Welcome to www.echopark.com, the website of EchoPark Automotive, Inc., a Delaware corporation, on our own behalf and on behalf of our parent company, Sonic Automotive, Inc. and our respective subsidiaries and affiliates, including our dealerships and vehicle buying centers located throughout the United States (collectively, our “Dealerships,” “we,” “us,” or “our”).

This website provides information about our company, our business, our alliances and third party relationships, and our products and services. We strive to protect all personal information that we receive or generate. This privacy policy (“Privacy Policy” or “Policy”) explains our data protection practices, not just for our website visitors but also for our customers, partners, and vendors who use our mobile apps and visit us in person.

This privacy policy also explains the nature of the personal information we collect, the means by which we collect it, the purposes for which we collect it, and how we use, process, protect, and share it.

Please read this entire privacy policy before submitting information to this website, to our mobile apps, or in person at our Dealerships. By accessing or using this website for any purpose and by submitting any of your personal information to us, you are consenting to the terms and conditions of this Policy and to our Terms of Use posted at https://www.echopark.com/terms-and-conditions (“Terms of Use”). If you disagree with any part of this Privacy Policy or the Terms of Use, please do not use this website or any of our other services and do not share any personal information with us.

This Policy includes supplemental terms in its final section that apply solely to California residents covered by the California Consumer Privacy Act (“CCPA”).

“Consent” means the voluntary, affirmative approval of, or agreement to, a right, authority, or permission requested by us regarding our collection, use, or processing of information in any form, including by a Customer’s electronic execution of a document, affirmative action signifying agreement (such as a Customer’s clicking on an electronic button or asking us to take his or her picture on vehicle delivery) or physical signature of a document delivered in person.

“Customers” are former, current, or prospective purchasers of one or more vehicles or Dealership Services from us and any other person or business which visits our website or our Dealerships or otherwise undertakes to do business with us in any manner, including business partners, vendors, suppliers, and service providers.

“Customer Data” means a Customer’s personal information that a Customer submits, emails, transmits, or otherwise makes available to us through the use of this website or otherwise from communications or transactions with us; provided that Customer Data does not include any Dealership Data.

“Dealership Data” means all data and information that is created, developed, licensed, stored, or used in or by us or our Dealerships or in any of our products, services, or activities, including information about a Customer we obtain from third party sources.

“Dealership Services” or “Services” mean all products and services other than vehicles that we may offer, sell, lease, or provide at any time, including parts, repair services, maintenance services, customer support services, finance services, leasing services, and other tangible and intangible materials and benefits.

“Vehicle Data” means the digital information collected, stored, or used in a vehicle’s on-board diagnostics or other electronic systems that may include vehicle user names, contact information, phone numbers, emails, texts, GPS location data, vehicle service history, and other information.

"You," “your,” or “user” means any and all of our website visitors and Customers regardless of how such persons may interact, communicate, or do business with us.

Our website describes a wide range of vehicles and Services that we offer, sell, lease, and provide to a broad range of Customers. Our website is for general commercial and informational purposes and is designed to facilitate and enhance communications and transactions with Customers for the purchase of our vehicles and Services. While any person may review the information on our website, it is not intended for communications or transactions with persons below the legal age of contracting (generally age 18).

4.1 Overview. This section explains generally the sources from which, and the means by which, we collect and process personal information and the purposes for which we do so.

4.2 Customer registration. A Customer who subscribes to or accesses any of our newsletters, email reminder services, or other product or Service or who desires to purchase or lease a vehicle from us will need to create an account, complete an online registration form, and indicate the matters of interest to him or her. Your account data may include your name, physical address, phone number, email address, and other information that will enable us to respond efficiently to your request or interest. If you desire more information about our vehicles and Services or desire to schedule a call with one of our representatives, you may do so online as well.

