AutoFi Privacy Policy

AutoFi Privacy Policy

Effective as of and last updated on September 15, 2023

This Privacy Policy includes important information about your personal information and we encourage you to read it carefully.

Introduction

AutoFi, Inc. (“we,” “our,” “us” or “AutoFi”) provides digital retailing solutions for automotive dealers, marketplaces, original equipment manufacturers (“OEMs”), and its financing partners.

Privacy and security are very important to us at AutoFi. This Privacy Policy (this “Policy”) is meant to help you understand how we collect, use, and share personal information in our possession, including how we may use your personal information to operate, improve, develop and protect our services. This Policy also outlines certain rights you have regarding your personal information.

As used in this Policy, “personal information” or “personal data” means any information that identifies, relates to, describes, or is capable of being associated with or reasonably linked to, a particular person or household. Personal information may include your name, address, e-mail address, telephone number; age, date of birth, and social security number; and financial information, including information concerning your assets, income, and bankruptcy history. This Policy applies to AutoFi, its website at www.autofi.com (the “Website”), and its products and services, including its software and API services (collectively, the “Service”). If you are an AutoFi customer (i.e., you have contracted with AutoFi to purchase certain of our products or services) and your contract with us conflicts with this Policy, the terms of your contract supersede the conflicting terms in this Policy.

On third-party websites, including our dealer and marketplace customer websites, the privacy statement or policy of the third party applies, even if those third-party websites integrate the Service. This Policy applies only to information directly submitted to or collected by the Service. This Policy does not govern the information practices or the content of any other websites or where the Service contains links to other websites.

AutoFi encourages you to review the privacy statements of other websites to understand their information practices.

What Personal Information Does AutoFi Collect?

Below is a brief summary of the categories or types of information that we collect from our customers, the employees and other authorized users of our customers, and end-users.

● If you are an AutoFi customer, which may include automotive dealers and marketplaces and our financing partners (collectively, “AutoFi Customers”), we may collect and receive information and data pertaining to your customers and billing details, such as credit card and bank account information and your billing address.

● If you are an employee, authorized user, or other individual who is granted access to the Service by an AutoFi Customer (collectively, “Authorized Users”), we may collect your email address, phone number, password, and domain (or similar account details) information.

● If you are a user of the Service, which includes customers who are shopping, purchasing, or applying for financing of an automobile (collectively, “End Users”), we may request, and you may provide financial credit data, driver’s license number, bank account information, employment and/or employment history information, phone number, and email address (together, with AutoFi Customer Information, “Other Information”).

● If you otherwise access or use the Service, including if you are a visitor to the Website, we may collect, or you may provide, the following information:

           1. metadata that provides additional context about the way you work and use the Service;

          2. as with most websites and technology services delivered over the Internet, our servers automatically collect information when you access or use our websites or Service and record that information in log files. This log data may include the Internet Protocol (IP) address, the address of the web page visited before using the website or Services, browser type and settings, the date and time the Services were used, information about browser configuration and plugins, language preferences and cookie data; and

         3. information about devices accessing the Website and Service, including the type of device, what operating system is used, device settings, application IDs, and unique device identifiers. Whether we collect some or all of this Other Information often depends on the type of device used and its settings.

How Do We Use and Share Personal Information?

Broadly, we use any personal information we collect or receive to provide the Service or as may be permitted or required by law or regulation.

● AutoFi Customers. If you are an AutoFi Customer, we may use personal information to fulfill our obligations to you or to perform the services you request. We may also use personal information to carry out our core business operations and to perform functions such as billing and reconciliation and meet our contractual and legal obligations related to anti-money laundering and “know-your-customer” (KYC) obligations.

● Authorized Users. If you are an Authorized User, we may use your personal information in connection with providing the Service to an AutoFi Customer. This may include using your personal information to create, update and maintain your account with AutoFi.

● End Users. If you are an End User, we may use your personal information in connection with or to facilitate the purchase, lease, or financing of an automobile when you go through the automobile transacting or financing process. Further, we may share your personal information with our services providers, vendors, and other third parties in connection with the automobile transacting process and the evaluation of your loan application. This may include your name, email address, date of birth, phone number, employment and income details, financing credit data, including your social security number, and other data from your credit bureau file.

Additionally, we may use and share your personal information for other business purposes, which may include:

● with our services providers, partners, or contractors, including data processors, in connection with the services they perform for us;

● to enforce a contact with you;

● to comply with applicable law or regulation, or a judicial proceeding, court order, or legal process;

● to ensure the quality of information;

● in connection with a change of ownership or control of all or part of our business;

● as we reasonably believe is appropriate to protect the rights, privacy or property of you, AutoFi, our partners, and others; or

● for any other purpose with your consent.

Finally, we may collect, use and share your information in an aggregated, de-identified or anonymized form, which will not identify you personally, for any purpose permitted under applicable law. This may include creating or using aggregated, de-identified, or anonymized data to improve or develop products and services.

We do not sell or rent personal information and will not share your personal information with third parties for their own marketing or promotional purposes unless you ask us to or provide us your consent to do so.

