Privacy Notice
Scope and Legal Framework
This notice supplements our Privacy Policy and addresses rights under:
- GDPR (EU/UK residents)
- CCPA/CPRA (California consumers)
- VCDPA (Virginia residents)
Expanded Data Categories
Personal Identifiers
- Full name, alias
- Postal address, email, phone
- Driver’s license/state ID (for test drives)
Commercial Information
- Vehicle purchase/lease history
- Service records
- Financing applications
Internet Activity
- Cookies and tracking technologies (see Cookie Policy)
- Geolocation data (with consent)
- Social media interactions
Inferences
- Predicted interests (e.g., SUV buyers)
- Creditworthiness assessments
Detailed Rights Overview
Access & Portability
Request a copy of your data in a structured, machine-readable format.
Correction
Update inaccurate details (e.g., contact information).
Deletion
"Right to be forgotten," subject to legal retention requirements.
Opt-Out Rights
- Sales/sharing (CCPA): We do not sell data but allow opt-out from targeted ads.
- Automated decision-making: Request human review of credit decisions.
Non-Discrimination
We will not deny services for exercising privacy rights.
Submission Process
To exercise rights:
- Email: privacy@car-2000.com
- Web Form: Submit via our Data Subject Request Portal
- Mail: CAR 2000 INC, Legal Department, [Address]
We verify requests via:
- Account authentication
- Government ID matching
Response timeline: 45 days (extendable under law).
Data Sharing Map
| Recipient Category | Purpose | Examples |
|---|---|---|
| Lenders | Financing approvals | Ally Financial, Capital One |
| Insurers | Policy underwriting | State Farm, Progressive |
| Service Providers | Marketing, IT support | Salesforce, CDK Global |
International Data Transfers
For EU/UK data:
- Standard Contractual Clauses (SCCs) with vendors.
- Data localization where required.
Contact: privacy@car-2000.com