Privacy Policy

Introduction

CarKey, Inc. (“CarKey,” “we,” “us,” “our”) has created a connected car API platform to enable application developers (“Developers”) to build applications and use standard APIs to allow their clients or end users (“End Users”) to use such applications to communicate with End Users’ vehicles manufactured by certain vehicle manufacturers (“OEMs”).

This Privacy Policy describes how CarKey handles personal information or personal data (“Personal Data”) and certain other information that is collected in the provision of our Service. This Privacy Policy does not apply to any third party website, product or service, including any applications made available by Developers (each of the foregoing, a “Third Party Service”), even if the Third Party Service links to (or from) the Service or is enabled through the Service. CarKey does not operate those Third Party Services - please always review the privacy practices and terms of service of those Third Party Services before deciding whether to provide any information to them.

“You”, as used in this Privacy Policy, may be a visitor to our Site, a Developer using our Service (“Customer”), or a Customer’s End Users. If you are an End User, we will generally collect and process your Personal Data (described below) at the direction of our Customers. Our use of End Users’ Personal Data on behalf of Customers is governed by our contract with the applicable Customer and the Customer’s own privacy policies. Our Customers are responsible for making sure that End Users’ privacy rights are respected, including ensuring appropriate disclosures about third party data collection and use. If you are an End User and would like to learn more about how a Customer may use your Personal Data when using our Service, you should contact that Customer directly or review that Customer’s privacy policy.

Before using the Service or submitting any Personal Data to CarKey, please review this Privacy Policy carefully and contact us at [email protected] if you have any questions. By using or accessing the Service in any manner, you acknowledge and agree to the terms, practices and policies outlined in this Privacy Policy. If you do not agree to this Privacy Policy, please do not access the Site or otherwise use the Service.

When you interact with us through the Service, we may collect Personal Data and other information from you, as further described below. Please read “CarKey’s Use of Your Personal Data” to learn more about how we use our data.

A. End User Information

We collect the following categories of Personal Data relating to End Users:

Account Information: If you authorize a Third Party Service that utilizes our Service to access your vehicle information, we collect and store Personal Data about you (“Account Personal Data”), such as your email address, password, PIN (OEM account credentials) and Vehicle Identification Number (VIN), as necessary to enable you to use applications made available to you by Developers.

Vehicle Information: We collect certain information through trusted third parties, including Developers and OEMs. Some features of the Service allow you to provide or transmit data and content, including regarding your vehicle and the use thereof (“Vehicle Information”), to or through the Service. When you authorize a Third Party Service that utilizes our Service, whether directly via use of our APIs or other services, or through an application built by us directly, to access your Vehicle Information, you are agreeing to share Vehicle Information and other information with us. You are enabling us to interact with and through Third Party Services or OEMs on your behalf and with your consent.

Information Collected Automatically: We automatically collect certain information relating to End Users’ interaction with the Service, as described under the “Information Collected Automatically” section below.

B. Customer or Visitor Information

If you are a customer, prospect or visitor to our Site, we collect Personal Data from you when you voluntarily provide such information, such as when you contact us with inquiries, contact our sales team or customer support team, respond to one of our surveys, register for access to the Service, sign up for an event, or make a request to receive information about CarKey’s products, like a whitepaper or a newsletter, instruct information to be shared with us or use certain components of the Service.

The specific Personal Data collected during these interactions will vary based on the purpose of the form or the nature of your request, but it will generally include the following categories of Personal Data:

• Identification and Contact Information: We collect your name, email address, phone number, and mailing/billing addresses when you register for access to the Service.

• Professional or Employment Information: We collect your company or employer or your role at your company when you sign up for an event, request content or if you voluntarily elect to share this information, to help us understand you better as a customer or prospective customer.

• Financial Information: For any Service that you purchase for a fee, we and/or our payment processor(s) will collect the billing information necessary to process your payments, such as your payment card number, banking information and/or a billing address, and authentication details.

• Commercial Information: If you create an account, we may retain a history of the services that you purchase from us and our communications history about those services.

Information Collected Automatically: We also automatically collect certain information relating to interaction with our Service, as described under the “Information Collected Automatically” section below.

