CarDoorX Privacy Policy (Canada)

CarDoorX (“CarDoorX”, “we”, “us”, or “our”) is a platform used by automotive dealers (“Dealers”) to manage and sell inventory, transactions, leads, and related customer information.

This Privacy Policy explains how we collect, use, disclose, and safeguard personal information in Canada in connection with:

• Information stored on CarDoorX as a result of the platform's intended purpose (for example, dealer accounts, user activity, system logs), and

• Any information that a Dealer submits to, uploads into, or collects through the CarDoorX platform (including information about the Dealer's own customers).

(collectively, the “Services”).

Scope: This Privacy Policy applies only to information handled within the CarDoorX platform and related infrastructure. It does not govern a Dealer's own independent websites, systems, or offline data practices, which are subject to the Dealer's own privacy policies and legal obligations.

By using the Services (including by creating a Dealer account or submitting data to CarDoorX), you consent to the collection, use, and disclosure of personal information as described in this Privacy Policy. If you do not agree, please discontinue use of the Services.

1. Who We Are & How to Contact Us

CarDoorX is operated by:

If you have questions or concerns about this Privacy Policy or our handling of personal information, please contact us at the email above.

2. What Is “Personal Information”?

“Personal information” means information about an identifiable individual, as defined under applicable Canadian privacy laws (such as the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, provincial private-sector privacy laws).

In the context of CarDoorX, this includes:

• Information about Dealer representatives and users (e.g., dealer staff with logins), and

• Information about Dealer and CarDoor customers (e.g., consumers buying, selling, or financing vehicles), when such information identifies an individual.

Personal information does not include certain business contact information used solely to communicate with a person in relation to their job or profession, or information that has been irreversibly de-identified or aggregated.

3. Roles: CarDoorX vs. Dealers

In most cases:

• The Dealer determines what customer information is collected and potentially uploaded to CarDoorX and the purposes for which it is used in the Dealer's business (“Dealer Customer Data”).

• CarDoorX processes this Dealer Customer Data on behalf of the Dealer, providing hosting, tools, and services (similar to a “service provider” or “agent” under Canadian privacy laws).

Dealers remain responsible for:

• Providing appropriate notices to, and obtaining any required consents from, their customers; and

• Ensuring their use of CarDoorX complies with applicable laws and their own privacy policies.

This Privacy Policy describes how CarDoorX handles personal information within the platform, but it does not replace or limit a Dealer's own privacy obligations to their customers.

4. Information We Collect

4.1 Information About Dealers and Dealer Users

We collect personal information about Dealers and their authorized users (e.g., employees, agents, administrators) such as:

• Account & Profile Information

• Dealer name and contact details

• Name, title, and role of individual users

• Work email address and phone number

• Login credentials and authentication information

• Platform Use & Configuration

• User permissions and roles

• Settings, preferences, and configuration choices

• Communications & Support

• Information shared via email, chat, phone, or in-app messages

• Feedback, surveys, and support requests

4.2 Information About Dealer Customers (Dealer Customer Data)

Through the platform, Dealers may submit, upload, or collect personal information about their own customers (e.g., vehicle buyers, sellers, or leads). This may include, depending on the Dealer's use of the platform:

• Basic Identification & Contact Information

• Name

• Address

• Email address

• Phone number

• Vehicle & Transaction Information

• Vehicles owned, sold, purchased, or considered

• Vehicle Identification Number (VIN)

• Photos, descriptions, and related documents

• Offers, valuations, and transaction history

• Eligibility, Financing & Supporting Information

• Date of birth

• Driver's licence or other ID details (where permitted by law)

• Income, employment, housing status, and similar financial information supplied by the customer or Dealer

• Information obtained (with consent) from credit bureaus via financing partners, where integrated by the Dealer

Important: CarDoorX does not control what Dealer Customer Data is collected, uploaded, or used. Dealerships must ensure they have the authority and any required consents to provide this information to CarDoorX.

