Effective as of January 1, 2020
Last updated December 1, 2022
1. INFORMATION WE COLLECT ONLINE
Through your use of the Sites and Services, we may collect Personally Identifiable Information from you. “Personally Identifiable Information” is individually identifiable information about an individual consumer that we collect online and that we maintain in an accessible form.
Information You Provide
We may collect the following Personally Identifiable Information that you voluntarily provide to us in using our Sites and Services:
- Apply Now. When you apply to refinance your auto loan, you will provide us with Personally Identifiable Information such as your first and last name, telephone number, email address, and physical address. You also will provide us with information relating to your vehicle (such as its year, make, model, trim, and estimated number of miles), information relating to your current loan (such as the name of your current auto lender and current monthly auto payment), information relating to your current residence (such as the type of residence and your monthly payment), information regarding your employment and income, and your date of birth. You also may voluntarily agree to provide us with your Social Security number. If you respond to an offer in the mail to refinance your auto loan, you will provide your pre-qualification code and zip code.
- Prequalification. When you explore your options with our “Get Prequalified” you will provide us with Personally Identifiable Information such as your first and last name and physical address. You also will provide us with other information such as your date of birth, yearly income, monthly vehicle payments, and vehicle year.
- Careers. If you apply for a job through one of our Sites, you will provide your first and last name, email address, phone number, resume and cover letter.
- Atla. If you create an account with our Atla app, we will collect your name, email address, and telephone number. If you use Atla’s competitive rate range feature, we will collect the last four digits of your Social Security number, date of birth, gross annual income, and address. If you upload your retail instalment contract to your dashboard, we will collect any personal information contained in that contract. Information you provide through the Atla app is secured by industry standard encryption algorithms (128-bit encryption used by major banks), and it is also protected by using 2-factor authentication.
- Contact Us. If you contact us through the Sites, we may collect your name, email address, and telephone number along with any other Personally Identifiable Information you voluntarily provide.
- Interact with our Sites or Services. When you send us any feedback, questions, comments, suggestions, ideas, or interact with us in any way, you may need to provide us with your log-in information, name and/or email address.
Information as You Navigate Our Sites
We automatically collect certain Personally Identifiable Information through your use of the Sites and Services, such as the following:
- Usage Information. We collect information such as which of the pages on the Sites you access, the frequency of access, and what you click on while on the Sites.
- Device Information. We collect information about the device you are using, such as hardware model, operating system, application version number, and browser.
- Mobile Device Information. In addition to the Device Information listed above, when you access our Sites via a browser on your mobile device, we collect and aggregate information about whether you are accessing the Sites via a mobile device or tablet, device type, and carrier.
- Location Information. We collect location information from Site visitors on a city-regional basis.
Third Party Information
Information from Other Sources
When you apply for a loan, we may obtain Personally Identifiable Information about you from other sources, such as information about your credit profile or other information from Experian, TransUnion, and Equifax. We also may collect information about you from other sources to verify the information you provided in your loan application.
2. HOW WE USE YOUR INFORMATION
We use the Personally Identifiable Information we collect to provide the Services to you, to improve our Sites and Services, and to protect our legal rights. In addition, we may use the Personally Identifiable Information we collect to:
- Find you loan options from our lender base;
- Process your account registration with our application, Atla;
- Review your loan application;
- Send you notifications of our latest news and updates if you voluntarily elect to receive them;
- Communicate with you via telephone, mobile devices, email or postal mail about our products and services that we feel may be of interest to you;
- Research and analyze other products and services offered by us or others that may save you money;
- Deliver relevant advertising and analyze the effectiveness of our advertising and other campaigns;
- Communicate with you about our Sites or Services or to inform you of any changes to our Sites or Services;
- Provide support;
- Maintain and improve our Sites and Services;
- Protection the security and integrity of our Sites and Services;
- Defend our legal rights and the rights of others;
- Fulfill any other purposes for which you provide it, or any other purpose we deem necessary or appropriate;
- Efficiently maintain our business; and
- Comply with applicable law.
3. HOW WE SHARE YOUR INFORMATION
We may share the information that we collect about you in the following ways:
- Lenders. Once you have submitted an application, we will begin the process of finding you a loan, if qualified, from our lender base of over 200 financial institutions. Your Personally Identifiable Information is not sent to each lender in our network for review. Instead, your credit profile and needs are matched to the borrower profile established by our lenders and sent to those lenders first. By submitting an application, you consent to the use of your credit report for the purpose of obtaining a credit offer from one of our participating lenders.