Cookies

When you visit our Website, sign up or respond to a promotional offer, fill out a website, or request information from us, we may collect information about you using cookies and other similar tracking technologies. We do this by sending a cookie to your computer or device when you access the Service. We collect this information to make interactions with the Service easier and more meaningful. Unless you choose to identify yourself to AutoFi, either by responding to a promotional offer, opening an account, or filling out a web form (such as a “Contact Me” or a “30-Day Free Trial” web form), that cookie is the only identifying information AutoFi collects about your browsing session.

There are two types of cookies we use: session-based and persistent-based. Session cookies exist only during one session. They disappear from your computer when you close your browser software or turn off your computer. Persistent cookies remain on your computer after you close your browser or turn off your computer.

If you have chosen to identify yourself to AutoFi, the AutoFi uses session cookies containing unique identifiers to allow AutoFi to uniquely identify you. Each time you access the Service, a session cookie containing an encrypted, unique identifier that is tied to your account is placed in your browser. These session cookies allow AutoFi to uniquely identify you when you are navigating the Service and to process your online transactions and requests. Session cookies are required to use the Service.

AutoFi may use persistent cookies that only AutoFi can read and use to identify browsers that have previously accessed the Service. In such case, when you access the Service or provide AutoFi with personal information, a unique identifier is assigned to you. This unique identifier is associated with a persistent cookie that AutoFi places on your web browser. AutoFi is especially careful about the security and confidentiality of the information stored in persistent cookies. For example, AutoFi does not store account numbers or passwords in persistent cookies. If you disable your web browser’s ability to accept cookies, you will be able to navigate the Service, but you will not be able to successfully use the Service.

From time to time, we engage third parties to track and analyze non-personally identifiable usage and volume statistical information from individuals who access the Service. This session tracking is used to store information or maintain data on individuals in order to recognize those individuals’ requests when they connect to the Service. We may also use other third-party cookies to track the performance of AutoFi advertisements. The information provided to third parties does not include personal information, but this information may be re-associated with personal information after AutoFi receives it. This Policy does not cover our use of third-party cookies.

Storage and Retention of Personal Information

We retain personal information for no longer than necessary to fulfill the purposes for which it was collected and used in accordance with our agreements with AutoFi Customers, as applicable, as described in this Policy, unless a longer retention period is required or permitted under applicable law. As permitted under applicable law, even after you stop using an application or terminate your account with one or more AutoFi Customers, AutoFi may still retain your information (for example, if you still have an account with another AutoFi Customer). However, your information will only be processed as required by law or in accordance with this Policy.

Please refer to the “Your Data Protection Rights” section for options that may be available to you, including the right to request deletion of User Data or Other Information. You can also contact us about our data retention practices using the contact information below.

Security

AutoFi is committed to protecting the confidentiality of your information and online transactions. We maintain physical, technical, organizational, and administrative security measures designed to protect your personal information from unauthorized access and use, alteration, and destruction. Our security controls include the use of strong browser encryption, use of secure facilities for data storage and processing, and limiting access to your information to employees, agents, and contractors who need to know such information to provide products or services to you. Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure. If you have a reason to believe that your interaction with us is no longer secure, please immediately notify us in accordance with the “Contacting AutoFi” section below.

Changes to this Privacy Statement

California Residents

We reserve the right to change this Policy at any time by posting a new version on our Website. You will not be given any notice of these modifications. Your continued use of the Service after any changes are posted will be deemed to constitute your agreement to and acceptance of such changes to this Policy. AutoFi will also notify AutoFi Customers of any material changes as specified in their agreements, as they are generally best positioned to notify their end-users about such changes to this Policy, as appropriate.

Your Data Protection Rights

Under applicable law, and subject to limitations and exceptions provided by law, if you are a California resident, you may have the following rights with respect to User Data and Other Information AutoFi has collected or received about you that constitutes personal information under the CCPA:

● to request access to more details about the categories and specific pieces of personal information we may have collected about you in the last 12 months (including personal information disclosed for business purposes);

● to request deletion of your personal information;

● to opt-out of any “sales” of your personal information, if a business is selling your information; and

● to not be discriminated against for exercising these rights.

To exercise your access or deletion rights, where applicable, you can submit a request to: privacy@autofi.com. You may be required to provide additional information necessary to verify your identity before we can respond to your request.

We will consider all such requests and provide our response within a reasonable period of time (and within any time period required by applicable law). Please note, however, that certain information may be exempt from such requests, for example, if we need to keep the information to comply with our own legal obligations or to establish, exercise, or defend legal claims.

Please note, if you are an End User, we may contact the relevant AutoFi Customer that collected your User Data or Other Information to process your request.

Residents of Colorado, Connecticut, Virginia, and Utah:

If you are a resident of Colorado, Connecticut, Virginia, or Utah, you have rights to:

· Confirm whether we process your personal information.

· Access and delete certain personal information.

· Data portability.

· Opt-out of personal data processing for targeted advertising and sales.

