I. INTRODUCTION

This page describes how Carvana Operations HC LLC (“Carvana”), together with its parents, subsidiaries, and affiliates, including ADESA US AUCTION, LLC (“ADESA”) handles certain types of your personal data. This includes how we handle certain personal data that is subject to certain laws, such as data subject to the Fair Credit Reporting Act (“FCRA”).

• For California and Oregon Individual Consumers and Website Visitors, such as an individual who interacts with us through our websites, social media accounts, online advertisements, email, and mobile applications (collectively, our “Platforms”), through communications (such as mail and phone), at in-person events, and through other online and offline methods – click HERE to view our Consumer Privacy Notice
• For Consumers from whom we collect information that is subject to the federal Gramm-Leach-Bliley Act (“GLBA”), Fair Credit Reporting Act (“FCRA”), or the California Financial Information Privacy Act (collectively, “Financial Information”), click HERE to view our Financial Privacy Notice
• For California Candidates, such as applicants – click HERE to view our California Job Applicant Privacy Notice
• For California Business Contacts, such as our vendors, service providers, and business partners – click HERE to view our California Business (“B2B”) Privacy Notice
• If you are an Android app user, please click here to submit a request to delete your account.

These privacy disclosures also do not apply to other, non-financial personal data, such as data subject to the Health Insurance Portability and Accountability Act (HIPAA), the California Confidentiality of Medical Information Act, or the Driver’s Privacy Protection Act of 1994.

For more information regarding Carvana's terms of use, please review our User Agreement, the terms of which are incorporated herein.

II. FINANCIAL PRIVACY NOTICE

Click HERE to Print

Changes: We may update this Financial Privacy Notice from time to time. The current Financial Privacy Notice will be effective when published on the date indicated above. When required by applicable law, we will notify you of any changes by posting an updated Financial Privacy Notice on this website or as otherwise required by applicable law.

III. CALIFORNIA JOB APPLICANT PRIVACY NOTICE

PRIVACY NOTICE /YOUR PRIVACY RIGHTS

A. Introduction

Carvana Operations HC LLC (“Carvana”), together with its parents, subsidiaries, and affiliates, including ADESA US Auction, LLC (“ADESA,”) together and collectively with Carvana, referred to throughout this Applicant Privacy Notice as "Company," "us," "we," or "our," is committed to protecting the privacy of Personal Information (defined below). This Applicant Privacy Notice contains details about how we collect, use, share, and retain (collectively “process”) the Personal Information of California residents’ (“you” or “your”) when you interact with us via our website(s), email, mobile application(s), social media accounts, online advertisements, and other digital platforms (collectively, “Digital Properties”), and through other online and offline interactions when you apply for a job with us. Unless otherwise noted, the information below describes how and why we collected, used, and disclosed your information within the past 12 months and describes how and why we will use new information collected from you. It also explains your rights relating to Personal Information under the California Consumer Privacy Act (the “CCPA”).

Applicability: This Applicant Privacy Notice DOES NOT APPLY to Personal Information we may collect about you in other contexts outside of your role as an applicant, such as information we collect about you if you do business with us: (i) as a consumer in connection with financial products or services primarily for personal, family, or household purposes; (ii) in a business-to-business context, as a vendor, service provider, or business partner; or (iii) once you have become an employee. If you interact with our website, purchase our products or services, or otherwise engage with us outside of your applicant relationship, Carvana’s User Agreement, Consumer Privacy Notice and Financial and Other Privacy Notices apply to any Personal Information we process through those interactions.

We are required by California’s privacy laws and regulations to give you the information in this Applicant Privacy Notice. It is important that you read this Applicant Privacy Notice carefully, together with any other information that we might give you from time to time about how we collect and use your Personal Information.

Whenever you interact with us on behalf of another individual or entity, such as if you provide us with names of other individuals as references in your job application, you must obtain their consent (or have the legal authority without consent) to share their Personal Information with us.

Changes: We may update this Applicant Privacy Notice from time to time. Any updated Applicant Privacy Notice will be effective when posted. Please check this Applicant Privacy Notice periodically for updates. If required by law, we will contact you directly to provide you with an updated Applicant Privacy Notice.

This Applicant Privacy Notice does not form part of any contract of employment or other contract to provide services and does not give you any contractual rights.

As used in this Notice, the term "Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an individual or household. Personal Information does not include information that is publicly available, de-identified, or aggregated.

B. Sources of Personal Information

We collect Personal Information about you from the following sources:

1. Directly from you. We may collect Personal Information you provide to us directly, such as when you use Our website, mobile site, application, and/or other service, regardless of how distributed, transmitted, published, or broadcast (each, a "Service), or when you complete a paper or online application (including on a dedicated online talent management platform), communicate with us in connection with your application, provide references, or participate in an interview or any aptitude test or assessment (including online). We may also collect your Personal Information when you decide to complete questionnaires, such as a satisfaction survey or a diversity and inclusion questionnaire.
2. Information automatically collected or inferred from your online interaction with us and through tracking technologies. We automatically collect technical information about your online interactions with us (such as IP address or other unique identifier related to you or your laptop, personal computer, browser, mobile device, tablet, or other device (a "Device" or "Devices"), Device location, characteristics, and capabilities, prior and current web activity, your Carvana and ADESA website activities and related click data, and browsing preferences when you visit or interact with our Service or Digital Properties (“Usage Information”).
3. Information from public sources, including government entities from which public records are obtained and information you submit in public forums.
4. From third parties. We may collect Personal Information from third parties, such as companies or individuals who direct or refer you to us (including third-party staffing or recruiting firms or individuals who suggest or identify you, as well as from publicly available sources and third-party professional social networking websites). Where permitted or otherwise authorized by law, we may also collect information received from third parties in connection with references or background checks.

We may combine and use information and make inferences from information that we receive from the various sources described in this Applicant Privacy Notice, including third party sources. We may also use or disclose the combined information and inferences for the purposes identified below.

