What should a dealership check in a software vendor's privacy terms?

Secondary use and aggregation

Look for permission to use data in de-identified or aggregated form. That is common and often reasonable, but confirm the de-identification standard and whether the output is sold.

Model training

Establish explicitly whether your customer data can train models used for other customers, and whether you can opt out. Silence is not an answer.

Affiliates and subprocessors

Ask for the current subprocessor list and notification obligations when it changes. Data flowing to a parent company or sibling product is a disclosure your customers may not expect.

What survives termination

Confirm retention periods after the relationship ends, deletion commitments and whether any licence to use the data persists. Perpetual licences to dealership customer data should be negotiated out.

Where the terms live

Privacy commitments may sit in the master agreement, a data-processing addendum, an online privacy policy, and product-specific terms. Gather all and read them together.

Note which document controls and whether the vendor can change online terms without notice. Save dated copies.

Terms that change later are difficult to dispute if you cannot show what you agreed to.

Your customers' rights

Customers may ask what data you hold, request deletion or opt out of sharing. Ask how the vendor supports these requests: does it provide tools or a process, how quickly does it act and does it pass requests to its subprocessors?

Test with a sample request during evaluation. The dealer remains answerable to the customer even when the vendor holds the data.

Common mistakes in privacy review

Reading only the main contract, missing model training clauses, accepting perpetual licences to customer data and not tracking subprocessor changes are the usual gaps. Another is not involving legal counsel for a high-risk vendor. Schedule a re-review at each renewal and whenever the vendor announces a change of ownership.

A short privacy checklist

Confirm the permitted uses, the aggregation and training terms, the subprocessor list, retention and deletion periods, breach notification, support for customer requests and the survival of licences after termination. Record the answers and the document version, and set a reminder to repeat the review when the vendor updates its terms.