- To Comply with the Law. We may disclose Personally Identifiable Information we collect if we determine in our sole discretion that such disclosure is necessary to comply with the law, including disclosure to law enforcement agencies and other government agencies and disclosure responsive to subpoenas. We also may disclose information we collect if we deem it necessary to protect the rights, property, or safety of us, our customers or others; in connection with any legal proceedings or prospective legal proceedings; and to any person who we reasonably believe may apply to a court or other competent authority for disclosure of that Personally Identifiable Information where, in our reasonable opinion, such court or authority would be reasonably likely to order disclosure of that Personally Identifiable Information.
- To Third Parties. We may disclose your Personally Identifiable Information to third party vendors that provide us services to process your information for purposes of reviewing your loan application. We may disclose the information we collect to companies that perform marketing services on our behalf, with which we have joint marketing agreements, or with which we have other agreements that, among other things, require the safeguarding of your information. Also, we may disclose your Personally Identifiable Information to third parties that are interested in contacting you or providing offers to you that may be related to our products and services or about products or services you may find of interest, and we may be compensated for such disclosure. You can, at any time, opt-out of our ability to share information with unaffiliated third parties that do not provide services to us for processing your loan application by contacting Atla Guide customer service at 877-815-7598, RateGenius Customer Service at 866-728-3436, AUTOPAY Customer Service at 844-276-3272, or Tresl’s Customer Service at 866-504-3748.
- Advertising. We may disclose your Personally Identifiable Information to service providers to prepare, deploy, and analyze advertising content.
- Business Transactions. We may disclose your Personally Identifiable Information to any other person or entity as part of any business or asset sale, equity transaction, merger, acquisition, bankruptcy, liquidation, or similar proceeding, or in preparation for any of these events.
- Consent. We may disclose your Personally Identifiable Information to any other person or entity where you consent to the disclosure.
- Other Purposes. We may disclose your Personally Identifiable Information for any other purpose disclosed by us when you provide the information or for any other purpose we deem necessary, including to protect the health or safety of others.
4. COOKIES AND OTHER TRACKING TECHNOLOGIES
- Estimate audience size and usage patterns;
- Understand and save your preferences for future visits, allowing us to customize the Sites and Services to your individual needs;
- Advertise new content and services that relate to your interests;
- Keep track of advertisements and search engine results;
- Compile aggregate data about site traffic and site interactions to resolve issues and offer better site experiences and tools in the future; and
- Recognize when you return to the Sites and identify the originating source from which you came to the Sites.
How You Can Opt-Out of Cookies
Cookies can be blocked by changing your Internet browser settings to refuse all or some Cookies. If you choose to block all Cookies (including essential Cookies) you may not be able to access all or parts of the Sites.
You can find out more about Cookies and how to manage Cookies by visiting www.AboutCookies.org.
You can opt out of Cookies set by specific entities by following the instructions found at these links:
- Google: https://adssettings.google.com
- Facebook: https://www.facebook.com/about/ads
- Microsoft: https://account.microsoft.com/privacy/ad-settings/
Advertising Industry Resources
You can understand which entities have currently enabled Cookies for your browser or mobile device and how to opt-out of some of those Cookies by accessing the Network Advertising Initiative’s website or the Digital Advertising Alliance’s website. For more information on mobile specific opt-out choices, visit the Network Advertising Initiative’s Mobile Choices website.
5. “DO NOT TRACK” SIGNALS
Some internet browsers incorporate a “Do Not Track” feature that signals to websites you visit that you do not want to have your online activity tracked. Given that there is not a uniform way that browsers communicate the “Do Not Track” signal, the Sites do not currently interpret, respond to or alter their practices when they receive “Do Not Track” signals.
6. CHOICES ABOUT YOUR INFORMATION
Review and Request Changes to Your Information
You may use your account to access, correct, or view certain Personally Identifiable Information we have collected and which is associated with your account. To review or request changes to any of your Personally Identifiable Information, please contact us at firstname.lastname@example.org.
To unsubscribe from our marketing emails, please click the unsubscribe link included in the footer of our emails. You also may submit a request to us at email@example.com.