4.3 Information Collected Automatically

When Dealer users access or use CarDoorX, we automatically collect:

• Usage Information

• Pages and features accessed

• Actions taken (e.g., created/updated records, searches)

• Timestamps, session duration, and navigation paths

• Device & Technical Information

• IP address

• Browser type and version

• Device type, operating system, and identifiers

• Error logs and performance metrics

• Cookies and Similar Technologies

We use cookies, pixels, and similar technologies to:

• Maintain sessions and security

• Remember certain preferences

• Analyze platform usage and performance

You may manage certain cookies via your browser settings. If you disable cookies, some features of CarDoorX may not function properly. Where required by law, we will seek consent for non-essential cookies.

4.4 Information from Third Parties

We may receive information from third parties, such as:

• Service and Infrastructure Providers

• Logs, diagnostics, and analytics related to platform performance and security.

• Finance, Payment, and Integration Partners

• Limited information required to operate integrated features (e.g., status of a financing application, payment status), where the Dealer uses such integrations and consents are in place.

5. How We Use Personal Information

We use personal information for purposes that are reasonable and appropriate in the context of CarDoorX, including:

5.1 Operating and Providing the Platform

• Creating and managing Dealer accounts and user profiles

• Hosting and storing Dealer and Dealer Customer Data

• Enabling platform features (inventory, leads, offers, financing workflows, etc.)

• Processing platform-related transactions, where applicable

5.2 Supporting Dealers in Their Use of the Platform

• Providing customer support and responding to requests

• Training and onboarding Dealer staff

• Communicating about updates, maintenance, and new features

5.3 Security, Fraud Prevention, and Legal Compliance

• Protecting the security and integrity of CarDoorX

• Monitoring and investigating suspicious activity or potential abuse

• Enforcing our agreements and acceptable use policies

• Complying with legal, regulatory, and audit requirements

5.4 Improving and Developing CarDoorX

• Understanding how Dealers and users interact with CarDoorX

• Fixing bugs and improving performance and usability

• Developing new features, enhancements, and services

• Creating aggregated or de-identified analytics to better understand usage and inform business decisions

5.5 Communications and Optional Marketing

• Sending service-related notices (e.g., system updates, maintenance notices, policy changes)

• Sending occasional marketing communications about CarDoorX or related services (where permitted by law and subject to Dealer/user preferences)

You may opt out of marketing communications at any time (see Section 9). Service, security, or transaction-related communications may still be sent where necessary.

6. Consent and Your Choices

In many cases, your consent to our collection, use, and disclosure of personal information is implied through your or your organization's use of CarDoorX.

In certain cases, we may seek express consent, for example:

• When required by law for specific activities (e.g., some marketing, certain cookies), or

• When we intend to use or disclose personal information for a materially new purpose not already described in this Policy.

You can typically:

• Manage account settings and preferences within CarDoorX (where available),

• Unsubscribe from marketing emails using the “unsubscribe” link in those messages, and

• Contact us at [email protected] to withdraw consent or update your choices, subject to legal or contractual restrictions.

Withdrawing consent may limit our ability to provide some or all CarDoorX functionality to you or your organization.

7. How We Share Personal Information

We do not sell personal information. We may disclose personal information in the following circumstances:

7.1 Service Providers

We share personal information with trusted third-party service providers who assist us in operating CarDoorX, such as:

• Hosting and infrastructure providers

• Data storage, backup, and security services

• Analytics providers

• Customer support and communication tools

• Payment processors or integration partners (where used)

These providers are generally required to protect personal information and to use it only for the purposes of providing services to CarDoorX.

7.2 Dealers and Dealer Users

Within a Dealer's account, information will be visible to that Dealer and its authorized users based on the Dealer's configuration and permissions. CarDoorX does not control internal access policies at each Dealer.

If a Dealer elects to integrate CarDoorX with other systems, some personal information may be shared with those systems as configured by the Dealer, in accordance with the Dealer's instructions.