4.3 Consent to transactional activities. If you take steps to do business with us, we will request that you affirmatively Consent to our processing of certain transactions like credit checks, processing vehicle loans, and warranty applications by electronic execution of an online form or execution of documents delivered in person. We will also ask for your Consent to our ability to communicate with you by phone calls, text messages, and emails, which will require you to provide us with your phone number and email address. If you transfer a picture to us or permit us to take your picture upon vehicle delivery, you are deemed to impliedly Consent to our use of your picture for marketing purposes (unless and until you advise us otherwise in writing). Any form by which we request your Consent will include your agreement to this Privacy Policy and our Terms of Use. You agree that we can rely upon your Consent for all purposes referenced in the applicable Consent document you approve and this Policy.

4.4 Other means of collection. We collect personal information by a variety of means and methods, including the following:

• When you submit personal information to us voluntarily, including when you register an account, communicate with us, or search for or order, purchase, lease, or acquire any of our vehicles or Services;
• When you visit our website, we may collect location and other information from the internet browser you are using;
• When you engage in purchase, lease, financing, or other vehicle-related transactions with us or with any of our business partners, including completion of credit, insurance, warranty, or vehicle protection applications or submission of information for vehicle registrations, licenses, or calculation and processing of vehicle taxes, permits, or services;
• When we purchase or accept a vehicle from you as a trade-in, your vehicle may include digital systems that may store Vehicle Data and other personal data. You agree to delete that information from your vehicle before delivering it to us;
• When you submit information to us in pursuit of third party products and services, including insurance, maintenance services, and vehicle security services;
• When your communications with us provide us with certain technical formation, such as internet protocol (IP) address, browser type, time zone setting and location, device operating system, and other technologies you may use to access our website or otherwise communicate with us;
• Through Cookies and navigational data like Uniform Resource Locators (URLs) that we, third party vehicle listing sites, or other digital advertisers may use to gather information about the date and time online visits or other uses of our website or the websites of third parties, including business partners on whose sites we post vehicle information;
• Through third party services we use to track and analyze certain information from users of our website, the websites of business partners, or the websites of digital advertising networks with which we work that involve the exchange of statistical or demographic data on each site’s visitors and users;
• From third parties and public sources, including from data analytics providers for our own social media pages, including Facebook, Twitter, Instagram, and LinkedIn;
• From vehicle displays, shows, or marketing presentations we may make to you or to any group or gathering at which you are present; and
• From receiving or responding to any vehicle warranty, service, delivery, support, or other Customer inquiry or support request.

5.1 Personal information collected. The personal information we collect varies by user, transaction, and purpose, but our primary purpose is the efficient and satisfactory conduct of our business and for related legal purposes. The types of personal information that we collect do not apply at all times or to all Customers, and most types are based on a Customer’s voluntary submission of data or other voluntary interaction with us or our business partners.

• Publicly available information, which is information that is lawfully made available from Federal, State, or local government records and information that we or a business partner reasonably believes the Customer has publicly released or made available without restriction;
• De-identified, pseudonymized, or aggregated data;
• Personal information covered by certain sector-specific privacy laws that is protected in accordance with those laws, including the Fair Credit Reporting Act (15 U.S.C. §1681 et seq.) (“FRCA”), the Gramm-Leach-Bliley Act (15 U.S.C. §6801 et seq.) (“GLBA”), and the Driver’s Privacy Protection Act of 1994 (18 U.S. Code §2721 et. seq.) (“DPPA”). We separately comply with those requirements by means other than through application of this Policy; and
• Vehicle Data, which we do not voluntarily collect, do not desire to receive, and which we request that our Customers purge or delete from any vehicle sold to us or traded in for one of our vehicles, before delivery of the vehicle to us.

• Directly from Customers from forms or applications the Customers complete or with respect to vehicles or Services our Customers purchase or request from us;
• Directly from our Customers who visit our social media pages through links from our website (though such social media platforms are subject to their own privacy policies and not this Policy);
• Directly from a Customer when he or she picks up a vehicle and requests or permits one of our sales representatives to take his or her picture with the new vehicle and authorizes us to post the picture in our dealership or on our website or use it in marketing materials;
• Indirectly from our Customers from observing their actions on our website or from communications with our Customers in any form (i.e., text messages, phone calls, or emails), including from in-person visits to our Dealerships;
• From our business partners for Services associated with Customers’ transactions with us (e.g., vehicle searches, credit applications, vehicle protection services, Service requests, etc.); and

