AutoRevolution Cookie Notice

AutoRevolution uses cookies and similar technologies to provide, secure, maintain, analyze, and improve our automotive software platforms and digital services. As a provider of automotive dealership websites, digital retailing solutions, CRM software, inventory merchandising tools, lead management platforms, marketing technology, analytics services, and related SaaS products, we use these technologies to support platform functionality, security, authentication, performance monitoring, business analytics, personalization, advertising measurement, and compliance obligations. This Cookie Notice explains our data collection practices, cookie categories, third-party technologies, consent options, privacy rights, and the choices available to individuals who interact with our Services.

This Cookie Notice ("Notice")explains how Metzger Enterprises LLC d/b/a AutoRevolution, a Texas limited liability company, together with its subsidiaries, affiliates, successors, and assigns (collectively, "Provider, "Company," "AutoRevolution," "LotPix," "Vehicle Image Studio," "Forward2Phone," "IIManager," "we," "us," or "our"), its affiliates, subsidiaries, service providers, and authorized partners use cookies and similar technologies when you access or interact with our websites, applications, customer portals, software-as-a-service (SaaS) platforms, digital retailing solutions, customer relationship management (CRM) systems, inventory and merchandising tools, fixed operations technologies, analytics platforms, marketing services, APIs, integrations, and other products and services designed for automotive dealerships and related automotive businesses (collectively, the "Services"). These technologies are used to support essential platform functionality, user authentication, security monitoring, fraud prevention, system administration, performance optimization, analytics, customer support, integration management, advertising and marketing activities, and compliance obligations. This Notice provides detailed information regarding the types of technologies we use, the information they collect, the purposes for which they are deployed, the third parties that may place or access such technologies, and the choices available to users and business customers regarding their use, consistent with applicable privacy, consumer protection, and data protection laws.

Capitalized terms not otherwise defined in this Cookie Notice have the meanings assigned to them in the applicable agreement between Customer and Provider, including any master services agreement, subscription agreement, order form, terms of service, privacy policy, or definitions glossary made available by Provider.

For purposes of this Cookie Notice, the following additional definitions apply:

We use cookies and similar technologies to operate, secure, maintain, analyze, and improve our websites, applications, customer portals, software platforms, digital retailing solutions, inventory management systems, customer relationship management (CRM) tools, marketing services, and other products and services (collectively, the "Services").

Cookies are small text files stored on a browser, device, or application that enable websites and online services to recognize users, remember preferences, facilitate functionality, and collect information about interactions with the Services. In addition to cookies, we may use web beacons, pixels, tags, software development kits (SDKs), local storage technologies, session replay tools, APIs, server-side tracking technologies, device identifiers, and similar technologies (collectively, "Tracking Technologies").

These Tracking Technologies help us:

• Authenticate users and maintain secure sessions;
• Operate and administer our SaaS platforms and customer-facing applications;
• Remember preferences, settings, and consent choices;
• Monitor platform performance, availability, and reliability;
• Analyze website and application usage patterns;
• Detect, investigate, and prevent fraud, security incidents, unauthorized access, and misuse;
• Improve functionality, user experience, and service offerings;
• Measure the effectiveness of marketing, advertising, and communications campaigns;
• Personalize content, resources, and business-related communications; and
• Comply with legal, regulatory, contractual, and operational requirements.

Tracking Technologies may be deployed directly by us ("first-party cookies") or by our service providers, business partners, advertising partners, analytics providers, and integration partners ("third-party cookies"). Depending on applicable law, certain Tracking Technologies may be activated only after obtaining your consent.

We categorize cookies and similar technologies based on their purpose and functionality.

Some cookies may perform multiple functions and may therefore fall into more than one category depending on their use.

We may also use session cookies, which expire when a browser session ends, and persistent cookies, which remain on a device for a specified period unless deleted earlier.

We engage trusted third-party providers to assist with website operations, platform functionality, analytics, customer engagement, marketing, security, and business operations. These providers may place or access cookies and similar technologies on our behalf or collect information directly through their technologies.

Depending on the Services used, third-party providers may include:

• Website and application analytics providers;
• Cloud hosting and infrastructure providers;
• Customer relationship management (CRM) and customer support platforms;
• Marketing automation and email service providers;
• Advertising, attribution, and retargeting partners;
• Social media and business networking platforms;
• Identity verification and authentication providers;
• Security, fraud prevention, and monitoring providers; and
• Automotive technology integration partners and data service providers.

Examples of technologies we may use include analytics tools such as Google Analytics, advertising and attribution technologies, customer engagement platforms, consent management solutions, and security monitoring services. The specific providers used may change over time as our business, technology stack, and service offerings evolve.

Third-party providers may collect information in accordance with their own privacy notices and contractual obligations. We encourage users to review applicable third-party privacy policies for additional information regarding their data processing practices.

Depending on your location and applicable privacy laws, you may have the ability to manage your cookie preferences, opt out of certain tracking activities, and exercise privacy rights regarding personal information collected through cookies and similar technologies.

When required by applicable law, we present users with a cookie preference banner or consent management platform upon their first visit to our websites.

• You may accept all cookies, reject non-essential cookies, or customize your cookie preferences;
• Your preferences will be stored and honored in accordance with applicable legal requirements;
• You may modify or withdraw previously provided consent at any time through our cookie preference center;
• Strictly Necessary Cookies remain active because they are essential to providing and securing the Services.

Where required by applicable law, including certain U.S. state privacy laws, we recognize and process browser-based opt-out preference signals, including the Global Privacy Control ("GPC"), as requests to opt out of activities that may constitute targeted advertising, sharing of personal information, or similar regulated processing activities.

Recognition of such signals may be limited to the browser, device, or profile from which the signal is transmitted and may not automatically apply across all devices, applications, or accounts associated with a user.

Users may manage cookie and tracking preferences through a variety of methods, including:

• Adjusting browser settings to block, delete, or restrict cookies;
• Using device-level privacy controls and permissions;
• Managing mobile advertising identifiers and personalized advertising settings on mobile devices;
• Using available analytics opt-out mechanisms, including the Google Analytics Opt-out ( Browser Add-on);
• Submitting or enabling recognized opt-out preference signals such as Global Privacy Control ("GPC");
• Utilizing our cookie preference center to update consent choices; and
• Exercising applicable privacy rights through our " Do Not Sell or Share My Personal Information" page or other privacy rights request mechanisms where available.

Please note that disabling certain cookies or tracking technologies may affect the availability, functionality, performance, security, or user experience of portions of the Services.

Residents of certain U.S. states may have rights regarding personal information collected through cookies, pixels, advertising technologies, analytics tools, and similar tracking technologies. The availability and scope of these rights vary based on applicable law, the nature of the information processed, and our role as either a business, controller, processor, service provider, or contractor.

Subject to applicable law and verification requirements, eligible individuals may have one or more of the following rights:

• Right to know and access personal information collected about them;
• Right to obtain information regarding categories of personal information collected, used, disclosed, sold, or shared;
• Right to correct inaccurate personal information;
• Right to request deletion of personal information, subject to legal exceptions;
• Right to obtain a portable copy of personal information where applicable;
• Right to opt out of targeted advertising;
• Right to opt out of the sale or sharing of personal information where such rights apply;
• Right to opt out of certain profiling activities that produce legal or similarly significant effects;
• Right to limit the use or disclosure of sensitive personal information where applicable;
• Right to appeal certain privacy-rights decisions where required by law; and
• Right to be free from unlawful discrimination or retaliation for exercising privacy rights.

Many of these rights may be exercised through our cookie preference center, Global Privacy Control ("GPC") signals where recognized, or by submitting a privacy rights request through the methods described below.

California residents may have rights under the California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act ("CPRA"), including the right to:

• Know what personal information we collect, use, disclose, sell, or share;
• Access specific pieces of personal information;
• Request correction of inaccurate personal information;
• Request deletion of personal information, subject to applicable exceptions;
• Opt out of the sale or sharing of personal information;
• Limit the use and disclosure of sensitive personal information where applicable;
• Receive equal service and pricing regardless of privacy-rights exercise; and
• Designate an authorized agent to submit requests on their behalf.

Where applicable, we recognize and process Global Privacy Control ("GPC") signals as legally required opt-out requests. California residents may exercise applicable rights through the privacy request methods described in this Notice.

Texas residents may have rights under the Texas Data Privacy and Security Act ("TDPSA"), including the right to:

• Confirm whether personal data is being processed;
• Access personal data;
• Correct inaccuracies in personal data;
• Delete personal data provided by or obtained about the consumer;
• Obtain a copy of personal data in a portable format where technically feasible;
• Opt out of targeted advertising;
• Opt out of the sale of personal data; and
• Opt out of profiling in furtherance of decisions producing legal or similarly significant effects.

Our privacy practices are designed to support transparency, consumer control, and responsible processing of information collected through cookies and similar technologies.

Virginia residents may have rights under the Virginia Consumer Data Protection Act ("VCDPA"), including rights to access, correct, delete, and obtain copies of personal data, as well as rights to opt out of targeted advertising, the sale of personal data, and certain profiling activities.

Virginia residents may also have the right to appeal our decisions regarding privacy-rights requests.

Colorado residents may have rights under the Colorado Privacy Act ("CPA"), including rights to access, correct, delete, and obtain copies of personal data, as well as rights to opt out of targeted advertising, sales of personal data, and certain profiling activities.

Where required by Colorado law, we recognize and process applicable universal opt-out mechanisms.

Connecticut residents may have rights under the Connecticut Data Privacy Act ("CTDPA"), including rights to access, correct, delete, and obtain copies of personal data, and to opt out of targeted advertising, sales of personal data, and certain profiling activities.

Connecticut residents may also have appeal rights in connection with privacy-rights requests.

Utah residents may have rights under the Utah Consumer Privacy Act ("UCPA"), including rights to access and delete certain personal data and to opt out of targeted advertising and sales of personal data.

Because privacy laws continue to evolve, we encourage users to review this Notice periodically for updates regarding applicable state-specific rights.

Residents of other states with applicable privacy laws, including but not limited to Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Indiana, Kentucky, Maryland, Minnesota, Rhode Island, and other jurisdictions with applicable privacy laws may have additional rights regarding personal information collected through cookies and similar technologies, including rights related to:

• Accessing personal information;
• Correcting inaccurate information;
• Deleting personal information;
• Obtaining a portable copy of personal information;
• Opting out of targeted advertising;
• Opting out of certain profiling activities;
• Managing consent preferences; and
• Restricting certain disclosures of personal information.

Applicable rights and requirements may differ based on jurisdiction, eligibility thresholds, exemptions, contractual relationships, and the role we perform in connection with the relevant data processing activity.

We collect, use, and process information obtained through cookies and similar technologies for legitimate business, operational, security, compliance, and commercial purposes, including to:

• Provide, operate, maintain, and improve our Services;
• Support automotive dealership operations, digital retailing platforms, CRM systems, inventory management tools, lead management solutions, and related business applications;
• Authenticate users and administer customer accounts;
• Maintain platform security, availability, reliability, and performance;
• Detect, investigate, and prevent fraud, abuse, unauthorized access, and cybersecurity incidents;
• Analyze website traffic, engagement metrics, and platform utilization trends;
• Measure and improve the effectiveness of marketing, advertising, and communications campaigns;
• Generate business intelligence, analytics, reporting, and performance insights;
• Provide customer support and technical assistance;
• Personalize user experiences and business communications;
• Develop, test, enhance, and optimize products and features, including AI-enabled functionality where applicable; and
• Comply with legal, regulatory, contractual, and industry obligations.

We retain information collected through cookies and similar technologies only for as long as reasonably necessary to fulfill the purposes described in this Notice, comply with legal obligations, resolve disputes, enforce agreements, maintain security, and support legitimate business operations.

Retention periods vary depending on the type of cookie, the purpose for which it was deployed, contractual requirements, legal obligations, technical considerations, and applicable regulatory requirements.

Some cookies may expire automatically after a browser session ends, while others may remain active for longer periods. Where feasible, personal information may be de-identified, anonymized, aggregated, or otherwise transformed into information that no longer identifies an individual.

We may disclose information collected through cookies and similar technologies to authorized third parties as necessary to operate our business and provide the Services.

Recipients may include:

• Cloud hosting, infrastructure, and platform providers;
• Analytics and measurement providers;
• Customer relationship management (CRM) and marketing automation platforms;
• Advertising, attribution, and audience measurement partners;
• Security, fraud prevention, and monitoring providers;
• Professional advisors, auditors, and consultants;
• Corporate affiliates and subsidiaries;
• Government agencies, regulators, law enforcement, or other parties where required by law; and
• Successors or counterparties involved in mergers, acquisitions, financing transactions, reorganizations, or asset transfers.

We do not disclose personal information beyond what is reasonably necessary for the purposes described in this Notice and applicable privacy laws.

Individuals who wish to exercise applicable privacy rights may submit requests using the methods below.

Before processing certain requests, we may take reasonable steps to verify identity, authority, residency, or account ownership, consistent with applicable law.

To submit a privacy request:

• Online Request Form: Privacy Rights Request Form
• Email: compliance@autorevolution.com

Authorized agents may submit requests on behalf of eligible individuals where permitted by applicable law. Additional verification may be required before fulfilling such requests.

Individuals seeking to exercise applicable privacy rights, including rights related to access, correction, deletion, portability, opt-out preferences, targeted advertising, sales or sharing of personal information, profiling, or consent withdrawal, may submit requests using the contact information above or through our designated privacy request mechanisms.

To help protect personal information and prevent unauthorized disclosures, we may take reasonable steps to verify the identity, authority, residency, or account ownership of individuals submitting requests before processing them.

We will respond to privacy-related requests within the timeframes required by applicable law. In certain circumstances, additional time may be necessary to verify requests, investigate concerns, comply with legal obligations, or complete requested actions, in which case we will notify the requestor as required.

If you require this Cookie Notice in an alternative format or need assistance understanding your privacy choices due to a disability or accessibility need, please contact us using the information above and we will make reasonable efforts to provide appropriate assistance.

This Section provides additional disclosures that may apply to users, customers, dealership personnel, business representatives, website visitors, and other individuals depending on their location, residency, applicable privacy laws, and the nature of the Services accessed.

Privacy laws vary by jurisdiction and may impose different requirements regarding cookies, tracking technologies, personal information, personal data, targeted advertising, analytics, profiling, consent, and consumer rights. Where applicable law provides additional rights or protections, we will process personal information and respond to requests in accordance with applicable legal requirements.

We may modify, revise, or update this Cookie Notice from time to time to reflect changes in our business practices, technologies, legal obligations, regulatory requirements, industry standards, or Service offerings.

When material changes are made, we will update the "Last Updated" date appearing at the top of this Notice and may provide additional notice where required by applicable law.

Your continued use of the Services following the effective date of an updated Cookie Notice constitutes acknowledgment of the revised Notice to the extent permitted by applicable law.

If you have questions, comments, concerns, or requests regarding this Cookie Notice, our use of cookies and similar tracking technologies, your privacy rights, or our data processing practices, please contact us using the information below.

We welcome inquiries from website visitors, customers, dealership personnel, business partners, authorized agents, regulators, and other individuals seeking information about our privacy and compliance practices.

AutoRevolution
Attn: Privacy & Compliance
334 East Church Street
Lewisville, Texas 75057

• Telephone: (972) 243-8460
• Email: compliance@autorevolution.com

Regulators, supervisory authorities, business customers, vendors, and legal representatives seeking information regarding AutoRevolution's privacy, security, compliance, or data governance practices may contact our Privacy & Compliance Team using the information provided above.

We are committed to maintaining transparent privacy practices and addressing inquiries regarding cookies, tracking technologies, consumer privacy rights, and data protection obligations in accordance with applicable federal, state, and international privacy requirements.

Because we provide enterprise software solutions to automotive dealerships, dealer groups, automotive retailers, service providers, manufacturers, finance and insurance providers, and related businesses, certain information processed through the Services may be handled on behalf of our business customers.

Where we process information as a service provider, processor, or contractor, we process such information according to applicable agreements, customer instructions, contractual commitments, and applicable privacy laws.

Business customers remain responsible for their own privacy notices, disclosures, consumer communications, and compliance obligations applicable to their independent data practices.

Users accessing the Services from outside the United States should note that our Services are primarily designed for businesses operating in the United States. Where applicable, additional privacy requirements may apply depending on the user's jurisdiction and the nature of the information processed.

International users may contact us regarding questions about cross-border data processing, privacy rights, or applicable protections.