Carvana’s Financial and Other Privacy Notices

Thank you for your patience, this is a long one.
Effective Date: July 1, 2024

I. INTRODUCTION

This page describes how Carvana Operations HC LLC (“Carvana”), together with its parents, subsidiaries, and affiliates, including ADESA US AUCTION, LLC (“ADESA”) handles certain types of your personal data. This includes how we handle Personal Information (as defined by applicable data protection laws) that is subject to the California Consumer Privacy Act (CCPA) and the Oregon Consumer Privacy Act (OCPA) for the following types of California and Oregon residents:

  • For California and Oregon Individual Consumers and Website Visitors, such as an individual who interacts with us through our websites, social media accounts, online advertisements, email, and mobile applications (collectively, our “Platforms”), through communications (such as mail and phone), at in-person events, and through other online and offline methods – click HERE to view our California and Oregon Consumer Privacy Notice
  • For California Candidates, such as applicants – click HERE to view our California Job Applicant Privacy Notice
  • For California Business Contacts, such as our vendors, service providers, and business partners – click HERE to view our California Business (“B2B”) Privacy Notice

Importantly, the privacy disclosures posted on this page do not apply to certain personal data that is subject to certain laws, such as data subject to the Fair Credit Reporting Act (“FCRA”). Your personal financial data is subject to our Financial Privacy Notice below. These privacy disclosures also do not apply to other, non-financial personal data, such as data subject to the Health Insurance Portability and Accountability Act (HIPAA), the California Confidentiality of Medical Information Act, or the Driver’s Privacy Protection Act of 1994. If you are an Android app user, please click here to submit a request to delete your account.

For more information regarding Carvana's terms of use, please review our User Agreement, the terms of which are incorporated herein.

II. FINANCIAL PRIVACY NOTICE

FINANCIAL PRIVACY NOTICE

Effective Date: August 28, 2023

Click HERE to Print

FACTS
WHAT DOES CARVANA, LLC ("CARVANA") DO WITH YOUR PERSONAL INFORMATION?
Why?
Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do.
What?
The types of personal information we collect and share depend on the product or service you have with us. This information can include:
  • Social Security number and driver’s license number
  • account balances and payment history
  • income, credit history and employment information
  • vehicle type and identification
How?
All financial companies need to share customers’ personal information to run their everyday business. In the section below, we list the reasons financial companies can share their customers’ personal information; the reasons Carvana chooses to share; and whether you can limit this sharing.
Reasons we can share your personal information
Does Carvana share?
Can you limit this sharing?
For our everyday business purposes – such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit bureaus
Yes
No

For our marketing purposes –

to offer our products and services to you
Yes
No

For joint marketing with other financial companies

Yes
No

For our affiliates’ everyday business purposes –

information about your transactions and experiences
Yes
No

For our affiliates’ everyday business purposes –

information about your creditworthiness
Yes
Yes

For our affiliates to market to you

Yes

(excl. phone numbers)
Yes

For our nonaffiliates to market to you

Yes

(excl. phone numbers)
Yes
To limit our sharing
  • Click here; or
  • Call (844) 732-2556
Please note: If you are a new customer, we can begin sharing your information 30 days from the date we sent this notice. When you are no longer our customer, we continue to share your information as described in this notice. However, you can contact us at any time to limit our sharing.
Questions?
Call (844) 732-2556 or go to www.carvana.com
Who we are
Who is providing this notice?
Carvana Operations HC LLC and relevant parents, subsidiaries, and affiliates, including: Carvana, LLC; Loan Acceptance FC, LLC; Carvana FAC LLC; and Carvana Insurance Services LLC (together, “Carvana”)
What we do
How does Carvana protect my personal information?
To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings.
How does Carvana collect my personal information?
We collect your personal information, for example, when you
  • visit our website
  • apply for financing or give us your income information
  • provide employment information or give us your contact information
  • pay your bills
We also collect your personal information from others, such as credit bureaus, affiliates or other companies.
Why can’t I limit all sharing?
Federal law gives you the right to limit only
  • sharing for affiliates’ everyday business purposes – information about your creditworthiness
  • affiliates from using your information to market to you
  • sharing for nonaffiliates to market to you
State laws and individual companies may give you additional rights to limit sharing. See below for more on your rights under state law.
What happens when I limit sharing for an account I hold jointly with someone else?
Your choices will apply to everyone on your account.
Definitions
Affiliates
Companies related by common ownership or control. They can be financial and nonfinancial companies.
  • All Carvana affiliates, including Carvana Logistics, LLC and Carvana Shipping & Delivery LLC. DriveTime Car Sales Company, LLC (“DriveTime”) and all institutions in the DriveTime family of companies, including Bridgecrest Acceptance Corporation and Bridgecrest Credit Company, LLC are our affiliates. Our other affiliates include companies with the DriveTime or DT name such as ancillary product and insurance companies including SilverRock Group, Inc., SilverRock Insurance, LLC, and Blueshore Insurance Co.
Nonaffiliates
Companies not related by common ownership or control. They can be financial and nonfinancial companies.
  • Nonaffiliates we share with could include insurance companies, mortgage companies, credit card companies, and direct marketing companies.
Joint Marketing
A formal agreement between nonaffiliated financial companies that together market financial products or services to you.
  • Our joint marketing partners could include insurance companies, automobile dealers, and credit card companies.
Other important information

California residents: We will not share personal information with nonaffiliates to market to you, except with your express consent. We will limit sharing among our affiliates and joint marketing to the extent required by California law. CA residents are provided a CA notice for additional choices.

Vermont residents: We will not disclose information about your creditworthiness to our affiliates and will not disclose your personal information, financial information, credit report, or health information to nonaffiliated third parties to market to you, other than as permitted by Vermont law, unless you authorize us to make those disclosures. Additional information concerning our privacy policies can be found at https://www.carvana.com/privacy-policy or call (844)732-2556.

Important Financial Privacy Choices for California Consumers

You have the right to control whether we share some of your personal information. Please read the following information carefully before you make your choices below.

Your Rights

You have the following rights to restrict the sharing of personal and financial information with our affiliates (companies we own or control) and outside companies that we do business with. Nothing in this form prohibits the sharing of information necessary for us to follow the law, as permitted by law, or to give you the best service on your accounts with us. This includes sending you information about some other products or services.

Your Choices

Restrict Information Sharing With Companies We Own or Control (Affiliates): Unless you say “No,” we may share personal and financial information about you with our affiliated companies.

[_] NO, please do not share personal and financial information with your affiliated companies.

Restrict Information Sharing With Other Companies We Do Business With To Provide Financial Products And Services: Unless you say “No,” we may share personal and financial information about you with outside companies we contract with to provide financial products and services to you.

[_] NO, please do not share personal and financial information with outside companies you contract with to provide financial products and services.

___________________________________________

Time Sensitive Reply

You may make your privacy choice(s) at any time. Your choice(s) marked here will remain unless you state otherwise. However, if we do not hear from you we may share some of your information with affiliated companies and other companies with whom we have contracts to provide products and services.

Name: ___________________________________________

Email Address Associated With Your Account: ___________________________________________

Signature: ___________________________________________

Date: ___________________________________________

To exercise your choices, do one of the following:
(1) Click the "NO" hyperlinked above for one or more choices; or
(2) Call this toll-free number: (844) 732-2556

III. CONSUMER PRIVACY NOTICE

Consumer Privacy Notice
Effective Date: July 1, 2024

PRIVACY NOTICE /YOUR PRIVACY RIGHTS

If you are a California or Oregon resident, please click here for more information about your specific privacy rights.

A. Introduction

Carvana Operations HC LLC (“Carvana”), together with its parents, subsidiaries, and affiliates, including ADESA US Auction, LLC (“ADESA,”) together and collectively with Carvana, referred to throughout this Consumer Privacy Notice as "Company," "us," "we," or "our," collects and processes information about you as described in this Consumer Privacy Notice (“Consumer Notice”). We are committed to protecting the privacy of those with whom we interact. This Consumer Notice contains details about how we collect, use, and share personal information that we obtain from and about you when you interact with us via our website(s), email, mobile application(s), social media accounts, online advertisements, and other digital platforms (collectively, the “Digital Properties”), and in other online and offline interactions. Please read this Consumer Notice carefully.

Applicability: We collect information in several contexts as described below. However, this Consumer Notice does not apply to the following information:

  1. Information we collect in connection with providing individual consumers a financial product or service (or in connection with a consumer seeking such financial products or services), such as by reviewing applications for financing. For example, this Consumer Notice does not apply to information we collect that is subject to the federal Gramm-Leach-Bliley Act (“GLBA”), Fair Credit Reporting Act (“FCRA”), or the California Financial Information Privacy Act (collectively, “Financial Information”). Financial Information is subject instead to our Financial Privacy Notice available higher on this page.
  2. Information about job applicants. Such information is subject to a separate Applicant Privacy Notice available lower on this page.
  3. Information about our employees, contractors, and agents. Such information is subject to a separate personnel (employee) privacy notice that we make available to those individuals.
  4. Information we collect from individuals with whom we engage in solely business-to-business communications and transactions, such as information about the employees of our business partners and service providers. Such information is subject to a separate Business Privacy Notice available lower on this page.

Changes: We may update this Consumer Notice from time to time. The current Consumer Notice will be effective when posted. Please check this Consumer Notice periodically for updates as your continued use of the Service, Digital Properties, and other continued interactions with us after an update will signify your acceptance of the new policy. If any of the changes are unacceptable to you, you should cease interacting with us. When required under applicable law, we will notify you of any changes to this Consumer Notice by posting an updated Consumer Notice on this website.

B. Sources of Personal Information

We collect information about you and how you interact with us in several ways, including:

  1. Information you provide to us directly. Our website, mobile site, application, and/or other service, regardless of how distributed, transmitted, published, or broadcast (each, a "Service") may allow you and/or other users to create, post, store, and share content, including but not limited to messages, text, photos, graphics, videos, software, code, and other materials (collectively, "User Content"). We collect the information you provide to us directly, such as when registering and/or set up an account/profile to access the Service or Digital Properties, including by submitting User Content.
  2. Information automatically collected or inferred from your online interaction with us. We automatically collect technical information about your online interactions with us (such as IP address or other unique identifier related to you or your laptop, personal computer, browser, mobile device, tablet, or other device (a "Device" or "Devices"), Device location, characteristics, and capabilities, prior and current web activity, your Carvana or ADESA website activities and related click data, and browsing preferences when you visit or interact with our Service or Digital Properties (“Usage Information”).
  3. Information from public sources, including government entities from which public records are obtained and information you submit in public forums.
  4. Information from third parties. We receive information about you and your interactions with us from third parties, such as identity verification partners, marketing and advertising providers, social media companies, ad networks, lead generators, data brokers, and companies that provide or sell lists of potential purchasers.

We may combine information that we receive from the various sources described in this Consumer Notice, including third party sources and public sources, and use or disclose it for the purposes identified below.

C. Types of Personal Information We Collect

The types of information that we collect about you (“Personal Information”) include:

  1. Identifiers, such as your name, alias, postal address, country of residence, unique personal identifier, online identifier, internet protocol address, email address, account name, phone number, social media identifiers (e.g., X handle, Instagram name, etc.) driver’s license number, passport number, or other similar identifiers.
  2. Customer records, such as signatures.
  3. Protected Class and Demographic information, such as age, race, gender, gender identity, national origin, religion, citizenship, marital status, military or veteran status, or date of birth.
  4. Commercial information and preferences, including records of personal property, products or services purchased, obtained, or considered, information you provide or post using the Service or Digital Properties, or other purchasing or consuming histories or tendencies.
  5. Internet or other electronic network activity information, such as your browsing history, search history, and information regarding your interactions with us (including interacting with us online, through chat/chatbots, by mobile application, and through advertisements).
  6. Geolocation information, such as approximate location based on your IP address.
  7. Audio, electronic, visual, or similar information, such as video recordings of our premises, call center recordings, pictures you may post or submit via the Service or the Digital Properties, web activity recordings, or customer support chat logs and/or recordings.
  8. Professional or employment information, such as job title, employer, business address and contact information, employment history, or other professional information.
  9. Education information, such as education history, including information related to level of education derived from credit reports and related data sources.
  10. Inferences drawn from any of the information we collect to create a profile about you reflecting your preferences, characteristics, and behaviors.
  11. Sensitive personal information, such as social security number, driver’s license number, or passport number; account log-in information; racial or ethnic origin; and precise geolocation (with your express consent).

D. How We Use Your Personal Information

We may use each category of your information described above in the following ways:

  1. To enable interactions between you and us or between you and other users or third parties, such as to facilitate online purchases of our products or those offered by other users or third parties using the Service or Digital Properties; process shipping and returns; register and administer your account, provide you with and support your interactions with us, other users, and/or third parties; diagnose, repair and track service and quality issues; facilitate an order, download, return, or exchange; provide requested product information; communicate with you about your account or our data practices; install and configure changes and updates to programs and technologies related to interactions with us; authenticate those who interact with us; or to respond to your requests, complaints, and inquiries.
  2. For our own internal business purposes, such as to evaluate, audit, debug, or improve the usage, quality, and performance of programs and technologies related to interactions with us or third parties; design new services; process and catalog your responses to surveys or questionnaires (e.g., customer satisfaction reviews); perform internal research for technological development and demonstration; conduct data analysis and testing; and maintain proper business records and other relevant records.
  3. For legal, safety, or security reasons, such as to comply with legal requirements; protect our safety, our property, or rights of those who interact with us, or others; conduct compliance training; investigate and respond to legal claims; respond to law enforcement requests; and detect, prevent, and respond to security incidents or other malicious, deceptive, fraudulent, or illegal activity.
  4. For marketing. We may use your Personal Information to market our products or services or those of third parties, such as our business partners or other users of our Service. We may use your Personal Information to invite you to participate in marketing surveys, questionnaires, promotions, events, or contests. We may audit aspects of our ad impressions and verify positioning and quality of ad impressions. We may use your Personal Information for short-term transient use, including for contextual ad customization. We may use your Personal Information to enhance our content and to deliver advertisements to you, including commercial emails. For more information about online marketing activity, see Section F below.
  5. Plaid Technologies, Inc. (“Plaid”): if you elect to link to Plaid during your use of the Service or Digital Properties, we may use Plaid to gather certain data from financial institutions. By electing to link to Plaid, you grant us and Plaid the right, power, and authority to act on your behalf to access and transmit your personal and financial information from the relevant financial institution. By electing to link to Plaid, you agree to your personal and financial information being transferred, stored, and processed by us and Plaid in accordance with this Consumer Notice and the Plaid Privacy Policy.
  6. For any other purposes for which you provide consent.

E. With Whom We Share Your Personal Information

We may share your Personal Information with the categories of recipients described below:

  1. Affiliates and subsidiaries: We may share your Personal Information within the Carvana or ADESA group of companies, which includes parents, corporate affiliates, subsidiaries, business units, and other companies that share common ownership for the purposes described above.
  2. Service providers: We may share your Personal Information with service providers working on our behalf in order to facilitate our interactions with you or request or support our relationship with you, such as hosting service providers, IT providers, operating systems and platforms, internet service providers, analytics companies, and marketing providers (e.g., we may share your email address with our outbound email marketing provider). We may contract with other companies to provide certain services, including identity verification, email distribution, market research, promotions management, and payment processing. We take reasonable efforts to provide these companies with only the information they need to perform services on our behalf.
  3. Third parties necessary to complete a transaction or request. We may disclose information to third parties to provide you with services or benefits you may request, such as shipping vendors. We may also share information with third parties at your direction, such as if you direct us to send or receive information from third parties using Plaid, or if you interact with other users of the Service or Digital Properties.
  4. Business partners and other third parties: We may also provide your Personal Information or provide access to your Personal Information to our business partners who may use it for their own purposes, such as supplemental product providers, including those who offer vehicle accessories, insurance, and other partners who work with us on promotional or sponsorship opportunities, including co-branded products and services; advertisers, ad platforms and networks, and social media platforms; lead generators; and third parties whose cookies and tracking tools we use as described in Section F (Cookies and Tracking Technologies).
  5. For legal, security, and safety purposes: We may share your Personal Information with third parties such as law enforcement or other government agencies to comply with law or legal requirements; to enforce or apply our User Agreement and other agreements; and to protect our rights, property, and safety, and of our users and third parties.
  6. In connection with a corporate transaction: We may transfer any information we have about you in connection with a change in corporate control, including but not limited to a merger or sale (including transfers made as part of insolvency or bankruptcy proceedings) involving all or part of Carvana or ADESA, or as part of a corporate reorganization or stock sale.

We may also de-identity, anonymize, or aggregate Personal Information to share with third parties for any purpose.

F. How We Use Cookies and Tracking Technologies

We and authorized third parties may also collect information, which may include Personal Information, via cookies, web beacons, tracking pixels, embedded scripts, location-identifying technologies, Device recognition technologies, in-app tracking methods, Device and activity monitoring, session replay technologies, or other manual, passive, or automatic tracking technologies, programs, or platforms (“Tracking Technologies”).

Types of information collected. We and authorized third parties collect data about you and your Devices, including but not limited to Usage Information; your Internet Service Provider; IP address/Internet address from which you accessed our website(s) and/or other unique identifier(s) related to you or your Device(s); cookie ID; Ad ID; Device location (both approximate and precise); Device characteristics (including make, model, operating system/settings, and other specifications); browser type used; the date and time you access our website(s) and/or take certain actions on our website(s); recordings of your interactions with our websites and other Digital Properties; the pages you accessed while visiting our website(s) and related click behavior (such as products or offerings viewed and/or purchased); advertisements viewed; previously visited websites, applications, and services; search history; and preferences.

Types of Tracking Technologies used. We and third parties that we authorize may use the following Tracking Technologies on the Service and Digital Properties:

  • Cookies

    A cookie is a small text file that is stored on a user’s Device. We may place cookies on your Device(s), which may last only during a single session or may be persistent over multiple sessions over time. Session cookies make it easier for you to navigate the Service and Digital Properties and expire when you close your browser. Other cookies remain longer and help in understanding how you use the Service and Digital Properties, for marketing, to personalize and enhance your user experience, and other purposes described below.

  • Web Beacons (“Tracking Pixels”)

    Web beacons are small graphic images, also known as “tracking pixels,” “Internet tags,” or “clear gifs,” embedded in web pages and e-mail messages. Web beacons may be used to count the number of visitors to the Service and Digital Properties, facilitate marketing, to monitor how users navigate the Service and Digital Properties, and to count content views.

  • Embedded Scripts

    An embedded script is programming code designed to collect information about your interactions with the Service and Digital Properties. It is temporarily downloaded onto your computer from our web server, or from a third party with which we work, and is active only while you are connected to the Service or Digital Properties and deleted or deactivated thereafter.

  • Location-Identifying Technologies

    GPS (global positioning systems) software, geo-filtering, and other location-aware technologies locate you (sometimes precisely), or make assumptions about your location, for purposes such as verifying your location and delivering or restricting content based on your location. If you have enabled GPS or use other location-based features on the Service or Digital Properties, your Device location may be tracked by us and third parties. Certain Service or Digital Properties features may access and use information about your Device location (such as based on IP address or GPS, as applicable), or your account information, to suggest certain content, products, or services that may be available to you. Our Service and Digital Property content may be personalized based on various information we may have about you to try to provide you with more location-relevant content.

  • Device Recognition Technologies

    We may use device recognition technologies, including application of statistical probability to data sets, as well as linking a common unique identifier to different device use (e.g., Facebook ID), which attempt to recognize or make assumptions about users and devices (e.g., that a user of multiple devices is the same user or household) (“Cross-device Data”).

  • In-App Tracking Methods

    There are a variety of Tracking Technologies that may be included in mobile applications, and these are not browser-based like cookies and cannot be controlled by browser settings. Some use device identifiers or other identifiers such as “Ad IDs,” or may use “SDKs,” to associate app user activity to a particular app and to track user activity across apps and/or devices. SDKs are blocks of code that may be installed in our mobile application by third party companies with which we work. SDKs help us understand how you interact with our mobile application, to improve marketing, and collect certain information about the Device and network you use to access our application, such as the advertising identifier associated with your Device and information about how you interact with our application.

  • Device and Activity Monitoring Technologies

    We use technologies such as session replay tools that monitor, and may record, your interactions with the Service and Digital Properties, including without limitation, keystrokes and how you move through and engage with the Service and Digital Properties. These technologies may also collect and analyze information from your Device, such as, without limitation, your operating system, plug-ins, system fonts, and other data.

Purposes for using these technologies. We and authorized third parties use these Tracking Technologies for purposes including:

  • Personalization, such as remembering user preferences, login details and browsing behavior; tracking your activity across online properties and platforms over time to better understand your preferences and interests; and personalizing online content;
  • Improving performance, such as maintaining and improving the performance of the Service and Digital Properties;
  • Analytics, such as analyzing how the Service and Digital Properties are used to help us improve the Service’s and Digital Properties’ performance and user experience;
  • Advertising, such as providing you with offers that may be of interest to you; conducting targeted advertising to you on the Service and Digital Properties, as well as digital properties of third parties; and measuring the effectiveness of our communications with you and advertising campaigns, including identifying how and when you engage with our communications; and
  • Security, such as user or Device identification and prevention of fraud and malicious behavior.

These Tracking Technologies may be used to track you across Devices and websites over time for purposes above.

Disclosures of your information. We may disclose Personal Information to third parties or permit third parties to place Tracking Technologies on our website(s) to allow these third parties to directly collect Personal Information from you, such as social media companies, advertising networks, companies that provide analytics including ad tracking and reporting, security providers, and others that help us operate our business, including the Service and Digital Properties. These companies use this information to provide you with more relevant advertising tailored to your interest based on your browsing of the Service and Digital Properties and elsewhere on the Internet, sometimes known as “interest-based advertising” and “online behavioral advertising (“Interest-based Advertising”) which may include sending you an ad on another online service after you have left the Service or Digital Properties (i.e., “retargeting”).

Our disclosures of information to third parties may include the following:

  • Google Analytics. We use Google Analytics to analyze traffic to our website(s) in order to help us understand our customers' and visitors' needs and to continually improve our site(s) for them. The data they collect on our behalf may include, but is not limited to, search engine referral, affiliate referrals, traffic driven by banner ads or other online promotions, how visitors navigate around the site, and the most popular pages. We also collect certain technical information, such as the browser version and operating system. We reserve the right to use, transfer, sell, and share data about our users for any lawful business purpose, such as analyzing usage trends and seeking compatible advertisers, sponsors, clients, and customers. For more information on how Google Analytics collects and processes data, please visit www.google.com/policies/privacy/partners/.
  • Social media companies. We use social media Tracking Technologies (such as the Meta Pixel and/or related Meta business tools) that may allow third parties, including Meta, to collect or receive information from our Service, Digital Properties, and/or elsewhere on the Internet and use that information to provide measurement services and target ads. In addition, we may serve ads on other online services that are targeted to reach people on those services that are also identified in one or more of our databases (“Matched List Ads”). This is done by using Tracking Technologies or by matching common factors between our databases and the databases of the other online services. For instance, we may use such ad services offered by Meta or X and other third-party services. We are not responsible for these third-party services, including without limitation their security of the data. Most third party social media companies (such as Meta and X) will generally enable you to hover over the box in the right corner of such a Meta ad, or go to your social media account settings, and find out what options you have to control such ads. We are not responsible for such third parties’ failure to comply with your or our opt-out instructions, they may not give us notice of opt-outs to our ads that you give to them, and they may change their options without notice to us or you.

Your choices regarding Tracking Technologies. Some of the companies that perform advertising-related services may participate in the Digital Advertising Alliance’s (“DAA”) Self-Regulatory Program for Online Behavioral Advertising. To learn more about how you can exercise certain choices regarding Interest-based Advertising, visit http://www.aboutads.info/choices/ and http://www.aboutads.info/appchoices for information on the DAA’s opt-out programs. Some of these companies may also be members of the Network Advertising Initiative (“NAI”). For more information about the NAI including how consumers can opt-out from receiving interest-based advertising from some or all of NAI's members, please visit http://www.networkadvertising.org/choices. Opting out of Interest-based Advertising will not opt you out of all advertising, but rather only Interest-based Advertising from us or our agents or representatives. Also, if your browsers are configured to reject cookies when you visit these opt-out webpages, or you subsequently erase your cookies, use a different Device or web browser, or use a non-browser-based method of access (e.g., mobile app), your NAI / DAA browser-based opt-out may not, or may no longer, be effective.

Some browsers have incorporated Do Not Track (“DNT”) preferences. Most of these features, when turned on, send signals to the website you are visiting that you do not wish to have information about your online searching and browsing activities collected and used. As there is not yet a common agreement about how to interpret DNT signals, we do not honor DNT signals from website browsers at this time. However, you may be able to refuse or delete cookies. If you refuse or delete cookies, some of our website(s) functionality may be impaired. If you change Devices or browsers, or use multiple Devices or browsers, and delete your cookies, you may need to repeat this process for each Device or browser. Please refer to your browser’s Help instructions to learn more about how to manage cookies and the use of other tracking technologies.

