Privacy Policy for mcgrathoffer.com

Introduction

McGrath Auto and its subsidiaries and affiliated entities under common ownership and control (collectively, “McGrath,” “we,” “us,” or “our”) respect your privacy and the information you entrust to us.

This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit mcgrathoffer.com (the “Site”), submit an inquiry, request information about an offer, or interact with the products, services, promotions, and dealership activities associated with the Site (collectively, the “Services”).

This policy also describes information collected through related communications and dealership interactions, including transactions involving vehicle purchases, leases, financing, and service. Not every category of information described below is collected through the Site itself. The information we collect depends on how you interact with us.

If you become an inactive customer or your account is closed or suspended, we will continue to handle previously collected information according to the policy applicable when it was collected, subject to applicable law.

Certain information and activities may be subject to federal laws, including the Gramm-Leach-Bliley Act and the Fair Credit Reporting Act. Exemptions under those laws and applicable state privacy laws may limit which state privacy rights apply.

1. Personal Information We Collect

Personal information generally means information that identifies, relates to, or is reasonably linkable to an identifiable individual.

Depending on your interactions with the Site and our dealerships, we may collect the following categories:

Sensitive Information

Some information may receive additional protection under applicable law. Legal definitions of sensitive information vary.

Under Iowa law, sensitive data includes certain information concerning racial or ethnic origin, religious beliefs, mental or physical health diagnoses, sexual orientation, citizenship or immigration status, genetic or biometric identification, known children, and precise geolocation, subject to statutory qualifications.

The following reflects the categories described in our information practices. Inclusion in this table does not mean every category is legally classified as sensitive under Iowa law.

Where required by applicable law, we provide notice and an opportunity to opt out of sensitive-data processing, or obtain the required consent.

2. Sources of Personal Information

We may collect information:

• Directly from you, including through offer inquiries, website forms, telephone calls, emails, applications, contracts, and in-person interactions.
• Automatically, through cookies, pixels, analytics tools, and similar technologies used on the Site.
• From advertising networks and marketing agencies, including companies supporting our advertising campaigns.
• From customer-data and analytics providers, including call-tracking, sales-prospecting, and data-analysis services.
• From online lead providers, including third-party websites that share inquiries about vehicles, products, or Services.
• From vehicle manufacturers and their finance companies, including information connected with vehicle inquiries, purchases, leases, and financing.
• From credit-reporting agencies, in connection with credit applications and related transactions.
• From government agencies, including motor vehicle departments.
• From insurance companies, including information associated with accidents, repairs, or claims.
• From social media platforms, including information associated with advertising campaigns and your interactions with our content.
• From towing companies, in connection with vehicles transported to our dealerships.

3. How We Use Personal Information

We may use the information described above for the following purposes:

• Responding to requests: Answering questions, providing offer information, and assisting with vehicle, product, or service inquiries.
• Advertising and marketing: Communicating promotions and offers, conducting market research, and evaluating campaign performance.
• Personalization and targeted advertising: Customizing website content and advertisements based on your interests and interactions.
• Website and advertising measurement: Reviewing website activity, counting advertising impressions, and measuring engagement.
• Customer service: Maintaining customer relationships, servicing accounts and products, and supporting quality assurance and training.
• Transactions: Processing purchases, leases, orders, payments, and related paperwork; verifying information; and confirming incentive eligibility.
• Financing: Supporting financing applications and related products or Services.
• Security and fraud prevention: Detecting security incidents and protecting against fraudulent, deceptive, malicious, or illegal activity.
• Legal and regulatory matters: Meeting applicable requirements, maintaining necessary records, and responding to or defending legal claims.

4. How We Disclose Personal Information

We may disclose personal information to service providers and contractors that support our business. We may also sell personal information or share information with third parties for targeted advertising, as described below.

The categories involved depend on your interactions with us. A listed category does not mean every information item within that category is disclosed to every recipient.

Business Transfers

We may disclose or transfer information in connection with a merger, acquisition, reorganization, divestiture, bankruptcy, or sale of some or all of our assets, including during the evaluation of a proposed transaction.

Transferred information will remain subject to this Privacy Policy or a policy providing an equivalent level of privacy protection.

5. Iowa Privacy Rights and Choices

The Iowa Consumer Data Protection Act (“ICDPA”) provides certain rights to eligible Iowa residents. These rights apply where the law covers the business, information, and processing involved. Statutory exemptions may apply, including exemptions associated with certain financial information and activities.

Where applicable, you may request:

• Access: Confirmation of whether we process your personal data and access to that data.
• Deletion: Deletion of personal data you provided to us, subject to legal exceptions.
• Portability: A portable copy of eligible personal data you previously provided and that we process by automated means, subject to statutory exclusions.
• Sale opt-out: An end to the sale of your personal data.

