DEALERSHIP - PRIVACY POLICY

Updated: June 23, 2023

OUR APPROACH TO PRIVACY

We are committed to protecting the privacy of your personal information (Personal Information or PI) and the responsible use of that information to deliver personalized, relevant content to our customers. This Privacy Policy applies to this website or mobile application and the websites and mobile applications that display this Privacy Policy (collectively, Sites). We may also operate additional websites or mobile applications that are governed by their own privacy policies. This Privacy Policy describes our policies and procedures for the collection, use and disclosure of your information and data on these Sites and the services available through them (Services).

Our Sites also contain a link to our Website Terms of Use which govern your use of these Sites and the Services available through them. You understand that by using these Sites or Services you agree to the terms of both this Privacy Policy and the Website Terms of Use.

INFORMATION WE COLLECT

• Your contact information, e.g., name, postal and email address, phone number
• Information you provide when communicating with us via email, mail, call, chat or text
• Information about your vehicle - such as sales and service history, vehicle payments, VIN, and mileage
• Information required to process vehicle finance/loan applications and purchases, such as driver’s license, insurance policy numbers, social security numbers and other financial and credit-related information
• Payment information, to process sales and service transactions
• Details about your online activity and other personal preferences when using our Sites and Services
• Social media details and other information you choose to share on those platforms
• Information about how you access and use our Sites and Services, e.g., computer IP address, browser, type of device used, Site pages visited, geolocation, time and date of visit

HOW WE COLLECT INFORMATION

• Information you choose to provide through our Sites or Services
• From our affiliates
• From automotive manufacturers
• From our subcontractors, vendors and other third party providers (our Suppliers), including marketing agencies, advertising networks, credit reporting agencies, social media networks, data brokers, online lead providers and the like
• Automatically, from devices you use to connect to or interact with our Sites and Services
• Through communications with you via email, mail, phone, chat or text, copies or recordings of which we may retain

HOW WE USE YOUR INFORMATION

• Provide our Services to you
• Communicate with you and respond to your inquiries
• Customize information we provide you, including contextual customization of ads based on your interactions with our Sites
• Promote and market our Services to you
• Advertise to you on third party websites (e.g., Google, Bing, YouTube, Facebook, Instagram)
• Process transactions and payments, verify customer information and confirm eligibility for manufacturer rebates
• Provide or facilitate financing in connection with a vehicle purchase or lease
• Operate our business and analyze our Sites and Services
• By combining your PI with non-personal information and aggregating it with information collected from others; we may use this aggregated data in a number of ways, such as to improve the quality and value of our Sites and Services
• To defend against or respond to actual or potential claims and litigation

We do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects.

WHO WE SHARE YOUR INFORMATION WITH

• Our affiliates
• Automotive manufacturers, who may use that information to contact you
• Our Suppliers, that provide certain services or functions on our behalf
• In connection with an acquisition of our company or sale of our assets
• As otherwise required by applicable law

We do not sell your data.

We have implemented procedures to help ensure that that our Suppliers who may have access to Personal Information operate in accordance with both industry standards and applicable law. While we conduct vendor assessments of our Suppliers, we cannot control, and are not responsible for, the manner in which third parties use that information. Accordingly, you should review their privacy policies, as well as ours.

EXTERNAL LINKS; DATA USE BY THIRD PARTIES

Our Sites and Services may contain links to other third-party websites. After you leave our Sites, we have no control over the information collected from or about you on those third-party websites. Our Sites and Services may also include third-party advertising and other programs offered by or in collaboration with third-party businesses (e.g. Google, Bing, YouTube, Facebook, Instagram). These third-parties may collect information from you when you interact directly with them or through their tracking technologies on our Sites. We are not responsible, and assume no liability, for the privacy policies and/or practices of any third-party and use of your information by third-parties is subject to their privacy policies and terms of use. Accordingly, we encourage you to visit their sites and review their policies.

COOKIES,ETC.

We use a number of technologies to automatically collect information, including cookies, tracking pixels and web beacons. Our Sites include a notice that we use “Cookies”, which are small text files sent from a web server that are stored on your device and enable a site to remember you or your preferences. We may use cookies to recognize you and optimize your experience when visiting our Sites and using our Services. Tracking pixels are small images utilized to track a user, typically for advertising or analytics purposes. Web beacons allow data to be exchanged between systems. Our Sites may also be monitored by third-party software that may capture information about your visit that will help us improve the quality of our Sites and Services. We may use one or more of these technologies on our Sites to transmit information to you or about you and connect information about you from different sources, websites, devices, and mobile applications.

