status. The legal grounds for processing this information for these purposes are: (1) CAR’s legitimate interest in protecting the security of payments made to your account; (2) CAR’s legitimate interest in communicating with you about your purchase status; and (3) The processing is necessary for the performance of a contract between CAR and you.

o    If you have a Licensed Business Buyer Account, with your authorization, CAR processes your banking information, including your bank name, bank account number, bank address, date bank account opened, average balance of bank account, non-sufficient funds history, and other information pertinent to CAR’s acceptance of checks from you, for the purpose of verifying that CAR can safely accept checks from you. The legal ground for processing this information for this purpose is your consent, which can be withdrawn by revoking the authorization permitting your bank to release such information to CAR.

o    If you choose to transport a vehicle using CAR Transport, we process your shipping address for the purpose of obtaining a quote for transportation services, scheduling transportation, and tracking shipment of your vehicle. The legal ground for processing this information for these purposes is CAR’s legitimate interest in providing customers with convenient and reliable vehicle transportation services.

Personal data that is processed when you donate, consign, or sell a vehicle: When you donate, consign, or sell a vehicle, we may collect your name, business name, mailing address, email address, phone number, designation as a licensed dealer, other business license, vehicle owner, taxpayer identification number (e.g., social security number or employer identification number), as well as information concerning your vehicle (e.g., VIN number, mileage, value of your vehicle, and vehicle zip code).

• Purposes and Legal Grounds: CAR processes this information for the purpose of permitting you to donate, consign, or sell your vehicle. The legal grounds for processing this information is that it is necessary for the performance of a contract between CAR and you, and CAR’s legitimate interest in complying with applicable legal requirements. When you donate a vehicle, your personal data may also be shared with the benefactor charity for the purpose of allowing the benefactor charity to thank you for your donation. The legal ground for processing this information for this purpose is the benefactor charities’ legitimate interest in thanking donors.

Personal data that is processed when you request access to CAR industry reports, submit a form to learn more about an CAR service, or register for our contests, newsletters, clubs, activities, discussion lists, or announcement lists: When you request access to CAR industry reports, submit a form to learn more about an CAR service, or register for our contests, newsletters, clubs, activities, discussion lists, or announcement lists, we may collect your name, company name, email address, city, and state.

• Purposes and Legal Grounds: CAR processes this information for the purpose of permitting you to access CAR industry reports, learn more about a CAR service, or register for our contests, newsletters, clubs, activities, discussion lists, or announcement lists. The legal ground for processing this information for these purposes is CAR’s legitimate interest in permitting you to have access to the information and services that you request.

Personal data that is processed when you complete a customer survey: When you complete a customer survey we may collect your name, mailing address, email address, phone number, company name, job title, emergency contact, and information about your customer experiences, preferences, and interests.

• Purposes and Legal Grounds: When you complete a customer survey, the information you choose to provide to us will be processed, analyzed, and used in reports and other analyses of consumer experiences and preferences for the purposes of improving and marketing CAR’s goods or services, or for any other uses we disclose to you at the time the information is collected. The legal ground for processing your personal data for these purposes is CAR’s legitimate interests in obtaining feedback from our customers in order to help us improve and market our products and services for the benefit of our customers and our business.

Personal data that is processed for marketing purposes: When you register for an account, download the CAR buyer app, search for vehicles, place bids, purchase products, request information, complete a customer survey, or otherwise provide us with personal data, we may process your personal data for marketing purposes. We may also collect personal data from third-party sources, including our affiliates and organizations, such as the National Independent Automobile Dealers Association (NIADA). With your consent, we may access your mobile device location for the purpose of communicating with you when you are in close proximity to one of our auction locations. The electronic marketing communications you receive from CAR may be based on your location, and other indicators, such as your bidding behavior and typical purchases (e.g., location, vehicle type, mileage).

