California Privacy Notice (CCPA / CPRA)

Overview

This notice supplements our Privacy Policy and applies to "consumers" as defined under the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act).

Our role under CCPA/CPRA

• Business: When you interact with EZLeads directly (e.g., as a customer or prospect of EZLeads itself), we are the "Business".
• Service Provider: When we process personal information on behalf of dealerships using our platform, we operate as a "Service Provider" under our DPA.

Categories of personal information collected

In the past twelve (12) months we have collected the following categories of personal information:

• Identifiers (name, email, phone, IP address);
• Customer records (billing address, financial details for paid plans);
• Commercial information (purchase history, lead activity);
• Internet or network activity (logs, browsing, interactions);
• Geolocation data (approximate, derived from IP);
• Audio / electronic information (call recordings made through the call-center module);
• Professional or employment information (B2B contact data);
• Inferences (lead score, pipeline stage).

Sensitive personal information may include account login credentials. We use these only to operate the Services and do not infer personal characteristics from them.

Purposes of collection & use

• Provide, maintain and improve the Services;
• Process subscriptions, billing and customer support;
• Security, fraud prevention and incident response;
• Direct marketing of EZLeads to dealerships;
• Comply with legal obligations.

Disclosure for business purposes

We may disclose categories of personal information listed above to: cloud hosting providers, communications providers, payment processors, advertising networks (where permitted), professional advisers, and law-enforcement authorities. See our Sub-processors page for the current list.

Sale or sharing of personal information

EZLeads does not "sell" personal information for monetary consideration. We may "share" certain personal information for cross-context behavioral advertising in our own marketing (e.g., website-visitor retargeting on Meta and Google). California residents may opt out using the controls below.

Your rights under CCPA/CPRA

• Right to Know — request the categories and specific pieces of personal information we have collected, the categories of sources, the purposes of collection, and the categories of third parties we share with;
• Right to Delete — request deletion of personal information, subject to legal exemptions;
• Right to Correct — request correction of inaccurate personal information;
• Right to Opt Out of Sale or Sharing — direct us not to sell or share your personal information;
• Right to Limit Use of Sensitive Personal Information — limit our use to specific purposes;
• Right to Non-Discrimination — not be discriminated against for exercising your rights;
• Right to Portability — receive your personal information in a portable, readily usable format.

Do Not Sell or Share my Personal Information

You can opt out of "sharing" through:

• The privacy request form with "Opt out of sale/sharing" selected;
• The cookie banner shown on first visit;
• Sending Global Privacy Control (GPC) signals from your browser — we honor GPC.

Limit Use of Sensitive Personal Information

We do not use sensitive personal information to infer characteristics. If you wish to formally exercise this right anyway, use the form linked above and select the option.

How to exercise your rights

• Use our privacy request form;
• Email privacy@ezleads.io with subject "California privacy request";
• Call (786) 755-0991 during US business hours.

We will verify your identity using information already in our records and respond within 45 calendar days (with one 45-day extension where reasonably necessary).

Authorized agents

You may use an authorized agent to submit a request on your behalf. Agents must provide written, signed authorization and we may still need to verify your identity directly.

Annual metrics

EZLeads will publish, by July 1 of each year on this page, metrics for the prior calendar year covering verifiable consumer requests received, complied with, denied, and average response times — as required by California regulations applicable to businesses meeting the relevant thresholds.