C. Types of Personal Information We Collect

We may collect the following types of Personal Information about you such as:

1. Identifiers. Such as real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.
2. Records About You, such as signatures or electronic signatures.
3. Characteristics of protected classifications under California or federal law, such as your age (including birthdates), racial or ethnic origin, military or veteran status, disability status, marital status, sex, and your sexual orientation or gender identity.
4. Commercial information, such as salary and wage information and history, credit check history, household income data, and loan information.
5. Internet or other electronic network activity information,such as your browsing history, search history, and information regarding your interactions with and use of our Digital Properties, including via cookies and other tracking technologies. Please see Section F for further information.
6. Geolocation data, such as your location, derived from your IP address.
7. Audio, electronic, visual, or other sensory information,such as photographs or security camera footage in public areas of our facilities (including reception, the work floor, conference rooms, parking, and other general areas) if you participate in on-site activities, such as a job fair, job interview or aptitude test, as well as photographs, audio, or footage collected in the course of video interviews or through an online applicant platform, or other recordings.
8. Professional or employment-related information, such as certifications, qualifications, membership in professional bodies, employment history, job preferences (including your willingness to relocate or travel), documentation required under immigration and employment laws (such as citizenship, visa data, details of residency, and work permit information). We may also collect and process information about you generated during or after interviews and related activities, such as tests or satisfaction surveys. This information may come directly from you or from our employees or contractors. In addition, we may collect information about criminal convictions and offenses, such as information from legal proceedings, disciplinary information or sanctions from previous jobs, and information from background checks, alcohol or drug testing information (if permissible under law), employment eligibility checks, and other details you choose to disclose in your application materials, resume, or curriculum vitae (CV).
9. Education Information, such as education history, professional qualifications, academic certificates and licenses, languages spoken, and other relevant skills.
10. Inferences, including those drawn from the applicant information you submit. Such inferences include the likelihood of your profile being a good fit with our internal team and long-term prospects with us, or inferences relating to the detection and prevention of potential fraud. Inferences may also be drawn from the information collected via the tracking and cookies technologies identified in Section F below.
11. Sensitive Personal Information, including the following, where permissible or required under applicable laws and regulations:
    • Social Security number, driver’s license, state identification card, or passport number.
    • Account log-in information.
    • Racial or ethnic origin, religious or philosophical beliefs, or union membership.
    • Information about your health, such as disability status and information about such disability, drug-test results, vaccination status, and food intolerances (if, for instance, we invite you for a meal or we book a flight for your job interview).
    • Information about your sexual orientation, should you choose to provide it.

D. How We Use Personal Information

We may use each category of your Personal Information described above for the following purposes:

1. In connection with your application, such as assessing your application, interview, and test results for suitability for the position for which you have applied or other open positions; communicating with you concerning job openings or your application; conducting pre-employment verification and screening; offering you the job position, in our discretion; notifying you of job opportunities (including from affiliates in our group, where we have shared your job application with them); and dealing with any inquiry, challenge, or request for feedback received in relation to our recruitment and hiring decisions.
2. For our internal business purposes, such as managing and improving our recruitment process (for example, enhancing our scouting and talent identification processes); enforcing our policies and rules; and operating our diversity and inclusion initiatives.
3. For legal, safety or security reasons, such as complying with legal requirements, processes, or orders; complying with reporting and similar requirements; complying with government inspections and other requests from government or other public authorities; pursuing legal rights and remedies; investigating and responding to claims against Carvana or ADESA and its customers and employees; monitoring and managing equal opportunity programs; screening and conducting background checks (as required or permitted by law); protecting our, your, our customers’, and other individuals’ safety, property or rights; addressing security and health and safety issues (including managing spread of communicable diseases) and malicious, deceptive, fraudulent, or illegal activity; ascertaining your eligibility for work; and receiving legal advice or approval.
4. For marketing. We may use your Personal Information to market our products or services or those of third parties, such as our business partners or other users of our Service. We may use your Personal Information to invite you to participate in marketing surveys, questionnaires, promotions, events, or contests. We may audit aspects of our ad impressions and verify positioning and quality of ad impressions. We may use your Personal Information for short-term transient use, including for contextual ad customization. We may use your Personal Information to enhance our content and to deliver advertisements to you, including commercial emails. For more information about online marketing activity, see Section F below.
5. In connection with a corporate transaction, such as if we acquire, or some or all of our assets are acquired by, another entity, including through a sale in connection with bankruptcy and other forms of corporate change.
6. For recruiting purposes, such as to notify you about employment opportunities.

Additionally, we may use anonymized, de-identified, or aggregated information for any purpose permitted by law.

E. With Whom We Disclose or Share Personal Information

We may disclose or share your Personal Information with the categories of recipients described below:

1. Affiliates and subsidiaries, including parent entities, corporate affiliates, subsidiaries, business units, and other companies that share common ownership with us.
2. Service providers that work on our behalf to provide products and services, such as IT support providers, software service providers, background check vendors, and drug-screening providers.
3. Professional consultants, such as recruiters, accountants, lawyers, financial advisors, and audit firms.
4. Service Providers necessary to complete transactions you request,such as shipping companies; background check vendors; drug screening providers; and logistics providers.
5. Law enforcement, government agencies, and other recipients for legal, security, or safety purposes, such as when we share information to comply with law or legal requirements, to enforce or apply our policies, and to protect ours, our customers’, or third parties’ safety, property or rights.
6. To other entities in connection with a corporate transaction, such as if we, or some or all of our assets, are acquired by another entity, including through a sale in connection with bankruptcy or other forms of corporate change.
7. Third parties, such as certain travel services, companies that operate cookies and other tracking technologies, social media companies, certification providers, and other third parties who may use this information to market to you directly.
8. Entities to which you have consented to the disclosure, where consent is required by law.

We do not collect Sensitive Personal Information for the purpose of inferring characteristics about you.

We do not use or disclose Sensitive Personal Information for purposes to which the right to limit use and disclosure applies under the CCPA.

F. How We Use Cookies and Tracking Technologies

We and authorized third parties, through our Digital Properties, may also collect information, which may include Personal Information, via cookies, web beacons, tracking pixels, embedded scripts, location-identifying technologies, Device recognition technologies, in-app tracking methods, Device and activity monitoring, session replay technologies, or other manual, passive, or automatic tracking technologies, programs, or platforms (“Tracking Technologies”).