You can set your browser to notify you when you receive a cookie, giving you the chance to decide whether or not to accept it. However, if you do not accept cookies, you may not be able to use all of the features of our Sites or Services. Some browsers incorporate a “Do Not Track” (DNT) feature that, when turned on, signals to websites and online services that you do not want to be tracked. However, as there is yet no accepted standard for how to respond to DNT signals, we do not currently support DNT signals, other than cookies.

HOW WE PROTECT YOUR DATA

We employ data safeguards that comply with applicable federal and state law, including the updated FTC Safeguards, and in accordance with industry standards, to preserve the integrity and security of your Personal Information. However, we cannot guarantee the security of information you provide us with certainty or warrant it will not be accessed, disclosed, altered, or destroyed by unauthorized persons. We will make all legally required disclosures of any breach of the security, confidentiality, or integrity of your PI, in the manner and within the time periods required by applicable law.

DATA RETENTION

We retain your information only for as long as it is necessary and relevant for the purposes described in this Privacy Policy, and as required by applicable law.

OUR POLICY TOWARDS CHILDREN

Our Sites and Services are not targeted to nor intended for use by children. We are concerned about the privacy and safety of children when they use the internet. Accordingly, we will not knowingly request Personal Information from anyone under the age of 13 without prior, verifiable parental consent. Unfortunately, we cannot always determine the age of a visitor to our Sites or user of our Services.

JURISDICTIONS

Your Personal Information is collected and used by us within the United States. We make no representation that our Privacy Policy complies with the laws of any foreign jurisdictions, including the European Union’s General Data Privacy Regulation. If you choose to provide us with PI from outside the United States, you do so at your own risk and are responsible for compliance with any applicable foreign laws.

COMPLIANCE WITH LAW ENFORCEMENT

We cooperate with government and law enforcement officials, as well as private parties, to enforce and comply with the law. We may disclose any information about you to government or law enforcement officials or private parties that we, in our sole discretion, believe necessary or appropriate to respond to claims and legal process, including subpoenas, to protect our rights or that of a third party, to protect the safety of the public or any person, or to prevent or stop activity we consider to be, or may pose a risk of being, illegal, unethical or subject to legal action.

CORPORATE TRANSFERS

In connection with a corporate merger, acquisition, divestiture, asset sale, joint venture, bankruptcy, dissolution, reorganization, or any other similar transaction or proceeding, we may sell, divest, transfer, assign, share or otherwise engage in a transaction that involves some or all of our assets, including your Personal Information.

CHANGES TO OUR PRIVACY POLICY

We may modify our Privacy Policy, at any time and for any reason, by posting the revised Privacy Policy on our Site. Your use of our Sites or Services after any such posting indicates your acceptance of our modified Privacy Policy.

STATE PRIVACY LAWS

• The right to know how and for what purpose we collect it
• The right to access your information and request corrections to inaccurate information
• The right to opt-out of it being sold to third parties
• The right to opt-out of targeted advertising
• Subject to certain exclusions for legitimate business purposes, the right to have it deleted

In addition, Nevada privacy laws requires website operators to provide a way for Nevada residents to opt-out of the sale of certain information that website operators collect about them.

Furthermore, California privacy laws provides employees and job applicants who are California residents with certain rights with respect to their Personal Information. Accordingly, such employees and job applications should review our Privacy Policy to see the types of PI we collect and how we use it.

Other states are in the process of enacting their own privacy laws. As they do, residents of those states may have rights similar to those above with respect to their information. We will continue to monitor federal and state privacy law developments and update our policies and procedures as needed to comply with any additional State-Specific Privacy Laws.

If you have further inquiries about your information under a State-Specific Privacy Law, or are a resident of one of those states and wish to access, correct, opt-out or have your information deleted, please contact us as specified below under “How to Contact Us”. We will need to verify your identify before taking any action, in order to protect against the unauthorized disclosure or deletion of PI.

SMS COMMUNICATIONS

By providing your mobile number, you consent to receive SMS messages from Winner Subaru Volkswagen. Message frequency may vary. Message and data rates may apply. You may opt out at any time by replying STOP or request help by replying HELP.

OPTING OUT

If you wish to stop receiving email communications from us, you may “unsubscribe” using the link at the bottom of the email you receive. If you wish to be placed on our postal mailing “Do Not Contact” list, see the “How to Contact Us” section below and provide the name and address as listed on the mailing. To stop text communications, respond to the text with the words “STOP”. You may also control ads appearing on your browser or mobile device by adjusting your settings or using third party ad blocking tools.