G. Security

We maintain reasonable security procedures and technical and organizational measures to protect your Personal Information against accidental or unlawful destruction, loss, disclosure, alteration, or use. However, because no data transmission is completely secure, and no system of physical or electronic security is impenetrable, we cannot guarantee the security of the information you send to us or the security of our servers, networks, or databases, and by using our Service or Digital Properties you agree to assume all risk in connection with the information sent to us or collected by us when you access, visit, and/or use our Service or Digital Properties, including without limitation your personally identifiable information, Personal Information, or other registration information, and we are not responsible for any loss of such information, or the consequences thereof.

H. Children’s Privacy

Interactions with us are intended for individuals 16 years of age and older. Our interactions are not directed at, marketed to, nor intended for, children under 16 years of age. We do not knowingly collect any information, including Personal Information, from children under 16 years of age. If you believe that we have inadvertently collected Personal Information from a child under the age of 16, please contact us at the address below and we will use reasonable efforts to delete the child’s information from our databases.

I. External Links

When interacting with us you may encounter links to external sites or other online services, including those embedded in third party advertisements or sponsor information, that we do not control. We are not responsible for the privacy practices and data collection policies for such third party services. You should consult the privacy statements of those third party services for details.

J. User Agreement

The User Agreement for interactions with us is incorporated by reference into this Consumer Notice.

K. Contact Info/Your Choices

If you have questions regarding this Consumer Notice, please contact us at:

EMAIL:[email protected]
MAIL:Attention: Legal

300 E Rio Salado Pkwy

Building 1

Tempe, AZ 85281

Note: Only inquiries involving this Consumer Notice or Carvana’s collection, use, and/or management of your personal information should be sent to this email and/or mailing address. No other communication will be accepted or addressed.

Updating your information. If you've registered on any part of the Service or Digital Properties, you may change or update your member preferences or information in your account settings, if available, to keep all such data accurate and up to date.

Unsubscribing from promotional email messages. To opt-out of receiving promotional email messages from us, please click on the "Unsubscribe" link contained at the bottom of each email or by contacting us using the information above.

L. Your California and Oregon Privacy Rights

This section applies to certain California and Oregon residents and supplements (but does not replace) the Consumer Notice above. This section does not apply to the following information:

  • Information about individuals who are not California or Oregon residents.
  • Information we collect in connection with providing individual consumers a financial product or service (or in connection with a consumer seeking such financial products or services), such as by reviewing applications for financing. For example, this Consumer Notice does not apply to information we collect that is subject to the federal Gramm-Leach-Bliley Act (“GLBA”), Fair Credit Reporting Act (“FCRA”), or the California Financial Information Privacy Act (collectively, “Financial Information”). Financial Information is subject instead to our Financial Privacy Notice.
  • Information about job applicants. Such information is subject to a separate Applicant Privacy Notice available lower on this page.
  • Information about our employees, contractors, and agents. Such information is subject to a separate employee privacy notice that we will make available to those individuals.
  • Information we collect from individuals with whom we engage in solely business-to-business communications and transactions, including due diligence transactions, such as information about the employees of our business clients. Such information is subject to a separate Business Privacy Notice available lower on this page.

Pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively “CCPA”) and the Oregon Consumer Privacy Act of 2023 (“OCPA”), below is a summary of the personal information we have collected from consumers, the parties with whom we may have disclosed the personal information for business purposes, and the parties to whom we may have sold or shared the personal information over the last twelve (12) months. We do not knowingly sell the personal information of minors under 16 years of age.

Categories of Personal Information We CollectCategories of Third Parties With Whom We Disclose Personal Information for a Business PurposeCategories of Third Parties With Whom We Sell or Share Personal Information
Identifiers, such as real name, alias, postal address, country of residence, unique personal identifier, online identifier, IP address, email address, account name, phone number, social media identifiers, or other similar identifiers.
  • Service providers, such as identity verification services, technical support, research and analytics providers, etc.
  • Third party social network services
  • Our parents, subsidiaries, and affiliates
  • Marketing and advertising partners or providers
  • Public or law enforcement officials, as well as private parties involved in other legal process
  • Consumer credit reporting companies
  • Companies or other users to whom your data is shared at your direction
  • Supplemental product providers, such as those who offer vehicle accessories, insurance, etc.
  • Entities involved in a corporate transaction
  • Third party social network services
  • Data analytics providers
  • Marketing and advertising partners or providers
  • Companies that create or receive sales leads
Personal information subject to the California Customer Records Act, such as signatures.
  • Service providers, such as identity verification services, technical support, research and analytics providers, etc.
  • Third party social network services
  • Our parents, subsidiaries, and affiliates
  • Marketing and advertising partners or providers
  • Public or law enforcement officials, as well as private parties involved in other legal process
  • Consumer credit reporting companies
  • Companies or other users to whom your data is shared at your direction
  • Supplemental product providers, such as vehicle accessories, insurance, etc.
  • Entities involved in a corporate transaction
  • Third party social network services
  • Data analytics providers
  • Marketing and advertising partners or providers
  • Companies that create or receive sales leads
Characteristics of protected classifications under California or Federal Law, such as age, sex (including gender, gender identity, gender expression), national origin, citizenship, religion or creed, marital status, education, date of birth, veteran or military status.
  • Service providers, such as identity verification services, technical support, research and analytics providers, etc.
  • Third party social network services
  • Our parents, subsidiaries, and affiliates
  • Marketing and advertising partners or providers
  • Public or law enforcement officials, as well as private parties involved in other legal process
  • Consumer credit reporting companies
  • Companies to whom your data is shared at your direction
  • Supplemental product providers, such as vehicle accessories, insurance, etc.
  • Entities involved in a corporate transaction
  • Third party social network services
  • Data analytics providers
  • Companies that create or receive sales leads
Commercial information, including records of personal property, product or services purchased, obtained or considered, information you provide or post using the Service, or other purchasing or consuming histories or tendencies.
  • Service providers, such as identity verification services, technical support, research and analytics providers, etc.
  • Third party social network services
  • Our parents, subsidiaries, and affiliates
  • Marketing and advertising partners or providers
  • Public or law enforcement officials, as well as private parties involved in other legal process
  • Consumer credit reporting companies
  • Companies or other users to whom your data is shared at your direction
  • Supplemental product providers, such as vehicle accessories, insurance, etc.
  • Entities involved in a corporate transaction
  • Third party social network services
  • Data analytics providers
  • Marketing and advertising partners or providers
  • Companies that create or receive sales leads
Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an internet website, application or advertisement.
  • Service providers, such as identity verification services, financial services, technical support, research and analytics providers, etc.
  • Third party social network services
  • Our parents, subsidiaries, and affiliates
  • Marketing and advertising partners or providers
  • Public or law enforcement officials, as well as private parties involved in other legal process
  • Consumer credit reporting companies
  • Companies or other users to whom your data is shared at your direction
  • Supplemental product providers, such as vehicle accessories, insurance, etc.
  • Entities involved in a corporate transaction
  • Third party social network services
  • Data analytics providers
  • Marketing and advertising partners or providers
  • Companies that create or receive sales leads
Geolocation data, such as approximate location of a Device or equipment based on geographical coordinates and measurements,
  • Service providers, such as identity verification services, financial services, technical support, research and analytics providers, etc.
  • Third party social network services
  • Our parents, subsidiaries, and affiliates
  • Marketing and advertising partners or providers
  • Public or law enforcement officials, as well as private parties involved in other legal process
  • Consumer credit reporting companies
  • Companies or other users to whom your data is shared at your direction
  • Supplemental product providers, such as vehicle accessories, insurance, etc.
  • Entities involved in a corporate transaction
  • Third party social network services
  • Data analytics providers
  • Marketing and advertising partners or providers
  • Companies that create or receive sales leads
Audio, electronic, visual, or similar information such as CCTV footage, call recordings, pictures you post or submit via the Service or Digital Properties, customer support chat recordings, and web activity recordings, etc.
  • Service providers, such as identity verification services, financial services, technical support, research and analytics providers, etc.
  • Our parents, subsidiaries, and affiliates
  • Marketing and advertising partners or providers
  • Public or law enforcement officials, as well as private parties involved in other legal process
  • Companies or other users to whom your data is shared at your direction
  • Supplemental product providers, such as vehicle accessories, insurance, etc.
  • Entities involved in a corporate transaction
  • Third party social network services
  • Data analytics providers
  • Companies that create or receive sales leads
Professional or employment-related information, such as job title, employer, business address and contact information, employment history, other professional information, or education history.
  • Service providers, such as identity verification services, financial services, technical support, research and analytics providers, etc.
  • Third party social network services
  • Our parents, subsidiaries, and affiliates
  • Marketing and advertising partners or providers
  • Public or law enforcement officials, as well as private parties involved in other legal process
  • Consumer credit reporting companies
  • Companies or other users to whom your data is shared at your direction
  • Supplemental product providers, such as vehicle accessories, insurance, etc.
  • Entities involved in a corporate transaction
  • Third party social network services
  • Data analytics providers
  • Companies that create or receive sales leads
Education information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act.
  • Service providers, such as identity verification services, financial services, technical support, research and analytics providers, etc.
  • Third party social network services
  • Our parents, subsidiaries, and affiliates
  • Marketing and advertising partners or providers
  • Public or law enforcement officials, as well as private parties involved in other legal process
  • Consumer credit reporting companies
  • Companies or other users to whom your data is shared at your direction
  • Supplemental product providers, such as vehicle accessories, insurance, etc.
  • Entities involved in a corporate transaction
  • Third party social network services
  • Data analytics providers
  • Companies that create or receive sales leads
Inferences drawn from any of the information identified above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, and behavior.
  • Service providers, such as identity verification services, financial services, technical support, research and analytics providers, etc.
  • Third party social network services
  • Our parents, subsidiaries, and affiliates
  • Marketing and advertising partners or providers
  • Public or law enforcement officials, as well as private parties involved in other legal process
  • Consumer credit reporting companies
  • Companies or other users to whom your data is shared at your direction
  • Supplemental product providers, such as vehicle accessories, insurance, etc.
  • Entities involved in a corporate transaction
  • Third party social network services
  • Data analytics providers
  • Companies that create or receive sales leads
Sensitive personal information, such as social security number, driver’s license number or passport number; account log-in information; racial or ethnic origin or religious or philosophical beliefs; and precise geolocation
  • Service providers, such as identity verification services, financial services, technical support, research and analytics providers, etc.
  • Our parents, subsidiaries, and affiliates
  • Public or law enforcement officials, as well as private parties involved in other legal process
  • Consumer credit reporting companies
  • Companies or other users to whom your data is shared at your direction
  • Entities involved in a corporate transaction
  • Not sold or shared

Collection of the categories of personal information identified above may occur through one or more of the following sources:

  • From you, when you engage in certain activities such as when you register and/or set up an account/profile to access the Service or Digital Properties, including by submitting User Content.
  • From third party social networking service(s) that you may have accessed, visited, and/or used that may be integrated with or linked to the Service or Digital Properties(s).
  • From lead generation partners or sources.
  • From identity verification partners.
  • From entities that sell or share your personal information, including entities registered in California as data brokers.
  • From service providers who gather personal information from you or external parties who possess and/or process your personal information, once you grant the requisite right, power, and/or authority to those service providers to act on your behalf and gather and/or provide such data to us.
  • Through local device storage (placing and/or storing code or other types of information and/or devices (e.g., "cookies") on your Device(s)) or other Tracking Technologies (web beacons, web bugs, clear gifs, and similar technologies), as described in detail in Section B and F of this Consumer Notice.

The business and/or or commercial purpose(s) for which we collect the data identified above may include one or more of the following:

  • Auditing, such as auditing related to a current interaction with you and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards;
  • Debugging, such as debugging to identify and repair errors that impair existing intended functionality;
  • The occurrence of mergers and acquisitions, including in the event Carvana or ADESA undergoes a corporate reorganization such as a merger, acquisition, sale of part or all of its business, or other related event (including transfers made as part of insolvency or bankruptcy proceedings) involving all or part of Carvana or ADESA, or as part of a corporate reorganization or stock sale, in which data may be collected, used, or shared for the purpose of negotiating or completing such transactions;
  • Performing or improving services, such as maintaining or servicing accounts, providing customer service, facilitating communications between users, providing consumers with requested or personalized content, communicating with you about new features, products, or services, processing or fulfilling orders and transactions, tailoring the services that we offer to your needs; verifying your information, processing payments, providing financing, providing analytic services, or providing similar services on behalf of Carvana or ADESA;
  • Quality assurance, including undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by Carvana or ADESA, and to improve, upgrade, or enhance the Service and Digital Properties or a device that is owned, manufactured, manufactured for, or controlled by Carvana or ADESA;
  • Security, such as detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and/or prosecuting those responsible for that activity;
  • Short-term, transient use;
  • To communicate, advertise, and/or market Carvana or ADESA’s goods, products, and/or services, to show you content and sponsored messaging, to engage in interest-based advertising, to gauge the effectiveness of marketing campaigns, and/or for other marketing or advertising purposes;
  • To comply with legal or compliance requirements, such as compliance training, investigating and responding to legal claims, responding to law enforcement requests, or as otherwise required by law;
  • To conduct internal research, including undertaking internal research for technological development and/or demonstration and analyzing trends;
  • To help diagnose problems with our servers, to gather broad demographic information, track users' movements around the Service and Digital Properties, and/or to otherwise administer the Service and Digital Properties; and/or
  • To track geographic location, usage patterns, broad demographic information, and/or the movements of individual users.