Please note: The use of cookies/tracking technologies and the data sharing related to such technologies identified in this Section F may constitute a sale or sharing of Personal Information under California law. If you would like to opt out of the sale and sharing of your Personal Information, please follow the steps to opt out provided in Section H, below.

We do not "sell" or "share" (as those terms are defined by the CCPA) the Personal Information you submit to us in relation to a job application or prospective job application.

Types of information collected. We and authorized third parties collect data about you and your Devices, including but not limited to Usage Information; your Internet Service Provider; IP address/Internet address from which you accessed our website(s) and/or other unique identifier(s) related to you or your Device(s); cookie ID; Ad ID; Device location (both approximate and precise); Device characteristics (including make, model, operating system/settings, and other specifications); browser type used; the date and time you access our website(s) and/or take certain actions on our website(s); recordings of your interactions with our websites and other Digital Properties; the pages you accessed while visiting our website(s) and related click behavior (such as products or offerings viewed and/or purchased); advertisements viewed; previously visited websites, applications, and services; search history; and preferences.

Types of Tracking Technologies used. We and third parties that we authorize may use the following Tracking Technologies on the Service and Digital Properties:

• Cookies

  A cookie is a small text file that is stored on a user’s Device. We may place cookies on your Device(s), which may last only during a single session or may be persistent over multiple sessions over time. Session cookies make it easier for you to navigate the Service and Digital Properties and expire when you close your browser. Other cookies remain longer and help in understanding how you use the Service and Digital Properties, for marketing, to personalize and enhance your user experience, and other purposes described below.

• Web Beacons (“Tracking Pixels”)

  Web beacons are small graphic images, also known as “tracking pixels,” “Internet tags,” or “clear gifs,” embedded in web pages and e-mail messages. Web beacons may be used to count the number of visitors to the Service and Digital Properties, facilitate marketing, monitor how users navigate the Service and Digital Properties, and to count content views.

• Embedded Scripts

  An embedded script is programming code designed to collect information about your interactions with the Service and Digital Properties. It is temporarily downloaded onto your computer from our web server, or from a third party with which we work, and is active only while you are connected to the Service or Digital Properties and deleted or deactivated thereafter.

• Location-Identifying Technologies

  GPS (global positioning systems) software, geo-filtering, and other location-aware technologies locate you (sometimes precisely), or make assumptions about your location, for purposes such as verifying your location and delivering or restricting content based on your location. If you have enabled GPS or use other location-based features on the Service or Digital Properties, your Device location may be tracked by us and third parties. Certain Service or Digital Properties features may access and use information about your Device location (such as based on IP address or GPS, as applicable), or your account information, to suggest certain content, products, or services that may be available to you. Our Service and Digital Property content may be personalized based on various information we may have about you to try to provide you with more location-relevant content.

• Device Recognition Technologies

  We may use device recognition technologies, including application of statistical probability to data sets, as well as linking a common unique identifier to different device use (e.g., Facebook ID), which attempt to recognize or make assumptions about users and devices (e.g., that a user of multiple devices is the same user or household) (“Cross-device Data”).

• In-App Tracking Methods

  There are a variety of Tracking Technologies that may be included in mobile applications, and these are not browser-based like cookies and cannot be controlled by browser settings. Some use device identifiers or other identifiers such as “Ad IDs,” or may use “SDKs,” to associate app user activity to a particular app and to track user activity across apps and/or devices. SDKs are blocks of code that may be installed in our mobile application by third party companies with which we work. SDKs help us understand how you interact with our mobile application, to improve marketing, and collect certain information about the Device and network you use to access our application, such as the advertising identifier associated with your Device and information about how you interact with our application.

• Device and Activity Monitoring Technologies

  We use technologies such as session replay tools that monitor, and may record, your interactions with the Service and Digital Properties, including without limitation, keystrokes and how you move through and engage with the Service and Digital Properties. These technologies may also collect and analyze information from your Device, such as, without limitation, your operating system, plug-ins, system fonts, and other data.

Purposes for using these technologies. We and authorized third parties use these Tracking Technologies for purposes including:

• Personalization, such as remembering user preferences, login details and browsing behavior; tracking your activity across online properties and platforms over time to better understand your preferences and interests; and personalizing online content;
• Improving performance, such as maintaining and improving the performance of the Service and Digital Properties;
• Analytics, such as analyzing how the Service and Digital Properties are used to help us improve the Service’s and Digital Properties’ performance and user experience;
• Advertising, such as providing you with offers that may be of interest to you; conducting targeted advertising to you on the Service and Digital Properties, as well as digital properties of third parties; and measuring the effectiveness of our communications with you and advertising campaigns, including identifying how and when you engage with our communications; and
• Security, such as user or Device identification and prevention of fraud and malicious behavior.

These Tracking Technologies may be used to track you across Devices and websites over time for purposes above.

Disclosure of your information. We may disclose Personal Information to third parties or permit third parties to place Tracking Technologies on our website(s) to allow these third parties to directly collect Personal Information from you, such as social media companies, advertising networks, companies that provide analytics including ad tracking and reporting, security providers, and others that help us operate our business, including the Service and Digital Properties. These companies use this information to provide you with more relevant advertising tailored to your interest based on your browsing of the Service and Digital Properties and elsewhere on the Internet, sometimes known as “interest-based advertising” and “online behavioral advertising (“Interest-based Advertising”) which may include sending you an ad on another online service after you have left the Service or Digital Properties (i.e., “retargeting”).

