Carvana

Carvana is an online used car retailer.

4.1/10

How we calculate ratings →

Handling

Does the policy allow personally-targeted or behavioral marketing? Yes, but you may opt-out

4/10

Does the service allow you to permanently delete your personal data? No

0/5

Does the service allow third-party access to private personal data? Yes, all parties specified (including non-critical service providers such as advertisers)

3/10

This may come in the form of outright data sharing or by using local third-party analytics software (such as Google Analytics, which collects a plethora of user information).

Note that whether the policy allows sharing aggregated user data does not affect this question.

If the personal data is encrypted when it passes through the third-party, it does not count as third-party access (as the data is inaccessible to that party).

If personal data has been made public by, for example, posting it to a blog, it does not count as private personal information (and is therefore not considered by this question).

Score

Yes

The policy allows sharing personal data with third parties (not just critical service providers), and does not explicitly list the third parties.

Yes, all parties specified (including non-critical service providers such as advertisers)

30%

Yes, not all parties specified (but only to critical service providers)

70%

Yes, all parties specified (only to critical service providers)

80%

100%

Citation

Reasons we can share your personal information:

For our every day business purposes – such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit bureaus
For our marketing purposes – to offer our products and services to you
For joint marketing with other financial companies
For our affiliates’ everyday business purposes – information about your transactions and experiences
For our affiliates’ everyday business purposes – information about your creditworthiness
For our affiliates to market to you
For nonaffiliates to market to you

[...]

Affiliates:
Companies related by common ownership or control. They can be financial and nonfinancial companies.

DriveTime Car Sales Company, LLC (“DriveTime”) and all institutions in the DriveTime family of companies; Bridgecrest Acceptance Corporation (“Bridgecrest Acceptance”); Bridgecrest Credit Company, LLC (“Bridgecrest Credit”); Driver’s Seat, LLC and DS Nominee Titleholder, LLC (together, “Driver’s Seat”), are affiliates. Our other affiliates include companies with the DriveTime or DT name; financial companies, such as GFC Lending, LLC d/b/a GO Financial; insurance companies such as SilverRock Group, Inc., SilverRock Insurance, LLC, Motion Telematics, LLC and nonfinancial companies, such as GO Auto Exh LLC.

Nonaffiliates:
Companies not related by common ownership or control. They can be financial and nonfinancial companies.

Nonaffiliates we share with could include insurance companies, mortgage companies, credit card companies and direct marketing companies.

Joint Marketing:

A formal agreement between nonaffiliated financial companies that together market financial products or services to you.
Our joint marketing partners could include insurance companies, automobile dealers and credit card companies.

When does the policy allow law enforcement access to personal data? Not specified

0/5

Transparency

Does the policy outline the service's general security practices? Somewhat

1/3

Score

Somewhat

The policy provides only a very vague overview of its security practices.

30%

Yes

60%

Yes, including audits

"Reviews," "monitoring," etc. also count as audits.

80%

Yes, including independent audits

Independent "reviews," "monitoring," etc. also count as independent audits.

100%

N/A

The service doesn't collect any personal information.

100%

Citation

How does Carvana protect my personal information?
To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings.

Is the policy's history made available? Only the date it was last modified

3/5

Does the policy require users to be notified in case of a data breach? Not necessarily

0/7

Will affected users be notified when the policy is meaningfully changed? No

0/5

Collection

Does the service collect personal data from third parties? Yes, but for critical data only

7/10

Is it clear why the service collects the personal data that it does? Yes

10/10

Does the service allow the user to control whether personal data is collected or used for non-critical purposes? On an opt-out basis, but only for some non-critical data/uses

3/10

Some services allow users to opt-out or opt-in to of non-critical collection or use of personal data, such as collecting data for personalized advertisements.

Score

On an opt-out basis, but only for some non-critical data/uses

30%

On an opt-out basis, for all non-critical data/uses

60%

On an opt-in basis

60%

N/A (no data used for non-critical purposes)

100%

Citation

[Cannot Limit]

For our every day business purposes – such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit bureaus
For our marketing purposes – to offer our products and services to you
For joint marketing with other financial companies
For our affiliates’ everyday business purposes – information about your transactions and experiences
[Can Limit]
For our affiliates’ everyday business purposes – information about your creditworthiness
For our affiliates to market to you
For nonaffiliates to market to you

Does the policy list the personal data it collects? Yes, generally

7/10

Score

The policy does not claim to not collect personal data, but it also doesn't provide any meaningful insight into the types of personal data it collects.

Only summarily

The policy uses overly vague language to provide a summary of the types of collected personal data.

30%

Yes, generally

All general categories of collected personal data are listed, though not all types of personal data are explicitly mentioned (for example, the list might use a phrase like 'such as' when listing types of personal data).

70%

Yes, exhaustively

All types of collected personal data are listed specifically

100%

N/A (no personal data is collected)

100%

Citation

The types of personal information we collect and share depend on the product or service you have with us. This information can include:

Social Security number and income
account balances and payment history
credit history and employment information

[...]

We collect your personal information, for example, when you

visit our website
apply for financing or give us your income information
provide employment information or give us your contact information
pay your bills

We also collect your personal information from others, such as credit bureaus, affiliates or other companies.

Last Updated

March 28, 2021

Sources

Source #1 ↗

Contributors

doamatto