Effective Date: January 1, 2020

Last Updated: January 1, 2020

Toyota Motor Sales, U.S.A., Inc. and Toyota Motor North America, Inc. and their wholly-owned subsidiaries that share common branding with them, together with Toyota Motor Corporation (collectively, "Toyota," "us," or "our") are committed to maintaining your confidence and trust as it relates to the privacy of your information. This privacy policy is for our customers, users and website visitors who are California residents (this "California Privacy Policy”) and supplements the information contained in Toyota’s Online Privacy Statement located at https://www.buyatoyota.com/sandiego/legal/.

Table of Contents:
I. OVERVIEW OF THIS CALIFORNIA PRIVACY POLICY
II. HOW WE COLLECT, USE, AND SHARE PERSONAL INFORMATION
III. CCPA RIGHTS FOR CALIFORNIA CONSUMERS
IV. CONTACT US; EXERCISE YOUR RIGHT

I. OVERVIEW OF THIS CALIFORNIA PRIVACY POLICY

What is this California Privacy Policy? The California Consumer Privacy Act of 2018 ("CCPA") and other privacy laws in California give California consumers certain privacy rights related to their personal information. These rights are in addition to any privacy rights set forth in the Toyota Privacy Statement. This California Privacy Policy describes the rights that California consumers may have under the CCPA.

To which Toyota entities does this California Privacy Policy apply? This California Privacy Policy only applies to those websites operated by Toyota. Note this California Privacy Policy does not apply to any Toyota, Lexus or Scion dealers, local Toyota dealer associations, private distributors, Toyota Financial Services, Lexus Financial Services, or Toyota Insurance Management Solutions. For information about your California privacy rights for any of these entities, please contact these entities directly.

What is “personal information”? For the purposes of this California Privacy Policy, “personal information” is defined as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California consumer or California household. Personal information does not include:

• Publicly available information from government records.
• De-identified or aggregated information.
• Other regulated information that is excluded from the CCPA's scope, such as:
• medical information governed by the California Confidentiality of Medical Information Act (CMIA);
• protected health information collected by a covered entity or business associated governed by the Health Insurance Portability and Accountability Act of 1996 (HIPAA);
• clinical trial data subject to the Federal Policy for the Protection of Human Subjects;
• personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994.

What are “California consumers”? A “California consumer” is a natural person who resides in California. For the purposes of this California Privacy Policy, a California consumer does not include persons to the extent they are (i) acting as an employee, owner, director, officer or contractor of a company, partnership, sole proprietorship, nonprofit or government agency that is doing business with Toyota or (ii) acting as a job applicant to, an employee of, owner of, director of, officer of, medical staff member of, or contractor of Toyota.

II. HOW WE COLLECT, USE, AND SHARE PERSONAL INFORMATION

Toyota may collect personal information from you in different ways and for different purposes. It is important to note that the types of personal information we collect will depend on your interaction with us, including the types of products or services you use.

This section contains the Categories of Personal Information that we may have collected in the last 12 months prior to the effective date of this California Privacy Policy or may collect and includes the following information for each category:

Description: Describes the category of personal information collected
Examples: Examples of personal information collected per category
Sources: Categories of sources from which personal information is collected
Business Purposes: The business and/or commercial purpose(s) for which personal information is collected or used
Third Parties: The categories of third parties with whom personal information is shared or sold for a business purpose.

Contact Information:
Description:
Includes attributes that identify a natural person
Examples:
Consumer name, address, phone number, email, owner account information, online identifier, user ID, and site visitor details (names, addresses, etc.) and demographic information (such as zip code, age). May also include personal identifiers such as social media IDs, and vehicle ownership

Sources:

• Consumer-provided
• Dealers
• Service providers
• Third party companies (non-service providers Toyota acquires data from)
• Vehicles with telematics capabilities
• Consumer online activity
• Affiliated companies
• Toyota internally derived data

Business Purposes:

• Customer support (customer relationship management, manage customer service requests, manage open customer matters, system records of interactions with customers across multiple touch-points)
• Road side assistance (emergency road side assistance such as tow services, fuel)
• Telematics services (provide telematics services, emergency services electronic signatures on agreements)
• Vehicle services (service reminders, warranty, express maintenance)

Third Parties:
Industry research (Toyota shares data with auto-industry vendors)

Consumer Product and Service Data:
Description:
Includes consumer vehicle ownership records associated with the consumers current and/or prior owned vehicles
Examples:
Vehicle ownership transactions, Retail Delivery Report (RDR) records, recall records, warranty records, repair order records, part order records, Toyota Insurance Management Solutions insurance product records, and incentive offers accepted by a consumer

Sources:

• Consumer-provided
• Dealers
• Service providers
• Third party companies (non- Service Providers Toyota acquires data from)
• Vehicle with telematics capabilities
• Consumer online activity
• Affiliated companies
• Toyota internally derived data

Business Purposes:
Dealer service support (Identify and provide services to the consumer, improve timing during dealer visits, and enhance overall dealership experience)

Third Parties:
Marketing vendors (to collect or use data on behalf of Toyota to conduct marketing activities related to products or services).
Dealerships or private distributors (to provide services to vehicle owners)