• Purposes and Legal Grounds:

o    We process your email address, mobile device number, location (city, state, zip), buyer type (public vs. nonpublic), and other contact and demographic data to send you periodic marketing materials, including but not limited to birthday and anniversary cards, sponsored social media marketing messages, mobile notifications of our auctions, and other electronic marketing communications and publications for the purpose of notifying you of CAR’s products and services, product updates, special offers, and other issues. We may also share your personal data with our social media partners that assist us in identifying others who are likely to be interested in CAR’s products and services.

o    The general legal ground for processing your email address and other contact data for this purpose is CAR’s legitimate interest in providing our customers and our potential customers with marketing materials to effectively promote CAR’s products and services.

o    If you provide your consent to receive marketing communications and publications from CAR, the legal ground for processing your email address and other contact data for this purpose is your consent, which you may withdraw at any time by through the Unsubscribe link at the bottom of each electronic marketing communication or by updating your preferences in our Profile Center or Subscription Center. Buyers will also have the opportunity to opt-out of receiving push notifications through the CAR buyer app.

o    We process location and other information, such as bidding behavior, typical purchases, interests, and preferences for the purpose of providing our customers and potential customers with electronic marketing communications that are likely to be of specific interest to them. The legal ground for processing location data is your consent, which you may withdraw by adjusting your mobile device settings. The legal ground for processing information concerning bidding behavior, typical purchases, interests, and preferences is our legitimate interest in providing our customers and potential customers with electronic marketing communications that are likely to be of interest to them rather than sending every electronic marketing communication to every customer.

Personal data that is processed when you upload information or content to the CAR website, including videos, comments, feedback, and other information: If you upload videos, comments, feedback, or other information, we will collect any personal information contained in such content. Please keep in mind that whenever you voluntarily disclose personal data online in a forum accessible by others, for example through email, a newsgroup, discussion lists, or elsewhere, that personal data can be collected and used by others. If you post personal data online that is accessible to the public, you may receive unsolicited messages from other parties in return. Please exercise caution whenever you post information online.

• Purposes and Legal Grounds: CAR processes your videos, comments, feedback, and other information for the purpose of providing our users with the opportunity share such content with other users. The legal ground for processing this information for this purpose is CAR’s legitimate interest in enabling our users to provide comments, feedback, and other information they desire to share with CAR and other viewers of CAR’s Sites.

Personal data that is processed when you sign in to your CAR account using social media: If you choose to sign in to your CAR account using your social media sign-in credentials (e.g., your Facebook sign-in credentials), the first time you do so you will be asked whether you agree that the social media provider may provide certain information to CAR, such as your name, email address, gender, age, likes, interests, profile photo, posts, comments and other information associated with your social media account. All of this is made available to CAR by the social media provider due to the way the social media sign-on configuration works. If you do not want your information to be shared with CAR by the social media provider, you can simply sign in to your CAR account using your CAR account credentials instead of your social media credentials.

• Purposes and Legal Grounds: CAR processes this information to provide you with an alternative method to sign in to your CAR buyer Account, and for the purpose of creating effective marketing campaigns and customizing marketing that is focused on your preferences. The legal grounds for processing this information for these purposes is CAR’s legitimate interest in providing you an alternative sign-in method, and effectively marketing our products and services to our customers.

Personal data that is processed when you apply to be listed as a transportation vendor, export vendor, or inbound tower: If you apply to be listed as a resource for buyers in need of transportation and/or shipping services, or as a tower looking for inbound towing opportunities, you will be asked to complete an application, which may collect your name, company name, URL, mailing address, phone number, email address, years in business, and information about your services.

• Purposes and Legal Grounds: CAR processes this information for the purpose of determining whether you are eligible to be listed as a resource for buyers looking for transportation/shipping services, or as a tower looking for inbound towing opportunities. The legal ground for processing this information for these purposes, is CAR’s legitimate interest in providing buyers with reliable transportation/shipping resources; identifying reliable vendors for inbound towing opportunities; and complying with applicable legal requirements.

Personal data that is processed when you upload your resume and/or apply for a position at CAR: If you choose to upload a copy of your resume and/or complete an application, we may collect a variety of personal data, including your name, mailing address, email address, phone number, Social Security number, work experience, education history, references, information about your applicable degrees, licenses, and certifications, veteran status, whether you are 18 years of age or older, whether you are legally eligible to work in the country to which you are applying, whether you will require an employer to sponsor you for employment-based visa status in the U.S., whether you have a valid driver’s license, whether you or your relatives have ever worked for CAR or one of our affiliates, your pay expectations, whether you are willing to relocate if required and any other information in your application that you choose to share with us, such as personal preferences, hobbies, social preferences, etc.