C. Information Collected Automatically

When you visit, use, or otherwise interact with the Service, we may receive certain information about your visit, use, or interactions. For example, we may monitor the number of people that visit the Service, peak hours of visits, which page(s) are visited, the domains our visitors come from (e.g., google.com, yahoo.com, etc.), and which browsers people use to access the Service (e.g., Chrome, Firefox, Edge, etc.), broad geographical information, and navigation pattern. In particular, the following information is created and automatically logged in our systems:

• Log Information: Information that your browser automatically sends whenever you visit the Site. Log Information includes your Internet Protocol (IP) address, browser type and settings, the date and time of your request, and how you interacted with the Site. We may also infer from your IP address the geographic area you are connecting from when you visit the Site.

• Customer Usage Data: When you use our Service, we collect operational data like API requests or usage information regarding your or your End Users’ use of the Service (“Customer Usage Data”).

• Cookies: We may, and we may allow third party service providers to, use cookies or similar technologies to collect information about your browsing activities over time and across different websites following your use of the Service. Please read the “Cookies” section below for more information.

CarKey uses the Personal Data you provide or otherwise collected in the provision of the Service in a manner that is consistent with this Privacy Policy. If you provide Personal Data for a certain reason, we will use the Personal Data in connection with the reason for which it was provided, as further described below.

If we intend on using any Personal Data in any manner that is not consistent with this Privacy Policy, you will be informed of such anticipated use prior to or at the time at which the Personal Data is collected.

A. End User Information

Account Information: We process Account Information as necessary in order to create and administer your account and enable you to use applications made available to you by Developers. Processing this information is necessary for our legitimate interest in providing our Service to Developers, and it also furthers your interest in being able to use applications made available to you by Developers. We do not use your Account Information for marketing purposes.

Vehicle Information: We process Vehicle Information at the direction of our Customers for the purpose of providing the Service and pursuant to our agreement with the relevant Customer.

B. Customer or Visitor Information

We use Personal Data that you provide through the Service (described above) to provide you with access to the Service, operate and maintain the Service (including providing customer service, fixing malfunctions, testing our security systems, etc.), and process transactions. This processing is necessary to perform the contract we are about to enter into or have entered into with you.

We also use Personal Data as necessary for the following legitimate business interests:

• To respond to your inquiries, comments, feedback or questions;

• To manage our relationship with you, which includes sending administrative information to you relating to our Service and changes to our terms, conditions, and policies, and asking you to leave a review or take a survey;

• To administer and protect our business and the Site, prevent fraud, criminal activity, or misuses of our Site, and to ensure the security of our IT systems, architecture and networks (including troubleshooting, testing, system maintenance, support and hosting of data); and

• To comply with legal obligations and legal process and to protect our rights, privacy, safety or property, and/or that of our affiliates, you or other third parties, and enforce our terms and policies.

For information about what we mean by legitimate interests and the rights of individuals in the European Economic Area and the United Kingdom, please see the “European Individuals” section below.

In addition, we may use your Personal Data to contact you in the future to tell you about events, promotions, features, or other services we believe will be of interest to you. Where required by applicable law, we will obtain appropriate consent prior to sending you marketing communications. You may opt out of receiving emails by following the instructions contained in each promotional email we send you or by contacting us. If you unsubscribe from our marketing lists, you will no longer receive marketing communications but we will continue to contact you regarding our Site and Service and to respond to your requests.

C. Information Collected Automatically

We use information collected automatically (described above) as necessary for our legitimate interest in analyzing use of our Service, providing, maintaining and improving the content and functionality of the Service and our customer relationships and experiences. In particular, we will use this information to help us create new features or functions, refine or personalize the user or Service experience, for example remembering your information so you will not have to enter it each time you use the Service, increase Service technical performance, develop our business and inform our marketing strategy. Where required by the applicable law, we will use cookies and similar technologies other than strictly necessary cookies with your consent. Read the “Cookies” section below for more information.

CarKey Is Not in the Business of Selling Your Information

We consider this information to be a vital part of our relationship with you. There are, however, certain circumstances in which we may share your Personal Data with certain third parties, whether you are an End User or a Customer or Site visitor of ours, without further notice to you, as set forth below.

Third Party Services

If you are an End User, as described above, if you authorize a Third Party Service to access your vehicle information you acknowledge that we may share your information (including Vehicle Information) with the third party that provides the Third Party Service. The use of your information by such third party will be subject to its applicable privacy policy, which you should carefully review.

Business Transfers

As we develop our business, we might sell or buy businesses or assets. In the event of a corporate sale, merger, reorganization, dissolution or similar event, Personal Data may be part of the transferred assets.

Service Providers

CarKey, like many businesses, sometimes engages other companies to perform certain business-related functions and services, and we may share Personal Data with these service providers to assist us in meeting business operations needs. Pursuant to our instructions, these parties will access, process or store Personal Data in the course of performing their duties to us. These functions and services include:

• IT, hosting, cloud services or user support;

• For our Customers and Site visitors, event management, email communication software providers, email newsletter providers, database and sales/customer relationship management services, payment processors, web analytics services (for more details on the third parties that place cookies through the Site, please see the “Cookies” section below). We may also disclose your Personal Data to professional advisors, such as lawyers, bankers, auditors and insurers, where necessary in the course of the professional services they render to us.

Legal Requirements

CarKey may disclose Personal Data if required to do so by law or in the good faith belief that such action is necessary to (i) comply with a legal obligation, (ii) protect and defend the rights or property of CarKey, (iii) act in urgent circumstances to protect the personal safety of users of the Service or the public, or (iv) protect against legal liability.

Scope. This section applies to individuals in the European Economic Area (“EEA”) and the United Kingdom (“UK”).

Data Controller/Data Processor. CarKey generally acts as the data processor on behalf of our Customers for the processing of End Users’ Vehicle Information (described above) and other information that we collect from or about End Users at the direction of our Customers. We process this data pursuant to our Customers’ instructions and subject to our agreements with them. If you are an End User of one of our Customers and have questions about how your Personal Data is processed by that Customer or would like to exercise your privacy rights (described below), please contact that Customer directly.

We act as the data controller for the processing of Account Personal Data, Personal Data relating to our Customers or Site visitors and Information Collected Automatically (each as described above).

Legal Bases for Processing. This Privacy Policy (the paragraph “CarKey’s Use of Your Personal Data”) describes the legal bases we rely on for the processing of your Personal Data. Please contact us at [email protected] if you have any questions about the specific legal basis we are relying on to process your Personal Data.

As used in this Privacy Policy, “legitimate interests” means our interests in administering and conducting our business and it also refers to your interest in using our Service. This Privacy Policy describes when we process your Personal Data for our legitimate interests, what these interests are and your rights. We will not use your Personal Data for activities where the impact on you overrides our interests, unless we have your consent or those activities are otherwise required or permitted by law.

Your Rights. Under certain circumstances you have the following rights in relation to your Personal Data that we process as a data controller:

• Right of access: If you ask us, we will confirm whether we are processing your Personal Data and, if so, provide you with a copy of that Personal Data along with certain other details. If you require additional copies, we may need to charge a reasonable fee.

• Right to rectification: If your Personal Data is inaccurate or incomplete, you are entitled to ask that we correct or complete it. If we shared your Personal Data with others, we will tell them about the correction where possible. If you ask us, and where possible and lawful to do so, we will also tell you with whom we shared your Personal Data so you can contact them directly.

• Right to rectification: If your Personal Data is inaccurate or incomplete, you are entitled to ask that we correct or complete it. If we shared your Personal Data with others, we will tell them about the correction where possible. If you ask us, and where possible and lawful to do so, we will also tell you with whom we shared your Personal Data so you can contact them directly.

• Right to restrict processing: You may ask us to restrict or ‘block’ the processing of your Personal Data in certain circumstances, such as where you contest the accuracy of the data or object to us processing it (please read below for information on your right to object). We will tell you before we lift any restriction on processing. If we shared your Personal Data with others, we will tell them about the restriction where possible. If you ask us, and where possible and lawful to do so, we will also tell you with whom we shared your Personal Data so you can contact them directly.

• Right to data portability: You have the right to obtain your Personal Data from us that you consented to give us or that was provided to us as necessary in connection with our contract with you, and that is processed by automated means. We will give you your Personal Data in a structured, commonly used and machine-readable format. You may reuse it elsewhere.

• Right to object: You may ask us at any time to stop processing your Personal Data, and we will do so:

If we are relying on a legitimate interest to process your Personal Data -- unless we demonstrate compelling legitimate grounds for the processing or we need to process your data in order to establish, exercise, or defend legal claims; If we are processing your Personal Data for direct marketing. We may keep minimum information about you in a suppression list in order to ensure your choices are respected in the future and to comply with data protection laws (such processing is necessary for our and your legitimate interest in pursuing the purposes described above);

• Right to withdraw consent: If we rely on your consent to process your Personal Data, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect any processing of your data before we received notice that you wished to withdraw consent.

• Right to lodge a complaint with the data protection authority: If you have a concern about our privacy practices, including the way we handled your Personal Data, you can report it to your local data protection authority. If you are a resident of the UK and believe that we maintain your Personal Data within the scope of the applicable laws relating to personal data in the UK, you may direct questions or complaints to the UK supervisory authority, the Information Commissioner’s Office.

Please see the “Contacting CarKey” section below for information on how to exercise your rights.

Data Transfers. CarKey is based in the United States. The United States may have data protection laws less stringent than or otherwise different from the laws in effect in the EEA and the UK. Transfers of your personal data to CarKey to the United States are necessary to perform the agreement we have entered into, or are about to enter into, with you.

We and our service providers use cookies and similar technologies to collect certain information as individuals navigate our Site or use our Service, as described below.

What Is A Cookie. A “cookie” is a piece of information sent to your browser by a website you visit. Cookies can be stored on your computer for different periods of time. Some cookies expire after a certain amount of time, or upon logging out (session cookies), others survive after your browser is closed until a defined expiration date set in the cookie (as determined by the third party placing it), and help recognize your computer when you open your browser and browse the Internet again (persistent cookies). For more details on cookies please visit All About Cookies. We also use other similar technologies called pixel tags or “clear” GIFs, which are small images on a web page that work together with cookies to recognize visitors and how they interact with content. Using these tools we can better understand which content is of interest to our visitors.

Types of Cookies Used. We use the following categories of cookies or similar technologies:

A. End Users

If you are an End User, we use strictly necessary or “essential” cookies set by CarKey to enable the use and navigation of the CarKey Connect Authorization flow. Because these cookies are strictly necessary for the purpose described above, End Users cannot refuse them.

B. Customers and Visitors

If you are a Customer or visitor to our Site, we use the following types of cookies or similar technologies:

• Strictly Necessary or Essential Cookies: These cookies are required to enable basic website functionality and, for Customers, these cookies are essential for using and navigating the CarKey Dashboard. They are usually only set in response to actions made by you which amount to a request for services. Because these cookies are strictly necessary, you cannot refuse them.

• Marketing: These cookies are used to deliver advertising that is more relevant to you and your interests. They may also be used to limit the number of times you see an advertisement and measure the effectiveness of advertising campaigns.

• Personalization: These cookies allow the website to remember choices you make (such as your user name, language, or the region you are in) and provide enhanced, more personal features, including enabling live support chat functionality and related customer support for users. These cookies are not essential for using and navigating the Service. However, without these cookies, live support chat functionality and other features may become unavailable.

• Analytics: These cookies help the website operator understand how its website performs, how visitors interact with the website, and whether there may be technical issues. For example, we use cookies or other tracking technologies provided by Google Analytics (Google LLC), to collect information such as how often users visit the Site, what pages they visit and for how long, what other sites they used prior to coming to the Site, and other engagement data. CarKey uses this information to evaluate and improve our Service. For more information about Google Analytics visit https://policies.google.com/technologies/partner-sites. To prevent the storage and processing of this data (including your IP address) by Google, you can download and install the browser-plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en.

You can read more details about the cookies and similar technologies we use by clicking on Cookie Settings on our Site.

Your Choices. If you are a user in the EEA, the UK or other jurisdiction with similar cookie consent requirements, we will set cookies other than strictly necessary cookies only with your consent. You can exercise your cookie preferences when you first arrive at our Site. You will see a notice about our use of cookies, providing you with the opportunity to learn more and to choose which types of cookies you wish to allow to access your device before providing your consent to the placement of cookies. You can also change these settings at any time by going to the Cookie Settings.

You can also block or delete cookies by modifying your browser settings. On most web browsers, you will find a “help” section on the toolbar. Please refer to this section for information on how to receive a notification when you are receiving a new cookie and how to turn cookies off. Please see the links below for guidance on how to modify your web browser’s settings on the most popular browsers:

• Microsoft Edge
• Mozilla Firefox
• Google Chrome
• Apple Safari

Please note that if you limit the ability of websites to set cookies, you may be unable to access certain parts of the Site and you may not be able to benefit from the full functionality of the Site.

You can opt out of interest-based targeting provided by participating ad servers through the Digital Advertising Alliance (http://youradchoices.com), visiting the Your Online Choices page or the Network Advertising Initiative page. These opt-out tools are provided by third parties, not us. We do not control or operate these tools or the choices that advertisers and others provide through these tools. In addition, on your iOS or Android, you can change your device settings to control whether you see online interest-based ads. You may also manage or opt-out of cookies by using the links provided by the third parties described above.

Your Choices

You can visit the Site without providing any Personal Data, however some Personal Data is needed so that you can use the Service or certain features of it. If you choose not to provide Personal Data that is needed to use features of our Service, you may not be able to use those features. You can also contact us to ask us to update your Personal Data or if you need to change or correct your Personal Data (if you have a Customer account with us, you can also log in to your account to update your name and email address).

Data Retention

We keep Personal Data for as long as reasonably necessary for the purposes described in this Privacy Policy, while we have a legitimate business need to do so, or as required by law (e.g. for tax, legal, accounting or other purposes), whichever is the longer.

If you have elected to receive marketing communications, we retain information about your marketing preferences until you opt out of receiving these communications and in accordance with our policies.

To determine the appropriate retention period for your Personal Data, we will consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purposes for which we use your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Children

CarKey does not knowingly collect Personal Data from children under the age of 13. If you are under the age of 13, please do not submit any Personal Data through the Service. We encourage parents and legal guardians to monitor their children’s Internet usage and to help enforce our Privacy Policy by instructing their children never to provide Personal Data on the Service without their permission. If you have reason to believe that a child under the age of 13 has provided Personal Data to CarKey through the Service, please contact us, and we will endeavor to delete that information from our databases.

No Endorsement of Third Party Services

This Privacy Policy applies only to the Service. The policies and procedures we described here do not apply to the Third Party Services. Any links or integrations from or with a Third Party Service do not imply that CarKey endorses the Third Party Service. The information that you share with Third Party Services will be governed by the specific privacy policies and terms of service of the Third Party Services and not by this Privacy Policy.

Security

CarKey takes reasonable steps to protect the Personal Data provided via the Service from loss, misuse, unauthorized access, disclosure, alteration, or destruction. However, no Internet or email transmission is ever fully secure or error free. In particular, email sent to or from the Service may not be secure. Therefore, you should take special care in deciding what information you send to us via email. Please keep this in mind when disclosing any Personal Data to CarKey via the Internet. In addition, we are not responsible for circumvention of any privacy settings or security measures contained on the Service, or third party websites.

Changes to CarKey’s Privacy Policy

The Service and our business may change from time to time. As a result, at times it may be necessary for CarKey to make changes to this Privacy Policy. CarKey reserves the right to update or modify this Privacy Policy at any time and from time to time without prior notice and when we do we will post an updated version on this page, unless we are required to notify you of the changes by the applicable law. Please review this policy periodically, and especially before you provide any Personal Data. This Privacy Policy was last updated on the date indicated above. Your continued use of the Service after we have posted an updated Privacy Policy, or notified you if applicable, shall indicate your agreement with the terms of such revised Privacy Policy.