7.3 Business Transactions

If CarDoorX or CarDoor Inc. is involved in a merger, acquisition, financing, reorganization, or sale of some or all assets, personal information may be disclosed as part of that transaction, subject to appropriate confidentiality and in compliance with applicable privacy laws.

7.4 Legal and Safety Obligations

We may disclose personal information when we believe it is reasonably necessary to:

• Comply with applicable laws, regulations, or legal processes

• Respond to lawful requests from law enforcement or regulators

• Protect the rights, property, or safety of CarDoorX, our users, Dealers, or the public

• Detect, prevent, or address fraud, security, or technical issues

8. International Transfers

Personal information handled by CarDoorX may be stored and processed in Canada and in other jurisdictions where our or our service providers' systems are located. As a result, personal information may be subject to the laws of those jurisdictions and may be accessible to government, courts, or law enforcement under lawful orders.

We take reasonable steps to ensure that personal information transferred outside of Canada is protected by appropriate safeguards, in line with Canadian privacy requirements.

9. Your Rights and Choices

Subject to applicable laws, individuals may have the right to:

• Access personal information about them held by CarDoorX,

• Request correction of inaccurate or incomplete personal information,

• Withdraw consent to certain uses and disclosures, and

• Request information about our personal information practices.

Dealer users or Dealer customers who wish to exercise these rights can:

• Contact their Dealer, where the Dealer is the primary organization responsible for the data, and/or

• Contact CarDoorX at [email protected].

We may need to verify identity and, in some cases, confirm with the relevant Dealer before responding to certain requests, given our role as a service provider.

You can also opt out of marketing emails by using the “unsubscribe” link included in those communications.

10. Retention of Personal Information

We retain personal information for as long as reasonably necessary to:

• Provide and support CarDoorX to the Dealer,

• Fulfil the purposes described in this Privacy Policy,

• Meet legal, regulatory, and audit obligations, and

• Protect our rights (for example, in case of disputes or claims).

Dealers are responsible for their own retention policies and decisions regarding deletion or export of data from CarDoorX. When personal information is no longer required by us, we will securely delete or anonymize it in accordance with our retention policies and applicable laws.

11. Security of Personal Information

We use reasonable physical, technical, and administrative safeguards designed to protect personal information from unauthorized access, use, disclosure, loss, or theft. These measures may include:

• Access controls and authentication

• Encryption and secure transmission where appropriate

• Logging and monitoring

• Employee training and confidentiality obligations

Despite these measures, no security controls are perfect, and we cannot guarantee absolute security. We encourage Dealers and users to follow good security practices, such as using strong passwords and enabling available security features.

12. Children's Privacy

CarDoorX is designed for use by business organizations (Dealers) and their authorized personnel. It is not directed to children or individuals under the age of majority in their province or territory, and we do not knowingly allow such individuals to create user accounts on CarDoorX.

If a Dealer uploads or collects information about a minor, it is the Dealer's responsibility to ensure that any required consents or authorizations have been obtained and that such collection complies with applicable laws.

If you believe we have collected personal information directly from a child inappropriately, please contact us at [email protected].

13. Third-Party Websites and Systems

CarDoorX may integrate with, or provide links to, third-party websites, apps, or systems (for example, finance partners, payment providers, CRM tools, or OEM systems). This Privacy Policy does not apply to those third parties, and we are not responsible for their privacy practices.

Dealers are responsible for ensuring any integrations they enable comply with applicable laws and for reviewing the privacy policies of third-party services they use.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or Services. When we make material changes, we will update the “Last updated” date at the top of this Policy and may provide additional notice (for example, within the platform or by email to Dealer administrators).

Your continued use of CarDoorX after any changes to this Privacy Policy indicates acceptance of the updated Policy.

15. Contacting Us or Filing a Complaint

If you have any questions, requests, or complaints about this Privacy Policy or our handling of personal information, please contact:

You may also have the right to lodge a complaint with the relevant privacy regulator (for example, the Office of the Privacy Commissioner of Canada or a provincial privacy commissioner).