• Purposes and Legal Grounds: CAR processes this information for the purpose of permitting you to be considered and evaluated for open positions that CAR is seeking to fill. The legal ground for processing this information for this purpose is CAR’s legitimate interest in analyzing resume and application information in connection with identifying qualified candidates to fill open positions at CAR, and compliance with CAR’s legal obligations where laws or contractual obligations require the processing of personal information.

Personal data that is processed when we use cookies and similar technologies to collect Usage Data: CAR’s web servers collect personal data pertaining to users of our Sites and the mobile devices and programs from which they access our Sites (“Usage Data”). Usage data can include IP address, domain name, referring web page, browser type, mobile device type and location, device operating system, device settings, and information about the way you use your device or the Sites (such as session time, pages visited, links or ads clicked, and whether a user is new or returning). Mobile applications collect device identifiers, and also may request permission to access certain features (e.g., microphone, camera, location) and display push notifications.

Usage data is gathered using the following methods: (1) cookies, (2) tags (a.k.a. web beacons or clear gifs), (3) conversion tracking (track clicks to sales from search results or ads), (4) general detection and use of your internet protocol (IP) address or domain name, and (5) third-party website analytics tools, including Google Analytics. CAR does not track individual user’s online activities over time across third party websites (and thus does not monitor your browser’s Do Not Track indicator).

Cookies

A cookie is a token that a server gives to your browser when you access an Internet website. Cookies can store many types of data. Cookies can help provide additional functionality to the Sites or help us analyze Site usage more accurately. Information gathered from the use of cookies may be combined with other data sources.

For more information on the types of cookies we collect, to control cookie settings and/or to disallow, delete and otherwise manage cookies, please visit our “Privacy Preference Center” with additional information about the different types of cookies used (e.g., strictly necessary, performance, functional, targeting) and your options for setting controls. Additionally, if you reside in the European Union or other jurisdiction that requires us to obtain your consent to use cookies on our Sites, then you will have an opportunity to manage your cookie preferences on our Sites, other than certain cookies required to enable core Site functionality, which you cannot choose to disable.

• Purposes and Legal Grounds: Usage data is collected for the purpose of helping us manage and administer our Sites, improving the content of our Sites, measuring the effectiveness of our advertising, Site administration and analytic purposes, providing aggregate or statistical reviews of user Site traffic patterns, personalizing content and internal ads, providing social media features, and customizing and improving the user experience and functionality of our Sites. The legal ground for processing this data for these purposes is our legitimate interest in conducting analytics and understanding how users interact with our Sites, so we can enhance the user experience and functionality of our Sites. If you do not want Usage Data collected through the use of these technologies, there is a simple procedure in most browsers that allows you to automatically decline many of these technologies, or to be given the choice of declining or accepting them.

THIRD-PARTY RECIPIENTS OF PERSONAL DATA

In connection with the purposes set forth in this Privacy Policy, we may share your personal data with:

• Our affiliates: Your personal data may be shared with any member or affiliate of our corporate group.
• Other data subjects: Your personal data may be shared with other users of our Sites (e.g., when you upload videos, comments, feedback, and other information).
• Select business partners and third-party service providers: Your personal data may be shared with our business partners, third-party service providers, contractors and sub-contractors, including:

o    Electronic payment vendors: We use electronic payment vendors to process credit card data and to utilize I-Pay, which enables qualified buyers with company check writing privileges to make payments directly from a U.S.-based bank account via the Internet.

o    Third-party advertising, social media, and analytics partners: We also share information about your use of the Sites with our social media, advertising and analytics partners. Our third-party ad networks and social media companies may use cookies, tags and other technology to collect information about your browsing activities over time and across different websites when you visit our Sites. Third party vendors or ad networks may use cookies, tags and other mechanisms to serve ads on other sites based on a user’s prior visits to our Sites. You may opt out of participation with various third-party networks by visiting the Network Advertising Initiative opt out page. We also share information about your use of our Sites with our third-party providers that assist us with improvement and optimization of our Sites.

o    Third-party app, platform or other service providers: We share the personal data we collect with third-party app, platform and other service providers, such as database managers/developers, and web developers/hosting companies that assist us with certain processing activities, such as storing/backing up data, enhancing/maintaining databases, publishing content, and developing/offering a variety of products/services. If you use our Sites, your personal data, including name, contact information and any stored biographical/firm information within CAR’s database, may be stored and processed through some of our third-party app vendors. We also use third party providers to distribute organizational emails.