We do not collect Sensitive Personal Information for the purpose of inferring characteristics about you. We do not use or disclose Sensitive Personal Information for purposes to which the right to limit use and disclosure or right to revoke applies under the CCPA and OCPA.

Retention. We retain your Personal Information as long as necessary to fulfill the purposes outlined in this Consumer Notice unless we are required to do otherwise by applicable law. This includes retaining your Personal Information to provide you with the products or services you have requested and interact with you; maintain our business relationship with you; improve our business over time; ensure the ongoing legality, safety and security of our services and relationships; or otherwise in accordance with our internal retention procedures. Once you have terminated your relationship with us, we may retain your Personal Information in our systems and records in order to ensure adequate fulfillment of surviving provisions in terminated contracts or for other legitimate business purposes, such as to enable easier future user onboarding, demonstrate our business practices and contractual obligations, or provide you with information about our products and services in case of interest.

Your Rights

California and Oregon residents may exercise the following rights, subject to legal limitations and applicable exceptions, via our Privacy Portal at https://privacy.carvana.com/privacy or by calling 800-333-4554.

  • Right to Know. You have the right to request information about the categories of personal information we have collected about you, the categories of sources from which we collected the personal information, the purposes for collecting, selling, or sharing the personal information, and the categories of third parties with whom we have shared or sold your personal information (“Categories Report”). You may also request information about the specific pieces of personal information we have collected about you (“Specific Pieces Report”).
  • Right to Delete. You have the right to request that we delete personal information that we have collected from you.
  • Right to Correct. You have the right to request that we correct inaccurate information that we maintain about you.
  • Right to Opt Out. You have the right to opt out of the sale or processing of your personal information.

To fully exercise the Right to Opt Out, you must both: (A) submit an Opt-Out of Sale/Sharing request through our Privacy Portal and (B) disable the “Sale/Sharing” toggle through Your Privacy Choices. Disabling the “Sale/Sharing” through Your Privacy Choices will place a cookie on your browser signaling that you have opted out of such online activities. Please note:

  • The opt-out cookie only applies to the Carvana or ADESA website and only to the browser and Device you are using at the time you make the selection. You will also need to disable the “Sale/Sharing” toggle through Your Privacy Choices from each browser on each Device you use, and on each Carvana or ADESA website you access.
  • If you clear cookies on your browser, you will need to disable the “Sale/Sharing” toggle through Your Privacy Choices from that browser again.
  • If you have blocked cookies through your browser settings, we will be unable to comply with your opt out request.

To the extent required by law, we will honor opt-out preference signals sent in a format commonly used and recognized by businesses, such as an HTTP header field or JavaScript object. We will process opt-out preference signals at the browser level.

In accordance with applicable law, we will not discriminate against you for exercising these rights.

Verification: In order to exercise your rights, except your right to Opt-Out, as described above, we may need to obtain information to locate you in our records, verify that you are a California or Oregon resident, and/or verify your identity depending on the nature of the request. We may request some or all of the following information to verify your identity or locate you in our records: name, email address, date of birth, and last four digits of SSN. In some cases, we may require additional or different information in order to verify your identity. Once you submit a request, we will send an email to acknowledge our receipt of your request and verification that you must respond to in order for us to proceed with a Right to Delete, Right to Correct, or Right to Know.

Please be aware there might be circumstances where we will not honor your request, as permitted under the CCPA or OCPA. For example, if we are not able to verify your identity and/or that you are a California or Oregon resident, we may not honor your access, deletion, or correction request. Additionally, we may not honor your request if an exception under the CCPA or OCPA applies.

Authorized Agents: Authorized agents may exercise rights on behalf of consumers, but we reserve the right to also verify the consumer directly as described above. Authorized agents must use the Privacy Portal and upload signed permission from the consumer demonstrating the agent has authority to exercise rights on the consumer’s behalf. We may also require the consumer to directly verify their own identity with us or directly confirm they provided the agent permission to submit the request.

Timing: We will process a Request to Opt Out within 15 business days. We will respond to Requests to Delete, Requests to Correct, and Requests to Know within 45 calendar days, unless we need more time (in which case we will notify you) and may take up to 90 calendar days in total to respond to your request(s).

California Shine the Light: If you are a California resident, you may opt out of sharing your Personal Information with third parties for the third parties’ direct marketing purposes. Please contact us at [email protected] if you would like to do so.

Total Requests (1/1/2023 - 12/31/2023)
Request TypeNumber of Requests
Total Do Not Sell Requests Received*

293445

Do Not Sell requests denied

0

Do Not Sell requests complied with in whole

293445

Do Not Sell requests complied with in part

0

Average number of days to complete Do Not Sell requests

1

Total Delete Requests Received

1421

Delete requests denied

754

Delete requests complied with in whole

667

Delete requests complied with in part

0

Average number of days to complete Delete requests

6

Total Right to Know Requests

68

Right to Know requests denied

49

Right to Know requests complied with in whole

19

Right to Know requests complied with in part

0

Average number of days to complete Right to Know requests

17

Total Right to Correct

5

Right to Correct requests denied

5

Right to Correct requests completed

0

Average Days to complete

3

Total Right to Limit Requests

Not Applicable

*Metrics disclosed for this category represent requests for all individuals, including California consumers

* * * * * * * * * * * * *

If you don't agree to the terms contained in this Consumer Notice, you must immediately exit the Service and Digital Properties.

Last Revised and Effective: July 1, 2024

IV. APPLICANT PRIVACY NOTICE

California Job Applicant Privacy Notice
Effective Date: July 1, 2024

PRIVACY NOTICE /YOUR PRIVACY RIGHTS

A. Introduction

Carvana Operations HC LLC (“Carvana”), together with its parents, subsidiaries, and affiliates, including ADESA US Auction, LLC (“ADESA,”) together and collectively with Carvana, referred to throughout this Applicant Privacy Notice as "Company," "us," "we," or "our," is committed to protecting the privacy of Personal Information (defined below). This Applicant Privacy Notice contains details about how we collect, use, share, and retain (collectively “process”) the Personal Information of California residents’ (“you” or “your”) when you interact with us via our website(s), email, mobile application(s), social media accounts, online advertisements, and other digital platforms (collectively, “Digital Properties”), and through other online and offline interactions when you apply for a job with us. Unless otherwise noted, the information below describes how and why we collected, used, and disclosed your information within the past 12 months and describes how and why we will use new information collected from you. It also explains your rights relating to Personal Information under the California Consumer Privacy Act (the “CCPA”).

Applicability: This Applicant Privacy Notice DOES NOT APPLY to Personal Information we may collect about you in other contexts outside of your role as an applicant, such as information we collect about you if you do business with us: (i) as a consumer in connection with financial products or services primarily for personal, family, or household purposes; (ii) in a business-to-business context, as a vendor, service provider, or business partner; or (iii) once you have become an employee. If you interact with our website, purchase our products or services, or otherwise engage with us outside of your applicant relationship, Carvana’s User Agreement and Financial and Other Privacy Notices apply to any Personal Information we process through those interactions.

We are required by California’s privacy laws and regulations to give you the information in this Applicant Privacy Notice. It is important that you read this Applicant Privacy Notice carefully, together with any other information that we might give you from time to time about how we collect and use your Personal Information.

Whenever you interact with us on behalf of another individual or entity, such as if you provide us with names of other individuals as references in your job application, you must obtain their consent (or have the legal authority without consent) to share their Personal Information with us.

Changes: We may update this Applicant Privacy Notice from time to time. Any updated Applicant Privacy Notice will be effective when posted. Please check this Applicant Privacy Notice periodically for updates. If required by law, we will contact you directly to provide you with an updated Applicant Privacy Notice.

This Applicant Privacy Notice does not form part of any contract of employment or other contract to provide services and does not give you any contractual rights.

As used in this Notice, the term "Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an individual or household. Personal Information does not include information that is publicly available, de-identified, or aggregated.

B. Sources of Personal Information

We collect Personal Information about you from the following sources:

  1. Directly from you. We may collect Personal Information you provide to us directly, such as when you use Our website, mobile site, application, and/or other service, regardless of how distributed, transmitted, published, or broadcast (each, a "Service), or when you complete a paper or online application (including on a dedicated online talent management platform), communicate with us in connection with your application, provide references, or participate in an interview or any aptitude test or assessment (including online). We may also collect your Personal Information when you decide to complete questionnaires, such as a satisfaction survey or a diversity and inclusion questionnaire.
  2. Information automatically collected or inferred from your online interaction with us and through tracking technologies. We automatically collect technical information about your online interactions with us (such as IP address or other unique identifier related to you or your laptop, personal computer, browser, mobile device, tablet, or other device (a "Device" or "Devices"), Device location, characteristics, and capabilities, prior and current web activity, your Carvana and ADESA website activities and related click data, and browsing preferences when you visit or interact with our Service or Digital Properties (“Usage Information”).
  3. Information from public sources, including government entities from which public records are obtained and information you submit in public forums.
  4. From third parties. We may collect Personal Information from third parties, such as companies or individuals who direct or refer you to us (including third-party staffing or recruiting firms or individuals who suggest or identify you, as well as from publicly available sources and third-party professional social networking websites). Where permitted or otherwise authorized by law, we may also collect information received from third parties in connection with references or background checks.

We may combine and use information and make inferences from information that we receive from the various sources described in this Applicant Privacy Notice, including third party sources. We may also use or disclose the combined information and inferences for the purposes identified below.

C. Types of Personal Information We Collect

We may collect the following types of Personal Information about you such as:

  1. Identifiers. Such as real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.
  2. Records About You, such as signatures or electronic signatures.
  3. Characteristics of protected classifications under California or federal law, such as your age (including birthdates), racial or ethnic origin, military or veteran status, disability status, marital status, sex, and your sexual orientation or gender identity.
  4. Commercial information, such as salary and wage information and history, credit check history, household income data, and loan information.
  5. Internet or other electronic network activity information,such as your browsing history, search history, and information regarding your interactions with and use of our Digital Properties, including via cookies and other tracking technologies. Please see Section F for further information.
  6. Geolocation data, such as your location, derived from your IP address.
  7. Audio, electronic, visual, or other sensory information,such as photographs or security camera footage in public areas of our facilities (including reception, the work floor, conference rooms, parking, and other general areas) if you participate in on-site activities, such as a job fair, job interview or aptitude test, as well as photographs, audio, or footage collected in the course of video interviews or through an online applicant platform, or other recordings.
  8. Professional or employment-related information, such as certifications, qualifications, membership in professional bodies, employment history, job preferences (including your willingness to relocate or travel), documentation required under immigration and employment laws (such as citizenship, visa data, details of residency, and work permit information). We may also collect and process information about you generated during or after interviews and related activities, such as tests or satisfaction surveys. This information may come directly from you or from our employees or contractors. In addition, we may collect information about criminal convictions and offenses, such as information from legal proceedings, disciplinary information or sanctions from previous jobs, and information from background checks, alcohol or drug testing information (if permissible under law), employment eligibility checks, and other details you choose to disclose in your application materials, resume, or curriculum vitae (CV).
  9. Education Information, such as education history, professional qualifications, academic certificates and licenses, languages spoken, and other relevant skills.
  10. Inferences, including those drawn from the applicant information you submit. Such inferences include the likelihood of your profile being a good fit with our internal team and long-term prospects with us, or inferences relating to the detection and prevention of potential fraud. Inferences may also be drawn from the information collected via the tracking and cookies technologies identified in Section F below.
  11. Sensitive Personal Information, including the following, where permissible or required under applicable laws and regulations:
    • Social Security number, driver’s license, state identification card, or passport number.
    • Account log-in information.
    • Racial or ethnic origin, religious or philosophical beliefs, or union membership.
    • Information about your health, such as disability status and information about such disability, drug-test results, vaccination status, and food intolerances (if, for instance, we invite you for a meal or we book a flight for your job interview).
    • Information about your sexual orientation, should you choose to provide it.