Our disclosures of information to third parties may include the following:

• Google Analytics.
We use Google Analytics to analyze traffic to our website(s) in order to help us understand our customers' and visitors' needs and to continually improve our site(s) for them. The data they collect on our behalf may include, but is not limited to, search engine referrals, affiliate referrals, traffic driven by banner ads or other online promotions, how visitors navigate around the site, and the most popular pages. We also collect certain technical information, such as the browser version and operating system. We reserve the right to use, transfer, sell, and share data about our users for any lawful business purpose, such as analyzing usage trends and seeking compatible advertisers, sponsors, clients, and customers. For more information on how Google Analytics collects and processes data, please visit www.google.com/policies/privacy/partners/.
• Social media companies.We use social media Tracking Technologies (such as the Meta Pixel and/or related Meta business tools) that may allow third parties, including Meta, to collect or receive information from our Service, Digital Properties, and/or elsewhere on the Internet and use that information to provide measurement services and target ads. In addition, we may serve ads on other online services that are targeted to reach people on those services that are also identified in one or more of our databases (“Matched List Ads”). This is done by using Tracking Technologies or by matching common factors between our databases and the databases of the other online services. For instance, we may use such ad services offered by Meta or X and other third-party services. We are not responsible for these third-party services, including without limitation their security of the data. Most third-party social media companies (such as Meta and X) will generally enable you to hover over the box in the right corner of such a Meta ad, or go to your social media account settings, and find out what options you have to control such ads. We are not responsible for such third parties’ failure to comply with your or our opt-out instructions, they may not give us notice of opt-outs to our ads that you give to them, and they may change their options without notice to us or you.

Your choices regarding Tracking Technologies. Some of the companies that perform advertising-related services may participate in the Digital Advertising Alliance’s (“DAA”) Self-Regulatory Program for Online Behavioral Advertising. To learn more about how you can exercise certain choices regarding Interest-based Advertising, visit http://www.aboutads.info/choices/ and http://www.aboutads.info/appchoices for information on the DAA’s opt-out programs. Some of these companies may also be members of the Network Advertising Initiative (“NAI”). For more information about the NAI including how consumers can opt-out from receiving interest-based advertising from some or all of NAI's members, please visit http://www.networkadvertising.org/choices. Opting out of Interest-based Advertising will not opt you out of all advertising, but rather only Interest-based Advertising from us or our agents or representatives. Also, if your browsers are configured to reject cookies when you visit these opt-out webpages, or you subsequently erase your cookies, use a different Device or web browser, or use a non-browser-based method of access (e.g., mobile app), your NAI / DAA browser-based opt-out may not, or may no longer, be effective.

Some browsers have incorporated Do Not Track (“DNT”) preferences. Most of these features, when turned on, send signals to the website you are visiting that you do not wish to have information about your online searching and browsing activities collected and used. As there is not yet a common agreement about how to interpret DNT signals, we do not honor DNT signals from website browsers at this time. However, you may be able to refuse or delete cookies. If you refuse or delete cookies, some of our website(s) functionality may be impaired. If you change Devices or browsers, or use multiple Devices or browsers, and delete your cookies, you may need to repeat this process for each Device or browser. Please refer to your browser’s Help instructions to learn more about how to manage cookies and the use of other tracking technologies.

G. Additional Disclosures

Personal Information

We do not knowingly collect, sell, or share Personal Information of minors under the age of 16.

Below please find a chart detailing the categories of Personal Information we collect and with whom we disclose it and for what Business Purpose we do so, as well as the parties to whom we may have sold or shared the Personal Information. We do not “sell” or “share” (as those terms are defined under the CCPA) the Personal Information you submit to us in relation to a job application or prospective job application.

H. California Rights Concerning Personal Information

California residents may exercise the following rights, subject to legal limitations and applicable exceptions.

• Right to Know. You have the right to request information about the categories of Personal Information we have collected about you, the categories of sources from which we collected the Personal Information, the purposes for collecting, selling, or sharing the Personal Information, and the categories of third parties with whom we have shared or sold your Personal Information (“Categories Report”). You may also request information about the specific pieces of Personal Information we have collected about you (“Specific Pieces Report”).
• Right to Delete. You have the right to request that we delete Personal Information that we have collected from you.
• Right to Correct. You have the right to request that we correct inaccurate Personal Information that we maintain about you.
• Right to Opt Out. You have the right to opt out of the sale and sharing of your Personal Information.
• Additional California Rights. You have the right to limit the use of your sensitive personal information (information like your SSN, driver’s license number, etc.). However, this right is not applicable to your interactions with Carvana because we do not process sensitive personal information subject to this limitation. We only use your sensitive personal information for job applicant purposes (as described above); we do not use your sensitive personal information for other purposes (such as marketing).

You may exercise your Right to Know, your Right to Delete, and your Right to Correct via our Employment Privacy Portal at https://privacy.carvana.com/privacy or by calling 800-333-4554.

You may exercise your Right to Opt Out by selecting the “Opt Out” button via Your Privacy Choices.

In accordance with applicable law, we will not discriminate against you for exercising these rights.

Verification: In order to exercise your rights, we may need to obtain information to locate you in our records, verify that you are a California resident, and/or verify your identity depending on the nature of the request. In most cases, we will collect some or all of the following data elements: first and last name, email address, and telephone number. In some cases, we may request different or additional information, and will inform you if we need such information. Once you submit a request, we will send a verification email that you must respond to in order for us to proceed with your request as part of the verification process.

Authorized Agents: Authorized agents may exercise rights on behalf of California residents by submitting a request via our webform and indicating that they are submitting the request as an agent. We will require the agent to demonstrate authority to act on behalf of the resident by providing signed permission from the resident. We may also require the resident to verify their own identity directly with us or to directly confirm with us that they provided the authorized agent with permission to submit the request.

Timing: We will process the Right to Opt Out of Sale or Sharing requests within 15 business days. We will respond to Right to Delete, Right to Correct, and Right to Know requests within 45 calendar days, unless we need more time, in which case we will notify you and may take up to 90 calendar days in total to respond to your request.

I. Data Security and Data Retention

1. Security. We maintain reasonable security procedures and technical and organizational measures to protect your Personal Information against accidental or unlawful destruction, loss, disclosure, alteration, or use. However, because no data transmission is completely secure, and no system of physical or electronic security is impenetrable, we cannot guarantee the security of the information you send to us or the security of our servers, networks, or databases, and by using our Service or Digital Properties you agree to assume all risk in connection with the information sent to us or collected by us when you access, visit, and/or use our Service or Digital Properties, including without limitation your personally identifiable information, Personal Information, or other registration information, and we are not responsible for any loss of such information, or the consequences thereof.