HOW TO CONTACT US

If you have any questions or concerns regarding your privacy when using our Sites or Services, or are a resident of one of the states listed above and wish to exercise your rights under an applicable State-Specific Privacy Law, please click here to email us at: privacy@datadrivenholdings.com. California residents may also call us tollfree at 1-888-565-6043. We will make every effort to promptly respond and address your concerns.

Privacy Policy Supplement for the Foureyes Tool

Last Updated and Effective Date:
August 21, 2025

This Foureyes supplement to the Dealer's Privacy Policy ("Privacy Policy Supplement") addresses how personal information is collected, used, disclosed, and otherwise processed by Foureyes, LLC and its subsidiaries and affiliates ("Foureyes") on behalf of the automotive dealers and dealer or automotive group customers that are using the Foureyes Tool (collectively, the "Dealer(s)").

The Dealer posting or linking to this Privacy Policy Supplement uses the Foureyes platform and tools (such as Foureyes' analytics and reporting system and/or Foureyes' customer communications hosted system) (collectively, the "Foureyes Tool" or the "Tool"). Foureyes is operating as a service provider/processor to the Dealer and processing personal information on the Dealer's behalf.

For information about data rights available under U.S. state privacy laws and the California Notice at Collection, please see the State-Specific Privacy Addendum to the Dealer Privacy Policy Supplement.

Please also review the Dealer's Privacy Policy, Terms and/or any other applicable terms or agreement that may apply to your use of the Dealer's website or other services. If you have any questions, comments, or concerns, please contact the Dealer directly.

From time to time, Foureyes may update this Privacy Policy Supplement as described in the Changes to this Privacy Policy Supplement section below.

This Privacy Policy Supplement does not apply to the Dealer website or processing activities occurring on the Dealer website outside the scope of the Foureyes Tool. It also does not apply to Dealer communications occurring outside the Foureyes Tool or other processing activities performed by the Dealer. For information about how the Dealer processes personal information, please refer to the Dealer's privacy policy.

This Privacy Policy Supplement does not apply to or cover websites or resources that are not connected with the Foureyes Tool, with which Foureyes does not have a contractual relationship and over which Foureyes does not have control ("External Websites"). By clicking on links to External Websites, the operators of the External Websites may collect personal information. Foureyes is not responsible for the content or data collection practices of those External Websites, and your use of External Websites is subject to their respective terms of use and privacy policies. We encourage you to carefully read the privacy policy of any website you visit.

However, no method of transmission over the Internet, or method of electronic storage, is 100% secure, and we cannot and do not guarantee that personal information is completely secure and safe from such risks. If you have reason to believe that your information is no longer secure, please contact the relevant Dealer.

1. Scope of This Privacy Policy Supplement
   1. The Foureyes Tool
      This Privacy Policy Supplement applies to personal information that Foureyes collects, uses, discloses, and otherwise processes on behalf of the Dealer when you access, use or otherwise interact with the Dealer's website or otherwise communicate or engage with the Dealer where the Dealer has implemented the Foureyes Tool. This Privacy Policy Supplement covers only processing via the Foureyes Tool and no other processing by the Dealer. For information about how the Dealer processes personal information, please refer to the Dealer's privacy policy.
   
   
   2. Out of Scope
      This Privacy Policy Supplement does not apply to processing activities by Foureyes that are not described in this Privacy Policy Supplement, including but not limited to processing activities for which Foureyes acts as a business/controller.
2. How the Foureyes Tool Works
   The Foureyes Tool collects, generates and otherwise processes personal information when you interact with the Dealer's website, engage with the Dealer by phone, or fill out a form or interact with chat functionality on the Dealer's website, and/or receive and interact with email communications and/or SMS messages from the Dealer, where the Dealer's website and/or communications are connected with or sent and received through the Foureyes Tool. The Foureyes Tool collects information about your interactions with the Dealer’s website, such as browsing activity and information entered into website fields, regardless of whether the form or other website action is submitted via a submit button or similar action. The Dealer can adjust the settings of the Foureyes tool to manage when and how data is collected. Note that because the Foureyes tool collects data in real time, any information you enter into forms on the Dealer's site may be collected and transferred to Foureyes, even if you do not submit the form to the Dealer. You can opt out of this collection by opting out of the Foureyes tool. For more information about how the Foureyes Tool works and your opt-out options, click here and see the Your Choices section of this Privacy Policy Supplement.