. We maintain commercially reasonable security measures to protect the Personally Identifiable Information we collect and store from loss, misuse, destruction, or unauthorized access. However, no security measure or modality of data transmission over the Internet is 100% secure. Although we strive to use commercially acceptable means to protect your Personally Identifiable Information, we cannot guarantee absolute security.
8. THIRD PARTY LINKS
9. CHILDREN’S PRIVACY
The Sites are not intended for children under 13 years of age. We do not knowingly collect, use, or disclose personal information from children under 13.
10. NOTICE TO NEVADA RESIDENTS
Nevada law allows Nevada residents to opt-out of the sale of certain types of personal information. Subject to several exceptions, Nevada law defines “sale” to mean the exchange of certain types of personal information for monetary consideration to another person. We do not currently sell personal information as defined in the Nevada law. However, if you are a Nevada resident, you still may submit a verified request to opt-out of sales and we will record your instructions and incorporate them in the future if our policy changes. Opt-out requests may be sent to firstname.lastname@example.org or toll-free at (855) 350-7900.
11. NOTICE TO VIRGINIA RESIDENTS
The Virginia Consumer Data Protection Act (“VCDPA”) provides Virginia residents with the right to receive certain disclosures regarding the personal data we process about them. For purposes of this section, personal data means any information that is linked or reasonably linkable to an identified or identifiable natural person. Personal data does not include de-identified or publicly available information as the VCDPA defines those terms.
For a discussion of the categories of personal data we process, the purposes for our processing, the categories of personal data that we share with third parties, and the categories of third parties with whom we share personal data, please see Sections 1 through 3, above, and Section 12, below.
If you are a Virginia resident, the VCDPA grants you the right to: (1) confirm whether or not we are processing your personal data and to access such personal data; (2) correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of your personal data; (3) delete personal data you have provided or we have obtained about you; (4) obtain a copy of your personal data that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance, where the processing is carried out by automated means; and (5) opt out of the processing of your personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.
We sell personal data to third parties as defined in the VCDPA and process personal data for targeted advertising.
To exercise your rights, please email us at email@example.com with your name, the fact that you are a Virginia resident, and specifying the right(s) you wish to invoke. If we refuse to take action regarding your request, you may appeal our decision by emailing us at firstname.lastname@example.org.
12. NOTICE TO CALIFORNIA RESIDENTS
The CCPA defines “personal information” to mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household. Personal information does not include information publicly available, deidentified or aggregated information. For purposes of this “NOTICE TO CALIFORNIA RESIDENTS” section we will refer to this information as “Personal Information.”
Right to Know About Personal Information Collected, Disclosed, or Sold
If you are a California resident, you have the right to request that we disclose what Personal Information we have collected about you in the 12-month period preceding your request. This right includes the right to request any or all of the following:
(1) Specific pieces of Personal Information that we have collected about you;
(2) Categories of Personal Information that we have collected about you;
(3) Categories of sources from which the Personal Information was collected;
(4) Categories of Personal Information that we sold (if applicable) or disclosed for a business purpose about you;
(5) Categories of third parties to whom the Personal Information was sold (if applicable) or disclosed for a business purpose; and
(6) The business or commercial purpose for collecting or, if applicable, selling Personal Information.
The CCPA defines “sell” to mean selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a California resident’s Personal Information to another business or a third party for monetary or other valuable consideration.
Collection of Personal Information
- Postal address
- Unique personal identifiers (device identifier; cookies, beacons, pixel tags, mobile ad identifiers, or other similar technology; customer number, unique pseudonym or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device)
- Online identifier
- Internet Protocol address
- Email address
- Social Security number
- Telephone number
- Bank account number
- Credit and debit card number
- Insurance policy number or subscriber identification number
- Internet or other electronic network activity information (browsing history; search history; and information regarding consumer’s interaction with website, application or advertisement)
- Geolocation data
- Education information
- Professional or employment-related information (including employment history)
We collected the above Personal Information for the following business or commercial purposes:
- Auditing related to a current interaction with the consumer and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards
- Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity
- Debugging to identify and repair errors that impair existing intended functionality
- Short-term, transient use, provided that the personal information is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction
- Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider
- Undertaking internal research for technological development and demonstration.
- Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business
- Advancing a person’s commercial or economic interests, such as by inducing another person to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction
Disclosure or Sale of Personal Information
|Category of Personal Information||Category of Service Providers||Category of Third Parties|
|Identifiers (name, email address, telephone number, and postal address)||Stip Collection, Employment Verification, Cloud Hosting (IaaS)||Marketing automation, Push notifications, Chat providers, Credit Bureaus, SMS Providers, Lenders, Cloud Hosting Services|
|Cookies, beacons, pixel tags,|
mobile ad identifiers, or other
|Cloud Hosting providers||Data analytics providers Advertising networks |
|Internet Protocol address||Cloud Hosting providers||Data analytics providers Advertising networks|
|Social security number||Cloud Hosting providers||Credit Bureaus Lenders|
|Cloud Hosting providers Credit Card Processing||Lenders Credit Card Pmt Services|
We do not knowingly collect or sell the Personal Information of minors under 16 years of age.
Right to Request Deletion of Personal Information
If you are a California resident, you have the right to request that we delete the Personal Information about you that we have collected or maintain. However, per the CCPA, we are not required to comply with a request to delete if it is necessary for us to maintain the Personal Information in order to, for example, complete a transaction, detect security incidents, comply with a legal obligation, or otherwise use the Personal Information, internally, in a lawful manner that is compatible with the context in which you provided the information.
How to Submit a Request to Know or Delete
You may submit a request to know or delete by completing our online request form available here, emailing email@example.com or by calling us at (855) 350-7900. If you submit a request to delete online, you may be asked to confirm separately that you want your Personal Information deleted.
Our Process for Verifying a Request to Know or Delete
We will comply with your request upon verification of your identity and, to the extent applicable, the identity of the California resident on whose behalf you are making such request.
For requests to access categories of Personal Information and for requests to delete Personal Information that is not sensitive and does not pose a risk of harm by unauthorized deletion, we will verify your identity to a “reasonable degree of certainty” by verifying at least two data points that you previously provided to us and which we have determined to be reliable for the purpose of verifying identities.
For requests to access specific pieces of Personal Information or for requests to delete Personal Information that is sensitive and poses a risk of harm by unauthorized deletion, we will verify your identity to a “reasonably high degree of certainty” by verifying at least three pieces of Personal Information previously provided to us and which we have determined to be reliable for the purpose of verifying identities. In addition, you will be required to submit a signed declaration under penalty of perjury stating that you are the individual whose Personal Information is being requested.
Right to Opt-Out of Sale of Personal Information
If you are a California resident, you have the right to direct us to stop selling your Personal Information. To opt-out of our use of third-party advertising Cookies, please see the section “How You Can Opt-Out of Cookies” above. In addition, you may submit a request to opt-out of sales through our interactive webform available by clicking on this link: “Do Not Sell My Personal Information.” You also may submit a request by calling us toll-free at 855.350.7900 or emailing us at firstname.lastname@example.org.
Right to Non-Discrimination for the Exercise of a California Resident’s Privacy Rights
We will not discriminate against California residents if they exercise any of the rights provided in the CCPA as described in this section “Notice to California Residents.” As such, we will not deny goods or services to that California resident; charge different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; provide a different level or quality of goods or services to the California resident; or suggest that the California resident will receive a different price or rate for goods or services or a different level or quality of goods or services. However, we are permitted to charge a California resident a different price or rate, or provide a different level or quality of goods or services, if that difference is reasonably related to the value provided to us by the individual’s data.
If you are submitting a request on behalf of a California resident, please submit the request through one of the designated methods discussed above. After submitting the request, we will require additional information to verify your authority to act on behalf of the California resident.
Shine the Light Law
If you are a California resident, California Civil Code § 1798.83 permits you to request information regarding the disclosure of your personal information by us to third parties for the third-parties’ direct marketing purposes (as those terms are defined in that statute). To make such a request, please send an email to email@example.com or write to us at 9300 United Drive, Ste 180, Austin, Texas 78758.
14. HOW TO CONTACT US
To contact us for questions or concerns about our privacy policies or practices please call Atla Guide at 877-815-7598; RateGenius at 866-728-3436; AUTOPAY at 844-276-3272; Tresl at 866-504-3272 or email us at firstname.lastname@example.org.