If you are a resident of Colorado, Connecticut, or Virginia, you have the additional rights to:

· Correct inaccuracies in your personal information, taking into account the information’s nature and processing purpose.

· Opt-out of profiling in furtherance of decisions that produce legal or similarly significant effects.

Residents of Colorado, Connecticut, Virginia, or Utah who wish to exercise any of the above rights must submit a request to AutoFi at privacy@autofi.com. To appeal a decision regarding a consumer rights request, you must submit the appeal request to privacy@autofi.com. AutoFi’s Privacy Team will review all appeal requests and will inform you of any action taken or not taken in response to your appeal, including a written explanation of the reasons for our decisions, promptly, but in no event later than 45 days after our receipt of your request.

HR Privacy Notice

This Policy also applies to all applicants and prospective employees (collectively, “Applicants”) and current and former employees, officers, directors, contractors, and agents of AutoFi (collectively, “Workers”) whose personal information is collected or processed by us in the course of our business.

In the course of your employment, or during the course of your applying and going through the application process, with AutoFi, we may collect personal information directly from you, which may include:

● General HR Information: this might include your name, address, phone number, social security number or other unique personal identifier, driver’s license number, date of birth, age, employment and education history and records, professional qualifications, salary information, financial information related to credit and background checks, and other information that may be included on your CV, resume or application;

● Demographic and health information: where required to run our business and ensure the safety of our Workers, we may collect sensitive personal information such as details of your health or disability, including information concerning your COVID-19 testing and vaccination status, health insurance information, mental health information, medical and maternity leave, national origin, and immigration status. Where permitted by law, we may also ask Applicants and Workers to provide optional information such as race, disability, marital status, sex, ethnicity, gender, and military or veteran status;

● Legal Information: we may collect contractual information, such as information necessary to comply with our legal and contractual obligations or to initiate or respond to legal claims; and

● Information from Other Sources: we may collect or receive information about you from other sources, including through third-party services to supplement information provided by you. For example, we may conduct background and credit checks on you prior to your employment.

We collect personal information about you to operate our business. This may include determining whether to offer you employment at the Company, to contact your emergency contact in the event something happens to you at work, to keep you safe and to provide you efficient resources to do your job, to respond to your HR-related questions, and to comply with the law. We may share your information with our vendors and services providers, such as those we use for your HR and IT services, to law enforcement if we receive a proper request or if we reasonably believe it is necessary to protect the rights or safety of you or our team, and to other individuals, including other Workers, if you post content to Company sites, including our wiki page, or our public-facing sites. We do not sell your personal information.

California Consumer Privacy Act

If you are a California resident, the California Consumer Privacy Act (“CCPA”) provides you certain rights and choices regarding how we collect, share, use, and protect your “personal information” and how you can exercise those rights. The CCPA defines “personal information” as information that identifies, relates

to, describes, or is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

We do not share or sell personal information, nor have we sold it, in the last 12 months.

Certain information that we collect may be exempt from the CCPA because it is considered public information or covered by financial privacy laws, such as the Gramm-Leach Bliley Act, the California Financial Information Privacy Act, the Health Insurance Portability and Accountability Act, or the Fair Credit Reporting Act.

To the extent that we collect personal information that is subject to the CCPA, that information, our practices, and your rights are described below.

Under the California Consumer Privacy Act, California residents have the right to:

● Request that a business delete any personal information about the consumer that the business has collected from the consumer.

We collect the following categories of personal information:

      ○ Identifiers (e.g., your name, postal address, and social security number);

      ○ Customer records information; and

      ○ Internet or other electronic network activity information.

● Request that a business that collects personal information about the consumer disclose to the consumer, free of charge, the following:

      ○ the categories of personal information that it has collected about that consumer;

      ○ the categories of sources from which the personal information is collected;

      ○ the business or commercial purpose for collecting or selling personal information;

      ○ the categories of third parties with whom the business shares personal information; and

      ○ the specific pieces of personal information it has collected about that consumer.

● Request that a business that sells the consumer’s personal information, or that discloses it for a business purpose disclose, free of charge, to the consumer:

     ○ the categories of personal information that the business collected about the consumer;

     ○ the categories of personal information that the business sold about the consumer and the categories of third parties to whom the personal was sold, by category or categories of personal information for each third party to whom the personal information was sold; and

     ○ the categories of personal information that the business disclosed about the consumer for a business purpose.

● Direct a business that sells personal information about the consumer to third parties not to sell the consumer’s personal information.

You may submit a CCPA request by providing your first name, last name, email address, telephone number and ZIP code to the contact information listed below. You may also designate an authorized agent to make such requests on your behalf by mailing a signed Power of Attorney to us.

We will not discriminate against you because you exercise any of the rights as described in this section.

Contacting AutoFi

If you have any questions or comments about this Policy, or AutoFi’s privacy practices generally, you can contact AutoFi at privacy@autofi.com or by mail at:

AutoFi, Inc.

Attn: Legal

548 Market Street PMB 53613 San Francisco,

CA 94104-5401