3. Personal Information Processed by the Foureyes Tool
   As used in this Privacy Policy Supplement, "personal information" means any information that identifies or could be used to identify an individual person. For example, personal information may include name, email address, and IP address, or other unique identifier. It also includes other non-public information that is associated with such identifying information. Personal information does not include aggregated or anonymized information.
   
   The Foureyes Tool collects the following types of personal information on behalf of the Dealer:
   1. Information You Provide
      • Contact Information: The Foureyes Tool collects contact information that you provide in your interactions with the Dealer and/or the Dealer’s website, such as by entering information into a contact form or communicating with the Dealer by phone, email or chat. This includes information such as your name, personal phone number, home address, and email address. Note that when entering contact information into the website, this information may be collected even if you do not click a submit button or take a similar action.
      • Customer Profile: When you interact with the Dealer website, the Foureyes Tool generates a unique visitor ID number and visitor traffic number and creates a user profile. The Foureyes Tool collects information that a user provides through the Dealer website and interactions with the Dealer, as described in this Privacy Policy Supplement, and includes that user-provided information in the user profile. The Foureyes Tool also combines information collected automatically (described below) with user profile information for the same individual.
      • Chat and Phone Communications: The Foureyes Tool collects information that you enter into or through a chat feature or functionality made available on the Dealer website and/or information provided through phone communications with the Dealer. This information may include contact information and the content of any chats that you provide, including any inquiries or requests and your chat history.
      • SMS messaging and Marketing Emails: The Foureyes Tool collects your contact information and the content of your email communications with the Dealer. If you provide the Dealer with consent to receiving text messages, the Foureyes Tool may collect the phone number that you provide and your messaging history including any information included in those messages. Mobile information will not be shared with third parties for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with third parties.
   
   
   2. Information Collected Automatically
      • Log data: This may include your Internet Protocol ("IP") address, browser type and settings, the date and time of your request, and how you interact with our Services.
      • Device information: This may include your browser type and version, browser settings, time zone, unique device identifiers, available plugins, information about your approximate location (as determined through your IP address), mobile, computer, and/or device hardware information (e.g., operating system version, hardware model, IMEI number, and other unique device identifiers, MAC address, and device settings), device event information, log information, and crash data.
      • Usage information: This may include features that you use, clickstream data, access dates and times, and how you interact with the Dealer website. This information may also include the traffic source for the visit, referring / exit pages and URLs, how you interact with links on the Dealer website, landing pages, and pages viewed. The Foureyes Tool also may collect the date and time you open an email communication or click on any links in an email sent via the Foureyes Tool, and the Foureyes Tool may associate this information with the email address we already have from you.
   
   
   3. Information from Third Party Sources
      The Foureyes Tool may access or receive information from third-party sources that the Dealer connects or uploads to the Foureyes Tool. These third-party sources of information may include the Dealer's internal and/or third-party business operations and marketing systems and other third-party service providers to the Dealer, such advertising or analytics vendors.
   
   
   4. Sensitive Personal Information
      The Foureyes Tool does not intentionally collect personal information that is considered sensitive under privacy laws, such as genetic data, health information, race or religious information, about users to provide the Services.
   
   
    
4. How The Foureyes Tool Uses Personal Information
   The Foureyes Tool uses the personal information collected in the following ways:
   • To provide the Foureyes Tool and related services to the Dealer;
   • To assist the Dealer in establishing and managing a business relationship with you;
   • To send marketing communications, including emails and SMS messages, on the Dealer's behalf;
   • To analyze use of the Dealer website and communications;
   • To conduct research and analytics related to the Dealer's website and marketing activities, such as to understand how they are being used and where improvements may be needed;
   • To personalize and improve user experience on the Dealer's website and when interacting with the Dealer through personalized communications;
   • To compile aggregate and anonymized data for Foureyes' own use; and
   • For Foureyes' own legal and compliance obligations.


5. How the Foureyes Tool Discloses Personal Information
   On behalf of the Dealer, Foureyes transmits, discloses, grants access, makes available or provides personal information to or with the following types of third parties.
   • OEMs and their Digital Program Operators: Foureyes partners with various automotive manufacturers and their affiliates ("OEMs") as a part of their respective certified marketing programs and discloses personal information collected and generated through the Foureyes Tool with them, as set out under Forueyes' agreements with the Dealers and OEMs. Foureyes also discloses personal information to the third-party operators that provide the OEM with digital marketing and sales program technology platforms and program management ("Digital Program Operators"), according to Foureyes' agreements with the OEMs and the relevant Digital Program Operators.
   • Connected Data Partners: If the Dealer has established a relationship with a third-party partner that connects data with the Foureyes Tool ("Connected Data Partner"), Foureyes discloses personal information with the relevant Connected Data Partner, as set out under Foureyes' agreements with the Dealer and the Connected Data Partner.
   • Foureyes' Service Providers: Foureyes discloses personal information with its own service providers that help Foureyes to provide the Foureyes Tool.
   • Third Parties Related to Legal and Compliance: Foureyes may disclose personal information as required to meet its own legal and compliance requirements, as described in Foureyes' own privacy policy.