D. How We Use Personal Information

We may use each category of your Personal Information described above for the following purposes:

  1. In connection with your application, such as assessing your application, interview, and test results for suitability for the position for which you have applied or other open positions; communicating with you concerning job openings or your application; conducting pre-employment verification and screening; offering you the job position, in our discretion; notifying you of job opportunities (including from affiliates in our group, where we have shared your job application with them); and dealing with any inquiry, challenge, or request for feedback received in relation to our recruitment and hiring decisions.
  2. For our internal business purposes, such as managing and improving our recruitment process (for example, enhancing our scouting and talent identification processes); enforcing our policies and rules; and operating our diversity and inclusion initiatives.
  3. For legal, safety or security reasons, such as complying with legal requirements, processes, or orders; complying with reporting and similar requirements; complying with government inspections and other requests from government or other public authorities; pursuing legal rights and remedies; investigating and responding to claims against Carvana or ADESA and its customers and employees; monitoring and managing equal opportunity programs; screening and conducting background checks (as required or permitted by law); protecting our, your, our customers’, and other individuals’ safety, property or rights; addressing security and health and safety issues (including managing spread of communicable diseases) and malicious, deceptive, fraudulent, or illegal activity; ascertaining your eligibility for work; and receiving legal advice or approval.
  4. For marketing. We may use your Personal Information to market our products or services or those of third parties, such as our business partners or other users of our Service. We may use your Personal Information to invite you to participate in marketing surveys, questionnaires, promotions, events, or contests. We may audit aspects of our ad impressions and verify positioning and quality of ad impressions. We may use your Personal Information for short-term transient use, including for contextual ad customization. We may use your Personal Information to enhance our content and to deliver advertisements to you, including commercial emails. For more information about online marketing activity, see Section F below.
  5. In connection with a corporate transaction, such as if we acquire, or some or all of our assets are acquired by, another entity, including through a sale in connection with bankruptcy and other forms of corporate change.
  6. For recruiting purposes, such as to notify you about employment opportunities.

Additionally, we may use anonymized, de-identified, or aggregated information for any purpose permitted by law.

E. With Whom We Disclose or Share Personal Information

We may disclose or share your Personal Information with the categories of recipients described below:

  1. Affiliates and subsidiaries, including parent entities, corporate affiliates, subsidiaries, business units, and other companies that share common ownership with us.
  2. Service providers that work on our behalf to provide products and services, such as IT support providers, software service providers, background check vendors, and drug-screening providers.
  3. Professional consultants, such as recruiters, accountants, lawyers, financial advisors, and audit firms.
  4. Service Providers necessary to complete transactions you request,such as shipping companies; background check vendors; drug screening providers; and logistics providers.
  5. Law enforcement, government agencies, and other recipients for legal, security, or safety purposes, such as when we share information to comply with law or legal requirements, to enforce or apply our policies, and to protect ours, our customers’, or third parties’ safety, property or rights.
  6. To other entities in connection with a corporate transaction, such as if we, or some or all of our assets, are acquired by another entity, including through a sale in connection with bankruptcy or other forms of corporate change.
  7. Third parties, such as certain travel services, companies that operate cookies and other tracking technologies, social media companies, certification providers, and other third parties who may use this information to market to you directly.
  8. Entities to which you have consented to the disclosure, where consent is required by law.

We do not collect Sensitive Personal Information for the purpose of inferring characteristics about you.

We do not use or disclose Sensitive Personal Information for purposes to which the right to limit use and disclosure applies under the CCPA.

F. How We Use Cookies and Tracking Technologies

We and authorized third parties, through our Digital Properties, may also collect information, which may include Personal Information, via cookies, web beacons, tracking pixels, embedded scripts, location-identifying technologies, Device recognition technologies, in-app tracking methods, Device and activity monitoring, session replay technologies, or other manual, passive, or automatic tracking technologies, programs, or platforms (“Tracking Technologies”).

Please note: The use of cookies/tracking technologies and the data sharing related to such technologies identified in this Section F may constitute a sale or sharing of Personal Information under California law. If you would like to opt out of the sale and sharing of your Personal Information, please follow the steps to opt out provided in Section H, below.

We do not "sell" or "share" (as those terms are defined by the CCPA) the Personal Information you submit to us in relation to a job application or prospective job application.

Types of information collected. We and authorized third parties collect data about you and your Devices, including but not limited to Usage Information; your Internet Service Provider; IP address/Internet address from which you accessed our website(s) and/or other unique identifier(s) related to you or your Device(s); cookie ID; Ad ID; Device location (both approximate and precise); Device characteristics (including make, model, operating system/settings, and other specifications); browser type used; the date and time you access our website(s) and/or take certain actions on our website(s); recordings of your interactions with our websites and other Digital Properties; the pages you accessed while visiting our website(s) and related click behavior (such as products or offerings viewed and/or purchased); advertisements viewed; previously visited websites, applications, and services; search history; and preferences.

Types of Tracking Technologies used. We and third parties that we authorize may use the following Tracking Technologies on the Service and Digital Properties:

  • Cookies

    A cookie is a small text file that is stored on a user’s Device. We may place cookies on your Device(s), which may last only during a single session or may be persistent over multiple sessions over time. Session cookies make it easier for you to navigate the Service and Digital Properties and expire when you close your browser. Other cookies remain longer and help in understanding how you use the Service and Digital Properties, for marketing, to personalize and enhance your user experience, and other purposes described below.

  • Web Beacons (“Tracking Pixels”)

    Web beacons are small graphic images, also known as “tracking pixels,” “Internet tags,” or “clear gifs,” embedded in web pages and e-mail messages. Web beacons may be used to count the number of visitors to the Service and Digital Properties, facilitate marketing, monitor how users navigate the Service and Digital Properties, and to count content views.

  • Embedded Scripts

    An embedded script is programming code designed to collect information about your interactions with the Service and Digital Properties. It is temporarily downloaded onto your computer from our web server, or from a third party with which we work, and is active only while you are connected to the Service or Digital Properties and deleted or deactivated thereafter.

  • Location-Identifying Technologies

    GPS (global positioning systems) software, geo-filtering, and other location-aware technologies locate you (sometimes precisely), or make assumptions about your location, for purposes such as verifying your location and delivering or restricting content based on your location. If you have enabled GPS or use other location-based features on the Service or Digital Properties, your Device location may be tracked by us and third parties. Certain Service or Digital Properties features may access and use information about your Device location (such as based on IP address or GPS, as applicable), or your account information, to suggest certain content, products, or services that may be available to you. Our Service and Digital Property content may be personalized based on various information we may have about you to try to provide you with more location-relevant content.

  • Device Recognition Technologies

    We may use device recognition technologies, including application of statistical probability to data sets, as well as linking a common unique identifier to different device use (e.g., Facebook ID), which attempt to recognize or make assumptions about users and devices (e.g., that a user of multiple devices is the same user or household) (“Cross-device Data”).

  • In-App Tracking Methods

    There are a variety of Tracking Technologies that may be included in mobile applications, and these are not browser-based like cookies and cannot be controlled by browser settings. Some use device identifiers or other identifiers such as “Ad IDs,” or may use “SDKs,” to associate app user activity to a particular app and to track user activity across apps and/or devices. SDKs are blocks of code that may be installed in our mobile application by third party companies with which we work. SDKs help us understand how you interact with our mobile application, to improve marketing, and collect certain information about the Device and network you use to access our application, such as the advertising identifier associated with your Device and information about how you interact with our application.

  • Device and Activity Monitoring Technologies

    We use technologies such as session replay tools that monitor, and may record, your interactions with the Service and Digital Properties, including without limitation, keystrokes and how you move through and engage with the Service and Digital Properties. These technologies may also collect and analyze information from your Device, such as, without limitation, your operating system, plug-ins, system fonts, and other data.

Purposes for using these technologies. We and authorized third parties use these Tracking Technologies for purposes including:

  • Personalization, such as remembering user preferences, login details and browsing behavior; tracking your activity across online properties and platforms over time to better understand your preferences and interests; and personalizing online content;
  • Improving performance, such as maintaining and improving the performance of the Service and Digital Properties;
  • Analytics, such as analyzing how the Service and Digital Properties are used to help us improve the Service’s and Digital Properties’ performance and user experience;
  • Advertising, such as providing you with offers that may be of interest to you; conducting targeted advertising to you on the Service and Digital Properties, as well as digital properties of third parties; and measuring the effectiveness of our communications with you and advertising campaigns, including identifying how and when you engage with our communications; and
  • Security, such as user or Device identification and prevention of fraud and malicious behavior.

These Tracking Technologies may be used to track you across Devices and websites over time for purposes above.

Disclosure of your information. We may disclose Personal Information to third parties or permit third parties to place Tracking Technologies on our website(s) to allow these third parties to directly collect Personal Information from you, such as social media companies, advertising networks, companies that provide analytics including ad tracking and reporting, security providers, and others that help us operate our business, including the Service and Digital Properties. These companies use this information to provide you with more relevant advertising tailored to your interest based on your browsing of the Service and Digital Properties and elsewhere on the Internet, sometimes known as “interest-based advertising” and “online behavioral advertising (“Interest-based Advertising”) which may include sending you an ad on another online service after you have left the Service or Digital Properties (i.e., “retargeting”).

Our disclosures of information to third parties may include the following:

  • Google Analytics.
  • We use Google Analytics to analyze traffic to our website(s) in order to help us understand our customers' and visitors' needs and to continually improve our site(s) for them. The data they collect on our behalf may include, but is not limited to, search engine referrals, affiliate referrals, traffic driven by banner ads or other online promotions, how visitors navigate around the site, and the most popular pages. We also collect certain technical information, such as the browser version and operating system. We reserve the right to use, transfer, sell, and share data about our users for any lawful business purpose, such as analyzing usage trends and seeking compatible advertisers, sponsors, clients, and customers. For more information on how Google Analytics collects and processes data, please visit www.google.com/policies/privacy/partners/.
  • Social media companies.We use social media Tracking Technologies (such as the Meta Pixel and/or related Meta business tools) that may allow third parties, including Meta, to collect or receive information from our Service, Digital Properties, and/or elsewhere on the Internet and use that information to provide measurement services and target ads. In addition, we may serve ads on other online services that are targeted to reach people on those services that are also identified in one or more of our databases (“Matched List Ads”). This is done by using Tracking Technologies or by matching common factors between our databases and the databases of the other online services. For instance, we may use such ad services offered by Meta or X and other third-party services. We are not responsible for these third-party services, including without limitation their security of the data. Most third-party social media companies (such as Meta and X) will generally enable you to hover over the box in the right corner of such a Meta ad, or go to your social media account settings, and find out what options you have to control such ads. We are not responsible for such third parties’ failure to comply with your or our opt-out instructions, they may not give us notice of opt-outs to our ads that you give to them, and they may change their options without notice to us or you.

Your choices regarding Tracking Technologies. Some of the companies that perform advertising-related services may participate in the Digital Advertising Alliance’s (“DAA”) Self-Regulatory Program for Online Behavioral Advertising. To learn more about how you can exercise certain choices regarding Interest-based Advertising, visit http://www.aboutads.info/choices/ and http://www.aboutads.info/appchoices for information on the DAA’s opt-out programs. Some of these companies may also be members of the Network Advertising Initiative (“NAI”). For more information about the NAI including how consumers can opt-out from receiving interest-based advertising from some or all of NAI's members, please visit http://www.networkadvertising.org/choices. Opting out of Interest-based Advertising will not opt you out of all advertising, but rather only Interest-based Advertising from us or our agents or representatives. Also, if your browsers are configured to reject cookies when you visit these opt-out webpages, or you subsequently erase your cookies, use a different Device or web browser, or use a non-browser-based method of access (e.g., mobile app), your NAI / DAA browser-based opt-out may not, or may no longer, be effective.

Some browsers have incorporated Do Not Track (“DNT”) preferences. Most of these features, when turned on, send signals to the website you are visiting that you do not wish to have information about your online searching and browsing activities collected and used. As there is not yet a common agreement about how to interpret DNT signals, we do not honor DNT signals from website browsers at this time. However, you may be able to refuse or delete cookies. If you refuse or delete cookies, some of our website(s) functionality may be impaired. If you change Devices or browsers, or use multiple Devices or browsers, and delete your cookies, you may need to repeat this process for each Device or browser. Please refer to your browser’s Help instructions to learn more about how to manage cookies and the use of other tracking technologies.

G. Additional Disclosures

Personal Information

We do not knowingly collect, sell, or share Personal Information of minors under the age of 16.

Below please find a chart detailing the categories of Personal Information we collect and with whom we disclose it and for what Business Purpose we do so, as well as the parties to whom we may have sold or shared the Personal Information. We do not “sell” or “share” (as those terms are defined under the CCPA) the Personal Information you submit to us in relation to a job application or prospective job application.