Consumer Interaction Data:
Description:
Includes a consumer’s interaction with Toyota via telephone, email, chat, text and/or postal mail.
Examples:
Call center records and screen, audio and/or video recordings

Sources:

• Consumer-provided
• Dealers
• Service providers
• Vehicle with telematics capabilities
• Consumer online activity
• Affiliated companies
• Toyota internally derived data

Business Purposes:

• Analytics (data is integrated from all other categories of data to perform analytics to help Toyota understand and serve a consumer better, improvement to service levels, consumer experience
• Studies (industry and government studies, product quality and reliability)
• Surveys (sales, service, quality)

Third Parties:
Augmentation vendors (to enrich Toyota data for better understanding of consumer preferences)

Consumer Online Activity:
Description:
Includes a consumer’s online interactions with Toyota

Examples:
Online accounts, browsing history, cookies, IP addresses, social media information

Sources:

• Consumer-provided
• Dealers
• Service providers
• Third party companies (non- Service Providers Toyota acquires data from)
• Vehicle with telematics capabilities
• Consumer online activity
• Affiliated companies
• Toyota internally derived data

Business Purposes:

• Business transactions (record company sales, services, financial records, lease, electronic signatures, deal negotiations, dealer validation)
• eCommerce (to record online commerce)

Third Parties:
Dealer support vendors (to use data collected by Toyota to provide services to dealers)

Vehicle Originated Data:
Description:
Includes data collected as part of vehicle remote services or driving behavior data

Examples:
Use of connected services and vehicle application suite services. Driving behavior such as acceleration and speed, steering, and braking functionality, and travel direction.

Sources:

• Consumer provided
• Service providers
• Vehicle with telematics capabilities
• Consumer online activity
• Affiliated companies
• Toyota internally derived data

Business Purposes:

• To provide vehicle remote services such as emergency services
• To provide vehicle functions such as navigation assistance, remote engine start, maintenance alerts and more.
• For quality confirmation, data analysis, research, and product development

Third Parties:

• Telematics vendors (to collect data from vehicles, manage telematics subscriptions, opt out/in of service, provide telematic services
• Navigation
• Affiliates and non-affiliated insurance companies to provide use base insurance information and offers

Marketing:
Description:
Includes pre and post-sale marketing interactions with a consumer

Examples:
Information collected at events, vehicle purchase negotiation information, vehicle service marketing information, direct marketing information, and retention marketing information

Sources:

• Consumer-provided
• Dealers
• Service providers
• Third party companies (non- Service Providers Toyota acquires data from)
• Vehicle with telematics capabilities
• Consumer online activity
• Affiliated companies
• Toyota internally derived data

Business Purposes:

• Offers of insurance (Toyota Insurance Management Solutions TIMS) (to provide offers to consumers interested in vehicle related insurance products)
• Service and telematic marketing (customer maintenance and retention)
• Vehicle marketing (social media marketing, sharing informative material and gifts [such as the owner’s manual, welcome manual, merchandise, etc.], customer maintenance and retention)
• Affiliate marketing (such as Toyota Financial Services)

Third Parties:
Media agencies (to execute media programs, advertisements, attributions; determine effectiveness of programs; and track consumer activities via internal and third-party tagging/cookies)

Research Data:
Description:
Includes personal information collected by Toyota related to consumer and product research

Examples:
Survey information, syndicated product and/or service studies, predictive behavioral studies, focus group information

Sources:

• Consumer-provided
• Dealers
• Service providers
• Third party companies (non-service providers Toyota acquires data from)
• Vehicle with telematics capabilities
• Consumer online activity
• Toyota internally derived data

Business Purposes:

• Emission testing (to adhere to state and federal legislative requirements)
• Product Improvement (research & design, quality controls)

Third Parties:
Service vendors (to support Toyota in providing services such as survey, service reminders, emission testing, safety/recall programs, logistics, shipping)

Legal Activity:
Description:
Includes personal information collected related to legal claims

Examples:
Dispute, claim, reimbursement, litigation, and recalls

Sources:

• Consumer-provided
• Dealers
• Service providers
• Third party companies (non-service providers Toyota acquires data from)
• Vehicle with telematics capabilities
• Consumer online activity
• Affiliated companies
• Toyota internally derived data

Business Purposes:

• Dispute resolution (dispute cases, dispute case payments, government requests, arbitrations)
• Safety notices and recalls (quality safety reporting, campaign notifications and execution)
• Compliance with laws

Third Parties:
None applicable

In addition to the purposes and categories of third parties identified above, we may also share your personal information with the following third parties and for the following purposes:

• With our service providers that provide services to us and process personal information on our behalf
• With regulatory authorities, credit bureaus or other governmental agencies, as needed, to comply with our legal or regulatory requirements
• To a third party as part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or party of our business

We may have sold the following categories of personal information about you to third parties in the prior twelve (12) months:

• Contact Information
• Consumer Product and Service Data
• Consumer Interaction Data
• Consumer Online Activity
• Vehicle Originated Data
• Marketing
• Research Data

However, we do not sell the personal information of minors under the age of 16 without affirmative authorization. For more information about opting out of this sale, please see Section III.C (Right to Opt-Out of Sale of Your Personal Information) below.

III. CCPA RIGHTS FOR CALIFORNIA CONSUMERS

The CCPA provides California consumers with certain rights regarding their personal information. This Section III explains those rights. If you are a California consumer and would like to exercise any of those rights, please see Section III.E (How to Submit a Request) below for more information on how to submit a request.

If you are a California consumer, you may have the right to request that Toyota provide you with information regarding what personal information about you we have collected, used, disclosed or sold in the preceding twelve (12) months. Once we receive your request and verify your identity, we will disclose to you the following:

1. The categories of personal information we have collected about you in the preceding twelve (12) months.
2. The categories of sources from which we collected your personal information in the preceding twelve (12) months.
3. The business or commercial purposes for collecting your personal information in the preceding twelve (12) months.
4. The categories of third parties with whom we shared your personal information in the preceding twelve (12) months.
5. The specific pieces of personal information we collected about you in the preceding twelve (12) months.

If you are a California consumer, you may have the right to request that Toyota delete certain of your personal information that we have collected from you. However, this right to deletion does not apply to any of your personal information that is subject to an exception under the CCPA (as described below). Once we receive your request and verify your identity, we will delete (and direct our service providers to delete) your personal information in our records that is not subject to any of the CCPA exceptions. Specifically, we may deny your deletion request if your personal information is required for any of the following reasons, which we will identify in our response to you if we deny your request:

1. Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
2. To be able to fulfill the terms of a written warranty or product recall conducted in accordance with federal law.
3. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
4. Debug products to identify and repair errors that impair existing intended functionality.
5. Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
6. Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 seq.).
7. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement, if you previously provided informed consent.
8. Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us.
9. Comply with a legal obligation.
10. Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

If you are a California consumer, you may have the right to request that Toyota stop selling certain or all of your personal information. Once we receive your request and verify your identity, we will process your request as soon as feasibly possible and will also provide notification of your request to any third parties to whom we sold your personal information in the ninety (90) days prior to your request. You may also use an authorized agent to submit a request to opt-out on your behalf, as long as you provide the authorized agent with written permission to do so and the agent provides such proof to us when they submit your request. If you opt-out and subsequently enter into any transactions where a sale of your personal information is required as a condition of completing the transaction, we will provide you with instructions on how you may opt back in. In addition, your opt-out will not affect any situations where you direct us to transfer your personal information to a third party.

Toyota will not discriminate against any California consumer who exercises any of the rights described above. Specifically, we will not deny you goods or services; charge you different prices or rates, including through granting discounts or other benefits, or imposing penalties; provide you with a different level of service or quality of goods or services; or suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

If you are a California consumer and would like to exercise any of the CCPA rights identified above, please contact us using one of the methods provided below:

• By e-mail to:
  andrewparker@daviselen.com
  
  
• By mail to:
  Davis Elen Advertising, Inc
  Attn: San Diego TDA CCPA Requests
  865 S. Figueroa Street, Suite 1200
  Los Angeles, CA 90017

If you are a California consumer, you may have the option to designate an authorized agent to submit a request on your behalf, so long the authorized agent has your written permission to do so and you have taken steps to verify your identity directly with us. If you would like to designate an agent, your agent must register as such with the California Secretary of State and submit a copy of this registration along with your consumer request to us. We may need to contact you directly to verify the request.

We cannot fulfill your request or provide you with your personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a verifiable consumer request does not require you to create an account with us.

To verify your identity, we will ask that you provide the following personal information when you submit your request:

• First Name
• Last Name
• Email Address
• Mobile Phone Number
• Address
• City
• State
• Zip Code

You may need to provide additional information as part of your responses to our identity verification questions. We will only use this information to confirm your identity which may include the use of a third-party identity verification service. In the event we use a third-party identity verification service, our third-party identification verification tool will ask you certain identity verification questions and match those answers with what it has in its database. Depending on your type of request or the information requested by you, we may require additional information in order to verify your identity and fulfill your request.

If we cannot successfully verify your identity, we will inform you of that fact.

We will respond to your request within forty-five (45) days. However, in certain circumstances, we may require additional time to process your request, as permitted by the CCPA or other applicable law. We will advise you within forty-five (45) days after receiving your request if such an extension is necessary and why it is needed. Any disclosures we provide will only cover the 12-month period preceding our receipt of your verifiable consumer request.

If we cannot fulfill your request, our response to you will also explain the reason why we cannot fulfill your request.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

You may only make a verifiable consumer request to know about or access your personal information twice within a 12-month period.

IV. CONTACT US; EXERCISE YOUR RIGHTS

If you have any questions or concerns regarding this California Privacy Policy or our privacy practices, please contact us using one of the methods provided below:

• By e-mail to:
  andrewparker@daviselen.com
  
  
• By mail to:
  Davis Elen Advertising, Inc
  Attn: San Diego TDA CCPA Requests
  865 S. Figueroa Street, Suite 1200
  Los Angeles, CA 90017