Privacy Policy

1. Who we are

Pacific Autohaus (also referred to as "we," "us," or "our") is a licensed California auto dealer located at 933 S 4th Street, Grover Beach, CA 93433. This Privacy Policy covers personal information we collect from visitors to our website, customers, and applicants for financing.

2. Categories of personal information we collect

In the past 12 months we have collected the following categories of personal information as defined by the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA):

• Identifiers: name, phone number, email address, mailing address, IP address.
• Customer records: information from lead forms and consultations (vehicle of interest, trade-in details, notes).
• Commercial information: vehicles viewed, inquiries made, purchase history if you buy a car from us.
• Internet / network activity: pages visited, referring URL, approximate location based on IP, browser and device type, timestamps. Collected via first-party analytics and cookies as described below.
• Geolocation data: approximate location from IP address only. We do not collect precise GPS location.
• Professional or employment information: employment status, employer, job title, monthly income — collected only if you submit a financing application.
• Sensitive personal information (SPI): Social Security number, driver's license number, and financial account information — collected only if you submit a financing application. See §6 below for how we handle SPI.
• Inferences: vehicle preferences, budget range, and purchase intent inferred from the above.

3. How we use your personal information

We use the information we collect to:

• Respond to your inquiry, schedule test drives, send vehicle details, and follow up on open leads.
• Process financing applications through our lending partners (if you submit a credit app).
• Complete a vehicle purchase, trade-in, or service transaction.
• Send transactional SMS/email (confirmations, reply-back to your texts, status updates).
• Send marketing SMS/email only if you checked the opt-in box on a form. You can reply STOP at any time.
• Comply with legal obligations (DMV reporting, tax, anti-money-laundering, dealer licensing).
• Detect and prevent fraud.
• Improve the website and debug issues.

4. Categories of third parties we share with

We do not sell or share your personal information for cross-context behavioral advertising. We do disclose personal information to the following categories of service providers, each under a contract that limits their use of the data to providing services to us:

• DealerCenter — our dealer management system (inventory, deal structuring, credit app processing).
• Lending partners — banks and credit unions we submit your financing application to on your behalf.
• SMS / messaging providers — to deliver text messages you've asked us to send.
• Analytics providers — Google Analytics and similar first-party analytics to understand site usage.
• Ad platforms — Meta (Facebook/Instagram) Pixel and Google Ads conversion tracking, used for measurement only, not for cross-context behavioral advertising.
• Payment processors — for deposits and payments.
• Government agencies — DMV and tax authorities as required by law.
• Professional advisors — our lawyers, accountants, and auditors.

We do not sell or share your personal information as those terms are defined under the CCPA/CPRA. Because we do not sell or share, we are not required to provide (and do not provide) a "Do Not Sell or Share My Personal Information" link.

5. Sources of personal information

We collect personal information directly from you (forms, texts, phone calls, in-person visits), from automated technology when you use our website (cookies, server logs), from service providers and lending partners (credit bureaus, vehicle history services), and occasionally from public sources (DMV records, public property records).

6. Sensitive personal information — use and limits

We collect sensitive personal information (SSN, driver's license, financial account info) only when you voluntarily submit a credit application. We use it solely to:

• Verify your identity.
• Submit your application to lenders to obtain financing for the vehicle you are purchasing.
• Comply with federal and state legal obligations (OFAC, Patriot Act, dealer record-keeping).

Right to limit use of sensitive personal information: under CPRA you have the right to limit our use of SPI to those purposes listed above. Because we already only use SPI for those purposes, no additional action is required — but you may still submit a formal request and we'll confirm in writing.

7. Retention periods

We retain personal information only as long as reasonably necessary for the purpose we collected it. Specific retention periods:

• Website inquiry leads (name, phone, email from form submissions) — up to 3 years from your last interaction.
• Purchase / transaction records — 7 years, as required by California DMV and IRS.
• Credit applications and related sensitive information — 25 months from submission for approved applicants, or 25 months from denial for denied applicants, as required by the Equal Credit Opportunity Act.
• SMS consent and opt-out records — indefinitely, to honor your STOP request.
• Web analytics logs — 26 months (Google Analytics default).
• Marketing email lists — until you unsubscribe.

When a retention period expires, we securely delete or de-identify the information.

8. Your California privacy rights

If you are a California resident, you have the following rights under the CCPA/CPRA. These rights apply regardless of whether you are a customer or just a website visitor.

• Right to know — request a copy of the specific pieces and categories of personal information we have collected about you, the sources, the purposes, and the categories of third parties we've disclosed to.
• Right to delete — request deletion of personal information we have collected from you, subject to legal exceptions (e.g. completed transactions, pending financing applications, legal obligations).
• Right to correct — request that we correct inaccurate personal information we maintain about you.
• Right to limit use of sensitive personal information — as described in §6 above.
• Right to opt out of sale / sharing — we don't sell or share, so there's nothing to opt out of; but you can still submit a request and we'll confirm.
• Right to non-discrimination — we will not deny you service, charge you a different price, or provide a different level of quality of service because you exercised any of these rights.

9. How to exercise your rights

To exercise any of the rights above, email [email protected] or call (805) 904-0010 with:

• Your name, phone number, and email address.
• The specific right you are exercising (know, delete, correct, limit SPI).
• Enough information for us to verify your identity (we may ask follow-up questions to match your request against our records).

We will respond within 45 days of receipt. We may extend once by another 45 days if reasonably needed and we will notify you of the extension. There is no fee to exercise your rights.

Authorized agents: you may designate an authorized agent to make a request on your behalf. We will require written verification of the agent's authority and may still contact you directly to verify the request.

10. Global Privacy Control (GPC) signals

We honor Global Privacy Control signals sent by browsers that support them. When we detect a GPC signal from your browser, we treat it as a valid opt-out of sale/sharing for that browser and device — even though, as stated above, we don't sell or share personal information in the first place. GPC signals do not affect cookies you have set explicitly (e.g. login state).

11. Minors under 16

Our website is not directed to children under 16, and we do not knowingly collect personal information from children under 16. We do not sell or share the personal information of any consumer under 16 years of age, and the affirmative-authorization (opt-in) requirement under CCPA/CPRA does not apply because we do not sell or share at all. If we learn that we have inadvertently collected personal information from a child under 16, we will delete it promptly.

12. California "Shine the Light" (Civil Code § 1798.83)

California residents may request once per calendar year a list of the categories of personal information we disclosed to third parties for their direct marketing purposes, along with the names and addresses of those third parties. Pacific Autohaus does not disclose personal information to third parties for those parties' direct marketing purposes, so there is no list to provide. You may still submit a written request to [email protected] and we will confirm this in writing.

13. Cookies and tracking

Our website uses:

• Strictly necessary cookies — to keep the site running (session, CSRF).
• Analytics cookies — Google Analytics to understand aggregate site usage.
• Advertising pixels — Meta Pixel and Google Ads to measure ad conversions. These do not fire for users whose browsers send a GPC signal.

You can disable cookies through your browser settings; this may affect site functionality.

14. Security

We use administrative, physical, and technical safeguards appropriate to the sensitivity of the personal information we handle. All financing applications are submitted through secure, encrypted channels. No method of transmission over the internet is 100% secure; if you believe your personal information has been compromised, contact us immediately.

15. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be posted here with a new "Last updated" date. Continued use of our website after changes are posted constitutes your acceptance of the updated policy.

16. Contact us

Privacy questions, requests, or complaints:

• Email: [email protected]
• Phone: (805) 904-0010
• Mail: Pacific Autohaus, 933 S 4th Street, Grover Beach, CA 93433

You may also contact the California Attorney General's office at oag.ca.gov/privacy if you believe we have violated your rights under California privacy law.