2. Retention. We retain your Personal Information as long as necessary to fulfill the purposes outlined in this Applicant Privacy Notice unless we are required to do otherwise by applicable law. This includes retaining your Personal Information to provide you with the products or services you have requested and interact with you; maintain our business relationship with you; improve our business over time; ensure the ongoing legality, safety and security of our services and relationships; or otherwise in accordance with our internal retention procedures. Once you have terminated your relationship with us, we may retain your Personal Information in our systems and records in order to ensure adequate fulfillment of surviving provisions in terminated contracts or for other legitimate business purposes, such as to enable easier future user onboarding, demonstrate our business practices and contractual obligations, or provide you with information about our products and services in case of interest.

J. Contact Information

If you have questions regarding this Applicant Privacy Notice or how we use your Personal Information, please contact us at:

IV. CALIFORNIA BUSINESS ("B2B") PRIVACY NOTICE

PRIVACY NOTICE /YOUR PRIVACY RIGHTS

Carvana Operations HC LLC (“Carvana”), together with its parents, subsidiaries, and affiliates, including ADESA US Auction, LLC (“ADESA,”) together and collectively with Carvana, referred to throughout this Notice as "Company," "us," "we," or "our," is committed to protecting the privacy of Personal Information (defined below). This Business Privacy Notice contains details about how we collect, use, share, and retain (collectively “process”) the Personal Information of California residents (“you” or “your”) collected about individuals with whom we engage in solely business-to-business communications and transactions, such as our vendors, service providers, and business partners when you interaction with us via our website(s), email, mobile application(s), social media accounts, online advertisements, and other digital platforms (collectively, “Digital Properties”) and through other online and offline interactions. Unless otherwise noted, the information below describes how and why we collected, used, and disclosed your information within the past 12 months and describes how and why we will use new information collected from you. It also explains your rights relating to Personal Information under the California Consumer Privacy Act (the “CCPA”).

Applicability: This Business Privacy Notice DOES NOT APPLY to Personal Information we may collect about you in other contexts, such as information we collect about you if you do other business with us as: (i) a consumer in connection with financial products or services primarily for personal, family, or household purposes; (ii) as an applicant for employment; or (iii) once you have become an employee. If you interact with our website, purchase our products or services, or otherwise engage with us outside of your applicant relationship with us, Carvana’s User Agreement, Consumer Privacy Notice and Financial and Other Privacy Notices apply to any Personal Information we process through those interactions.

We are required by California’s privacy laws and regulations to give you the information in this Business Privacy Notice. It is important that you read this Business Privacy Notice carefully, together with any other information that we might give you from time to time about how we collect and use your Personal Information.

Whenever you interact with us on behalf of another individual or entity, such as by providing or accessing Personal Information about another individual, you represent that your interactions and exchanges comply with applicable data privacy laws. You shall have sole responsibility for any violation of applicable laws as a result of a failure to obtain any necessary consent from such individuals.

Changes: We may update this Business Privacy Notice from time to time. Any updated Business Privacy Notice will be effective when posted. Please check this Business Privacy Notice periodically for updates. If required by law, we will contact you directly to provide you with an updated Business Privacy Notice.

This Business Privacy Notice does not form part of any contract of employment or other contract to provide services and does not give you any contractual rights.

As used in this Business Privacy Notice, the term “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an individual or household. Personal Information does not include information that is publicly available, de-identified, or aggregated.

B. Sources of Personal Information

We collect Personal Information about you from the following sources:

1. Directly from you. When you use our website, mobile site, application, and/or other service, regardless of how distributed, transmitted, published, or broadcast (each, a "Service") we may collect Personal Information you provide to us directly, such as when you contact us through our website(s), email, mobile application(s), social media accounts, online advertisements, and other digital platforms (collectively, “Digital Properties”); interact with us in person at our physical properties; sign up for offers or communications from us; communicate with us; place or customize orders; complete a survey; or sign up for an account or other services.
2. Information automatically collected or inferred from your online interaction with us and through tracking technologies. We automatically collect technical information about your online interactions with us (such as IP address or other unique identifier related to you or your laptop, personal computer, browser, mobile device, tablet, or other device (a "Device" or "Devices"), Device location, characteristics, and capabilities, prior and current web activity, your Carvana and ADESA website activities and related click data, and browsing preferences when you visit or interact with our Service or Digital Properties (“Usage Information”).
3. Information from public sources, including government entities from which public records are obtained and information you submit in public forums.
4. From third parties. We may collect Personal Information from third parties, such as manufacturing companies, industry partners, dealerships, financial institutions, publicly available sources including public profiles and websites, data brokers, or others interacting with us.

We may combine information that we receive from the various sources described in this Business Privacy Notice, including third party sources. We may also use or disclose the combined information and inferences for the purposes identified below.

C. Types of Personal Information We Collect

We may collect the following types of Personal Information about you such as:

1. Identifiers, such as your name, email address, physical address, telephone number, business contact information, account name or number, and Device identifiers (e.g., cookie IDs and IP address).
2. Records about you, such as signatures and dealer registration number.
3. Commercial information, such as information about vehicle purchases and sales (including type of vehicle, quantity, price, vehicle identification number, odometer reading, year, make, model, and date of purchase and/or sale); information about products or vehicles you or our business contacts are interested in; banking information or other payment details to take payment, fulfill contractual obligations, or for related purposes; delivery details; personal opinions or insights included in any feedback relating to your interactions with us; other commercial or financial information; and legal information relating to your commercial interactions with us, such as fraud checks or flags raised about your transactions, or complaints and information related to their resolution.
4. Internet or other electronic network activity information,such as your browsing history, search history, and information regarding your interactions with and use of our Digital Properties, including via cookies and other tracking technologies. Please see Section F for further information.
5. Geolocation data, such as your location, derived from your IP address.
6. Audio, visual, or other sensory information, such as recordings of your conversations with Carvana or ADESA representatives or video recordings of our premises.
7. Professional or employment-related information, such as job title, organization, professional licenses, credentials, specialty, professional affiliations, or other professional information.
8. Inferences drawn from any of the information we collect to assess purchase and/or sale patterns and the level of interest in our products and services based on frequency of visits and contact; evaluate the industries showing interest in our products and services based on IP address (where we can infer your approximate location to improve our communications to you); and determine your preferred frequency for receiving offers.
9. Sensitive Personal Information, including the following, where permissible or required under applicable laws and regulations:
       a. Social Security number, driver’s license, state identification card, or passport number.
       b. Account log-in information.

D. How We Use Personal Information

We may use each category of your Personal Information described above for the following purposes:

1. To provide you or your company with products and services,such as providing you the goods and services you or your company requests, processing your application to become a registered Company dealer; making a decision to accept or reject your application to become a Company dealer; facilitating auctions in which you or your company participates; providing customer service; processing or fulfilling orders and transactions, verifying customer information; processing payments; maintaining internal business records; communicating with you about your purchases or sales; hosting informational webinars; verifying creditworthiness; confirming eligibility for use of Company auction facilities and other programs or benefits; responding to requests, complaints, and inquiries; and providing similar services or otherwise facilitating your relationship with us.
2. For our internal business purposes, such as maintaining or servicing accounts; operating our Digital Properties and customizing the content; maintaining internal business records; enforcing our policies and rules; maintaining and updating the Company’s banned dealer list; organizational analysis; management reporting; managing Company assets and global workforce; work planning, both administratively and organizationally (including work schedules and billing of clients); project management; auditing; maintaining records on business activities, such as accounting, commercial, procurement, document management and other similar activities; budgeting; real estate management; IT administration of our technologies, network, and intranet; and IT security management and tasks.
3. For our internal research and product improvement purposes,such as verifying or maintaining the quality or safety of our products or services; evaluating the vehicle remarketing industry and conducting other market research; improving our products and services; designing new products and services; customizing advertisements to you; evaluating the effectiveness of our advertising or marketing efforts; and debugging and repairing errors with our systems, networks, and equipment.
4. For legal, safety or security reasons, such as complying with legal requirements; complying with reporting and similar requirements; investigating and responding to claims against the Company and its customers; completing due diligence (such as in connection with a corporate transaction); protecting our, your, our customers’, and other third parties’ safety, property or rights; detecting, preventing, and responding to security incidents; and protecting against malicious, deceptive, fraudulent, or illegal activity.
5. In connection with a corporate transaction, such as if we acquire, or some or all of our assets are acquired by, another entity, including through a sale in connection with bankruptcy and other forms of corporate change.
6. For marketing, such as marketing our products or services or those of our affiliates, business partners, or other third parties. For example, we may use Personal Information we collect to send you newsletters, surveys, questionnaires, promotions, or information about events or webinars. You can unsubscribe to our email marketing via the “Manage Preferences” or “Unsubscribe” link in the email or by contacting us using the information in Section J.

We may use anonymized, de-identified, or aggregated information for any purpose permitted by law.

E. With Whom We Disclose or Share Personal Information

We may disclose or share your Personal Information with the categories of recipients described below:

1. Affiliates and subsidiaries, including parent entities, corporate affiliates, subsidiaries, business units, and other companies that share common ownership.
2. Service providers that work on our behalf to provide the products and services you request or that support our relationship with you, such as IT providers, companies that provide business support services, data analytics providers, financial administration, and event organization.
3. Professional consultants, such as accountants, lawyers, and financial advisors.
4. Vendors necessary to complete transactions you request, such as shipping companies and logistics providers.
5. Law enforcement, government agencies, and other recipients for legal, security, or safety purposes, such as when we share information to comply with law or legal requirements, to enforce or apply our policies, and to protect ours, our customers’, or third parties’ safety, property or rights.
6. In connection with a corporate transaction, such as if we, or some or all of our assets, are acquired by another entity, including through a sale in connection with bankruptcy or other forms of corporate change.
7. Third parties, such as certain travel services, companies that operate cookies and other tracking technologies, social media companies, certification providers, and other third parties who may use this information to market to you directly.
8. Entities to which you have consented to the disclosure, where consent is required by law.

We do not collect Sensitive Personal Information for the purpose of inferring characteristics about you.

We do not use or disclose Sensitive Personal Information for purposes to which the right to limit use and disclosure applies under the CCPA.

F. How We Use Cookies and Tracking Technologies We and authorized third parties, through our Digital Properties, may also collect information, which may include Personal Information, via cookies, web beacons, tracking pixels, embedded scripts, location-identifying technologies, Device recognition technologies, in-app tracking methods, Device and activity monitoring, session replay technologies, or other manual, passive, or automatic tracking technologies, programs, or platforms (“Tracking Technologies”).

Types of information collected. We and authorized third parties collect data about you and your Devices, including but not limited to Usage Information; your Internet Service Provider; IP address/Internet address from which you accessed our website(s) and/or other unique identifier(s) related to you or your Device(s); cookie ID; Ad ID; Device location (both approximate and precise); Device characteristics (including make, model, operating system/settings, and other specifications); browser type used; the date and time you access our website(s) and/or take certain actions on our website(s); recordings of your interactions with our websites and other Digital Properties; the pages you accessed while visiting our website(s) and related click behavior (such as products or offerings viewed and/or purchased); advertisements viewed; previously visited websites, applications, and services; search history; and preferences.

Types of Tracking Technologies used. We and third parties that we authorize may use the following Tracking Technologies on the Service and Digital Properties:

• Cookies

  A cookie is a small text file that is stored on a user’s Device. We may place cookies on your Device(s), which may last only during a single session or may be persistent over multiple sessions over time. Session cookies make it easier for you to navigate the Service and Digital Properties and expire when you close your browser. Other cookies remain longer and help in understanding how you use the Service and Digital Properties, for marketing, to personalize and enhance your user experience, and for other purposes described below.

• Web Beacons (“Tracking Pixels”)

  Web beacons are small graphic images, also known as “tracking pixels,” “Internet tags,” or “clear gifs,” embedded in web pages and e-mail messages. Web beacons may be used to count the number of visitors to the Service and Digital Properties, facilitate marketing, to monitor how users navigate the Service and Digital Properties, and to count content views.

• Embedded Scripts

  An embedded script is programming code designed to collect information about your interactions with the Service and Digital Properties. It is temporarily downloaded onto your computer from our web server, or from a third party with which we work, and is active only while you are connected to the Service or Digital Properties and deleted or deactivated thereafter.

• Location-Identifying Technologies

  GPS (global positioning systems) software, geo-filtering, and other location-aware technologies locate you (sometimes precisely), or make assumptions about your location, for purposes such as verifying your location and delivering or restricting content based on your location. If you have enabled GPS or use other location-based features on the Service or Digital Properties, your Device location may be tracked by us and third parties. Certain Service or Digital Properties features may access and use information about your Device location (such as based on IP address or GPS, as applicable), or your account information, to suggest certain content, products, or services that may be available to you. Our Service and Digital Property content may be personalized based on various information we may have about you to try to provide you with more location-relevant content.

• Device Recognition Technologies

  We may use device recognition technologies, including application of statistical probability to data sets, as well as linking a common unique identifier to different device use (e.g., Facebook ID), which attempt to recognize or make assumptions about users and devices (e.g., that a user of multiple devices is the same user or household) (“Cross-device Data”).

• In-App Tracking Methods

  There are a variety of Tracking Technologies that may be included in mobile applications, and these are not browser-based like cookies and cannot be controlled by browser settings. Some use device identifiers or other identifiers such as “Ad IDs,” or may use “SDKs,” to associate app user activity to a particular app and to track user activity across apps and/or devices. SDKs are blocks of code that may be installed in our mobile application by third party companies with which we work. SDKs help us understand how you interact with our mobile application, to improve marketing, and collect certain information about the Device and network you use to access our application, such as the advertising identifier associated with your Device and information about how you interact with our application.

• Device and Activity Monitoring Technologies

  We use technologies such as session replay tools that monitor, and may record, your interactions with the Service and Digital Properties, including without limitation, keystrokes and how you move through and engage with the Service and Digital Properties. These technologies may also collect and analyze information from your Device, such as, without limitation, your operating system, plug-ins, system fonts, and other data.

Purposes for using these technologies. We and authorized third parties use these Tracking Technologies for purposes including:

• Personalization, such as remembering user preferences, login details and browsing behavior; tracking your activity across online properties and platforms over time to better understand your preferences and interests; and personalizing online content;
• Improving performance, such as maintaining and improving the performance of the Service and Digital Properties;
• Analytics, such as analyzing how the Service and Digital Properties are used to help us improve the Service’s and Digital Properties’ performance and user experience;
• Advertising, such as providing you with offers that may be of interest to you; conducting targeted advertising to you on the Service and Digital Properties, as well as digital properties of third parties; and measuring the effectiveness of our communications with you and advertising campaigns, including identifying how and when you engage with our communications; and
• Security, such as user or Device identification and prevention of fraud and malicious behavior.

These Tracking Technologies may be used to track you across Devices and websites over time for purposes above.

Disclosure of your information. We may disclose Personal Information to third parties or permit third parties to place Tracking Technologies on our website(s) to allow these third parties to directly collect Personal Information from you, such as social media companies, advertising networks, companies that provide analytics including ad tracking and reporting, security providers, and others that help us operate our business, including the Service and Digital Properties. These companies use this information to provide you with more relevant advertising tailored to your interest based on your browsing of the Service and Digital Properties and elsewhere on the Internet, sometimes known as “interest-based advertising” and “online behavioral advertising” (“Interest-based Advertising”) which may include sending you an ad on another online service after you have left the Service or Digital Properties (i.e., “retargeting”).

Our disclosures of information to third parties may include the following:

• Google Analytics. We use Google Analytics to analyze traffic to our website(s) in order to help us understand our customers' and visitors' needs and to continually improve our site(s) for them. The data they collect on our behalf may include, but is not limited to, search engine referrals, affiliate referrals, traffic driven by banner ads or other online promotions, how visitors navigate around the site, and the most popular pages. We also collect certain technical information, such as the browser version and operating system. We reserve the right to use, transfer, sell, and share data about our users for any lawful business purpose, such as analyzing usage trends and seeking compatible advertisers, sponsors, clients, and customers. For more information on how Google Analytics collects and processes data, please visit www.google.com/policies/privacy/partners/.
• Social media companies. We use social media Tracking Technologies (such as the Meta Pixel and/or related Meta business tools) that may allow third parties, including Meta, to collect or receive information from our Service, Digital Properties, and/or elsewhere on the Internet and use that information to provide measurement services and target ads. In addition, we may serve ads on other online services that are targeted to reach people on those services that are also identified in one or more of our databases (“Matched List Ads”). This is done by using Tracking Technologies or by matching common factors between our databases and the databases of the other online services. For instance, we may use such ad services offered by Meta or X and other third-party services. We are not responsible for these third-party services, including without limitation their security of the data. Most third-party social media companies (such as Meta and X) will generally enable you to hover over the box in the right corner of such a Meta ad, or go to your social media account settings, and find out what options you have to control such ads. We are not responsible for such third parties’ failure to comply with your or our opt-out instructions, they may not give us notice of opt-outs to our ads that you give to them, and they may change their options without notice to us or you.

Your choices regarding Tracking Technologies. Some of the companies that perform advertising-related services may participate in the Digital Advertising Alliance’s (“DAA”) Self-Regulatory Program for Online Behavioral Advertising. To learn more about how you can exercise certain choices regarding Interest-based Advertising, visit http://www.aboutads.info/choices/ and http://www.aboutads.info/appchoices for information on the DAA’s opt-out programs. Some of these companies may also be members of the Network Advertising Initiative (“NAI”). For more information about the NAI including how consumers can opt-out from receiving interest-based advertising from some or all of NAI's members, please visit http://www.networkadvertising.org/choices. Opting out of Interest-based Advertising will not opt you out of all advertising, but rather only Interest-based Advertising from us or our agents or representatives. Also, if your browsers are configured to reject cookies when you visit these opt-out webpages, or you subsequently erase your cookies, use a different Device or web browser, or use a non-browser-based method of access (e.g., mobile app), your NAI / DAA browser-based opt-out may not, or may no longer, be effective.

Some browsers have incorporated Do Not Track (“DNT”) preferences. Most of these features, when turned on, send signals to the website you are visiting that you do not wish to have information about your online searching and browsing activities collected and used. As there is not yet a common agreement about how to interpret DNT signals, we do not honor DNT signals from website browsers at this time. However, you may be able to refuse or delete cookies. If you refuse or delete cookies, some of our website(s) functionality may be impaired. If you change Devices or browsers, or use multiple Devices or browsers, and delete your cookies, you may need to repeat this process for each Device or browser. Please refer to your browser’s Help instructions to learn more about how to manage cookies and the use of other tracking technologies.

Personal Information

We do not knowingly collect, sell, or share Personal Information of minors under the age of 16.

We may disclose Personal Information to third parties, including the categories of recipients described below. California law requires that we describe certain disclosures of Personal Information where we receive valuable consideration even if no money is exchanged and disclosures of Personal Information for purposes of targeted advertising or analytics services which California law considers a “sale” or “sharing”. In the course of supporting our digital advertising activities, we “sell” or “share” information to digital marketing partners. They use this information to provide us with digital advertising services and may use the information to improve the services and offerings they provide to us and other businesses. The information we “sell” or “share” in this manner includes information collected when you engage with our website, mobile application, and other digital offerings. Below please find a chart detailing the categories of Personal Information we collect and with whom we disclose it and for what Business Purpose we do so.

H. California Rights Concerning Personal Information

California residents may exercise the following rights, subject to legal limitations and applicable exceptions, by submitting a request through the following link: https://privacy.carvana.com/privacy.

• Right to Know. You have the right to request information about the categories of Personal Information we have collected about you, the categories of sources from which we collected the Personal Information, the purposes for collecting, selling, or sharing the Personal Information, and the categories of third parties with whom we have shared or sold your Personal Information (“Categories Report”). You may also request information about the specific pieces of Personal Information we have collected about you (“Specific Pieces Report”).
• Right to Delete. You have the right to request that we delete Personal Information that we have collected from you.
• Right to Correct. You have the right to request that we correct inaccurate Personal Information that we maintain about you.
• Right to Opt Out. You have the right to opt out of the sale of your personal information.

To fully exercise the Right to Opt Out, you must both: (A) submit an Opt-Out of Sale/Sharing request through our Opt-Out Form AND (B) select the “Opt Out” button via Your Privacy Choices modal. Clicking “Opt Out” within Your Privacy Choices will place a cookie on your browser signaling that you have opted out of such online activities. Please note:

• The opt-out cookie only applies to the Carvana or ADESA website and only to the browser and Device you are using at the time you make the selection. You will also need to select the “Opt Out” button through Your Privacy Choices from each browser on each Device you use, and on each Carvana or ADESA website you access.
• If you clear cookies on your browser, you will need to select “Opt Out” through Your Privacy Choices from that browser again.
• If you have blocked cookies through your browser settings, we will be unable to comply with your opt out request.

To the extent required by law, we will honor opt-out preference signals sent in a format commonly used and recognized by businesses, such as an HTTP header field or JavaScript object. We will process opt-out preference signals at the browser level.

In accordance with applicable law, we will not discriminate against you for exercising these rights.

Verification: In order to exercise your rights, we may need to obtain information to locate you in our records, verify that you are a California resident, and/or verify your identity depending on the nature of the request. In most cases, we will collect some or all of the following data elements: first and last name, email address, and telephone number. In some cases, we may request different or additional information, and will inform you if we need such information. Once you submit a request, we will send a verification email that you must respond to in order for us to proceed with your request as part of the verification process.

Authorized Agents: Authorized agents may exercise rights on behalf of California residents by submitting a request through the following link: https://privacy.carvana.com/privacy and indicating that they are submitting the request as an agent. We will require the agent to demonstrate authority to act on behalf of the resident by providing signed permission from the resident. We may also require the resident to verify their own identity directly with us or to directly confirm with us that they provided the authorized agent with permission to submit the request.

Timing: We will process the Right to Opt-Out of Sale or Sharing requests within 15 business days. We will respond to Right to Delete, Right to Correct, and Right to Know requests within 45 calendar days, unless we need more time, in which case we will notify you and may take up to 90 calendar days in total to respond to your request.

I. Data Security and Data Retention

1. Security. We maintain reasonable security procedures and technical and organizational measures to protect your Personal Information against accidental or unlawful destruction, loss, disclosure, alteration, or use. However, because no data transmission is completely secure, and no system of physical or electronic security is impenetrable, we cannot guarantee the security of the information you send to us or the security of our servers, networks, or databases, and by using our Service or Digital Properties you agree to assume all risk in connection with the information sent to us or collected by us when you access, visit, and/or use our Service or Digital Properties, including without limitation your personally identifiable information, Personal Information, or other registration information, and we are not responsible for any loss of such information, or the consequences thereof.
2. Retention. We retain your Personal Information as long as necessary to fulfill the purposes outlined in this Business Privacy Notice unless we are required to do otherwise by applicable law. This includes retaining your Personal Information to provide you with the products or services you have requested and interact with you; maintain our business relationship with you; improve our business over time; ensure the ongoing legality, safety and security of our services and relationships; or otherwise in accordance with our internal retention procedures. Once you have terminated your relationship with us, we may retain your Personal Information in our systems and records in order to ensure adequate fulfillment of surviving provisions in terminated contracts or for other legitimate business purposes, such as to enable easier future user onboarding, demonstrate our business practices and contractual obligations, or provide you with information about our products and services in case of interest.

If you have questions regarding this Business Privacy Notice or how we use your Personal Information, please contact us at: