Introduction & Overview

Welcome to Cal Auto Group. We value your trust and are deeply committed to protecting the privacy and security of your personal information. This Privacy Policy describes how Cal Auto Group (“Cal Auto Group,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects information about you (“you” or “your”) when you visit our website at calautogroup.com, interact with our online services, or visit any of our affiliated dealership locations throughout the State of California.

This policy applies to all personal information collected through calautogroup.com and all associated Cal Auto Group dealership locations and digital touchpoints, including online vehicle inventory tools, financing applications, service scheduling portals, contact forms, and other interactive features we may offer from time to time.

We encourage you to read this Privacy Policy carefully. By using our website or services, you acknowledge the practices described in this document. If you have questions or concerns at any time, please refer to Section 12 — Contact Us for details on how to reach our Privacy Officer.

---

Section 1 — Information We Collect

We collect several categories of personal information, depending on how you interact with us. Below is a detailed description of what we collect and how.

1.1 Information You Provide Directly

When you contact us, complete forms, apply for financing, schedule a service appointment, or otherwise engage with Cal Auto Group, you may provide us with the following:

• Contact Information: Full name, email address, phone number, and mailing or residential address.
• Vehicle Preferences & Trade-In Information: Desired vehicle make, model, trim, color, budget, and details about any trade-in vehicle (including VIN, mileage, condition, and ownership status).
• Financial Information: Information submitted through credit applications, including income, employment history, Social Security Number (SSN), existing debts, and banking details as required for financing and lease approvals.
• Government-Issued Identification: Driver’s license number, state of issuance, and other government-issued ID details collected for test drive authorization, identity verification, and financing compliance purposes.
• Signatures and Consent Records: Electronic or physical signatures on sales contracts, financing agreements, consent forms, and other dealership documents.
• Communications You Initiate: Messages, inquiries, and other content you submit through our website’s contact forms, live chat features, email correspondence, or telephone calls.

1.2 Information Collected Automatically

When you visit calautogroup.com, certain information is collected automatically through cookies, log files, and similar technologies:

• Device & Technical Information: IP address, browser type and version, operating system, device type, and device identifiers.
• Usage Data: Pages visited, time spent on each page, referring URLs, click-through paths, search queries entered on our site, and features accessed.
• Cookie & Session Data: Cookie identifiers, session tokens, and preference settings stored during your visit. See Section 3 for full details.
• Approximate Geographic Location: General geographic location (city or region level) derived from your IP address. We do not collect precise GPS-level geolocation without your explicit consent.

1.3 Information from Third Parties

In the course of conducting business, we may receive personal information about you from third-party sources, including:

• Credit Bureaus and Lenders: Credit history, credit scores, and related financial data obtained when you apply for vehicle financing or leasing.
• Vehicle History Providers: Vehicle history reports from providers such as Carfax or AutoCheck, used in connection with vehicle trade-in evaluations and pre-owned sales.
• Social Media Platforms: If you choose to interact with us through a social login or social media feature, we may receive limited profile information from those platforms (e.g., name, profile picture, email), subject to your platform privacy settings.
• Marketing and Lead Generation Partners: Prospective customer information from marketing vendors and automotive lead platforms through which you expressed interest in our vehicles or services.
• Government and Regulatory Sources: Information from the California Department of Motor Vehicles (DMV) and other government agencies as permitted or required by law (e.g., title transfers, registration verification).

---

Section 2 — How We Use Your Information

Cal Auto Group uses personal information only for legitimate business purposes that are reasonably necessary and proportionate to the nature of the information collected. Specific purposes include:

1. Process Vehicle Transactions: To facilitate vehicle sales, leases, trades, and financing applications, including title and registration processing with the DMV.
2. Service Appointments and Repair Orders: To schedule, confirm, manage, and follow up on vehicle service and maintenance appointments at our dealership locations.
3. Transactional Communications: To send purchase confirmations, financing approval notices, service completion alerts, recall notifications, and other communications necessary to complete your transaction.
4. Legal and Regulatory Compliance: To comply with applicable laws, regulations, and reporting obligations, including DMV requirements, lender obligations, and tax regulations.
5. Credit and Identity Verification: To conduct credit checks, verify your identity, and process financing applications through authorized lenders and credit bureaus.
6. Customer Service: To respond to your inquiries, resolve complaints, and provide general customer support.
7. Website and Service Improvement: To analyze how our website is used, identify technical issues, and improve the overall functionality, content, and user experience of calautogroup.com.
8. Marketing and Promotional Communications: To send you offers, promotions, vehicle recommendations, and dealership news that may be of interest to you. You may opt out of marketing communications at any time (see Section 6.4).
9. Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, unauthorized access, and other security incidents affecting our systems or customers.
10. Analytics: To understand website traffic patterns, measure the effectiveness of our marketing campaigns, and make data-driven business decisions.

---

Section 3 — Cookies and Tracking Technologies

3.1 What We Use

Cal Auto Group uses cookies and similar tracking technologies on calautogroup.com to operate and improve our website. These technologies include:

• Cookies: Small text files placed on your device by your web browser when you visit our site. Cookies help us recognize your device, remember your preferences, and understand how you use our site.
• Pixel Tags / Web Beacons: Tiny invisible images embedded in web pages or emails that allow us to confirm that a page was viewed or an email was opened, and to track user behavior for analytics and advertising purposes.
• Local Storage and Session Storage: Browser-based storage mechanisms that allow us to store certain data (such as shopping cart contents or preference settings) on your device during or between sessions.

We use the following categories of cookies:

Cookie Category	Purpose	Can Be Disabled?
Strictly Necessary	Essential for core website functionality (e.g., form submissions, security, navigation). The site cannot operate properly without these.	No — required for site operation
Performance / Analytics	Track how visitors use our site (pages visited, time on page, errors encountered). Used to improve site performance.	Yes — via browser settings or opt-out tools
Functional	Remember your preferences and settings (e.g., language, location, dealership selection) to personalize your experience.	Yes — disabling may affect personalization
Targeting / Advertising	Used to deliver advertisements relevant to your interests on our site and across the web. May track browsing activity across other sites.	Yes — see opt-out instructions in Section 4

3.2 Managing Cookies

You may control or disable cookies through your web browser settings. Most browsers allow you to refuse cookies, delete existing cookies, or be notified when a cookie is set. Instructions for managing cookies in common browsers are available through each browser’s help documentation. Please note that disabling certain cookies may impact the functionality and availability of features on calautogroup.com.

Global Privacy Control (GPC): Cal Auto Group honors the Global Privacy Control (GPC) browser signal as a valid opt-out of the sale and sharing of your personal information under California law. If your browser or browser extension is configured to send a GPC signal, we will treat it as an opt-out request from the associated browser and device. Per regulations effective January 1, 2026, we will display confirmation that your opt-out request has been honored.

---

Section 4 — Analytics and Advertising

Analytics: We use third-party analytics tools, including Google Analytics, to help us understand how visitors interact with calautogroup.com. These tools collect information such as your IP address, browser type, pages visited, and time spent on the site. This information is used in aggregate form to analyze traffic trends, optimize our content, and improve user experience.

Remarketing and Retargeting: We may use remarketing features through platforms such as Google Ads and Meta (Facebook/Instagram) to display advertisements to users who have previously visited our website. These platforms may use their own cookies and tracking technologies to collect data about your browsing behavior and serve you relevant advertisements on other websites and apps.

These third-party analytics and advertising services operate under their own privacy policies, which we encourage you to review:

• Google Privacy Policy: policies.google.com/privacy
• Meta Privacy Policy: facebook.com/privacy/policy

Opt-Out Options:

• Google Analytics Opt-Out: You may download and install the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout.
• Digital Advertising Alliance (DAA): Opt out of interest-based advertising from participating companies at optout.aboutads.info.
• Network Advertising Initiative (NAI): Opt out of targeted advertising from NAI member companies at optout.networkadvertising.org.

---

Section 5 — Sharing Your Information with Third Parties

5.1 Categories of Third Parties We Share With

Cal Auto Group may share your personal information with the following categories of third parties for legitimate business and legal purposes:

• Affiliated Dealerships: Other dealership locations operating within the Cal Auto Group family of dealerships, for the purpose of fulfilling your requests or providing consistent service.
• Lenders and Financial Institutions: Banks, credit unions, and automotive finance companies to process vehicle financing applications, lease agreements, and related insurance products.
• Manufacturer Partners (OEMs): Vehicle manufacturers whose products we sell, for purposes of warranty administration, recall notifications, and product updates specific to your vehicle.
• Service Providers and Vendors: Third-party companies that assist us in operating our business, including IT infrastructure providers, website hosting services, Customer Relationship Management (CRM) platforms, email marketing services, and payment processors.
• Marketing and Advertising Partners: Trusted partners who assist us with digital advertising, lead management, and targeted marketing campaigns, subject to contractual protections.
• Credit Reporting Agencies: Credit bureaus to whom we report credit and financing information as required by law or lender agreements.
• Legal and Regulatory Authorities: Government agencies, courts, law enforcement, or other regulatory bodies when required by law, legal process, or to protect the rights and safety of Cal Auto Group, our customers, or the public.

5.2 Sharing Under California Law (“Sale” and “Sharing”)

Cal Auto Group does not sell your personal information in the traditional commercial sense. However, under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the definition of “sharing” personal information includes disclosing it to third parties for cross-context behavioral advertising, even without monetary exchange. To the extent our use of advertising technologies (such as cookies and tracking pixels) constitutes “sharing” under California law, you have the right to opt out. See Section 6.4 for instructions.

5.3 No Sale to Data Brokers

Cal Auto Group does not sell your personal information to data brokers or any third parties for their own independent use or resale.

5.4 Service Provider Agreements

All third-party service providers who receive your personal information on our behalf are required by contract to: (a) protect your personal information using reasonable security measures; (b) use your information only for the specific, agreed-upon purposes; (c) refrain from selling, renting, or further disclosing your information without our authorization; and (d) comply with all applicable privacy laws, including the CCPA/CPRA.

---

Section 6 — Your Rights Under the California Consumer Privacy Act (CCPA/CPRA)

If you are a California resident, the CCPA as amended by the CPRA, and the updated CCPA regulations effective January 1, 2026, grant you the following rights with respect to your personal information. Cal Auto Group is committed to honoring these rights fully and transparently.

6.1 Right to Know

You have the right to request that we disclose to you:

• The categories of personal information we have collected about you;
• The specific pieces of personal information we hold about you;
• The categories of sources from which that information was collected;
• The business or commercial purposes for which the information was collected or shared;
• The categories of third parties with whom we have shared your information.

Per the updated 2025 CCPA regulations, if we retain your personal information for longer than 12 months, you may request disclosure of personal information going back to January 1, 2022.

6.2 Right to Delete

You have the right to request that Cal Auto Group delete personal information we have collected from you, subject to certain exceptions. We may be permitted or required to retain certain information to:

• Complete a transaction for which the information was collected;
• Fulfill a warranty or recall obligation;
• Comply with a legal obligation;
• Detect and protect against security incidents or fraudulent activity;
• Exercise free speech or another legal right; or
• Use the information for internal purposes reasonably aligned with your expectations.

When we cannot fulfill a deletion request due to an exception, we will notify you and explain which exception applies.

6.3 Right to Correct

You have the right to request that we correct inaccurate personal information that we maintain about you, taking into account the nature of the information and the purpose for which it is processed. We will use commercially reasonable efforts to correct the information and notify our service providers to do the same.

6.4 Right to Opt-Out of Sale or Sharing

You have the right to direct Cal Auto Group not to sell or share your personal information for cross-context behavioral advertising.

We also honor Global Privacy Control (GPC) browser signals as a valid opt-out request under California law. When we receive a GPC signal from your browser, we will process it as an opt-out of sale and sharing for that browser and device. Per regulations effective January 1, 2026, we will provide you with on-screen confirmation that your opt-out request has been successfully processed.

6.5 Right to Limit Use of Sensitive Personal Information

You have the right to direct Cal Auto Group to limit the use and disclosure of your sensitive personal information to only what is necessary to provide the services you have requested. Sensitive personal information we may collect includes:

• Social Security Number and government-issued ID numbers (including driver’s license numbers);
• Financial account information and credit application data;
• Precise geolocation (if collected with your consent); and
• Other categories of sensitive information as defined under CPRA.

To submit a request to limit the use of your sensitive personal information, please contact us at privacy@calautogroup.com or visit calautogroup.com/privacy-request.

6.6 Right to Non-Discrimination

Cal Auto Group will not discriminate against you for exercising any of your rights under the CCPA/CPRA. This means we will not:

• Deny you goods or services;
• Charge you different prices or rates;
• Provide you a different level or quality of goods or services; or
• Suggest that you will receive a different price or quality of goods or services as a result of exercising your privacy rights.

6.7 How to Submit a Privacy Rights Request

You may submit a CCPA/CPRA request through any of the following methods:

Email	privacy@calautogroup.com
Toll-Free Phone	[Insert Toll-Free Number — e.g., 1-800-CAL-AUTO]
Online Request Form	calautogroup.com/privacy-request

Response Timelines: We will acknowledge receipt of your request within 10 business days and will respond to your request within 45 calendar days. If we require additional time (up to an additional 45 calendar days), we will notify you of the extension and the reason for the delay.

Identity Verification: To protect your personal information, we may need to verify your identity before fulfilling a request. Verification may require you to provide information we already have on file, answer security questions, or submit additional documentation. We will not require you to create an account solely for the purpose of submitting a request.

Authorized Agents: You may designate an authorized agent to submit a CCPA/CPRA request on your behalf. The authorized agent must provide written proof of authorization (such as a signed permission letter or a power of attorney), and we may require you to verify your own identity directly with us to confirm the agent’s authority.

---

Section 7 — Data Security

Cal Auto Group takes the security of your personal information seriously and has implemented a multi-layered security program consisting of administrative, technical, and physical safeguards designed to protect your information from unauthorized access, disclosure, alteration, or destruction.

Our security measures include, but are not limited to:

• Encryption in Transit: We use SSL/TLS encryption to protect personal information transmitted between your browser and our servers.
• Access Controls: Role-based access permissions ensure that only authorized personnel can access personal information, and only to the extent required by their job function.
• Secure Infrastructure: Our website and data systems are hosted on secure servers with industry-standard protections, including firewalls, intrusion detection, and regular vulnerability assessments.
• Employee Training: Our team members receive regular training on data privacy, security best practices, and their obligations under California law.
• Vendor Security Requirements: Third-party service providers with access to your personal information are contractually required to implement and maintain reasonable security standards.

Data Breach Notification: In the event of a security breach involving your personal information, Cal Auto Group will notify affected consumers as required by California law, including California Civil Code § 1798.82 (California’s data breach notification statute), in a timely and transparent manner.

---

Section 8 — Data Retention

Cal Auto Group retains personal information for as long as is reasonably necessary to fulfill the purposes described in this Privacy Policy, comply with our legal and regulatory obligations, resolve disputes, enforce our agreements, and conduct legitimate business operations. When personal information is no longer needed, we securely destroy or de-identify it.

The following general retention guidelines apply:

Data Category	Typical Retention Period	Basis
Customer Sales and Transaction Records	7 years from the date of transaction	Automotive industry regulations, tax law, lender requirements
Financing and Credit Application Records	Per lender and regulatory requirements (typically 5–7 years)	Federal and state financial regulations
Website Analytics Data	Up to 26 months	Industry standard analytics retention
Marketing Opt-Out Records	Retained indefinitely	To permanently honor consumer opt-out preferences
Service Appointment Records	5–7 years from the service date	Warranty and dispute resolution purposes
Legal and Compliance Records	As required by applicable law	Regulatory obligations, statute of limitations

Retention periods may be extended where required by law or shortened where permitted and appropriate. If you submit a verified request to delete your personal information, we will delete it within the timeframes described in Section 6.2, subject to applicable legal exceptions.

---

Section 9 — Children’s Privacy / Minors

calautogroup.com and our associated dealership services are not directed at, and are not intended for use by, children under the age of 16. We do not knowingly collect personal information from individuals under the age of 16.

Consistent with the CPRA and updated 2025 CCPA regulations, any personal information belonging to consumers we know to be under the age of 16 is treated as sensitive personal information and afforded the highest level of protection under California law.

No Sale or Sharing Without Opt-In Consent: Cal Auto Group will not sell or share the personal information of consumers known to be under the age of 16 without affirmative opt-in consent. For consumers between the ages of 13 and 15, opt-in consent must be provided by the consumer directly. For consumers under the age of 13, verifiable parental or guardian consent is required.

If We Discover Collection from a Minor: If we learn or have reason to believe that we have inadvertently collected personal information from a child under 16 without the required consent, we will take prompt steps to delete that information from our records.

Parents and Guardians: If you believe your child has provided us with personal information and you would like to request access, correction, or deletion of that information, please contact our Privacy Officer at privacy@calautogroup.com.

---

Section 10 — Links to Third-Party Websites

calautogroup.com may contain links to third-party websites, applications, and services, including manufacturer websites, financing partner portals, and social media platforms. These third-party sites operate independently of Cal Auto Group and are governed by their own privacy policies and terms of service.

Cal Auto Group has no control over, and assumes no responsibility for, the content, privacy practices, or data collection activities of any third-party websites or services. The inclusion of a link on our website does not constitute an endorsement or recommendation of the linked third-party site or its privacy practices.

We strongly encourage you to review the privacy policy of every website you visit before providing any personal information.

---

Section 11 — Changes to This Privacy Policy

Cal Auto Group reserves the right to update, modify, or revise this Privacy Policy at any time, in order to reflect changes in our practices, services, legal requirements, or regulatory guidance. All changes will become effective upon posting the updated Privacy Policy to calautogroup.com, unless we indicate a different effective date.

The “Last Updated” date at the top of this page will always reflect the date of the most recent revision. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

Material Changes: If we make material changes to this Privacy Policy — such as changes to the categories of personal information we collect, how we use it, or your rights — we will provide prominent notice on our website and, where feasible, notify you by email using the address on file with us. Material changes will not apply retroactively to information previously collected without your consent where required by law.

Continued Use: Your continued use of calautogroup.com or our services following the posting of any changes to this Privacy Policy constitutes your acknowledgment of, and agreement to, the revised terms.

---

Section 12 — Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal information, please contact our Privacy Officer using any of the methods below. We are committed to responding promptly and transparently.

Contact	Privacy Officer / Data Privacy Team
Company	Cal Auto Group
Email	privacy@calautogroup.com
Toll-Free Phone	[Insert Toll-Free Number — e.g., 1-800-CAL-AUTO]
Mailing Address	Cal Auto Group, [Insert Street Address], California [Insert ZIP Code]
Online Request Form	calautogroup.com/privacy-request
Website	calautogroup.com

At Cal Auto Group, protecting your privacy is not simply a legal obligation — it is a core part of how we do business. We remain fully committed to being transparent, accountable, and responsive in all matters related to your personal information. Thank you for trusting us with your business.