• Customer data. You hereby grant us an irrevocable, non-exclusive and perpetual license to use all Customer Data that you convey, disclose, or make available to us to receive, hold, and use such Customer Data in connection with our business and for other purposes allowed by law.
• Dealership data. We own and retain all right, title and interest in and to all Dealership Data.
• Vehicle data. We disclaim any interest in, and any duty or obligation with respect to, any Vehicle Data in any form that is present or stored in (in computer memory or otherwise) any vehicle that a Customer sells to us or delivers to us for trade-in.

6.1 Purposes. We use the personal information that we collect or receive from our Customers for the purposes described in this Policy and for other business purposes allowed by law, including the development, delivery, and performance of our products and services, sharing with our affiliates for related business purposes, and as follows:

• To fulfill or meet the reason a Customer provided us with the information. For example, if you share your contact information to request a price quote or ask a question about our vehicles or Services, we will use that information to respond to your inquiry. If you provide your personal information to purchase a vehicle or a Service, we will use that information to process your payment and facilitate delivery;
• To facilitate new orders or to process returns or requests for Customer support, including through administering your account;
• To market our vehicles to you, including through your subscriptions to any of our email notifications or newsletters;
• To respond to your requests and questions, resolve disputes, investigate and address your concerns, and monitor and improve our responses;
• To help maintain the safety, security, and integrity of our website, databases, and technology assets and to detect and prevent transactional fraud;
• For testing, research, analysis, and new product and service development, including to improve our website, products, and services;
• For facilitating and processing your transactions with us and with our third party affiliates and business partners, including for vehicle purchase, leasing, financing, registration, and tax payments and for the performance of strategic partnerships;
• To respond to law enforcement requests and as required by applicable laws, court orders, or governmental regulations;
• To process information so as to create de-identified, pseudonymized, or aggregated information by removing data that can readily identify or lead to the identification of a data subject; and
• To evaluate or consummate a sale, merger, divestiture, restructuring, reorganization, dissolution, or other transfer of some or all of our assets in which personal information held by us is among the assets so transferred.

6.2 Exercise of legal rights. We may also process your personal information where necessary for the establishment, exercise or defense of tax, audit, or other legal rights or to exercise our rights, duties or obligations under applicable laws.

6.3 Activities with customer consent. When you do business with us, whether online or in person, and Consent to certain actions or activities by us, we will undertake, perform, and process such activities as you authorize. This may include credit checks, loan processing, vehicle warranty applications, license and title registration, and other actions. If you Consent to communications with us by phone calls, text messages and emails, we will communicate with you at the phone number or email address you provide, unless and until you withdraw your Consent in writing. You agree that we may rely upon your Consent for all purposes referenced in the applicable Consent document and this Policy.

7.1 We disclose certain personal information to affiliates, including Sonic Automotive, Inc., and to third parties for purposes related to the conduct of our business. We also share user data with certain data analytics firms who assist in our analysis and improvement of our website and in the generation of Customer leads for our business (e.g., Google Analytics; Twilio Sendgrid, CDK eLead, etc.).

7.2 We disclose your personal information to Dealership and call center personnel and business partners as necessary to process your requests for vehicles and Services. All authorized personnel are subject to duties of confidentiality with regard to such information.

7.3 We may disclose your personal information to our authorized technology subcontractors, vendors, and processors who are subject to confidentiality obligations with regard to the processing of such personal information.

7.4 Financial transactions relating to our vehicles and Services are generally paid by check, ACH transaction, wire transfer, or through payment services providers (e.g., banks, credit card companies, etc.). We share transaction data with our vehicle lenders, lessors, and payment services providers to process payments and refunds and to resolve issues relating to Customer transactions.

7.5 We may also disclose your personal information when necessary for compliance with a legal obligation to which we are subject, in response to law enforcement requests, in order to secure our networks, to avoid fraud or malicious network behavior, to protect your vital interests or the vital interests of another natural person, to establish or defend legal claims, or to comply with applicable laws.

7.6 We may also share your personal information as allowed by applicable law.

• All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

8.1 We use a browser feature known as a “Cookie,” web beacons (also known as pixels), and other technologies primarily to collect information from users of our website. A Cookie is a file containing an identifier (a string of letters and numbers) that is sent by a web server to a web browser and is stored by the browser. The identifier is then sent back to the server each time the browser requests a page from the server. Manage cookies.

8.2 Cookies may be either “persistent” Cookies or “session” Cookies. A persistent Cookie will be stored by a web browser and will remain valid until its set expiry date, unless deleted by the user before the expiry date. A session Cookie, on the other hand, will expire at the end of the user session when the web browser is closed.

8.3 Personal information we hold may be linked to the information obtained from Cookies.

8.4 We primarily use Cookies for the following purposes:

• Authentication: To identify you when you visit our website and as you navigate our website;
• Status: To help us to determine if you are logged into our website;
• Personalization: To store information about your preferences and to personalize the website for you;
• Security: As an element of the security measures used to protect Customer accounts, including preventing fraudulent use of login credentials and to protect our website and online transactions generally; and
• Analytics: To help us analyze the use and performance of our website and to process transactions.

8.5 Our third party vendors may use Cookies that are stored on your computer when you visit our website. Most browsers allow you to refuse to accept Cookies and to delete Cookies. The methods for doing so vary from browser to browser and from version to version. Blocking all Cookies will have a negative impact on the usability of many websites. If you block Cookies associated with our website, you will not be able to use all of the features on our website.

8.6 We use Google Analytics, Content Square and Optimizely to analyze the use of our website. These providers gather information about website use by means of Cookies. The information gathered relating to our website is used to create reports about the use of our website.

We implement and maintain administrative, technical, physical, and organizational measures that we believe are appropriate to protect personal information against unlawful or unauthorized access, use, or disclosure.

10.1 Our data retention policies are designed to comply with our legal obligations in relation to the retention and deletion of personal information, whether held by us or by any of our data processors or vendors.

10.2 Personal information that we process will be kept for as long as necessary to fully perform the purpose for which it is collected and for such additional periods of time as we deem necessary or appropriate to the sound operation of our business. Our legal rights, obligations, and interests require that we retain personal information after the completion of specific transactions with our Customers.

10.3 We may retain your personal information for the longer of: (i) the period of your consent to our collection and use of such information; (ii) the period necessary for us to fulfill the purposes of our tax, audit, or other legal rights, duties, and interests with regard to Customer Data; and (iii) such longer period as permitted under applicable laws. Customer Data which has been de-identified, pseudonymized or aggregated is no longer personal information.

10.4 We may retain your personal information for longer periods of time in order to comply with a legal obligation, such as obligations we may have with respect to litigation or arbitration, in order to protect your vital interests or the vital interests of another person, or to meet our tax, audit, or other legal rights, duties, and interests.

We may modify this Privacy Policy from time to time by publishing a new version on our website. You should check this website periodically to ensure that you agree with and approve to any changes to this Policy. Your continued use of our website and/or the continued conduct of business with us after an update of this policy constitutes your consent to the then current version of this Privacy Policy.

If you have any questions or comments about this Privacy Policy, please contact us at:

• Website: echoparkautomotiveprivacy.com
• Email: privacy@echoparkautomotive.com
• Toll Free Phone: (800) 810-1827
• Mail: Consumer Privacy Request, EchoPark Automotive, Inc., 4401 Colwick Road, Charlotte, NC 28211.

This Privacy Policy Supplement for California Consumers (this “Supplement”) adds additional terms to those contained in this Policy that apply solely to residents of the State of California who are subject to the California Consumer Privacy Act of 2018, as amended (“CCPA”). Any terms defined in the CCPA that are not otherwise defined in this Supplement shall have the same meanings as such terms are given in the CCPA.

The CCPA provides Consumers with certain additional rights and information regarding their personal information. This Supplement provides those disclosures and describes those additional rights and explains how such additional rights may be exercised. Please read this Supplement as an expansion of the terms of the Policy set forth above as to Consumers interacting or doing business with us.

