Costco Auto Program’s Commitment to Privacy

Updated as of: May 25, 2018

The Costco Auto Program is operated by Affinity Auto Program, Inc. (“CAP”, “we”, “us” or “our”). Affinity Auto Program is an independent company, not an affiliate of Costco Wholesale Corporation (“Costco”). CAP respects your right to privacy and your ability to make informed choices about the uses of your information. This privacy policy (“Privacy Policy”), which is separate from Costco’s privacy policy, describes our policies and practices regarding the collection, use and disclosure of your information as part of the Costco Auto Program and our technology platforms, including, without limitation, our website, mobile application, call center, text and chat communications, interactive features and social media pages (collectively, the “CAP Site”). This Privacy Policy applies to information collected from the CAP Site unless different terms are specified in an online or other form or contract we provide you.

Guide to Content

1. COLLECTION OF INFORMATION
2. HOW WE USE THE INFORMATION WE COLLECT
3. OUR LEGAL BASIS FOR USING YOUR INFORMATION
4. SHARING OF INFORMATION
5. YOUR PRIVACY RIGHTS, CHOICE AND ACCESS
6. DATA RETENTION
7. YOUR INFORMATION WILL BE STORED IN THE USA
8. INTEREST-BASED/TARGETED ADVERTISING; HOW TO OPT OUT; DO NOT TRACK
9. HOW WE COMMUNICATE WITH YOU
10. SECURITY OF YOUR INFORMATION
11. OTHER SITES
12. CHANGES AND POLICY UPDATES
13. CONTACT US

1. COLLECTION OF INFORMATION

We collect and process the following information:

Information You Provide To Us

We collect “Personal Information”, which is information that relates to an identifiable individual, such as name, email address, telephone number, home address, geolocation, demographic information (such as post code, gender and age), contact information, and information about vehicle purchases (such as a vehicle purchase agreement that you give us permission to review). The types of Personal Information we collect will vary depending on your use of the various features and programs available on the CAP Site from time to time.

We collect and store the Personal Information that you provide us, such as when you:

• request to be referred to a participating CAP dealer to receive member pricing on a desired vehicle or to receive a discount coupon or voucher for parts and service;
• provide other information, such as information about your vehicle preferences (e.g., vehicle make, model and/or your desired vehicle options);
• register at the CAP Site for an OEM promotion or opt-in to receive text messages, emails or other offers or communications;
• contact us for any reason (such as when you speak with a CAP customer service representative); or
• provide feedback by participating in a member survey.

Information We Collect Automatically

• Usage Information: When you visit the CAP Site, we, as well as any third-party advertisers and/or service providers, use a variety of technologies that automatically or passively collect information about how various parts of the CAP Site are accessed and used (“Usage Information”), such as your browser type, device type, operating system, application version, the pages served to you, previous page views, the site from which you linked, the time and date of your visit to the CAP Site, your use of features on the CAP Site, and your inquiries. This statistical data helps us understand what is interesting and relevant to users so we can best tailor our content. Usage Information is generally non-identifying, but if CAP associates it with you as a specific and identifiable person, CAP will treat it as Personal Information.
• Device Identifiers: We also automatically collect an Internet (IP) address or other unique identifier information ("Device Identifier") for the computer, mobile device, technology or other device (collectively, “Device”) you use to access the CAP Site. A Device Identifier is a number that is automatically assigned to your Device when you access a web site or its servers, and our computers identify your Device by its Device Identifier. We use Device Identifiers to, among other things, administer the CAP Site, help diagnose problems with our servers, analyze trends, track users’ web page movements, help identify you and your inquiries, and gather broad demographic information for aggregate use.
• Cookies and Similar Technologies. We use cookies, pixel tags, and similar technologies to automatically collect information. Cookies are small bits of information that are stored by your Device’s web browser. Pixel tags are very small images or small pieces of data embedded in images, also known as “web beacons” or “clear GIFs,” that can recognize cookies, the time and date a page is viewed, a description of the page where the pixel tag is placed, and similar information from your Device.

We allow specific third parties to place and read their own cookies, web beacons, and similar technologies to collect information through the CAP Site. For example, our third party service providers use these technologies to collect information that helps us with traffic measurement, research, analytics and providing you with offers and coupons, including through the delivery of targeted advertisements. Depending on the configuration options offered by the operating system, web browser, and other software on your Device, you may be able to decide if and how your Device will accept a cookie by configuring your preferences or options in your Device or web browser. If you choose to refuse, disable, or delete these technologies, some of the functionality of the CAP Site may no longer be available to you.

Information From Other Sources

We may receive additional information about you from other sources and may combine that information with the other information we collect or receive about you. For example, you may choose to participate in a third party application or social media site through which you allow us to collect (or the third party to share) information about you, including Usage Information and Personal Information. We may also receive information from third-party partners and service providers, including partners and service providers that provide us information that is publicly or commercially available. We may match the information we collect about you through the CAP Site with information collected from such third parties in order to enhance our ability to serve you, to tailor our content to you and/or, with your consent, to offer you opportunities to purchase products or services that we believe may be of interest to you.

2. HOW WE USE THE INFORMATION WE COLLECT

We use the information we collect about and from you for a variety of business purposes, including:

• using your vehicle request and post code to locate a participating dealership in your area for the specific make and model requested;
• responding to your questions and requests;
• providing you with access to certain areas and features of the CAP Site;
• verifying your identity (for example, we use your Costco membership number to verify your membership with Costco and to determine your level of Costco membership to verify the Costco cash card amount you may be entitled to through a promotion);
• sending notice of changes to any policy and/or the CAP Site or research tools;
• tailoring content, advertisements, and offers we provide you;
• providing vehicle safety information or recall notices;
• providing you with market updates and other promotional information. For example, we may send you:
• information about the participating dealership for the vehicle you requested, including, without limitation, dealership information, an overview of next steps (following your request for dealer information) and CAP benefits;
• coupons for vehicle parts, service and/or accessories;
• dealer or manufacturer special offers, if you consent to this;
• updates about manufacturer rebates and incentives that may be of interest to you based on your prior vehicle requests, industry updates and trends, if you consent to this;
• announcements about new CAP benefits or enhancements; or
• other special offers or savings opportunities, with your consent.
• improving the CAP Site and for internal business purposes;
• compiling aggregate statistics about the total number of daily visitors to the CAP Site, the pages most frequently visited and how long visitors stay at each page (this allows us to understand our customer’s needs and to develop products and services to serve those needs); and
• as otherwise described to you at the point of collection or pursuant to your consent.

3. OUR LEGAL BASIS FOR USING YOUR INFORMATION

If you live in the European Economic Area (EEA) or Iceland, we will only process your personal information where at least one of the following applies:

• If it is in our legitimate interests or the legitimate interests of others (such as participating CAP dealers) to use your personal information. For example, it is in our legitimate interests to use your personal information to improve the CAP Site, and to share your personal information with third parties who provide services to us relating to the CAP Site. If you would like further information about how we decide when a particular use is in our legitimate interests, you may contact us using the contact details set out below.
• If we need to use your personal information to perform our responsibilities to you under the Costco Auto Program (including, for example, giving your information to a participating CAP dealer who can contact you based on your request).
• If you consent. Sometimes we may ask for your consent to use certain types of personal information (e.g., by asking you to tick an online box if you would like us to share your information with Costco so you can receive promotional messages from them). In these circumstances, your consent will be our legal basis for processing your personal information. If you have provided consent, you may withdraw it at any time. You may do this by “opting out” where we give you the opportunity to do so, or by contacting us using the contact details below. Note that if you consent to our sharing your information with a third party such as Costco and you later withdraw your consent, we won’t share new information, but the third party may continue to use the information they already have. If you want a third party to stop using your information, you should contact them directly.

4. SHARING OF INFORMATION

Except as provided below, we will not provide any of your Personal Information to third parties without your specific consent. We share your information for purposes described at the time you provide your information or with third parties as follows:

• Participating Dealerships and Vehicle Manufacturers. We share your information with participating dealerships and/or vehicle manufacturers so that they can provide you with special offers, promotional materials, and other materials that you request, or, if you consent, that we think might be of interest to you. For example, we may share your name, email address, phone number and requested vehicle information (such as make, model and vehicle features) with a participating dealership to help you with the purchase of your vehicle. However, CAP is not responsible for the privacy practices of these participating dealerships and/or vehicle manufacturers, which may use your information for their own purposes.
• Costco. We share Personal Information with Costco for customer service, member tracking and satisfaction purposes. If you consent, we will share information with Costco so Costco can communicate with you about other products and services that you may be interested in.
• Third Parties Providing Services On Our Behalf. We share your Personal Information with third parties that perform functions on our behalf (or on behalf of our partners) such as service providers that host or operate the CAP Site, analyze data, fulfill inquiries or provide customer service; or other third parties that participate in or administer our promotions or provide marketing or promotional assistance.
• Other Parties with Your Consent. While on the CAP Site, you may have the opportunity to opt-in to receive information and/or marketing offers from someone else or to otherwise consent to the sharing of your information with a third party. If you agree to have your Personal Information shared, your Personal Information will be disclosed to the third party and the Personal Information you disclose will be subject to the privacy policy and business practices of that third party. We are not responsible for any additional information you provide directly to these parties, and we encourage you to become familiar with their privacy practices and policies before disclosing information to them.
• Business Transfers. Your information, including Personal Information, may be disclosed or transferred as part of, or during negotiations of, any merger or sale of company assets or acquisition.
• Legal Disclosure. We may transfer and disclose information, including your Personal Information, Usage Information and Device Identifier (including IP address), to third parties to comply with a legal obligation; when we believe in good faith that the law requires it; at the request of governmental authorities conducting an investigation; to verify or enforce our applicable policies; to respond to an emergency; or otherwise to protect the rights, property, safety, or security of third parties, visitors to the CAP Site or the public.
• Non-Personal Information. We share non-Personal Information, such as aggregate user statistics, demographic information, and Usage Information with third parties.

5. YOUR PRIVACY RIGHTS, CHOICE AND ACCESS

You have a number of choices about how we handle information we collect or receive about you.

• Use of Your Personal Information. You may direct us not to share your Personal Information with third parties, not to use your Personal Information to provide you with information or offers, or not to send you e-mails, text messages or other communications by: (i) sending us an e-mail at MemberService@CostcoAuto.is; (ii) contacting us by mail at Costco Auto Program, 10251 Vista Sorrento Parkway, Suite 300, San Diego, California 92121, Attn: Privacy Policy; or (iii) following the removal instructions in the communication that you receive.
• EEA and Iceland Rights. If you are in the EEA or Iceland, you have certain rights in relation to your personal information. If you would like further information about these or would like to exercise them, please contact us using the contact details below at any time. You have the right to request that we:
• Provide access to any personal information we hold about you;
• Update any of your personal information which is out of date or incorrect;
• Delete any personal information which we are holding about you;
• Restrict the way that we process your personal information;
• Stop processing your personal information for direct-marketing purposes;
• Provide your personal information to a third party provider of services;
• Provide you with a copy of any personal information which we hold about you; or
• Consider any valid objections which you have to our use of your personal information.

We will consider all such requests and provide our response within a reasonable period (and in any event within any time period required by applicable law). Please note, however, that certain personal information may be exempt from such requests in certain circumstances. If an exception applies, we will tell you this when responding to your request. We may request you provide us with information necessary to confirm your identity before responding to any request you make.

6. DATA RETENTION

We will generally store your information until it is no longer necessary to provide services to you, or until you ask us to delete it, whichever comes first; but there are some exceptions to this general rule. We will retain information to comply with the law, prevent fraud, collect fees, resolve disputes, troubleshoot problems, assist with investigations, enforce our agreements, and take other actions permitted by law. For more information, contact us using the details below.

7. YOUR INFORMATION WILL BE STORED IN THE USA

If you are in a country other than the United States of America, you should be aware that the data that we collect from you will be transferred to and stored in the USA. The laws of the United States may not protect the privacy of your information at the same level as provided by the laws of your country. In an effort to safeguard individual privacy, we will only transfer personal information from Iceland or EEA to the USA if one of the following applies: we have entered into an agreement using standard contract clauses (approved by the European Commission or a data protection authority) with our service provider or affiliate regarding the transfer; the service provider that transfers the data is certified under the EU-US Privacy Shield Framework; or you give your express consent to the transfer.

If you have any questions about our transfer of personal information to the USA, or would like further information, please contact us using the details below.

8. INTEREST-BASED/TARGETED ADVERTISING; HOW TO OPT OUT; DO NOT TRACK

CAP uses third-party network advertisers to serve advertisements and third-party analytics vendors to evaluate and provide us with information about the use of the CAP Site and viewing of our content. We do not share Personal Information with these third parties in connection with serving interest-based or targeted advertisements (unless, of course, you give us permission), but ad network providers, the advertisers, the sponsors, and/or analytics service providers may set and access their own cookies, pixel tags and similar technologies on your Device and they may otherwise collect or have access to information about you, including Usage Information. On occasion, we and our network advertisers target advertisements for products and services in which you might be interested based on your visits to both the CAP Site and other web sites. We use a variety of companies to serve advertisements.

CAP adheres to the Digital Advertising Alliance’s Self-Regulatory Principles for Online Behavioral Advertising. If you do not want to receive the benefits of targeted advertising, you may opt out of some network advertising programs that use your information by visiting: the NAI Opt-Out page and the DAA Opt-Out Page. Please note that even if you choose to remove your information (opt-out), you will still see advertisements while you’re browsing online, including advertisements that are relevant to the content of the webpage or application page on which they are displayed and advertisements that are relevant to your current location. However, the advertisements you see may be less relevant to you and your interests. Additionally, many network advertising programs allow you to view and manage the interest categories they have compiled from your online browsing activities. These interest categories help determine the types of targeted advertisements you may receive. The NAI Opt-Out Page and the DAA Opt-Out Page each provide a tool that identifies its member/participating companies that have cookies on your browser and provides a mechanism to opt out of receiving cookies from those companies. Please note that if you opt-out of targeted advertising, we will still track your visits to the CAP Site for our own analytics, operations and security purposes.

Some web browsers may give you the ability to enable a “do not track” setting. Because these features are not yet uniform, CAP currently does not take action in response to these signals.

9. HOW WE COMMUNICATE WITH YOU

We may communicate with you regarding the Costco Auto Program via mail, via telephone or via electronic communications, including via email to the email address you provide, via text message to the mobile phone you provide, or via the CAP Site.

If you consent to receiving text messages at your mobile phone number and later decide to opt-out, please follow the instructions in the body of the text message. Note that in order for you to receive communications via text message, you must maintain, at your own cost, a mobile device capable of sending and receiving text messages. Message and data rates may apply to each text message sent and received in connection with the Costco Auto Program. Please see your wireless provider to review your wireless plan details.

10. SECURITY OF YOUR INFORMATION

We take information security seriously and use certain reasonable security measures to help protect your Personal Information. However, no electronic data transmission or storage of information can be guaranteed to be 100% secure. Please note that we cannot ensure or warrant the security of any information you transmit to us, and you use the CAP Site and provide us with your information at your own risk.

11. OTHER SITES

The CAP Site may contain links to other websites or online services that are operated and maintained by Costco or third parties, and that are not under the control of or maintained by CAP.

This Privacy Policy does not apply to Costco’s activity or to any Personal Information you may disclose directly to Costco. We encourage you to review Costco’s privacy policy, available here.

12. CHANGES AND POLICY UPDATES

Please note, we may change information on the CAP Site and/or this Privacy Policy at any time without prior notice to you, and any changes will be effective immediately upon the posting of the revised Privacy Policy on the CAP Site. CAP will use your Personal Information in a manner consistent with the Privacy Policy in effect at the time you submitted the information, unless you consent to the new or revised policy. We encourage you to periodically review this page for the latest information on our privacy practices.

13. CONTACT US

If you have any questions or concerns regarding this Privacy Policy, please email us at MemberService@CostcoAuto.is or write to us at: Costco Auto Program, 10251 Vista Sorrento Parkway, Suite 300, San Diego, California 92121, Attn: Privacy Policy.

In addition, if you are in Iceland or EEA and you have any complaints about how we use your Personal Information, you have the right to lodge a complaint with the data protection authority in your country or seek a remedy through local courts if you believe your rights have been breached. A list of data protection authorities is available at http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080.

Again, this CAP privacy policy and practices are separate from Costco’s practices. Please visit Costco’s privacy policy for information about how Costco uses information.