(a) Overview. We extend the following rights to Consumers relating to their personal information that we have collected, used, or hold (collectively, “Data Rights”).

(b) When data rights do not apply. Data Rights are subject to certain exceptions and limitations based on the specific data processing activities involved or other legal constraints like law enforcement and litigation uses. If any of those exceptions or limitations should apply to a Data Rights request, we will explain in our response why (or the extent to which) we are unable to honor a Consumer request.

(c) Data rights described. A Consumer’s rights relating to his or her personal information includes one or more of the following rights if and as applicable to a given request (a “Data Rights Request”). If a Consumer desires to exercise any of these rights, he or she should contact us by using the Data Rights Request Form referenced in Section 13.6 below.

(i) The right to know. A Consumer has a right to request that we disclose certain information to him or her about our collection and use of the Consumer’s personal information over the past 12 months. Upon such a request, after verification of the Consumer’s identity, we will confirm (i) the categories of personal information we have collected about the Consumer, (ii) the categories of sources from which such information was collected, (iii) the business or commercial purpose for our collection, disclosure or use of such data, (iv) the categories of any third parties with which we shared such personal information for a business purpose, and (v) the specific pieces of personal information we have collected about the Consumer.

(ii) The right of deletion. In some circumstances, a Consumer has the right to request that we delete personal information that we have collected from or about the Consumer. Those circumstances include when (i) the personal information is no longer necessary in relation to the purposes for which it was collected or processed; (ii) the Consumer withdraws his or her Consent to any consent-based processing such as marketing; and/or (iii) our continued processing of such data violates this Policy or is otherwise unlawful. However, there are exceptions to the right of deletion, including when our retention and processing of such data is reasonably necessary to (A) complete the transaction for which such data was collected, to fulfill the terms of a written warranty or product recall or otherwise perform our contract with the Consumer, (B) provide a product or service requested by the Consumer or take actions reasonably anticipated within the context of our ongoing business relationship, (C) detect security incidents or protect against deceptive, fraudulent or unlawful activity, (D) for internal use reasonably aligned with the Consumer’s expectations under this Policy or applicable law, and/or (E) compliance with a legal obligation.

(iii) The right to data portability. In certain circumstances under the Right to Know, a Consumer has the right to access the specific pieces of his or her personal information that we collected from such Consumer, by mail or electronically, and if provided electronically, in a portable, readily useable format to the extent technically feasible. However, this right does not apply where it is outweighed by other lawful needs or when the attempted return of it would adversely affect the rights or interests of others, such as when the personal information cannot be segregated from other protected data.

(iv) Right to opt-out of the sale of personal information. If and to the extent we are deemed to Sell a Consumer’s personal information to a third party, the Consumer has the right to direct us to stop Selling the Consumer’s personal information to such third parties (the “Right to Opt-Out”). To exercise the Right to Opt-Out, the Consumer may submit a Data Rights Request Form to us invoking such right. The Consumer does not need to create an account with us to exercise his or her Right to Opt-Out. We will only use personal information provided in an opt-out request to review and comply with the requesting Consumer’s request. A Consumer’s exercise of the Right to Opt-Out will only apply to our disclosures to third parties which are not Service Providers and will not affect our own communications and transactions with our Customers or communications by our business partners with our Customers in connection with our own business activities.

To exercise any Data Rights, please complete and submit the Data Rights Request Form at the bottom of this page or by:

• Calling us at (800) 810-1827
• Emailing us at privacy@echoparkautomotive.com.

Any data rights request must:

• Provide sufficient information to permit us to reasonably verify that the requestor is the person about whom we collected personal information or an authorized representative thereof. We cannot respond to a request or provide personal information if we cannot verify the requestor’s identity or authority to make the request and confirm that the personal information relates to them.
• Such verification requirements include proof of the identity of the Consumer about whom a request is made either (i) by a third party identity verification service engaged by us, or (ii) by our matching the identifying information of the Consumer at issue with the personal information of the Consumer already maintained by us, either in a password protected account with the Consumer or by identification of the Consumer’s recent vehicle searches or other activities with us or our business partners.
• Describe the Data Rights Request with sufficient detail for us to properly understand, evaluate and respond to it.

Consumers do not need to create an account with us to submit a Data Rights Request, but we do consider requests made through a password protected account sufficiently verified when the request relates to personal information associated with that account. We will only use personal information provided in the request to verify the requestor’s identity or authority to make it.

We will promptly confirm receipt of any such request (generally within ten 10 days) and endeavor to substantively respond to it after verification within forty-five (45) days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing.

If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically or as otherwise agreed.

Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. We do not charge a fee to process or respond to verifiable Data Rights Requests unless excessive, repetitive, or manifestly unfounded.

Consumers have the right to be free of discrimination relating to their exercise of any Data Rights. We do not discriminate against Consumers for exercising any of their Data Rights. This means that the exercise of Data Rights will not result in our:

• Denial of any purchase or acquisition of our vehicles or Services;
• Charging a different price or rate for vehicles or Services, including through granting discounts or other benefits or imposing penalties;
• Providing a Consumer with a different level or quality of vehicles or Services; or
• Suggesting any of the above results to a Consumer.

California’s “Shine the Light” law (Civil Code Section § 1798.83) permits users of our website who are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes in the past year, including the categories of personal information disclosed and the identity of such third parties. To make such a request, please send an email or write to us at the address set forth in Section 12 above (“Our Contact Information”).