6. Your Choices - Opting Out of the Foureyes Tool

   Please be aware that the Dealer may engage in targeted advertising through its third-party advertising partners. The Foureyes Tool does not serve targeted ads, and Foureyes does not directly engage in targeted advertising on the Dealer's behalf. For information about the Dealer's targeted advertising activities and your options, please see the Dealer's privacy policy.

   1. Opting Out of Data Collection by the Foureyes Tool
      You may choose to opt out of data collection by the Foureyes Tool. To opt out, click here. For more information about opting out and how it works, please click here.
   
   
   2. Opting Out of Marketing Emails and SMS Messages Sent Via the Foureyes Tool
      • Email Opt-Out: To stop receiving promotional email communications sent via the Foureyes Tool on the Dealer's behalf, click on the "unsubscribe" link in the communication or send an email to support@foureyes.io.
        Please note that the opt out applies only to email communications sent via the Foureyes Tool and only for the particular Dealer whose communications you've opted out of. You may continue to receive other marketing emails sent by the Dealer or the Dealer's third-party service providers or agents, and you may continue to receive marketing emails from other Dealers that use the Foureyes Tool. To opt out of other marketing communications sent by the Dealer, please see the Dealer's privacy policy for the relevant opt-out information. To opt out of email communications sent by the Foureyes Tool on behalf of other Dealers, you will need to submit a separate opt-out request with Foureyes for each Dealer.
        If you opt-out of marketing emails sent via the Foureyes Tool, the Dealer will still send you transactional emails, such as responses to your requests.
      • SMS Opt-Out: To stop receiving SMS marketing communications sent via the Foureyes Tool on the Dealer's behalf, you can opt out at any time by responding with an opt-out notice in the SMS communication.


7. Your Privacy Rights and U.S. State Privacy Disclosures
   Depending on the state where you reside, you may have certain privacy rights provided under applicable law. For more information, please see the State-Specific Privacy Addendum to the Dealer Privacy Policy Supplement.


8. How Long Foureyes Retains Personal Information
   Foureyes retains personal information for the purposes stated in this Privacy Policy Supplement, as directed by the Dealer and as required or permitted under applicable law. To determine how long we keep personal information, we consider the amount, nature, and sensitivity of personal information, the reasons for which we collect and process the information, and applicable legal requirements.


9. How Foureyes Protects Personal Information
   At Foureyes, we take our responsibility to protect the security and privacy of personal information seriously. The Foureyes Tool has implemented what Foureyes believes to be reasonable and appropriate administrative, technical, and physical data security measures designed to prevent personal information from being lost, used, accessed, altered, or disclosed in an unauthorized or unlawful way.
10. "Do Not Track" Preferences
    Some Internet browsers may be configured to send "Do Not Track" signals to the online services that you visit. There is no consensus among industry participants as to what "Do Not Track" means in this context. Like many websites and online services, the Foureyes Tool does not currently alter its practices when a "Do Not Track" signal from a visitor's browser is sent, except as specifically required by law. For information about "Do Not Track" please visit All About DNT. For information about Global Privacy Controls/Opt-Out Preference Signals, see the Dealer's privacy policy and the State-Specific Privacy Addendum to the Dealer Privacy Policy Supplement.


11. Children's Privacy
    The Foureyes Tool does not knowingly collect personal information from children younger than the age of 18 or under the age of majority without the consent of a parent or legal guardian, as required under applicable law. If you learn or believe that a child under the age of 18 or under the age of majority has provided us with personal information, please contact the relevant Dealer.


12. Changes to this Privacy Policy Supplement
    Foureyes may update this Privacy Policy Supplement from time to time. When Foureyes updates this Privacy Policy Supplement, we will revise the "Last Updated and Effective Date" at the top of this Privacy Policy Supplement and post a link to the updated Privacy Policy Supplement. Changes to this Privacy Policy Supplement are effective when they are posted. If Foureyes makes any material changes, the Dealer may provide you with notice as required under applicable law. Please review this Privacy Policy Supplement periodically to ensure you are aware of any such changes.