Consumer Data Privacy Portal

Welcome to the Consumer Privacy Portal

We believe you should know what information we collect and store about you, how we use it, and who we share it with. Use the "Sign Up" link to create a Consumer Privacy Portal account, which is separate from your carvana.com account, and log in to learn about your data or to submit a request related to your data.

You can also submit a request without creating a Consumer Privacy Portal account by clicking the "Make a request" link under the Login button.

*Note: If you have not created a Consumer Privacy Portal account, you will need to create one to log in. Your carvana.com login information will not work for this Privacy Portal.

Make a request without creating a privacy account

Privacy Policy

Last Modified: 04/10/2019

Welcome to your data privacy portal. This Portal is designed to facilitate access to the personal data collected about you by the company who collected it from you, known as the "Controller". This Portal provides you with the unique opportunity to not only access your personal data, but also easily submit requests about your personal data directly to the Controller. The Controller will respond to those requests.

This notice explains: 1) How the Portal Works; 2) Who controls your personal data in various circumstances; and 3) How we processes your data. Please read this notice carefully.

How Does the Portal Work

When your personal data was collected by the Controller, the Controller submitted that personal data to the Portal in order to provide you access to it and to help facilitate the exercising of your rights. Your rights with respect to your personal data depend on certain factors, so you should review your Controller's privacy notice to understand what those rights are and how to exercise them. This Portal is a means of communication between you and the Controller of your personal data.

Cookies

A cookie is a piece of code that allows the web server to identify and track activity of the web browser. We use these in order to make websites work more efficiently and analyze our traffic. Cookies are widely used in order to make websites work more efficiently, as well as to provide information to the owners of the website. We may use both "Session Cookies" and "Persistent Cookies" on this website. Session Cookies will be deleted from your computer when you close your browser. Persistent Cookies will remain stored on your computer until deleted, or until they reach a specified expiry date.

Types of Cookies

Different cookies are used for different purposes. Our site may use these types of cookies:

Strictly necessary cookies. Our website requires the use of these cookies to properly operate or provide necessary functions relating to the services you request. For example, our website uses cookies to identify trusted web traffic.
Analytics cookies. These cookies allow us to improve how our website works, by allowing us and our third-party service providers to recognize and count the number of visitors and to see how visitors move around our website when they are using it. These cookies generate aggregate statistics that are not associated with an individualized profile.

You have a choice about the placement of cookies on our Portal. You can also use your web browser to directly block all cookies, or just third-party cookies, through your browser settings. Using your browser settings to block all cookies, including strictly necessary ones, may interfere with proper operation of the Portal. Guidance on how to control cookies in popular browsers is contained here:

Google allows users to opt out of tracking by Google Analytics and Google Analytics Demographics and Interest Reporting services. You can adjust your setting here, or download the Google Analytics Opt-Out Browser Add-on. We do not currently respond to 'do not track' signals and similar settings or mechanisms.

How Do I Use The Portal?

The Portal provides a means by which you can communicate with the Controller regarding your rights. Except for the email and password used to create a GDPR Edge account, the Controller is responsible for your personal data. This chart explains how the GDPR Edge Portal facilitates the exercise of your rights under the GDPR.

Requested Action	Responsible Party	What Actions Are Taken
I want to see what personal data the Controller has about me.	The Controller	When your personal data was collected, it was uploaded to the GDPR Edge platform to provide you access with it. The Controller has provided you with this information through the Portal.
I want to know why my personal data is being processed.	The Controller	When you access the Portal, the purposes for processing your personal data are provided by the Controller.
I want to see the categories of personal data processed.	The Controller	When you access the Portal, the categories of personal data are provided by the Controller.
I want to know who has received my personal data.	The Controller	You may submit this request to your Controller via the Portal.
I want to know how long my personal data will be stored.	The Controller	You may submit this request to your Controller via the Portal.
I want to object to the processing of my personal data.	The Controller	You may submit this request to your Controller via the Portal.
I want to request that my personal data be changed.	The Controller	You may submit this request to your Controller via the Portal.
I want to request that my personal data be deleted.	The Controller	You may submit this request to your Controller via the Portal.
I want to request that my personal data be transferred to a third party.	The Controller	You may submit this request to your Controller via the Portal.
I want to make a complaint regarding my personal data.	The Controller	You should review the Controller's privacy notice regarding your right to complain. You may also request this information from your Controller via the Portal.
I want to know whether I was subject to automated decision making or profiling.	The Controller	You may submit this request to your Controller via the Portal.
I want to create an account on the Data Privacy Portal	Truyo	We collect an email and password for the purpose of providing you access to the Portal.

How We Use Your Personal Data

As a data processor for the personal data provided to us by the Controller, we do not do anything with your personal information unless the Controller has instructed us to do it. We will hold it securely and retain it for the period instructed.

As a controller of the personal data you provide us (i.e. your email and password), we use it solely to provide access and facilitate the use of the GDPR Edge Portal. Our legal basis for processing is the legitimate interest of ensuring secure access to the Portal and properly verifying the identity of users requesting access to personal data.

Disclosures Of Your Personal Data

We will not share your information with any third parties or sell your information to anyone.

To provide this platform, we use data processors who are third parties who provide elements of services for us. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will hold it securely and retain it for the period we instruct.

We may also share your personal information with third parties in connection with the sale of our business, to enforce our Terms of Use or rules, to ensure the safety and security of the other Portal users and third parties, to protect our rights and property and the rights and property of our Portal users and third parties, to comply with legal process, or in other cases if we believe in good faith that disclosure is required by law. We will make efforts to inform you when any of these circumstances occur.

Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Data Retention

As a data processor for the personal data provided to us by the Controller, we will hold it securely and retain it for the period instructed.

With respect to the personal data you provide directly to us, we will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Generally, the time we retain your personal data is related to the amount of time you continue to have an account with us. In some circumstances you can ask us to delete your personal data (see "EU Data Subjects Legal Rights"). Whether we are able to honor such a request depends on the circumstances of the request.