Categories of Personal Information We CollectCategories of Third Parties With Whom We Disclose Personal InformationBusiness Purposes for Which We Disclose Personal InformationCategories of Third Parties With Whom We Sell or Share Personal Information
Identifiers (Section C.1)
  • Affiliates and subsidiaries
  • Service providers
  • Professional consultants
  • Vendors necessary to complete transactions you request
  • Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
  • In connection with a corporate transaction
  • Entities to which you have consented to the disclosure
  • In connection with your application
  • For our internal business purposes
  • For legal, safety or security reasons
  • In connection with a corporate transaction
  • For recruiting purposes
  • For any other purpose with your consent
  • Third party social network services.
  • Data analytics providers
  • Marketing and advertising partners or providers
  • Companies that create or receive sales leads
Records About You (Section C.2)
  • Affiliates and subsidiaries
  • Service providers
  • Professional consultants
  • Vendors necessary to complete transactions you request
  • Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
  • In connection with a corporate transaction
  • Entities to which you have consented to the disclosure
  • In connection with your application
  • For our internal business purposes
  • For legal, safety or security reasons
  • In connection with a corporate transaction
  • For recruiting purposes
  • For any other purpose with your consent
  • Third party social network services.
  • Data analytics providers
  • Marketing and advertising partners or providers
  • Companies that create or receive sales leads
Characteristics of protected classifications under California or federal law (Section C.3)
  • Affiliates and subsidiaries
  • Service providers
  • Professional consultants
  • Vendors necessary to complete transactions you request
  • Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
  • In connection with a corporate transaction
  • Entities to which you have consented to the disclosure
  • In connection with your application
  • For our internal business purposes
  • For legal, safety or security reasons
  • In connection with a corporate transaction
  • For recruiting purposes
  • For any other purpose with your consent
  • Not sold or shared
Commerical information (Section C.4)
  • Affiliates and subsidiaries
  • Service providers
  • Professional consultants
  • Vendors necessary to complete transactions you request
  • Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
  • In connection with a corporate transaction
  • Entities to which you have consented to the disclosure
  • In connection with your application
  • For our internal business purposes
  • For legal, safety or security reasons
  • In connection with a corporate transaction
  • For recruiting purposes
  • For any other purpose with your consent
  • Not sold or shared
Internet or other electronic network activity (Section C.5)
  • Affiliates and subsidiaries
  • Service providers
  • Professional consultants
  • Vendors necessary to complete transactions you request
  • Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
  • In connection with a corporate transaction
  • Entities to which you have consented to the disclosure
  • In connection with your application
  • For our internal business purposes
  • For legal, safety or security reasons
  • In connection with a corporate transaction
  • For recruiting purposes
  • For any other purpose with your consent
  • Third party social network services.
  • Data analytics providers
  • Marketing and advertising partners or providers
  • Companies that create or receive sales leads
Geolocation data (Section C.6)
  • Affiliates and subsidiaries
  • Service providers
  • Professional consultants
  • Vendors necessary to complete transactions you request
  • Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
  • In connection with a corporate transaction
  • Entities to which you have consented to the disclosure
  • In connection with your application
  • For our internal business purposes
  • For legal, safety or security reasons
  • In connection with a corporate transaction
  • For recruiting purposes
  • For any other purpose with your consent
  • Third party social network services.
  • Data analytics providers
  • Marketing and advertising partners or providers
  • Companies that create or receive sales leads
Audio, electronic, visual, olfactory, or similar information (Section C.7)
  • Affiliates and subsidiaries
  • Service providers
  • Professional consultants
  • Vendors necessary to complete transactions you request
  • Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
  • In connection with a corporate transaction
  • Entities to which you have consented to the disclosure
  • In connection with your application
  • For our internal business purposes
  • For legal, safety or security reasons
  • In connection with a corporate transaction
  • For recruiting purposes
  • For any other purpose with your consent
  • Third party social network services.
  • Data analytics providers
  • Marketing and advertising partners or providers
  • Companies that create or receive sales leads
Professional or employment-related information (Section C.8)
  • Affiliates and subsidiaries
  • Service providers
  • Professional consultants
  • Vendors necessary to complete transactions you request
  • Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
  • In connection with a corporate transaction
  • Entities to which you have consented to the disclosure
  • In connection with your application
  • For our internal business purposes
  • For legal, safety or security reasons
  • In connection with a corporate transaction
  • For recruiting purposes
  • For any other purpose with your consent
  • Not sold or shared
Education information (Section C.9)
  • Affiliates and subsidiaries
  • Service providers
  • Professional consultants
  • Vendors necessary to complete transactions you request
  • Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
  • In connection with a corporate transaction
  • Entities to which you have consented to the disclosure
  • In connection with your application
  • For our internal business purposes
  • For legal, safety or security reasons
  • In connection with a corporate transaction
  • For recruiting purposes
  • For any other purpose with your consent
  • Not sold or shared
Inferences (Section C.10)
  • Affiliates and subsidiaries
  • Service providers
  • Professional consultants
  • Vendors necessary to complete transactions you request
  • Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
  • In connection with a corporate transaction
  • Entities to which you have consented to the disclosure
  • In connection with your application
  • For our internal business purposes
  • For legal, safety or security reasons
  • In connection with a corporate transaction
  • For recruiting purposes
  • For any other purpose with your consent
  • Third party social network services.
  • Data analytics providers
  • Companies that create or receive sales leads
Sensitive personal information (Section C.11)
  • Affiliates and subsidiaries
  • Service providers
  • Professional consultants
  • Vendors necessary to complete transactions you request
  • Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
  • In connection with a corporate transaction
  • Entities to which you have consented to the disclosure
  • In connection with your application
  • For our internal business purposes
  • For legal, safety or security reasons
  • In connection with a corporate transaction
  • For recruiting purposes
  • For any other purpose with your consent
  • Not sold or shared


H. California Rights Concerning Personal Information

California residents may exercise the following rights, subject to legal limitations and applicable exceptions.

  • Right to Know. You have the right to request information about the categories of Personal Information we have collected about you, the categories of sources from which we collected the Personal Information, the purposes for collecting, selling, or sharing the Personal Information, and the categories of third parties with whom we have shared or sold your Personal Information (“Categories Report”). You may also request information about the specific pieces of Personal Information we have collected about you (“Specific Pieces Report”).
  • Right to Delete. You have the right to request that we delete Personal Information that we have collected from you.
  • Right to Correct. You have the right to request that we correct inaccurate Personal Information that we maintain about you.
  • Right to Opt Out. You have the right to opt out of the sale and sharing of your Personal Information.
  • Additional California Rights. You have the right to limit the use of your sensitive personal information (information like your SSN, driver’s license number, etc.). However, this right is not applicable to your interactions with Carvana because we do not process sensitive personal information subject to this limitation. We only use your sensitive personal information for job applicant purposes (as described above); we do not use your sensitive personal information for other purposes (such as marketing).

You may exercise your Right to Know, your Right to Delete, and your Right to Correct via our Employment Privacy Portal at https://privacy.carvana.com/privacy or by calling 800-333-4554.

You may exercise your Right to Opt Out by disabling the “Sale/Sharing” toggle through Your Privacy Choices.

In accordance with applicable law, we will not discriminate against you for exercising these rights.

Verification: In order to exercise your rights, we may need to obtain information to locate you in our records, verify that you are a California resident, and/or verify your identity depending on the nature of the request. In most cases, we will collect some or all of the following data elements: first and last name, email address, and telephone number. In some cases, we may request different or additional information, and will inform you if we need such information. Once you submit a request, we will send a verification email that you must respond to in order for us to proceed with your request as part of the verification process.

Authorized Agents: Authorized agents may exercise rights on behalf of California residents by submitting a request via our webform and indicating that they are submitting the request as an agent. We will require the agent to demonstrate authority to act on behalf of the resident by providing signed permission from the resident. We may also require the resident to verify their own identity directly with us or to directly confirm with us that they provided the authorized agent with permission to submit the request.

Timing: We will process the Right to Opt Out of Sale or Sharing requests within 15 business days. We will respond to Right to Delete, Right to Correct, and Right to Know requests within 45 calendar days, unless we need more time, in which case we will notify you and may take up to 90 calendar days in total to respond to your request.

I. Data Security and Data Retention

1. Security. We maintain reasonable security procedures and technical and organizational measures to protect your Personal Information against accidental or unlawful destruction, loss, disclosure, alteration, or use. However, because no data transmission is completely secure, and no system of physical or electronic security is impenetrable, we cannot guarantee the security of the information you send to us or the security of our servers, networks, or databases, and by using our Service or Digital Properties you agree to assume all risk in connection with the information sent to us or collected by us when you access, visit, and/or use our Service or Digital Properties, including without limitation your personally identifiable information, Personal Information, or other registration information, and we are not responsible for any loss of such information, or the consequences thereof.

2. Retention. We retain your Personal Information as long as necessary to fulfill the purposes outlined in this Applicant Privacy Notice unless we are required to do otherwise by applicable law. This includes retaining your Personal Information to provide you with the products or services you have requested and interact with you; maintain our business relationship with you; improve our business over time; ensure the ongoing legality, safety and security of our services and relationships; or otherwise in accordance with our internal retention procedures. Once you have terminated your relationship with us, we may retain your Personal Information in our systems and records in order to ensure adequate fulfillment of surviving provisions in terminated contracts or for other legitimate business purposes, such as to enable easier future user onboarding, demonstrate our business practices and contractual obligations, or provide you with information about our products and services in case of interest.

J. Contact Information

If you have questions regarding this Applicant Privacy Notice or how we use your Personal Information, please contact us at:

EMAIL:[email protected]
MAIL:Attention: Legal
300 E Rio Salado Pkwy
Building 1
Tempe, AZ 85281

V. BUSINESS ("B2B") PRIVACY NOTICE

CALIFORNIA PRIVACY NOTICE FOR INDIVIDUALS IN A BUSINESS RELATIONSHIP WITH CARVANA (“BUSINESS PRIVACY NOTICE”)
Effective Date: July 1, 2024

PRIVACY NOTICE /YOUR PRIVACY RIGHTS

A. Introduction

Carvana Operations HC LLC (“Carvana”), together with its parents, subsidiaries, and affiliates, including ADESA US Auction, LLC (“ADESA,”) together and collectively with Carvana, referred to throughout this Notice as "Company," "us," "we," or "our," is committed to protecting the privacy of Personal Information (defined below). This Business Privacy Notice contains details about how we collect, use, share, and retain (collectively “process”) the Personal Information of California residents (“you” or “your”) collected about individuals with whom we engage in solely business-to-business communications and transactions, such as our vendors, service providers, and business partners when you interaction with us via our website(s), email, mobile application(s), social media accounts, online advertisements, and other digital platforms (collectively, “Digital Properties”) and through other online and offline interactions. Unless otherwise noted, the information below describes how and why we collected, used, and disclosed your information within the past 12 months and describes how and why we will use new information collected from you. It also explains your rights relating to Personal Information under the California Consumer Privacy Act (the “CCPA”).

Applicability: This Business Privacy Notice DOES NOT APPLY to Personal Information we may collect about you in other contexts, such as information we collect about you if you do other business with us as: (i) a consumer in connection with financial products or services primarily for personal, family, or household purposes; (ii) as an applicant for employment; or (iii) once you have become an employee. If you interact with our website, purchase our products or services, or otherwise engage with us outside of your applicant relationship with us, Carvana’s User Agreement and Financial and Other Privacy Notices apply to any Personal Information we process through those interactions.

We are required by California’s privacy laws and regulations to give you the information in this Business Privacy Notice. It is important that you read this Business Privacy Notice carefully, together with any other information that we might give you from time to time about how we collect and use your Personal Information.

Whenever you interact with us on behalf of another individual or entity, such as by providing or accessing Personal Information about another individual, you represent that your interactions and exchanges comply with applicable data privacy laws. You shall have sole responsibility for any violation of applicable laws as a result of a failure to obtain any necessary consent from such individuals.

Changes: We may update this Business Privacy Notice from time to time. Any updated Business Privacy Notice will be effective when posted. Please check this Business Privacy Notice periodically for updates. If required by law, we will contact you directly to provide you with an updated Business Privacy Notice.

This Business Privacy Notice does not form part of any contract of employment or other contract to provide services and does not give you any contractual rights.

As used in this Business Privacy Notice, the term “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an individual or household. Personal Information does not include information that is publicly available, de-identified, or aggregated.

B. Sources of Personal Information

We collect Personal Information about you from the following sources:

  1. Directly from you. When you use our website, mobile site, application, and/or other service, regardless of how distributed, transmitted, published, or broadcast (each, a "Service") we may collect Personal Information you provide to us directly, such as when you contact us through our website(s), email, mobile application(s), social media accounts, online advertisements, and other digital platforms (collectively, “Digital Properties”); interact with us in person at our physical properties; sign up for offers or communications from us; communicate with us; place or customize orders; complete a survey; or sign up for an account or other services.
  2. Information automatically collected or inferred from your online interaction with us and through tracking technologies. We automatically collect technical information about your online interactions with us (such as IP address or other unique identifier related to you or your laptop, personal computer, browser, mobile device, tablet, or other device (a "Device" or "Devices"), Device location, characteristics, and capabilities, prior and current web activity, your Carvana and ADESA website activities and related click data, and browsing preferences when you visit or interact with our Service or Digital Properties (“Usage Information”).
  3. Information from public sources, including government entities from which public records are obtained and information you submit in public forums.
  4. From third parties. We may collect Personal Information from third parties, such as manufacturing companies, industry partners, dealerships, financial institutions, publicly available sources including public profiles and websites, data brokers, or others interacting with us.

We may combine information that we receive from the various sources described in this Business Privacy Notice, including third party sources. We may also use or disclose the combined information and inferences for the purposes identified below.

C. Types of Personal Information We Collect

We may collect the following types of Personal Information about you such as:

  1. Identifiers, such as your name, email address, physical address, telephone number, business contact information, account name or number, and Device identifiers (e.g., cookie IDs and IP address).
  2. Records about you, such as signatures and dealer registration number.
  3. Commercial information, such as information about vehicle purchases and sales (including type of vehicle, quantity, price, vehicle identification number, odometer reading, year, make, model, and date of purchase and/or sale); information about products or vehicles you or our business contacts are interested in; banking information or other payment details to take payment, fulfill contractual obligations, or for related purposes; delivery details; personal opinions or insights included in any feedback relating to your interactions with us; other commercial or financial information; and legal information relating to your commercial interactions with us, such as fraud checks or flags raised about your transactions, or complaints and information related to their resolution.
  4. Internet or other electronic network activity information,such as your browsing history, search history, and information regarding your interactions with and use of our Digital Properties, including via cookies and other tracking technologies. Please see Section F for further information.
  5. Geolocation data, such as your location, derived from your IP address.
  6. Audio, visual, or other sensory information, such as recordings of your conversations with Carvana or ADESA representatives or video recordings of our premises.
  7. Professional or employment-related information, such as job title, organization, professional licenses, credentials, specialty, professional affiliations, or other professional information.
  8. Inferences drawn from any of the information we collect to assess purchase and/or sale patterns and the level of interest in our products and services based on frequency of visits and contact; evaluate the industries showing interest in our products and services based on IP address (where we can infer your approximate location to improve our communications to you); and determine your preferred frequency for receiving offers.
  9. Sensitive Personal Information, including the following, where permissible or required under applicable laws and regulations:
        a. Social Security number, driver’s license, state identification card, or passport number.
        b. Account log-in information.

D. How We Use Personal Information

We may use each category of your Personal Information described above for the following purposes:

  1. To provide you or your company with products and services,such as providing you the goods and services you or your company requests, processing your application to become a registered Company dealer; making a decision to accept or reject your application to become a Company dealer; facilitating auctions in which you or your company participates; providing customer service; processing or fulfilling orders and transactions, verifying customer information; processing payments; maintaining internal business records; communicating with you about your purchases or sales; hosting informational webinars; verifying creditworthiness; confirming eligibility for use of Company auction facilities and other programs or benefits; responding to requests, complaints, and inquiries; and providing similar services or otherwise facilitating your relationship with us.
  2. For our internal business purposes, such as maintaining or servicing accounts; operating our Digital Properties and customizing the content; maintaining internal business records; enforcing our policies and rules; maintaining and updating the Company’s banned dealer list; organizational analysis; management reporting; managing Company assets and global workforce; work planning, both administratively and organizationally (including work schedules and billing of clients); project management; auditing; maintaining records on business activities, such as accounting, commercial, procurement, document management and other similar activities; budgeting; real estate management; IT administration of our technologies, network, and intranet; and IT security management and tasks.
  3. For our internal research and product improvement purposes,such as verifying or maintaining the quality or safety of our products or services; evaluating the vehicle remarketing industry and conducting other market research; improving our products and services; designing new products and services; customizing advertisements to you; evaluating the effectiveness of our advertising or marketing efforts; and debugging and repairing errors with our systems, networks, and equipment.
  4. For legal, safety or security reasons, such as complying with legal requirements; complying with reporting and similar requirements; investigating and responding to claims against the Company and its customers; completing due diligence (such as in connection with a corporate transaction); protecting our, your, our customers’, and other third parties’ safety, property or rights; detecting, preventing, and responding to security incidents; and protecting against malicious, deceptive, fraudulent, or illegal activity.
  5. In connection with a corporate transaction, such as if we acquire, or some or all of our assets are acquired by, another entity, including through a sale in connection with bankruptcy and other forms of corporate change.
  6. For marketing, such as marketing our products or services or those of our affiliates, business partners, or other third parties. For example, we may use Personal Information we collect to send you newsletters, surveys, questionnaires, promotions, or information about events or webinars. You can unsubscribe to our email marketing via the “Manage Preferences” or “Unsubscribe” link in the email or by contacting us using the information in Section J.

We may use anonymized, de-identified, or aggregated information for any purpose permitted by law.

E. With Whom We Disclose or Share Personal Information

We may disclose or share your Personal Information with the categories of recipients described below:

  1. Affiliates and subsidiaries, including parent entities, corporate affiliates, subsidiaries, business units, and other companies that share common ownership.
  2. Service providers that work on our behalf to provide the products and services you request or that support our relationship with you, such as IT providers, companies that provide business support services, data analytics providers, financial administration, and event organization.
  3. Professional consultants, such as accountants, lawyers, and financial advisors.
  4. Vendors necessary to complete transactions you request, such as shipping companies and logistics providers.
  5. Law enforcement, government agencies, and other recipients for legal, security, or safety purposes, such as when we share information to comply with law or legal requirements, to enforce or apply our policies, and to protect ours, our customers’, or third parties’ safety, property or rights.
  6. In connection with a corporate transaction, such as if we, or some or all of our assets, are acquired by another entity, including through a sale in connection with bankruptcy or other forms of corporate change.
  7. Third parties, such as certain travel services, companies that operate cookies and other tracking technologies, social media companies, certification providers, and other third parties who may use this information to market to you directly.
  8. Entities to which you have consented to the disclosure, where consent is required by law.

We do not collect Sensitive Personal Information for the purpose of inferring characteristics about you.

We do not use or disclose Sensitive Personal Information for purposes to which the right to limit use and disclosure applies under the CCPA.

F. How We Use Cookies and Tracking Technologies We and authorized third parties, through our Digital Properties, may also collect information, which may include Personal Information, via cookies, web beacons, tracking pixels, embedded scripts, location-identifying technologies, Device recognition technologies, in-app tracking methods, Device and activity monitoring, session replay technologies, or other manual, passive, or automatic tracking technologies, programs, or platforms (“Tracking Technologies”).

Types of information collected. We and authorized third parties collect data about you and your Devices, including but not limited to Usage Information; your Internet Service Provider; IP address/Internet address from which you accessed our website(s) and/or other unique identifier(s) related to you or your Device(s); cookie ID; Ad ID; Device location (both approximate and precise); Device characteristics (including make, model, operating system/settings, and other specifications); browser type used; the date and time you access our website(s) and/or take certain actions on our website(s); recordings of your interactions with our websites and other Digital Properties; the pages you accessed while visiting our website(s) and related click behavior (such as products or offerings viewed and/or purchased); advertisements viewed; previously visited websites, applications, and services; search history; and preferences.

Types of Tracking Technologies used. We and third parties that we authorize may use the following Tracking Technologies on the Service and Digital Properties:

  • Cookies

    A cookie is a small text file that is stored on a user’s Device. We may place cookies on your Device(s), which may last only during a single session or may be persistent over multiple sessions over time. Session cookies make it easier for you to navigate the Service and Digital Properties and expire when you close your browser. Other cookies remain longer and help in understanding how you use the Service and Digital Properties, for marketing, to personalize and enhance your user experience, and for other purposes described below.

  • Web Beacons (“Tracking Pixels”)

    Web beacons are small graphic images, also known as “tracking pixels,” “Internet tags,” or “clear gifs,” embedded in web pages and e-mail messages. Web beacons may be used to count the number of visitors to the Service and Digital Properties, facilitate marketing, to monitor how users navigate the Service and Digital Properties, and to count content views.

  • Embedded Scripts

    An embedded script is programming code designed to collect information about your interactions with the Service and Digital Properties. It is temporarily downloaded onto your computer from our web server, or from a third party with which we work, and is active only while you are connected to the Service or Digital Properties and deleted or deactivated thereafter.

  • Location-Identifying Technologies

    GPS (global positioning systems) software, geo-filtering, and other location-aware technologies locate you (sometimes precisely), or make assumptions about your location, for purposes such as verifying your location and delivering or restricting content based on your location. If you have enabled GPS or use other location-based features on the Service or Digital Properties, your Device location may be tracked by us and third parties. Certain Service or Digital Properties features may access and use information about your Device location (such as based on IP address or GPS, as applicable), or your account information, to suggest certain content, products, or services that may be available to you. Our Service and Digital Property content may be personalized based on various information we may have about you to try to provide you with more location-relevant content.

  • Device Recognition Technologies

    We may use device recognition technologies, including application of statistical probability to data sets, as well as linking a common unique identifier to different device use (e.g., Facebook ID), which attempt to recognize or make assumptions about users and devices (e.g., that a user of multiple devices is the same user or household) (“Cross-device Data”).

  • In-App Tracking Methods

    There are a variety of Tracking Technologies that may be included in mobile applications, and these are not browser-based like cookies and cannot be controlled by browser settings. Some use device identifiers or other identifiers such as “Ad IDs,” or may use “SDKs,” to associate app user activity to a particular app and to track user activity across apps and/or devices. SDKs are blocks of code that may be installed in our mobile application by third party companies with which we work. SDKs help us understand how you interact with our mobile application, to improve marketing, and collect certain information about the Device and network you use to access our application, such as the advertising identifier associated with your Device and information about how you interact with our application.

  • Device and Activity Monitoring Technologies

    We use technologies such as session replay tools that monitor, and may record, your interactions with the Service and Digital Properties, including without limitation, keystrokes and how you move through and engage with the Service and Digital Properties. These technologies may also collect and analyze information from your Device, such as, without limitation, your operating system, plug-ins, system fonts, and other data.

Purposes for using these technologies. We and authorized third parties use these Tracking Technologies for purposes including:

  • Personalization, such as remembering user preferences, login details and browsing behavior; tracking your activity across online properties and platforms over time to better understand your preferences and interests; and personalizing online content;
  • Improving performance, such as maintaining and improving the performance of the Service and Digital Properties;
  • Analytics, such as analyzing how the Service and Digital Properties are used to help us improve the Service’s and Digital Properties’ performance and user experience;
  • Advertising, such as providing you with offers that may be of interest to you; conducting targeted advertising to you on the Service and Digital Properties, as well as digital properties of third parties; and measuring the effectiveness of our communications with you and advertising campaigns, including identifying how and when you engage with our communications; and
  • Security, such as user or Device identification and prevention of fraud and malicious behavior.

These Tracking Technologies may be used to track you across Devices and websites over time for purposes above.

Disclosure of your information. We may disclose Personal Information to third parties or permit third parties to place Tracking Technologies on our website(s) to allow these third parties to directly collect Personal Information from you, such as social media companies, advertising networks, companies that provide analytics including ad tracking and reporting, security providers, and others that help us operate our business, including the Service and Digital Properties. These companies use this information to provide you with more relevant advertising tailored to your interest based on your browsing of the Service and Digital Properties and elsewhere on the Internet, sometimes known as “interest-based advertising” and “online behavioral advertising” (“Interest-based Advertising”) which may include sending you an ad on another online service after you have left the Service or Digital Properties (i.e., “retargeting”).

Our disclosures of information to third parties may include the following:

  • Google Analytics. We use Google Analytics to analyze traffic to our website(s) in order to help us understand our customers' and visitors' needs and to continually improve our site(s) for them. The data they collect on our behalf may include, but is not limited to, search engine referrals, affiliate referrals, traffic driven by banner ads or other online promotions, how visitors navigate around the site, and the most popular pages. We also collect certain technical information, such as the browser version and operating system. We reserve the right to use, transfer, sell, and share data about our users for any lawful business purpose, such as analyzing usage trends and seeking compatible advertisers, sponsors, clients, and customers. For more information on how Google Analytics collects and processes data, please visit www.google.com/policies/privacy/partners/.
  • Social media companies. We use social media Tracking Technologies (such as the Meta Pixel and/or related Meta business tools) that may allow third parties, including Meta, to collect or receive information from our Service, Digital Properties, and/or elsewhere on the Internet and use that information to provide measurement services and target ads. In addition, we may serve ads on other online services that are targeted to reach people on those services that are also identified in one or more of our databases (“Matched List Ads”). This is done by using Tracking Technologies or by matching common factors between our databases and the databases of the other online services. For instance, we may use such ad services offered by Meta or X and other third-party services. We are not responsible for these third-party services, including without limitation their security of the data. Most third-party social media companies (such as Meta and X) will generally enable you to hover over the box in the right corner of such a Meta ad, or go to your social media account settings, and find out what options you have to control such ads. We are not responsible for such third parties’ failure to comply with your or our opt-out instructions, they may not give us notice of opt-outs to our ads that you give to them, and they may change their options without notice to us or you.

Your choices regarding Tracking Technologies. Some of the companies that perform advertising-related services may participate in the Digital Advertising Alliance’s (“DAA”) Self-Regulatory Program for Online Behavioral Advertising. To learn more about how you can exercise certain choices regarding Interest-based Advertising, visit http://www.aboutads.info/choices/ and http://www.aboutads.info/appchoices for information on the DAA’s opt-out programs. Some of these companies may also be members of the Network Advertising Initiative (“NAI”). For more information about the NAI including how consumers can opt-out from receiving interest-based advertising from some or all of NAI's members, please visit http://www.networkadvertising.org/choices. Opting out of Interest-based Advertising will not opt you out of all advertising, but rather only Interest-based Advertising from us or our agents or representatives. Also, if your browsers are configured to reject cookies when you visit these opt-out webpages, or you subsequently erase your cookies, use a different Device or web browser, or use a non-browser-based method of access (e.g., mobile app), your NAI / DAA browser-based opt-out may not, or may no longer, be effective.

Some browsers have incorporated Do Not Track (“DNT”) preferences. Most of these features, when turned on, send signals to the website you are visiting that you do not wish to have information about your online searching and browsing activities collected and used. As there is not yet a common agreement about how to interpret DNT signals, we do not honor DNT signals from website browsers at this time. However, you may be able to refuse or delete cookies. If you refuse or delete cookies, some of our website(s) functionality may be impaired. If you change Devices or browsers, or use multiple Devices or browsers, and delete your cookies, you may need to repeat this process for each Device or browser. Please refer to your browser’s Help instructions to learn more about how to manage cookies and the use of other tracking technologies.

Personal Information

We do not knowingly collect, sell, or share Personal Information of minors under the age of 16.

We may disclose Personal Information to third parties, including the categories of recipients described below. California law requires that we describe certain disclosures of Personal Information where we receive valuable consideration even if no money is exchanged and disclosures of Personal Information for purposes of targeted advertising or analytics services which California law considers a “sale” or “sharing”. In the course of supporting our digital advertising activities, we “sell” or “share” information to digital marketing partners. They use this information to provide us with digital advertising services and may use the information to improve the services and offerings they provide to us and other businesses. The information we “sell” or “share” in this manner includes information collected when you engage with our website, mobile application, and other digital offerings. Below please find a chart detailing the categories of Personal Information we collect and with whom we disclose it and for what Business Purpose we do so.

Categories of Personal Information We Collect (and the corresponding section above)Categories of Third PartiesBusiness PurposesCategories of Third Parties With Whom We Sell or Share Personal Information
Identifiers (Section C.1)
  • Affiliates and subsidiaries
  • Service providers
  • Professional consultants
  • Vendors necessary to complete transactions you request
  • For legal, security, and safety purposes
  • In connection with a corporate transaction
  • Entities to which you have consented to the disclosure
  • To provide you or your company with products and services
  • For our internal business purposes
  • For our internal research and product improvement purposes
  • For legal, security, and safety purposes
  • In connection with a corporate transaction
  • For marketing
  • For any other purpose with your consent
  • Third party social network services
  • Data analytics providers
  • Marketing and advertising partners or providers
  • Companies that create or receive sales leads
Records About You (Section C.2)
  • Affiliates and subsidiaries
  • Service providers
  • Professional consultants
  • Vendors necessary to complete transactions you request
  • For legal, security, and safety purposes
  • In connection with a corporate transaction
  • Entities to which you have consented to the disclosure
  • To provide you or your company with products and services
  • For our internal business purposes
  • For our internal research and product improvement purposes
  • For legal, security, and safety purposes
  • In connection with a corporate transaction
  • For marketing
  • For any other purpose with your consent
  • Third party social network services
  • Data analytics providers
  • Marketing and advertising partners or providers
  • Companies that create or receive sales leads
Commercial information (Section C.3)
  • Affiliates and subsidiaries
  • Service providers
  • Professional consultants
  • Vendors necessary to complete transactions you request
  • For legal, security, and safety purposes
  • In connection with a corporate transaction
  • Entities to which you have consented to the disclosure
  • To provide you or your company with products and services
  • For our internal business purposes
  • For our internal research and product improvement purposes
  • For legal, security, and safety purposes
  • In connection with a corporate transaction
  • For marketing
  • For any other purpose with your consent
  • Third party social network services
  • Data analytics providers
  • Marketing and advertising partners or providers
  • Companies that create or receive sales leads
Internet or other electronic network activity (Section C.4)
  • Affiliates and subsidiaries
  • Service providers
  • Professional consultants
  • Vendors necessary to complete transactions you request
  • For legal, security, and safety purposes
  • In connection with a corporate transaction
  • Entities to which you have consented to the disclosure
  • To provide you or your company with products and services
  • For our internal business purposes
  • For our internal research and product improvement purposes
  • For legal, security, and safety purposes
  • In connection with a corporate transaction
  • For marketing
  • For any other purpose with your consent
  • Third party social network services
  • Data analytics providers
  • Marketing and advertising partners or providers
  • Companies that create or receive sales leads
Geolocation data (Section C.5)
  • Affiliates and subsidiaries
  • Service providers
  • Professional consultants
  • Vendors necessary to complete transactions you request
  • For legal, security, and safety purposes
  • In connection with a corporate transaction
  • Entities to which you have consented to the disclosure
  • To provide you or your company with products and services
  • For our internal business purposes
  • For our internal research and product improvement purposes
  • For legal, security, and safety purposes
  • In connection with a corporate transaction
  • For marketing
  • For any other purpose with your consent
  • Third party social network services
  • Data analytics providers
  • Marketing and advertising partners or providers
  • Companies that create or receive sales leads
Audio, electronic, visual, olfactory, or similar information (Section C.6)
  • Affiliates and subsidiaries
  • Service providers
  • Professional consultants
  • Vendors necessary to complete transactions you request
  • For legal, security, and safety purposes
  • In connection with a corporate transaction
  • Entities to which you have consented to the disclosure
  • To provide you or your company with products and services
  • For our internal business purposes
  • For our internal research and product improvement purposes
  • For legal, security, and safety purposes
  • In connection with a corporate transaction
  • For marketing
  • For any other purpose with your consent
  • Third party social network services
  • Data analytics providers
  • Marketing and advertising partners or providers
  • Companies that create or receive sales leads
Professional or employment-related information (Section C.7)
  • Affiliates and subsidiaries
  • Service providers
  • Professional consultants
  • Vendors necessary to complete transactions you request
  • For legal, security, and safety purposes
  • In connection with a corporate transaction
  • Entities to which you have consented to the disclosure
  • To provide you or your company with products and services
  • For our internal business purposes
  • For our internal research and product improvement purposes
  • For legal, security, and safety purposes
  • In connection with a corporate transaction
  • For marketing
  • For any other purpose with your consent
  • Third party social network services
  • Data analytics providers
  • Marketing and advertising partners or providers
  • Companies that create or receive sales leads
Inferences (Section C.8)
  • Affiliates and subsidiaries
  • Service providers
  • Professional consultants
  • Vendors necessary to complete transactions you request
  • For legal, security, and safety purposes
  • In connection with a corporate transaction
  • Entities to which you have consented to the disclosure
  • To provide you or your company with products and services
  • For our internal business purposes
  • For our internal research and product improvement purposes
  • For legal, security, and safety purposes
  • In connection with a corporate transaction
  • For marketing
  • For any other purpose with your consent
  • Third party social network services
  • Data analytics providers
  • Marketing and advertising partners or providers
  • Companies that create or receive sales leads
Sensitive personal information (Section C.9)
  • Affiliates and subsidiaries
  • Service providers
  • Professional consultants
  • Vendors necessary to complete transactions you request
  • For legal, security, and safety purposes
  • In connection with a corporate transaction
  • Entities to which you have consented to the disclosure
  • To provide you or your company with products and services
  • For our internal business purposes
  • For our internal research and product improvement purposes
  • For legal, security, and safety purposes
  • In connection with a corporate transaction
  • For marketing
  • For any other purpose with your consent
  • Third party social network services
  • Data analytics providers
  • Marketing and advertising partners or providers
  • Companies that create or receive sales leads


H. California Rights Concerning Personal Information

California residents may exercise the following rights, subject to legal limitations and applicable exceptions, by submitting a request through the following link: https://privacy.carvana.com/privacy.

  • Right to Know. You have the right to request information about the categories of Personal Information we have collected about you, the categories of sources from which we collected the Personal Information, the purposes for collecting, selling, or sharing the Personal Information, and the categories of third parties with whom we have shared or sold your Personal Information (“Categories Report”). You may also request information about the specific pieces of Personal Information we have collected about you (“Specific Pieces Report”).
  • Right to Delete. You have the right to request that we delete Personal Information that we have collected from you.
  • Right to Correct. You have the right to request that we correct inaccurate Personal Information that we maintain about you.
  • Right to Opt Out. You have the right to opt out of the sale of your personal information.

To fully exercise the Right to Opt Out, you must both: (A) submit an Opt-Out of Sale/Sharing request through our Privacy Portal and (B) disable the “Sale/Sharing” toggle through Your Privacy Choices. Disabling the “Sale/Sharing” through Your Privacy Choices will place a cookie on your browser signaling that you have opted out of such online activities. Please note:

  • The opt-out cookie only applies to the Carvana or ADESA website and only to the browser and Device you are using at the time you make the selection. You will also need to disable the “Sale/Sharing” toggle through Your Privacy Choices from each browser on each Device you use, and on each Carvana or ADESA website you access.
  • If you clear cookies on your browser, you will need to disable the “Sale/Sharing” toggle through Your Privacy Choices from that browser again.
  • If you have blocked cookies through your browser settings, we will be unable to comply with your opt out request.

To the extent required by law, we will honor opt-out preference signals sent in a format commonly used and recognized by businesses, such as an HTTP header field or JavaScript object. We will process opt-out preference signals at the browser level.

In accordance with applicable law, we will not discriminate against you for exercising these rights.

Verification: In order to exercise your rights, we may need to obtain information to locate you in our records, verify that you are a California resident, and/or verify your identity depending on the nature of the request. In most cases, we will collect some or all of the following data elements: first and last name, email address, and telephone number. In some cases, we may request different or additional information, and will inform you if we need such information. Once you submit a request, we will send a verification email that you must respond to in order for us to proceed with your request as part of the verification process.

Authorized Agents: Authorized agents may exercise rights on behalf of California residents by submitting a request through the following link: https://privacy.carvana.com/privacy and indicating that they are submitting the request as an agent. We will require the agent to demonstrate authority to act on behalf of the resident by providing signed permission from the resident. We may also require the resident to verify their own identity directly with us or to directly confirm with us that they provided the authorized agent with permission to submit the request.

Timing: We will process the Right to Opt-Out of Sale or Sharing requests within 15 business days. We will respond to Right to Delete, Right to Correct, and Right to Know requests within 45 calendar days, unless we need more time, in which case we will notify you and may take up to 90 calendar days in total to respond to your request.

I. Data Security and Data Retention

  1. Security. We maintain reasonable security procedures and technical and organizational measures to protect your Personal Information against accidental or unlawful destruction, loss, disclosure, alteration, or use. However, because no data transmission is completely secure, and no system of physical or electronic security is impenetrable, we cannot guarantee the security of the information you send to us or the security of our servers, networks, or databases, and by using our Service or Digital Properties you agree to assume all risk in connection with the information sent to us or collected by us when you access, visit, and/or use our Service or Digital Properties, including without limitation your personally identifiable information, Personal Information, or other registration information, and we are not responsible for any loss of such information, or the consequences thereof.
  2. Retention. We retain your Personal Information as long as necessary to fulfill the purposes outlined in this Business Privacy Notice unless we are required to do otherwise by applicable law. This includes retaining your Personal Information to provide you with the products or services you have requested and interact with you; maintain our business relationship with you; improve our business over time; ensure the ongoing legality, safety and security of our services and relationships; or otherwise in accordance with our internal retention procedures. Once you have terminated your relationship with us, we may retain your Personal Information in our systems and records in order to ensure adequate fulfillment of surviving provisions in terminated contracts or for other legitimate business purposes, such as to enable easier future user onboarding, demonstrate our business practices and contractual obligations, or provide you with information about our products and services in case of interest.
J. Contact Information

If you have questions regarding this Business Privacy Notice or how we use your Personal Information, please contact us at:

EMAIL:[email protected]
MAIL:Attention: Legal
300 E Rio Salado Pkwy
Building 1
Tempe, AZ 85281