Privacy Policy

OVERVIEW

BDC Automation LLC ("BDC Automation," "we," "us," "our") respects your privacy and is committed to protecting it through compliance with this Privacy Policy.

This Privacy Policy explains how we collect, use, disclose, and protect information when you:

• Visit our website at https://www.bdcautomation.com

• Use our automotive communications platform (the "Platform" or "Services")

• Interact with us as a business contact, prospect, or vendor

• Are a consumer whose information is processed by our dealer customers

Please read this Privacy Policy carefully. By accessing or using our Platform, you agree to this Privacy Policy. If you do not agree, please do not use our Services.

BDC Automation may update this Privacy Policy from time to time. Your continued use after changes constitutes acceptance of the updated Privacy Policy. This Privacy Policy is governed by and subject to our Terms of Service.

UNDERSTANDING BDC AUTOMATION'S ROLE IN YOUR DATA

BDC Automation operates in two distinct capacities depending on the type of information and your relationship with us. Understanding which role applies is important for knowing your privacy rights and who to contact.

WHEN WE ACT AS A BUSINESS (Data Controller)

When you interact with our website, sales team, support, or services as a dealership employee, prospect, vendor, or business contact, we act as a Business (under California law) or Data Controller (under GDPR) collecting and processing your information for our own business purposes.

Examples:

• You're a dealership manager requesting a demo

• You're signing up for our platform

• You're a dealership employee using our services

• You're attending our webinar or trade show

• You're a vendor or business partner

Your Rights: You have privacy rights under applicable law (see sections below for your state/country).

Contact Us: support@bdcautomation.com

WHEN WE ACT AS A SERVICE PROVIDER (Data Processor)

When automotive dealerships (our customers) use our Platform to process information about their customers and leads (consumers shopping for vehicles), we act as a Service Provider (under California law) or Data Processor (under GDPR) on behalf of the dealership.

Examples:

• A dealership uses our Platform to send you (a car shopper) a text about your trade-in inquiry

• A dealership uses our Platform to call you about a service appointment

• A dealership stores your contact information in our Platform

Your Rights: The dealership controls your information, not us. Contact the dealership directly to exercise your privacy rights.

We Process on Dealership's Behalf: We only process this consumer/lead data as directed by the dealership and in accordance with our Terms of Service.

IMPORTANT NOTICE FOR CONSUMERS (CAR SHOPPERS)

If you received a call, text, or email from a dealership that uses BDC Automation:

• The dealership is the controller of your information

• The dealership decides what communications to send you

• BDC Automation is just the technology platform

• To exercise your privacy rights (access, delete, opt-out), contact the dealership directly

• To opt out of communications, reply STOP to texts or follow opt-out instructions in emails/calls

BDC Automation provides technology tools. We do not decide who receives communications or verify that dealerships have proper consent. The dealership is solely responsible for compliance with privacy laws and telecommunications laws (TCPA, etc.).

INFORMATION WE COLLECT

1. Dealership/Business Contact Information

When you interact with us as a dealership, business contact, prospect, or vendor:

Information You Provide:

• Name, email address, phone number

• Job title, dealership/company name, department

• Billing and payment information

• Account credentials and login information

• Communications you send us (emails, support tickets, etc.)

• Information provided at events, trade shows, webinars

Information We Collect Automatically:

• IP address, browser type, device information

• Usage data (pages visited, features used, time spent)

• Log files and analytics data

• Cookie data (see Cookies Policy)

2. Consumer/Lead Data Processed on Behalf of Dealerships

This is data dealerships store and process through our Platform:

• Consumer names, phone numbers, email addresses

• Vehicle interest information, trade-in details

• Communication history and preferences

• Service appointment information

• Any other data dealerships choose to store in our Platform

Important: We process this data only on behalf of dealerships. We do not use consumer/lead data for our own marketing or sell it. Dealerships control this data and are responsible for obtaining proper consent and complying with privacy laws.

3. Information from Third Parties

We may receive information from:

• Business partners and marketing partners

• Data providers and public databases

• Social media platforms (for business contacts)

• Event/trade show organizers

We take steps to confirm third parties have proper rights to share this information with us.

HOW WE USE INFORMATION

For Dealership/Business Contacts:

Platform Functionality:

• Provide access to and functionality of our Platform

• Process your account setup and authentication

• Enable platform features and integrations

• Analyze usage and improve our Services

Customer Support:

• Respond to your questions and support requests

• Provide technical assistance and training

• Send service notifications and updates

Business Operations:

• Process billing and payments

• Prevent fraud and abuse

• Maintain security and prevent unauthorized access

• Comply with legal obligations

Marketing and Communications:

• Send you marketing emails (with your consent or as permitted by law)

• Provide newsletters, white papers, and product updates

• Invite you to webinars, events, and trade shows

• Study effectiveness of our marketing campaigns

Improvements and Analytics:

• Analyze how dealerships use our Platform

• Develop new features and products

• Test and improve platform performance

• Identify trends and usage patterns

For Consumer/Lead Data:

We process consumer/lead data only as directed by dealerships and only to:

• Provide the Platform services to dealerships

• Store and transmit communications on behalf of dealerships

• Provide analytics and reporting to dealerships

• Maintain security and prevent fraud/abuse

• Comply with legal obligations

We do NOT:

• Use consumer/lead data for our own marketing

• Sell consumer/lead data

• Make decisions about who dealerships should contact

• Verify consent or compliance (dealer's responsibility)

HOW WE SHARE INFORMATION

Service Providers and Subprocessors

We share information with vendors who help us operate our business:

• Hosting providers (Amazon Web Services, etc.)

• Telecommunications providers (Twilio, carriers for SMS/voice services)

• Payment processors (for billing)

• Analytics providers (usage analytics, performance monitoring)

• Support tools (customer service platforms)

• Security services (fraud prevention, security monitoring)

All vendors are contractually required to protect information and use it only for authorized purposes.

Legal Requirements

We may disclose information when required by law or to:

• Comply with legal process (subpoenas, court orders)

• Respond to government or law enforcement requests

• Protect our legal rights or defend against claims

• Prevent fraud or security threats

• Protect safety of individuals

Business Transfers

If we merge with, are acquired by, or sell assets to another company, information may be transferred as part of that transaction.

With Your Consent

We may share information with third parties when you give us permission.

Aggregated/De-identified Data

We may share aggregated, anonymized, or de-identified data that cannot identify individuals for research, analytics, and business purposes.

WE DO NOT SELL PERSONAL INFORMATION

BDC Automation does not sell personal information for monetary compensation.

For purposes of California law: We do not "sell" or "share" personal information for cross-context behavioral advertising in connection with our core Services. Our marketing website may use analytics and advertising tools; where required, we provide choices and honor opt-out signals.

DATA RETENTION

We retain information for the following periods (unless longer retention is required by law or for litigation):

Dealership Account Data: We retain your account information for the duration of our business relationship plus seven (7) years after the relationship ends.

Billing and Payment Records: We retain billing and payment records for seven (7) years after the final transaction.

Consumer/Lead Data (processed for dealers): We retain consumer and lead data as directed by the dealership. By default, we delete this data from production systems within ninety (90) days after the dealer's thirty (30) day export window following account termination.

Platform Usage Logs: We retain usage and system logs for up to twenty-four (24) months.

Support Tickets and Communications: We retain support tickets and related communications for three (3) years after resolution.

Marketing Contact Records: We retain marketing consent records until consent is withdrawn, plus three (3) years after withdrawal.

Security Incident Logs: We retain security incident logs for seven (7) years.

Consent Evidence (for Dealer messaging): Consent evidence is provided by dealerships. BDC recommends that dealerships retain consent records for four (4) or more years.

Backups: Data may persist in encrypted backup systems for up to ninety (90) days after deletion from production systems and will be deleted in the ordinary course, subject to legal holds.

Legal Holds: We may retain information longer when required by law, litigation holds, government investigations, or to resolve disputes.

DATA SECURITY

We maintain commercially reasonable administrative, technical, and organizational safeguards designed to protect information, including:

• Encryption of data in transit and at rest

• Access controls and authentication

• Security monitoring and threat detection

• Vendor security requirements

• Employee training on data protection

• Regular security assessments

No system is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at support@bdcautomation.com.

YOUR PRIVACY RIGHTS

Your rights depend on where you live. See the applicable section below.

CALIFORNIA RESIDENTS (CCPA/CPRA)

California residents have the right to:

Know: Request disclosure of personal information we've collected, used, disclosed, or sold about you (categories, sources, purposes, third parties)

Access: Request a copy of your personal information

Delete: Request deletion of your personal information (subject to exceptions)

Correct: Request correction of inaccurate personal information

Opt-Out: Opt out of "sale" or "sharing" of personal information (we don't sell or share)

Limit Sensitive Data Use: Request limits on use of sensitive personal information (we limit to permitted uses)

Non-Discrimination: Exercise rights without discrimination

To Exercise Rights:

• Email: support@bdcautomation.com

• Phone: +1-855-589-1800

We'll verify your identity before responding. We may need information such as email, account details, or recent interactions to verify your request. Response time: 45 days (may extend 45 days with notice).

Authorized Agents: You may designate an authorized agent. We may require proof of authorization.

Appeal Rights: If we deny your request, you may appeal by contacting us.

COLORADO RESIDENTS (CPA)

Colorado residents have rights similar to California residents:

• Access your personal information

• Correct inaccuracies

• Delete your personal information

• Opt out of targeted advertising, sale, or profiling (we don't engage in these)

To Exercise Rights: support@bdcautomation.com or +1-855-589-1800

Appeal Rights: If we deny your request or don't respond within 45 days, you may appeal by contacting us.

CONNECTICUT RESIDENTS (CTDPA)

Connecticut residents have similar rights to access, correct, delete, and opt out.

To Exercise Rights: support@bdcautomation.com or +1-855-589-1800

Appeal Rights: Available if we decline your request.

VIRGINIA RESIDENTS (VCDPA)

Virginia residents have rights to:

• Access, correct, and delete personal information

• Obtain a copy of personal information

• Opt out of targeted advertising, sale, or profiling

To Exercise Rights: support@bdcautomation.com or +1-855-589-1800

Appeal Rights: If we decline your request, contact us to appeal.

UTAH RESIDENTS (UCPA)

Utah residents may exercise access, deletion, and opt-out rights.

To Exercise Rights: support@bdcautomation.com or +1-855-589-1800

EUROPEAN RESIDENTS (GDPR)

If you're in the European Economic Area, United Kingdom, or Switzerland, you have rights under GDPR:

Access: Confirm what personal data we hold about you

Rectification: Correct inaccurate personal data

Erasure: Request deletion ("right to be forgotten")

Restriction: Limit how we process your data

Portability: Receive your data in a structured, machine-readable format

Object: Object to processing based on legitimate interests

Withdraw Consent: Withdraw consent for processing (doesn't affect prior lawful processing)

Lodge Complaint: File a complaint with your local data protection authority

To Exercise Rights: support@bdcautomation.com

Legal Basis for Processing:

• Consent: Where you've given explicit consent

• Contract: To perform our contract with you (Terms of Service)

• Legal Obligation: To comply with laws

• Legitimate Interests: For business operations, fraud prevention, security, and improvements (balanced against your rights)

Data Controller/Processor Roles:

• For dealership/business data: We are the Data Controller

• For consumer/lead data: Dealerships are Data Controllers, we are Data Processors

EU-U.S. Data Privacy Framework:

BDC Automation complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension, and the Swiss-U.S. DPF as set forth by the U.S. Department of Commerce. We have certified our adherence to the DPF Principles.

Dispute Resolution: EU, UK, and Swiss individuals may contact JAMS Mediation (https://www.jamsadr.com/eu-us-data-privacy-framework) for complaints. Under certain conditions, binding arbitration may be available.

FTC Jurisdiction: The Federal Trade Commission has jurisdiction

CANADIAN RESIDENTS (PIPEDA / PROVINCIAL LAWS)

PIPEDA Compliance:

BDC Automation complies with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws (Alberta PIPA, British Columbia PIPA, Quebec privacy law).

Your Rights:

• Access your personal information

• Correct inaccuracies

• Understand how we use your information

• Withdraw consent (subject to legal/contractual restrictions)

• File complaints with privacy commissioner

Contact for Canadian Privacy Matters:

• Email: support@bdcautomation.com

• Phone: +1-855-589-1800

Quebec Residents: You may have additional rights. Contact us for information specific to Quebec privacy law.

CASL (Anti-Spam) Compliance:

Canadian Anti-Spam Legislation (CASL) applies to commercial electronic messages (CEMs) sent to Canadian recipients.

Dealership Responsibility: Dealerships using our Platform to send CEMs to Canadian recipients are responsible for:

• Obtaining express or implied consent

• Including required identification information

• Providing functioning unsubscribe mechanism

• Processing unsubscribes within 10 business days

• Maintaining consent records

BDC Automation's Role: We provide technology infrastructure. Dealerships are responsible for CASL compliance when using our Platform to send CEMs.

MARKETING CHOICES

Opt Out of Marketing Emails:

• Click "unsubscribe" in any marketing email

• Email support@bdcautomation.com

• Call +1-855-589-1800

Note: Even if you opt out of marketing, we may still send you:

• Transactional messages (account notifications, billing)

• Service updates and security alerts

• Support-related communications

Cookies and Tracking: See our Cookies Policy for information on managing cookies and tracking technologies.

CHILDREN'S PRIVACY

Our Services are not intended for children under 16 (or 13 in the U.S.). We do not knowingly collect personal information from children. If we learn we've collected a child's information, we'll delete it promptly.

If you're a parent/guardian: If you believe we've collected your child's information, contact us immediately at support@bdcautomation.com.

DO NOT TRACK SIGNALS

Some browsers have "Do Not Track" (DNT) features. Our Platform currently does not respond to DNT signals. We may respond to DNT signals in the future and will update this Privacy Policy accordingly.

LINKS TO OTHER WEBSITES

Our Platform may contain links to third-party websites, apps, or services. We are not responsible for their privacy practices. This Privacy Policy applies only to BDC Automation services.

Third-Party Platforms: We are not responsible for privacy practices of:

• Social media platforms (Facebook, LinkedIn, etc.)

• App stores (Apple, Google)

• Third-party integrations you connect to our Platform

• Websites linked from our Platform

Review their privacy policies before providing information to third parties.

INTERNATIONAL DATA TRANSFERS

BDC Automation is based in the United States. If you're accessing our Services from outside the U.S., your information will be transferred to, stored, and processed in the United States.

Safeguards:

• EU-U.S. Data Privacy Framework (for EEA/UK/Swiss data)

• Standard Contractual Clauses (where applicable)

• Other appropriate safeguards as required by law

We process international data in accordance with applicable laws and this Privacy Policy.

TELECOMMUNICATIONS & TCPA CONTEXT

For Dealerships Using Our Platform:

Our Platform enables dealerships to send calls, texts, and emails to consumers. Dealerships are solely responsible for:

• Obtaining proper consent (including TCPA Prior Express Written Consent where required)

• Maintaining Do Not Call (DNC) compliance

• Honoring opt-out requests

• Complying with calling time restrictions

• Call recording disclosures

• Truthful caller identification

• Carrier policy compliance (10DLC, etc.)

• Ringless voicemail compliance (where applicable)

BDC Automation's Role:

• We are a technology provider, not the sender

• We do not determine who should receive communications

• We do not verify consent or legal compliance

• We do not guarantee message/call delivery (carriers control delivery)

• We provide tools; dealerships control usage

For Consumers: If you received unwanted communications from a dealership using our Platform, contact the dealership to opt out or file complaints. We cannot stop communications on your behalf.

CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. Changes will be posted with a new "Last Updated" date at the top.

Material Changes:

• We'll notify you of material changes via email (to your account email) or Platform notification

• Continued use after changes constitutes acceptance

• Where required by law, we'll obtain your consent for material changes

Check Regularly: Please review this Privacy Policy periodically for updates.

CONTACT US

For Privacy Questions, Requests, or Complaints:

BDC Automation LLC
2041 East St # 738
Concord, California 94520
United States

Email: support@bdcautomation.com
Phone: +1-855-589-1800 (toll-free)
Website: https://www.bdcautomation.com

For EU/UK/Swiss Data Privacy Framework Complaints:

Email: support@bdcautomation.com

If we don't resolve your concern, you may contact:

• JAMS Mediation: https://www.jamsadr.com/eu-us-data-privacy-framework

• Your local data protection authority (for EU/UK/Swiss residents)

• Privacy Commissioner (for Canadian residents)

• California Attorney General (for California residents)

ACCESSIBILITY

We're committed to making our Privacy Policy accessible. If you need this Privacy Policy in an alternative format or have accessibility questions, contact us at support@bdcautomation.com or +1-855-589-1800.