State-Specific Privacy Notices

RouteOne has developed tools to help Dealers who are subject to state-specific privacy laws manage their compliance with that law’s requirements. 

State-Specific Privacy Notices

Dealers who are subject to state-specific privacy laws will now be able to upload and distribute a state-specific privacy notice (referred to in California’s privacy law as the ‘Notice at Collection’) to their customers. This notice informs consumers about the dealership’s information practices, including  what types of personal information the dealership collects and the purpose for which the information is collected. Your dealership has the option to upload state-specific privacy notices for one or more of the applicable states.

Important Note: Use of the State-Specific Privacy Notice feature does not ensure compliance with applicable legal and regulatory obligations; rather, the feature is intended only to be a tool to help your dealership manage compliance. Dealer remains solely responsible for compliance with applicable legal and regulatory obligations and should seek the advice of legal counsel.

Uploading your own ‘State-Specific Privacy Notice’ PDF 

To upload your own ‘State-Specific Privacy Notice,’ click on the ‘Admin’ tab from the top navigation, then select ‘Preferences.’ Scroll down to the ‘State-Specific Privacy Notice’ section.

To use a RouteOne-provided PDF template, refer to the ‘Uploading a RouteOne-provided ‘State-Specific Privacy Notice’ PDF template’ section of this guide below.

Once your ‘State-Specific Privacy Notice’ PDF is ready to be uploaded, click the ‘Select File’ button to browse your local computer, and select your PDF.

Note: Uploading a new PDF will delete and replace a previously uploaded PDF.  

Important Note: If you choose to upload your own ‘State-Specific Privacy Notice,’ it must be in PDF format and less than 5MB in size. 

To complete your upload, click the ‘Save Information’ button at the bottom of the ‘Admin’ page.

Once your PDF is successfully uploaded, you will be navigated away from the ‘Admin’ page. 

You can return to the ‘Admin’ page and the ‘State-Specific Privacy Notice’ section to see that your file has uploaded. 

A prompt to print the uploaded ‘State-Specific Privacy Notice’ will be presented to dealer users before they enter customer information into a data collection page in RouteOne, providing the ability for dealer users to provide the State-Specific Privacy Notice to the consumer if they have not already done so.

If you are a Digital Retail subscriber, a link to the State-Specific Privacy Notice will appear below form fields for the applicant and co-applicant to review as necessary prior to submitting their personal information.

Uploading a RouteOne-provided ‘State-Specific Privacy Notice’ PDF template (California only)

RouteOne-provided templates are only available for the California Consumer Privacy Act, as amended by the California Privacy Rights Act. For all other state-specific privacy laws, you will need to upload your own ‘State-Specific Privacy Notice.’ Please refer to the previous section of this guide, ‘Uploading your own ‘State-Specific Privacy Notice’ PDF.’

To use a RouteOne-provided ‘Notice at Collection’ PDF template, click on the ‘Admin’ tab from the top navigation, and select ‘Preferences.’ Scroll down to the ‘State-Specific Privacy Notice’ section. 

Download either the English PDF Template OR the Multilingual PDF Template. The multilingual PDF template includes English, French, and Spanish versions of the ‘Notice at Collection.’ 

Locate the downloaded template file.

In Windows 10, your downloaded PDF will be typically found at C:\Users\<Your Name>\Downloads

Once you have located the downloaded file, double click the PDF file to open with your default PDF viewer. 

The PDF template will open in your default PDF viewer. See the example below. 

Important: If the PDF does not open, you may need to install a PDF viewer. Adobe Acrobat Reader DC is a free PDF viewer and can be downloaded at https://acrobat.adobe.com/us/en/acrobat/pdf-reader.html  

Use your PDF viewer to input your dealership’s details. Fields that can be edited are highlighted.

Important: Please note that, due to changes in California law, several sections of RouteOne’s updated California Notice at Collection template require you to input information that accurately describes your dealership’s information practices. Please review and complete the template in its entirety before uploading to the RouteOne platform. Use of the RouteOne-provided Notice at Collection PDF template does not ensure compliance with applicable legal and regulatory obligations.

You remain solely responsible for compliance and should seek the advice of legal counsel to be sure your State-Specific Privacy Notice accurately reflects your dealership’s practices and satisfies the requirements of California law.

Ensure that you enter your dealership name and address at the beginning of the document.

Continue inputting your dealership’s details.  

Important Notes:

If you use a RouteOne-provided PDF template, you must indicate your dealership’s selling and/or sharing practices for each stated category of personal information and sensitive personal information.  

If you use a RouteOne-provided PDF template, you must describe your data retention period for each category of personal information. Alternatively, you can describe the criteria used by your dealership to determine the period of time you retain personal information.  

If you use the RouteOne-provided PDF multilingual template, you must translate any additional content you add to the English section to the French and Spanish sections. 

If you use a RouteOne-provided PDF template, ensure you input the website address of your ‘Do Not Sell My Personal Information’ webpage (at which a consumer may opt out of the sale of their personal information) at the end of the template, if applicable. If your dealership does not sell personal information, you may wish to input ‘NOT APPLICABLE’ or 'DEALER DOES NOT SELL OR SHARE PERSONAL INFORMATION TO THIRD PARTIES’ in this space for clarity. 

If you use a RouteOne-provided PDF template, be sure to insert the website address of your online privacy policy at the end of the document. If you do not maintain an online privacy policy, you may wish to input ‘Not Applicable’ in this space for clarity. 

Please review the template in its entirety to ensure all sections have been completed and are accurate. Once your edits are complete, save a copy of the PDF to your computer. You may optionally rename the file as you see fit. 

Once your ‘State-Specific Privacy Notice’ PDF is ready to be uploaded, return to the RouteOne system, click the ‘Select File’ button to browse your local computer, and select your PDF.

Uploading a new PDF will delete and replace a previously uploaded PDF. 

To complete your upload, click the ‘Save Information’ button at the bottom of the ‘Admin’ page. 

Once your PDF is successfully uploaded, you will be navigated away from the ‘Admin’ page. 

You can return to the ‘Admin’ page and the ‘State-Specific Privacy Notice’ section to see that your file has uploaded. 

A prompt to print the uploaded ‘State-Specific Privacy Notice’ will be presented to dealer users before they enter customer information into a data collection page in RouteOne, providing the ability for dealer users to provide the State-Specific Privacy Notice to the consumer if they have not already done so.

If you are a Digital Retail subscriber, a link to the notice will appear below form fields for the applicant and co-applicant to review as necessary prior to submitting their personal information. 

Deleting an Uploaded ‘State-Specific Privacy Notice’

To remove an uploaded ‘State-Specific Privacy Notice,’ click on the ‘Admin’ tab from the top navigation, and select ‘Preferences.’ Scroll down to the ‘State-Specific Privacy Notice’ section.

Click ‘Remove’ next to the uploaded file you would like to remove.

To complete the removal, click the ‘Save Information’ button at the bottom of the ‘Admin’ page. 

Important: Removal of the uploaded file is not reversible once the ‘Save Information’ button has been clicked. 

Printing the ‘State-Specific Privacy Notice’ 

Uploading a disclosure will trigger the ability to print a copy of the appropriate disclosure from all new data collection pages in RouteOne. 

You will be prompted to print the disclosure in the following locations:

• New Individual App  
• New Business App
• New Individual Customer
• New Business Customer
• New Credit/ID One Request
• New OFAC Request
• New Payoff Request
• New Valuation
• Payment Calculator
• Pre Approvals

Disclosure Upon Request

Consumers have the right to request that a business disclose one or more of the following: 

• The categories of personal information the business has collected about the consumer; 
• The categories of sources from which that information about the consumer was collected; 
• The business or commercial purpose for collecting, selling, or sharing the consumer’s personal information; 
• The categories of third parties with whom the business shared personal information; and
• The specific pieces of personal information the business has collected about that consumer (i.e., give the consumer his or her personal information).

RouteOne has developed a template response form, which is available to Dealers under the ‘Rates & Forms’ tab, to customize and provide to consumers in response to requests for disclosure of the categories of personal information.  

The response to a consumer’s Request for Disclosure must be specific to the individual. It is important that when using this response template, you look at what your dealership has collected, shared, and disclosed about the requesting consumer and fill out this form correctly; check the boxes for the applicable categories and items that are applicable to the requesting consumer. 

Important: This form is intended only to be a tool to aid you in your compliance, and use of the RouteOne-provided template does not ensure compliance with applicable legal and regulatory obligations. You remain solely responsible for compliance and should seek the advice of legal counsel to be sure your responses to Requests for Disclosure satisfy the requirements of CCPA. 

Requesting a Consumer’s Specific Personal Information from RouteOne

If a customer requests their specific personal information from your dealership and you need to obtain data from RouteOne, call the RouteOne service desk at 866.768.8301, opt. 4, or email  r1support@routeone.com to request a copy of the customer’s personal information.  

Provide the contact information (name, phone number, and email address) for the authorized Dealer representative (i.e., the Dealer employee responsible for responding to state-specific privacy requests), your RouteOne Dealer ID, and the date the customer made the request. 

The RouteOne service desk representative will create and escalate a ticket to our Level 2 team. A Level 2 representative will contact the authorized Dealer representative via phone to collect the customer information required to complete the record request. 

Best practices for requesting a customer record include: 

• Ensure you have the accurate spelling of the customer’s name. 
• Include all possible record iterations, such as other possible names. 
• The record search will depend on the accuracy of the information provided.

Once the customer information has been provided to the Level 2 representative, RouteOne will generate a report (which may consist of multiple files) within 10-14 business days. 

Once the report is available, it will be delivered to the authorized Dealer representative via encrypted email.

Important: The report will contain information that: 1) is in RouteOne’s database as of the date the report is generated; 2) is the result of a search based solely upon the search terms provided by the Dealer; and 3) only includes information for the twelve (12) month period preceding the date of the consumer request, subject to RouteOne record retention policies.  

The dealership should consult with its counsel and remains solely responsible for: 1) verifying the identity of the requesting consumer; 2) deciding which data in the report must be disclosed to the consumer; 3) determining the applicability of any exemptions from disclosure; and 4) confirming the accuracy of the information contained in the report that is generated at the Dealer’s request. 

Requesting Deletion of a Consumer’s Personal Information from RouteOne

If a consumer requests deletion of their personal information at your dealership and you need to in turn request deletion of that information by RouteOne, call the RouteOne service desk at 866.768.8301, opt. 4, or email r1support@routeone.com to request deletion of the consumer’s personal information.  

Provide the contact information (name, phone number, and email address) for the authorized Dealer representative (i.e., the Dealer employee responsible for responding to state-specific privacy requests), your RouteOne Dealer ID, and the date the consumer made the request. 

Important: The dealership should consult with its counsel and remains solely responsible for: 1) verifying the identity of the requesting consumer; and 2) determining the applicability of any exemptions from deletion. Once deletion has occurred, this action cannot be undone. 

The RouteOne service desk representative will create and escalate a ticket to our Level 2 team. 

A RouteOne Level 2 representative will contact the authorized Dealer representative via phone to collect the consumer information required to complete the deletion request. 

Best practices for requesting deletion of a consumer’s personal information include: 

• Ensure you have the accurate spelling of the consumer’s name. 
• Include all possible record iterations, such as other possible names. 
• The search will depend on the accuracy of the information provided. 

The RouteOne Level 2 representative will send an email taken to the authorized Dealer representative confirming the action taken.