(a) “Consumer(s)” means California resident(s) who are subject to CCPA and are identified or identifiable from or through the use of “personal information” collected or used by us as such term is defined in the CCPA.

(b) “Sell,” “Selling,” “Sale,” or “Sold” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Consumer’s personal information by a business subject to the CCPA to another covered business or to a third party for monetary or other consideration.

(c) “Service Provider” means a for-profit legal entity that processes a Consumer’s personal information on behalf of a CCPA-covered business that has disclosed such information to the recipient for a business purpose pursuant to a written contract that restricts the use of such data by the recipient to providing services to the disclosing business.

13.2 Categories of personal information collected. Listed below are the categories of personal information that we collect and use in our business for commercial purposes. These categories of data do not all apply at all times or as to all Consumers and often our receipt of this data is based on a Consumer’s voluntary submission of it to us for specific purposes or transactions requested by the Consumer:

(a) Sale of personal information. The CCPA requires that we disclose if we sell the personal information of Consumers to third parties which do not meet the definition of Service Providers under the CCPA. The common understanding of the term “sell” is to transfer property (in this case, personal information) for monetary consideration (i.e., cash), but under the CCPA, the definition of “sell” includes exchanging data for a business benefit other than cash. We do not sell, disclose, or transfer any Consumer’s personal information to a third party which does not meet the definition of Service Providers under the CCPA.

(b) Participation in advertising networks. We do participate in digital advertising activities through third party data analytics providers such as Google Analytics, which provides us with information collected on third-party websites on which we advertise our vehicles, including the identity of users of those websites. Our use of digital advertisers and participants helps us identify persons who are shopping for vehicles and enables us (i) to measure whether and how our ads were delivered to and interacted with by Consumers; (ii) provides us reporting about the effectiveness and performance of our ads; (iii) provides us reporting about users who interacted with our ads; and (iv) informs us about the percentage of our ads that had the opportunity to be seen.

13.4 Disclosures to categories of service providers. We disclose personal information for business purposes to the following categories of Service Providers under restrictive contracts which meet the requirements of the CCPA:

• Business partners who assist us in conducting transactions with our Consumers like submitting credit applications, financing, vehicle warranties, trade-ins, and scheduling vehicle service or delivery;
• Customer relationship management (“CRM”) software providers with which we have entered into licensing agreements for marketing and communications activities with current and prospective Customers;
• Data analytics and cloud data providers other than Google Analytics with which we have entered into licensing agreements for data collection, use, analysis, transfer, and storage in support of our business;
• Payment processing and human resource information system (“HRIS”) providers for vendor, supplier, contractor, employee and Service Provider payment processing activities; and
• Other Service Providers directly involved in our business transactions with Customers.

(a) Overview. We extend the following rights to Consumers relating to their personal information that we have collected, used, or hold (collectively, “Data Rights”).

(b) When data rights do not apply. Data Rights are subject to certain exceptions and limitations based on the specific data processing activities involved or other legal constraints like law enforcement and litigation uses. If any of those exceptions or limitations should apply to a Data Rights request, we will explain in our response why (or the extent to which) we are unable to honor a Consumer request.

(c) Data rights described. A Consumer’s rights relating to his or her personal information includes one or more of the following rights if and as applicable to a given request (a “Data Rights Request”). If a Consumer desires to exercise any of these rights, he or she should contact us by using the Data Rights Request Form referenced in Section 13.6 below.

(i) The right to know. A Consumer has a right to request that we disclose certain information to him or her about our collection and use of the Consumer’s personal information over the past 12 months. Upon such a request, after verification of the Consumer’s identity, we will confirm (i) the categories of personal information we have collected about the Consumer, (ii) the categories of sources from which such information was collected, (iii) the business or commercial purpose for our collection, disclosure or use of such data, (iv) the categories of any third parties with which we shared such personal information for a business purpose, and (v) the specific pieces of personal information we have collected about the Consumer.