o    Third-party transportation vendors: If a buyer chooses to transport a vehicle using CAR Transport services, CAR shares the buyer’s contact information, including shipping address with our third-party transportation vendors for the purpose of obtaining quotes, scheduling transportation, and tracking shipments.

o    Third-party Marketing Alliance Partners: If you register for and/or attend one of our seminars, we may share your personal data with our marketing alliance partners, so they can assist you with your purchase and arranging for transportation and shipping services.

o    Third-party charities: When you donate a vehicle, we may share your personal data with the benefactor charity for the purpose of allowing the benefactor charity to personally thank you for your donation.

• Governmental entities and third parties in connection with legal obligations, remedies and claims: We may disclose personal data about you to governmental entities, such as regulatory agencies, law enforcement, and judicial authorities, as well as other third parties under any of the following conditions: (a) if we have your valid consent to do so; (b) to comply with a valid subpoena, legal order, court order, warrant, legal process, or other legal obligation; (c) to enforce or apply any of our terms and conditions, policies, or other agreements; (d) exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction; or (e) as necessary to pursue available legal remedies or defend legal claims. We also may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
• Third parties in connection with a potential reorganization: We may share your personal data to a prospective seller or buyer in the event of a potential reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of CAR’s assets or stock, including without limitation, in connection with any bankruptcy or similar proceeding, provided that such entity will not be permitted to process your personal data other than as described in this Privacy Policy without providing you notice and, if required by applicable laws, obtaining your consent.
• Third parties in connection with screenings for jobs: We may also share your personal data with third parties who provide services to us such as recruitment agencies, consultants, background services and lawyers. If your personal information is shared in this way, CAR does so only on a “need-to-know” basis and will seek to ensure it is only used in connection with the functions or services these parties will be performing for CAR and that your personal information is treated by them in a confidential manner. These service providers that CAR uses may change over time but we will always seek to ensure that any third parties who handle your personal information will do so in a manner consistent with this Privacy Policy and in accordance with applicable law

Information We Collect from Other Sources

Financial institutions, manufacturing companies, and dealerships may also send us information about you. We take measures to ensure that these third-parties have a lawful or contractual right to collect, use, or disclose your information before providing any data to us. This information is used for our legitimate business interest.

LINKS TO OTHER SITES

As a resource to our visitors, our Sites contain offerings from other companies that you can link to through our Sites (such as Automotive Finance Vendors, Licensed Brokers, Transportation/Shipping Vendors, and Inspection Vendors). When you click on such a link on our Sites, you will be taken to the website of the other company, and its privacy practices will govern your use of that website and your interactions with that company.

We try to carefully choose websites that we believe are useful and meet our standards. However, the presence on our Sites of links to non-CAR websites does not mean that CAR endorses or accepts any responsibility for the content or use of such websites. CAR has no control over such websites, and has no responsibility for the privacy practices of such websites.

CROSS-BORDER TRANSFERS OF PERSONAL DATA

We store our data on servers in the United States. If you are located outside the U.S., your personal data will be transferred to servers in the U.S. The data protection laws of the U.S. may not be as comprehensive as the laws of your country. For example, personal data transferred to the U.S. may be subject to lawful access requests by federal and state authorities in the U.S. CAR may transfer your personal information to other countries such as India and the Philippines for the purposes described in this Privacy Policy. In order to provide adequate protection of your personal information, we have in place contractual arrangements (where appropriate) which cover these transfers and we will take all reasonable measures to safeguard your information whenever it is transferred.

Any transfers of personal data from the European Union, the United Kingdom and/or Switzerland to the United States are made pursuant to the EU-U.S. Privacy Shield, the Swiss-U.S. Privacy Shield, or pursuant to European Commission-approved Standard Contractual Clauses.

CAR participates in and complies with the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework (Privacy Shield) as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal data transferred from the European Union, the United Kingdom and/or Switzerland to the United States in reliance on Privacy Shield. CAR has certified to the Department of Commerce that it adheres to the Privacy Shield Principles and the Swiss-U.S. Privacy Shield Principles (collectively, the “Privacy Shield Principles”). If there is any conflict between the terms in this Privacy Policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern. You can learn more about the Privacy Shield program, and view our certification here.