We also provide a way to request that we stop processing your personal information for targeted advertising. We do not sell personal information of individuals we know are under age 16.

We will not unlawfully discriminate against you for exercising applicable privacy rights.

Submitting a Request

To submit a privacy request or opt out of the sale of personal information or targeted advertising, contact us:

Please identify the right you wish to exercise and mention mcgrathoffer.com so we can direct your request appropriately.

Identity Verification

We may need to verify your identity before fulfilling a request. Verification may include email or text-message verification and questions about your interactions or transactions with us.

If we cannot reasonably authenticate your request, we may request additional information or decline to fulfill it.

Response Timing and Fees

For requests covered by the ICDPA, we generally respond within 90 days. Where permitted, we may extend that period by 45 days and explain the extension.

Information provided in response to covered requests is generally free up to twice annually. Additional fees or a refusal to act may be permitted in circumstances specified by law.

Appeals

If we decline your request, you may appeal within 60 days after receiving our decision. Submit your appeal using the email address or telephone number above, by mail to the address below, or through instructions provided with our response.

Explain why you believe the decision should be reconsidered. We will provide a written appeal decision and explanation within 60 days after receiving your appeal. If we deny your appeal, we will provide an online method for contacting the Iowa Attorney General to submit a complaint.

6. Cookies and Similar Technologies

We use cookies and similar technologies, including pixels, web beacons, scripts, device fingerprinting, and local storage, to operate the Site, remember preferences, understand website activity, personalize content, and support advertising.

For purposes of this policy, “cookies” includes technologies that perform similar functions.

First-Party and Third-Party Cookies

First-party cookies are created or placed by us.

Third-party cookies are created or placed by third parties or enable information to be shared with third parties, including analytics providers, advertisers, and social media platforms.

A cookie may be treated as a third-party cookie even if it uses our domain when it is set by, used by, or shares information with another company.

Cookie Categories

Essential cookies support basic website functions, security, session management, and privacy preferences. The Site does not provide an internal mechanism for disabling essential cookies.

Functional cookies remember choices and support optional features, such as payment calculators or service-scheduling tools where available. They may also help identify website errors. Disabling them may limit certain features.

Analytics cookies collect information about how visitors use the Site, including pages viewed, time spent, referring websites, and interactions. We use this information to evaluate and improve website performance and content. Some analytics cookies may also support marketing.

Targeting cookies help deliver relevant advertisements, measure advertising effectiveness, limit repeated advertisements, and support retargeting. These technologies may recognize a browser or device and use activity across websites to infer interests.

Managing Cookies

You may manage eligible cookies through the Site's cookie banner or privacy settings and through your browser settings. You may also submit a privacy request using the contact information in this policy.

Your browser may allow you to block cookies, delete existing cookies, or receive notices when cookies are placed. Disabling cookies may affect website functionality.

To remove previously stored cookies, use your browser's controls. Clearing cookies may also remove saved preferences, so you may need to select your preferences again when returning to the Site.

Website privacy settings apply to technologies deployed through this Site. They do not necessarily control tracking or information collected independently by other websites or companies.

Google Analytics and Advertising Choices

We may use Google Analytics to understand website activity and improve the Site.

Additional information is available at:

• Google Analytics privacy information
• Google Analytics opt-out browser add-on
• Network Advertising Initiative
• Digital Advertising Alliance consumer choices

Opting out of interest-based advertising does not eliminate advertising. It limits certain advertisements tailored to your activity and interests.

7. Browser Privacy Signals

We support Do Not Track (“DNT”) and Global Privacy Control (“GPC”) signals as mechanisms for communicating browser or device privacy preferences.

When enabled, these signals override conflicting selections made through the Site's cookie banner or privacy settings.

A signal generally applies to the browser or device sending it. You may need to enable your preferences separately on other browsers or devices.

8. Website Analytics and Session Replay

We may collect aggregate or de-identified information about website usage, including pages viewed and time spent on the Site, to prepare reports and improve our Services.

Information collected through cookies and similar technologies may be linked with other information in ways that identify you, depending on the technology used and your privacy choices.

We or service providers acting on our behalf may also use session replay tools to understand how visitors interact with the Site. These tools may recreate website interactions, record navigation and clicks, identify errors, and help evaluate performance.

Depending on your interactions, these tools may capture information entered into website forms, including names, telephone numbers, email addresses, mailing addresses, and other information you provide.

We use this information to improve website functionality and the visitor experience. Where required by law, we obtain consent before using these technologies.

