1. Roles
For consumer information Cararri delivers to Dealer (enquiries, test drive requests and credit requests, "Consumer Data"), Cararri and Dealer each act as independent businesses responsible for their own compliance. Where state law requires, this Addendum serves as the contract governing disclosure of personal information between the parties.
2. Permitted use
Dealer will use Consumer Data only to respond to the consumer about the vehicle, financing, trade-ins and related products the consumer asked about, and as required by law. Dealer will not sell, rent, share for cross-context behavioral advertising, or use Consumer Data to build lists for unrelated marketing.
3. Safeguards
Dealer will maintain a written information security program meeting the FTC Safeguards Rule, including:
- A qualified individual responsible for the program.
- Access controls, multi-factor authentication for systems containing customer information, and encryption in transit and at rest.
- Staff training and prompt removal of access for departing staff.
- Secure disposal of Consumer Data when no longer needed.
4. Credit requests
Dealer will obtain a consumer's written authorization before requesting a credit report, will have a permissible purpose under the Fair Credit Reporting Act, and will provide adverse action notices and other disclosures where required.
5. Consumer requests
Dealer will honor opt-out, deletion and other privacy requests it receives directly as required by law, and will cooperate reasonably with Cararri on requests that involve both parties.
6. Security incidents
Dealer will notify Cararri at support@cararri.com within 72 hours of discovering unauthorized access to Consumer Data received from Cararri, and will cooperate in investigation and any required notifications.
7. Cararri's obligations
Cararri will deliver Consumer Data through secure channels, protect its copy of Consumer Data with reasonable safeguards and keep records of what it delivers.
8. Audit
On reasonable notice, Dealer will provide a summary of its safeguards or answer a security questionnaire no more than once per year, or after a security incident.