CAR is committed to subject to the Privacy Shield Principles all personal data received from the European Union, the United Kingdom and/or Switzerland in reliance on the Privacy Shield. CAR is subject to the oversight of the U.S. Federal Trade Commission, which has jurisdiction over CAR’s compliance with the Privacy Shield Principles. CAR will remain responsible for the processing of personal data in a manner inconsistent with the Privacy Shield Principles by third parties to which CAR has transferred personal data unless CAR proves it is not in any way responsible for the event giving rise to the damage.

You may contact CAR anytime with your privacy questions or concerns.

CHILDREN AND MINORS’ PRIVACY

Our Sites are not directed to individuals under the age of 18. We do not knowingly collect or use any personal data from users under 18 years of age. No information should be submitted to our Sites by visitors under 18 years of age, and visitors under 18 years old are not allowed to register for our contests, newsletter, clubs or activities. You must be 18 years or older to purchase products. If we learn that we have collected personal data from someone under 18, we will take steps to delete the information as soon as possible.

RETENTION OF PERSONAL DATA

The personal data that we collect from you is stored on our secure servers for as long as is reasonably necessary for the purposes for which the personal data is processed and to meet CAR’s legal obligations.

PROTECTING YOUR PERSONAL DATA

We are committed to protecting the information entrusted to us. We have implemented technical and organizational measures designed to assist in maintaining the security and confidentiality of personal data; safeguarding against anticipated threats to the confidentiality, integrity, and availability of personal data; and protecting your personal data against accidental or unlawful destruction, loss, alteration, and unauthorized access or disclosure.

However, whenever personal data is processed, there is a risk that such data could be lost, misused, modified, hacked, breached, and/or otherwise accessed by an unauthorized third party. No system or online transmission of data is completely secure. In addition to the technical and organizational measures that CAR has in place to protect your personal data, you should use appropriate security measures to protect your personal data. If you believe that your CAR account or any information you provided to us is no longer secure, notify us immediately.

YOUR RIGHTS IN RELATION TO YOUR PERSONAL DATA

If you reside in the European Union, you have various rights under the General Data Protection Regulation (GDPR) regarding the processing of your personal data, including under certain circumstances, the right to request access to and rectification or erasure of your personal data, data portability, restriction of processing of your personal data, the right to lodge a complaint with a supervisory authority, and the right to object to the processing of your personal data on certain grounds, including:

• The right to object when your personal data is processed based on the legitimate interests of CAR or a third party, including profiling related to such legitimate interests.
• The right to object when your personal data is processed for direct marketing purposes, including profiling related to direct marketing.

If you live in the European Union, and you wish to exercise any of these rights, you can make a request by writing to us at the following local address: Data Privacy Manager, 140 Progress, Suite 100, Irvine CA, 92618 or contact us. If you do not live in the European Union but you believe you have rights under your local laws, please contact us.

If you reside outside of the European Union, you may have similar rights under your local laws. If you reside in California, please see below.

If you reside in the European Union, the United Kingdom or Switzerland, you also have the right, under the Privacy Shield, to access and to correct, amend or delete your personal data where it is inaccurate or where it has been processed in violation of the Privacy Shield Principles, except where the burden or expense of providing access would be disproportionate to the risks to your privacy or where the rights of other individuals would be violated.

If you reside in the European Union, the United Kingdom or Switzerland, your rights under the Privacy Shield include the right to notice of the choices and means that CAR offers you for limiting the use and disclosure of your personal data. CAR provides you with the opportunity to choose how your personal data may be used under certain circumstances. If your personal data is to be used for a new purpose that is materially different from that for which your personal data was originally collected or subsequently authorized, or if your personal data is to be disclosed to a third-party controller, CAR will provide you with an opportunity to choose whether to have your personal data so used or disclosed. When sharing your personal data with third-party processors that CAR has retained to perform services on its behalf and pursuant to its instructions, CAR may disclose your personal data without offering an opportunity to opt out.