9. Third-Party Websites

The Site may contain links to third-party websites, services, and platforms.

This Privacy Policy does not govern information collected independently by those third parties. We are not responsible for their content or privacy practices. Review their privacy policies before providing information to them.

10. Information Security

We use reasonable administrative, technical, and physical measures to protect personal information, including encryption for online information and access restrictions for information maintained within our business.

Access is limited to personnel who need information to perform their responsibilities. We also take reasonable measures to protect systems used to store personal information.

No internet transmission or storage system can be guaranteed completely secure. We cannot guarantee the security of information transmitted to us.

If a security incident requires notification, we will provide notice as required by applicable law. Depending on the circumstances and legal requirements, communications may be provided electronically, by mail, or through another permitted method.

11. Children's Privacy

The Site and Services are not intended for children under 13.

We do not knowingly collect or use personal information from children under 13 or knowingly disclose their personal information to third parties.

If you are under 13, do not submit personal information through the Site or Services. If you believe a child under 13 has provided information to us, contact us using the information below.

12. Changes to This Privacy Policy

We may update this Privacy Policy periodically by posting a revised version on this page.

The “Last Updated” date identifies the most recent revision. Changes to our collection and processing practices apply prospectively to information provided after the changes take effect, subject to applicable law.

Please review this policy periodically. By accessing or using the Site and Services, you acknowledge this policy. Where the law requires separate consent for a particular activity, we will obtain that consent.

13. Dispute Resolution, Arbitration, and Class Action Waiver

Informal Dispute Resolution

By visiting the Site or using the Services, you and McGrath agree to first attempt to resolve disputes informally.

A “Dispute” includes a controversy, claim, action, proceeding, or demand arising from or relating to your use of the Site or Services or the interpretation, enforcement, validity, or alleged breach of this Privacy Policy.

Before initiating litigation or arbitration, the party raising the Dispute must provide written notice describing the relevant facts and circumstances and allow the receiving party 30 calendar days to respond or attempt resolution.

Send notices to:

We will send notices to you at the mailing address or email address we have on file.

This informal resolution procedure is a condition that must be satisfied before either party initiates a claim, except where prohibited by law.

Binding Arbitration

IF A DISPUTE CANNOT BE RESOLVED THROUGH THE INFORMAL PROCESS ABOVE, YOU AND MCGRATH AGREE TO RESOLVE IT THROUGH BINDING ARBITRATION ON AN INDIVIDUAL BASIS.

Arbitration uses a neutral arbitrator to hear both sides and decide a dispute instead of a judge or jury. Except as stated below, you and McGrath agree to resolve covered Disputes through arbitration rather than a court proceeding.

The Federal Arbitration Act, 9 U.S.C. §§ 1–16, governs this arbitration agreement. A single arbitrator will hear the Dispute, and the decision will be final and binding, subject to applicable law.

Arbitration will proceed under the American Arbitration Association's Consumer Arbitration Rules or, if you are a business, its Commercial Arbitration Rules, as applicable. Rules and filing information are available at www.adr.org/rules.

Small Claims Exception

This arbitration agreement does not apply to a Dispute brought in small claims court that falls within that court's jurisdiction.

If the amount in controversy exceeds the small claims court's jurisdiction, the Dispute will be subject to this arbitration agreement.

Class Action Waiver

You and McGrath agree that covered Disputes will be handled individually.

Neither party may combine a covered Dispute with claims brought by other individuals or participate in a class action lawsuit or class arbitration against the other party.

By using the Site or Services, you agree to this arbitration agreement and class action waiver. If you do not agree, do not use the Site or Services.

Severability

If any portion of this arbitration agreement or class action waiver is found invalid or unenforceable, the remaining provisions will continue to apply to the extent permitted by law.

The arbitrator will determine questions concerning the validity or enforceability of the arbitration agreement to the extent permitted by law.

Other Arbitration Agreements

If this arbitration agreement conflicts with another arbitration agreement between you and McGrath, including an agreement in a vehicle purchase order, retail installment contract, lease, or repair estimate, the other arbitration agreement will govern the conflict.

14. Governing Law and Venue

This Privacy Policy is governed by Iowa law without applying conflict-of-law principles.

Disputes that are not subject to arbitration will be resolved in a court located in Iowa, subject to applicable law. You consent to the personal jurisdiction of those courts for those proceedings.

If any provision of this Privacy Policy is found invalid or unenforceable, the remaining provisions will remain in effect to the extent permitted by law.

15. Contact Us

For questions about this Privacy Policy or to submit a privacy request, contact:

Please reference mcgrathoffer.com when contacting us about this policy.