What should a dealership check in a software vendor's privacy terms?
Whether the vendor can use your customer data for anything beyond providing the service to you. The clauses that matter are secondary use, aggregation, model training, sharing with affiliates and what survives termination. A provider permitted to use dealership customer data for its own products is a different commercial relationship from one that is not.
Secondary use and aggregation
Look for permission to use data in de-identified or aggregated form. That is common and often reasonable, but confirm the de-identification standard and whether the output is sold.
Model training
Establish explicitly whether your customer data can train models used for other customers, and whether you can opt out. Silence is not an answer.
Affiliates and subprocessors
Ask for the current subprocessor list and notification obligations when it changes. Data flowing to a parent company or sibling product is a disclosure your customers may not expect.
What survives termination
Confirm retention periods after the relationship ends, deletion commitments and whether any licence to use the data persists. Perpetual licences to dealership customer data should be negotiated out.
What to verify
Look for secondary use and aggregation permissions
Ask explicitly about model training and opt-out
Request the subprocessor list and change notifications
Confirm what licence and retention survive termination
Continue the research
Fraud & cybersecurity
Identity verification, endpoint security, backup, monitoring and incident readiness.
Compare providers →Customer data platforms (CDP)
Identity resolution, first-party data unification, audiences and activation.
Compare providers →Credit, identity & compliance
Credit applications, bureaus, adverse action, red flags and fraud prevention.
Compare providers →Related dealership technology questions
What does bidirectional integration or write-back mean?
Bidirectional generally means data moves in both directions, while write-back means one system can update another system’s record. Neither phrase is complete until the exact objects, fields, triggers, conflict rules and timing are stated.
Contract due diligenceWhat should a dealer ask before signing a software contract?
Confirm the exact products, implementation, service levels, data rights, security obligations, fees, renewal mechanics, price changes, termination, transition support and order-of-precedence across every incorporated document. Obtain qualified legal review for the dealer’s situation.
Vendor security reviewWhat security questions should dealerships ask software vendors?
Ask about governance, independent assessments, access control, encryption, logging, vulnerability management, incident response, resilience, data retention, subprocessors and contract obligations. Scope the review to the actual service and data involved.
Automotive CDP definitionWhat is an automotive customer data platform (CDP)?
An automotive CDP ingests dealership data from multiple sources, resolves identities, creates usable profiles or audiences, activates them in permitted destinations and may return outcomes for measurement. Products differ significantly in data hygiene, identity, activation and write-back.