CAR also provides you with specific rights related to your sensitive personal data. “Sensitive Data” under the EU-U.S. Privacy Shield Framework is defined as personal data specifying medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or information specifying the sex life of an individual. Under the Swiss-U.S. Privacy Shield Framework, “Sensitive Data” means personal data specifying medical or health conditions, personal sexuality, racial or ethnic origin, political opinions, religious, ideological or trade union-related views or activities, or information on social security measures or administrative or criminal proceedings and sanctions, which are treated outside pending proceedings. If your sensitive personal data is to be used for a new purpose that is different from that for which your sensitive personal data was originally collected or subsequently authorized, or is to be disclosed to a third party, CAR will obtain your affirmative express consent prior to such use or such disclosure.

In compliance with the Privacy Shield Principles, CAR is committed to resolving complaints about our collection and use of EU/UK/Swiss personal data. EU, UK and/or Swiss individuals with inquiries or complaints regarding our Privacy Shield policy should first contact CAR by email or by writing to us via mail at: Data Privacy Manager, 13832 Valley Blvd, La Puente, CA 91746.

ENTITIES COVERED BY THIS PRIVACY POLICY

Our following U.S. companies adhere to the Privacy Shield Principles:

• CAR, Inc.

YOUR CALIFORNIA PRIVACY DISCLOSURES

This “Your California Privacy Disclosures” supplements the Privacy Policy and contains the disclosures required under the California Consumer Privacy Act (“CCPA”). For individuals who are California residents, the CCPA requires certain disclosures about the categories of personal data we collect and how we use it, the categories of sources from whom we collect personal data, and the third parties with whom we share it.

Please note that for California residents, the term personal data as used in this section (referred to as personal information under the CCPA) means information that identifies, relates to, describes, is reasonably capable of being associated with or could reasonably be linked, directly or indirectly, with a particular consumer or household as defined in the CCPA. All other capitalized terms have the same meanings as given them in the Privacy Policy.

If you are a California resident who has provided personal data to CAR, or a California resident that reasonably believes that CAR collected or stores their personal data, you may exercise your rights under the CCPA and contact us.

You have the right to request CAR to:

1. (a) Disclose if we have collected personal data on you;
2. (b) Disclose the categories of personal data that we have collected on you (if any); the categories of sources from which the personal data is collected; the business or commercial purpose for collecting or selling personal data; and the categories of third parties with whom the business shares personal data;
3. (c) Disclose the specific pieces of personal data that we have collected on you (if any); and
4. (d) Delete personal data we have collected on you (if you satisfy the conditions set out in the CCPA).

NOTE: we do not sell your personal data as that term is defined in the CCPA and for this reason we do not provide an opt-out from the sale of your personal data.

In order to submit a request, we will need to verify your identity. If you have an account with us that is password-protected, we may verify your identity through our existing authentication practices for your account.

If you do not have an account with us, and your request concerns “categories” of personal data collected, we can request from you two data points of personal data to verify your identity. If you do not have an account with us, and your request concerns specific personal data, we can request from you at least three data points of personal data as well as a signed declaration with penalty of perjury to verify your identity.

Please note that following your verified request, we will send you your personal data in an email (Any response to your request, including any personal data may be sent as an encrypted file).

Please note that once you have submitted a request, we will send you a receipt, acknowledging your request, within 10 days. If, for some reason, you do not receive such a receipt within 10 days of your submitted request, please contact us as an error may have occurred.

We will process and respond to your request within 45 days after it is received (in some cases, as is allowed under the CCPA, this process may be extended by an additional 45-90 days). Please note, that regarding requests to know or access under subsections (a), (b), and (c) above, you may only make two requests in a 12-month period, and the information provided need only cover the 12-month period prior to your request.

Authorized Agent: As a California resident, you also have the right to designate an agent to exercise these rights on your behalf. If you choose to exercise your rights through the use of an authorized agent, we require that you verify the agent’s identity, and provide written permission granting the agent authority to submit a request on your behalf.

We hereby inform you that if you exercise any of your rights under the CCPA we may not deny you goods or services for that reason, or subject you to different prices than those paid by other consumers, unless provided otherwise under the CCPA, Federal, or State law.

Notice of Information We Collect

Pursuant to California Civil Section 1798.100(b), this serves as notice of the categories of personal data that we collect through the Site and Services and the commercial purposes for which the information was collected. Please note that all of the categories of personal data we collect about you (as detailed below) come from the following categories of sources:

• You, including through your use of our services
• Automatically collected from you
• Our affiliate companies
• Third parties

In particular, we will collect the following categories of personal data from California consumers: