Scope of this Policy

This Privacy Policy applies to personal information we collect, use and disclose when you:

• Visit any DWU website, including drivingwithus.ca and our dealer-facing pages;
• Submit a credit application, lead form, trade-in appraisal, or contact form;
• Communicate with us or with an AI assistant operating on behalf of a partner dealership by SMS, voice call, email, or messaging app;
• Are contacted by a dealership that uses our DWU AI Assistant SaaS platform to manage its lead follow-up.

Where DWU acts as a service provider (processor) to a third-party dealership, that dealership is the controller of your personal information. Please review that dealership's privacy notice for information about its own practices; this Policy explains what DWU does with the data on the dealership's behalf.

Personal Information We Collect

Depending on how you interact with us, we may collect:

• Identity & contact data: name, mobile phone number, email address, mailing address.
• Vehicle-interest data: desired make, model, trim, budget, trade-in details, financing preferences, credit-situation notes you choose to share.
• Communication content: inbound and outbound SMS messages, transcripts and audio recordings of phone calls placed or received through our AI voice service, email threads, and any other messages you send to us or to an AI assistant operating on behalf of a partner dealership.
• Application data: if you submit a credit / pre-approval application, the information in that application.
• Lead-source attribution: UTM parameters, referring page, the Facebook or Instagram Lead Form you submitted (if applicable), and the dealership for which the lead was generated.
• Technical data: IP address, device type, browser, operating system, language, time-zone, pages visited, and timestamps; collected via cookies and similar technologies as described in our Cookies Policy.

How We Use Personal Information

We use personal information for the following purposes only:

• To respond to your inquiry, process your credit application or trade-in appraisal, and provide the services you request;
• To send follow-up SMS, email or voice-call communications about a vehicle you've inquired about — these may be generated and delivered by our AI assistant on behalf of the dealership;
• To maintain a record of conversations so the dealership can pick up the conversation manually;
• To detect and block abuse, fraud, and security incidents;
• To improve the Service's safety, reliability and performance — using only aggregated and de-identified usage data, not the content of your personal messages;
• To comply with applicable law, lawful requests from regulators, and to enforce our terms.

We do not sell your personal information. We do not use the content of your SMS or voice communications to train any third-party AI model on your behalf or on behalf of other users.

The DWU AI Assistant (SMS, Voice, Email)

Some of the messages and phone calls you receive from us — or from a dealership using our platform — are generated by an artificial-intelligence assistant powered by a large language model (currently OpenAI's GPT family). When you send a reply, the content of your message is transmitted to OpenAI's API solely for the purpose of generating a reply on the dealership's behalf. Per OpenAI's API policy, content sent via the API is not used by OpenAI to train its models.

SMS: SMS messages are delivered and received through Twilio. The content of an SMS message is visible to Twilio and to the wireless carriers in the message path; this is inherent to how the SMS protocol works. You can opt out of SMS at any time by replying STOP to any message — your number will be added to our opt-out list and you will not receive further commercial SMS from the same dealership.

Voice calls: if you receive a call from our AI voice service (a current or future Enterprise-tier feature), the call may be recorded for quality, training and compliance purposes. You will hear a brief disclosure at the start of every recorded call. If you do not consent to recording, you can hang up at that point.

Email: transactional and follow-up emails are delivered through SendGrid (Twilio).

Facebook & Instagram Lead Forms

If you submit a Lead Form on a partner dealership's Facebook or Instagram ad, Meta transmits the form fields (typically your name, phone, email, and the vehicle you asked about) to that dealership through our platform. We use that data only to enable the dealership to follow up with you about the vehicle you inquired about. The information is governed by this Policy and by the Dealer's own privacy practices.

Service Providers (Sub-Processors)

We rely on the following service providers to operate the Service. Each is contractually required to protect your personal information consistent with this Policy and to use it only for the purposes we authorize.

Cross-Border Transfers

Because the service providers above operate primarily in the United States, your personal information will be processed and stored outside of Canada. While we contractually require all service providers to protect your data to a standard comparable to PIPEDA, personal information processed in a foreign jurisdiction is subject to that jurisdiction's laws, including the possibility of lawful access by foreign government authorities. By using the Service or submitting a credit application or contact form, you consent to this cross-border processing.

Data Retention

We retain personal information only as long as needed for the purposes described in this Policy or as required by law:

• Active leads / customers: for as long as the dealership maintains a relationship with you, plus a wind-down period of up to 90 days after termination of that relationship or of the dealership's account with DWU.
• SMS, email and voice transcripts / recordings: up to 24 months from creation, unless a longer retention is required by law or you've opted out (in which case opt-out records are kept indefinitely so we don't re-contact you).
• Credit application content: as required by lending and tax record-keeping laws, typically 7 years.
• Encrypted backups: overwritten in the ordinary backup-rotation cycle, typically within 35 days of data being deleted from the live system.
• Aggregated, de-identified analytics: may be retained indefinitely.

Your Privacy Rights (PIPEDA / PIPA)

Subject to limited exceptions, you have the right to:

• Access the personal information we hold about you;
• Correct personal information that is inaccurate, incomplete or out of date;
• Withdraw consent to the collection, use or disclosure of your personal information (subject to legal or contractual restrictions);
• Request deletion of your personal information when the legal basis to retain it no longer applies;
• Lodge a complaint with us at the address below, or directly with the Office of the Privacy Commissioner of Canada or your provincial commissioner.

To exercise any of these rights, contact our Privacy Officer at support@drivingwithus.ca. We will respond within 30 days. For verification we may ask you to confirm details we already hold about you (such as your phone number or the dealership you contacted).

SMS / CASL Opt-Out

You can opt out of commercial SMS from us or any dealership using our platform at any time by replying STOP to any text message. The opt-out is processed within seconds and applies to all future commercial SMS from the same sender (dealership). To unsubscribe from email, use the unsubscribe link at the bottom of any commercial email, or email support@drivingwithus.ca.

Security Safeguards

We protect personal information with reasonable physical, organizational and technical safeguards, including: TLS encryption in transit, encryption at rest for the production database and object storage, bcrypt-hashed passwords, mandatory two-factor authentication for dealer-portal accounts, strict tenant isolation between dealerships, HMAC-SHA256 verification of inbound webhook signatures, principle-of-least-privilege production access, and regular dependency-vulnerability scanning. No system can be guaranteed 100% secure, however, and we cannot warrant that personal information will not be used or disclosed in ways not described in this Policy.

Breach Notification

If a breach of our security safeguards creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as soon as feasible, as required by PIPEDA. Where we act as service provider to a partner dealership, we will notify that dealership of any breach affecting its End-Users without undue delay and in any event within 72 hours of confirmation, so that the dealership can meet its own notification obligations.

Cookies & Online Tracking

We use cookies, pixels and similar technologies to operate the website, remember your preferences, measure traffic (via Google Analytics) and serve interest-based advertising (via Google Ads and Meta). For details and opt-out instructions, please see our Cookies Policy.

Children

The Service is not directed at children under the age of majority in their province of residence, and we do not knowingly collect personal information from minors. If you believe a minor has provided us personal information, contact support@drivingwithus.ca and we will delete it.

Changes to this Policy

We may update this Policy from time to time. Material changes will be announced on the website at least 30 days before they take effect. The "Last updated" date below tells you when the current version was published.

Contact — Privacy Officer

Privacy Officer
Driving With Us Auto Market Ltd.
Email: support@drivingwithus.ca
General support: support@drivingwithus.ca