(ii) The right of deletion. In some circumstances, a Consumer has the right to request that we delete personal information that we have collected from or about the Consumer. Those circumstances include when (i) the personal information is no longer necessary in relation to the purposes for which it was collected or processed; (ii) the Consumer withdraws his or her Consent to any consent-based processing such as marketing; and/or (iii) our continued processing of such data violates this Policy or is otherwise unlawful. However, there are exceptions to the right of deletion, including when our retention and processing of such data is reasonably necessary to (A) complete the transaction for which such data was collected, to fulfill the terms of a written warranty or product recall or otherwise perform our contract with the Consumer, (B) provide a product or service requested by the Consumer or take actions reasonably anticipated within the context of our ongoing business relationship, (C) detect security incidents or protect against deceptive, fraudulent or unlawful activity, (D) for internal use reasonably aligned with the Consumer’s expectations under this Policy or applicable law, and/or (E) compliance with a legal obligation.

(iii) The right to data portability. In certain circumstances under the Right to Know, a Consumer has the right to access the specific pieces of his or her personal information that we collected from such Consumer, by mail or electronically, and if provided electronically, in a portable, readily useable format to the extent technically feasible. However, this right does not apply where it is outweighed by other lawful needs or when the attempted return of it would adversely affect the rights or interests of others, such as when the personal information cannot be segregated from other protected data.

(iv) Right to opt-out of the sale of personal information. If and to the extent we are deemed to Sell a Consumer’s personal information to a third party, the Consumer has the right to direct us to stop Selling the Consumer’s personal information to such third parties (the “Right to Opt-Out”). To exercise the Right to Opt-Out, the Consumer may submit a Data Rights Request Form to us invoking such right. The Consumer does not need to create an account with us to exercise his or her Right to Opt-Out. We will only use personal information provided in an opt-out request to review and comply with the requesting Consumer’s request. A Consumer’s exercise of the Right to Opt-Out will only apply to our disclosures to third parties which are not Service Providers and will not affect our own communications and transactions with our Customers or communications by our business partners with our Customers in connection with our own business activities.

To exercise any Data Rights, please complete and submit the Data Rights Request Form at the bottom of this page or by:

• Calling us at (800) 810-1827
• Emailing us at privacy@echoparkautomotive.com.

Any data rights request must:

• Provide sufficient information to permit us to reasonably verify that the requestor is the person about whom we collected personal information or an authorized representative thereof. We cannot respond to a request or provide personal information if we cannot verify the requestor’s identity or authority to make the request and confirm that the personal information relates to them.
• Such verification requirements include proof of the identity of the Consumer about whom a request is made either (i) by a third party identity verification service engaged by us, or (ii) by our matching the identifying information of the Consumer at issue with the personal information of the Consumer already maintained by us, either in a password protected account with the Consumer or by identification of the Consumer’s recent vehicle searches or other activities with us or our business partners.
• Describe the Data Rights Request with sufficient detail for us to properly understand, evaluate and respond to it.

Consumers do not need to create an account with us to submit a Data Rights Request, but we do consider requests made through a password protected account sufficiently verified when the request relates to personal information associated with that account. We will only use personal information provided in the request to verify the requestor’s identity or authority to make it.

We will promptly confirm receipt of any such request (generally within ten 10 days) and endeavor to substantively respond to it after verification within forty-five (45) days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing.

If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically or as otherwise agreed.

Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. We do not charge a fee to process or respond to verifiable Data Rights Requests unless excessive, repetitive, or manifestly unfounded.

Consumers have the right to be free of discrimination relating to their exercise of any Data Rights. We do not discriminate against Consumers for exercising any of their Data Rights. This means that the exercise of Data Rights will not result in our:

• Denial of any purchase or acquisition of our vehicles or Services;
• Charging a different price or rate for vehicles or Services, including through granting discounts or other benefits or imposing penalties;
• Providing a Consumer with a different level or quality of vehicles or Services; or
• Suggesting any of the above results to a Consumer.

California’s “Shine the Light” law (Civil Code Section § 1798.83) permits users of our website who are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes in the past year, including the categories of personal information disclosed and the identity of such third parties. To make such a request, please send an email or write to us at the address set forth in Section 12 above (“Our Contact Information”).