PRIVACY POLICY FOR CAR SALES CUSTOMERS OF HERTZ SYSTEM LICENSEE

Overland West, Inc.
dba Hertz Car Sales
P.O. Box 590
Ogden, UT 84402



PRIVACY POLICY FOR CAR SALES CUSTOMERS

Last updated February 25, 2002

The Hertz System licensee identified on the cover operates an independent car sales business using the "Hertz" name under a license granted by Hertz System, Inc., a subsidiary of The Hertz Corporation. That Hertz System licensee, together with any company operating the licensee's car sales business under an operating agreement, collectively are called the "Licensee".

The Hertz Corporation and its subsidiaries have adopted a Privacy Policy for Car Sales Customers, a current copy of which is attached. That policy, as it may be changed from time to time as described under the heading "Future Changes in Policy" appearing therein, is referred to as the "Hertz Privacy Policy". The Licensee is an independent business that is not owned or controlled by The Hertz Corporation, but the Licensee nonetheless has decided to abide by the Hertz Privacy Policy as if the Licensee were a subsidiary of The Hertz Corporation.

Customers and prospective customers of the Licensee's car sales business wishing to understand the Licensee's privacy policy should begin by familiarizing themselves with the Hertz Privacy Policy. To do this, they should read the Hertz Privacy Policy carefully all the way to the end, paying particular attention to references to subsidiaries. As described in the "Who We Are" section of the Hertz Privacy Policy, the term "we" is used throughout the Hertz Privacy Policy to include The Hertz Corporation and its subsidiaries. In essence, the Licensee's privacy policy is to observe the Hertz Privacy Policy as if the Licensee were a subsidiary of The Hertz Corporation and included in the term "we" as used in the Hertz Privacy Policy. A more detailed description of the Licensee's privacy policy follows.

Definitions.

"Customers". As used below, the term "customers or prospective customers" means individual persons, not companies, who are customers or prospective customers of the Licensee's car sales business.

"Personally Identifiable Data". As used below, the term "personally identifiable data" means any data about an identified or identifiable individual that are recorded in any form. The term does not cover aggregated data from which the personally identifiable characteristics have been removed.

Collection of Data. The Licensee will only gather personally identifiable data about customers and prospective customers in the manner and to the extent that the Licensee would be allowed to do so under the Hertz Privacy Policy were the Licensee a subsidiary of The Hertz Corporation.

Data Security. The Licensee will observe all the requirements of the Hertz Privacy Policy with respect to data security that would be applicable to the Licensee were the Licensee a subsidiary of The Hertz Corporation.

Use of Data. The Licensee shall only make any "Type I Use" of personally identifiable data about customers and prospective customers that the Licensee could make under the Hertz Privacy Policy were the Licensee a subsidiary of The Hertz Corporation, as that term is defined in the Hertz Privacy Policy. The Licensee retains the right to use aggregated data from which personally identifiable characteristics are removed in any way that the Licensee feels advances the Licensee's business interests.

How to Access or Correct Data. The Licensee will observe the obligations with respect to the accuracy, currency and completeness of personally identifiable data about customers and prospective customers that would apply to the Licensee under the Hertz Privacy Policy were the Licensee a subsidiary of The Hertz Corporation, with one difference. That difference is that all contacts should instead be addressed to the Licensee at the address shown on the cover, with a copy to either Director, Car Sales Privacy Services, The Hertz Corporation, P.O. Box 25301, Oklahoma City, OK 73125, U.S.A. or Director, Privacy Services, Hertz Europe Financial Center, Swords Business Park, Swords, Co. Dublin, Republic of Ireland.

Future Changes in Policy. The Licensee reserves the right to change this privacy policy in any way at any time. However, if the Licensee changes the Licensee's privacy policy in a way that is less protective of customers' or prospective customers' privacy, the change will not apply to the Licensee's use of any personally identifiable data about them that was collected by the Licensee before the change was made, unless the Licensee notifies the affected customers or prospective customers and provides them with the opportunity to direct the Licensee not to make new uses of personally identifiable data about them.

Coordination with Applicable Law. The Licensee's rights and obligations will be subject to the provisions of applicable law in the same manner as is provided for in the Hertz Privacy Policy with respect to subsidiaries of The Hertz Corporation.

Information Regarding Former Customers. The Licensee's obligations with respect to personally identifiable data regarding former customers or customers with inactive accounts will be the same as those that would apply under the Hertz Privacy Policy were the Licensee a subsidiary of The Hertz Corporation.

Customer Questions. If customers or prospective customers have any questions about the Licensee's collection and use of personally identifiable data about its customers, they can write to Licensee at the address shown on the cover. Licensee will observe the obligations regarding responses to customer questions that would apply to the Licensee under the Hertz Privacy Policy were the Licensee a subsidiary of The Hertz Corporation.

What Customers Consent and Agree To. By providing personally identifiable data to the Licensee, customers and prospective customers consent and agree to the same matters as they would consent and agree to under the Hertz Privacy Policy if they were dealing with a subsidiary of The Hertz Corporation.

The Hertz Corporation

Our Privacy Policy for Car Sales Customers

Last Updated November 1, 2001

Protecting your privacy is nothing new for us. We recognize that you want to understand how personally identifiable data about you is being gathered and used. We also recognize that you want to be able to make knowledgeable choices about whether to limit the manner in which personally identifiable data about you is used. This Privacy Policy is our current corporate policy on these subjects. To understand this Privacy Policy, you should read the entire policy carefully through to the "What You Consent and Agree To" section at the end of the policy.

When you read our Privacy Policy, you can expect to learn about the following topics:

  • Who We Are
  • Scope and Nature of Policy
  • Collection of Data
  • Types and Sources of Data Gathered
  • Use of "Cookies"
  • Third Party Websites
  • Retention of Data
  • Data Security
  • Use of Data
  • Parties to Which We Disclose Data
  • Type I Uses
  • Type II Uses
  • Sensitive Data
  • Options to Limit Use of Data
  • How to Access or Correct Data
  • Future Changes in Policy
  • Coordination with Applicable Law
  • Information Regarding Former
  • Customers
  • Customer Questions
  • What You Consent and Agree To

Who We Are

We are The Hertz Corporation and its subsidiaries. We, together with our agents and independent licensees, operate the largest car rental business in the world based upon revenues and one of the largest industrial and construction equipment rental businesses in North America based upon revenues. We also operate car sales and claim administration businesses. Our affiliates include our parent company, Ford Motor Company, and the companies (other than us) that Ford Motor Company controls, such as Ford Motor Credit Company.

Scope and Nature of Policy

This Privacy Policy covers personally identifiable data collected from and about you - individuals who are customers and prospective customers of our car sales businesses. "Personally identifiable data" means any data about an identified or identifiable individual that are recorded in any form. This Privacy Policy does not cover personally identifiable data we collect from and about our employees. It also does not cover personally identifiable data we collect from and about customers of our other businesses, including our car rental business. We have different corporate policies for those types of data. Further, this Privacy Policy does not cover aggregated data from which the personally identifiable characteristics have been removed. We retain the right to use aggregated data in any way that we feel advances our business interests.

This Privacy Policy complies with the requirements of the Safe Harbor Privacy Principles issued by the U.S. Department of Commerce on July 21, 2000 (the "Safe Harbor Principles"). Because we comply with the Safe Harbor Principles, our transfers of data from countries in the European Union to the United States meet the adequacy requirements of the European Union Data Protection Directive.

This Privacy Policy includes examples of the types of information we may collect and the kinds of companies to which we may disclose information. These examples are illustrative and should not be considered a complete inventory of our information collection or sharing practices. Accordingly, the words "include" and "including" mean inclusion without limitation.

We do not knowingly solicit personally identifiable data from persons under the age of 13 years.

As used in this Privacy Policy, the words "company" and "companies" mean any corporation(s), limited liability company or companies, partnership(s) or other similar entity or entities.

Collection of Data

Types and Sources of Data Gathered

In the ordinary course of our business, we gather personally identifiable data about you, including:
  • Information you provide, such as your name, address(es), employer(s), employee identification number(s), telephone number(s), fax number(s), e-mail address(es), date and place of birth, driver's license number, credit card information, the duration and ownership of your vehicle(s) and residence(s) and your vehicle preferences, along with your employment, salary and credit history and your other assets and liabilities;
  • Information about your transactions with us, our affiliates or others, such as the vehicle identification number of any vehicle you purchase from us and the method by which you finance any vehicle purchase; and
  • Information we receive from consumer reporting agencies, such as your creditworthiness and credit history.

We gather personally identifiable data about you from a variety of sources, including websites we operate, websites operated by others, vehicle purchase agreements and applications for loans to finance the purchase of vehicles from us. We also gather personally identifiable data about you from other companies with which we maintain business relationships.

Use of "Cookies"

One way we collect information about you when you use our websites is through the use of cookies. A "cookie" is a set of data that a website server stores on your computer. Cookies enable websites to recognize your computer and to "remember" your entries as you move from page to page, or even when you revisit the site from time to time using the same computer. Cookies stored on your computer by our websites are encrypted. This means that they cannot easily be read by anyone other than us.

We use two different types of cookies in our websites:

"Session cookies" track the user's progression through our sites in a single visit. These cookies enable us to remember things as the user progresses from one page to another. Your session cookies are deleted as soon as you close your browser. In addition, if you leave your browser open for a prolonged period, they are set to automatically erase themselves after a short period (typically less than one hour).

"Persistent cookies" remember a user at the user's next visit. Your persistent cookies are not automatically erased, and they remain on your computer until you erase them. (If you do not want these cookies to remain on your computer, you can erase them through use of your browser settings.)

Your browser or other software you install may permit you to restrict the use of session cookies, persistent cookies or all cookies. If you elect not to permit the use of session cookies, you will not be able to use our websites. If you elect not to permit the use of persistent cookies only, you may still enjoy the full functionality of our websites; however, if you do so, you will need to re-enter some data when starting a new session.

Third Party Websites

Our websites may contain links to third party websites, which may or may not be operated in conjunction with our websites. We do not monitor or control the information collected when you choose to "click through" links to these websites. The treatment of user data by the operators of third party websites may be different from ours. For details regarding their treatment of personally identifiable data about you, you will need to read their privacy policies or contact them.

Retention of Data

While we generally retain personally identifiable data about you as long as we believe it will be useful to us, we do not retain personally identifiable data about you longer than the law of the country and state in which it is being retained permits. Currently, the principal place in which we retain personally identifiable data about you is the State of Oklahoma, U.S.A.

Data Security

We maintain reasonable physical, electronic, and procedural safeguards to protect personally identifiable data about you from loss, misuse and unauthorized access, disclosure, alteration and destruction. As part of those precautions, we seek to protect personally identifiable data about you through technologies designed to safeguard the data during its transmission. We restrict access to personally identifiable data about you to those employees we determine need to know that information for us and our licensees to provide services to you. We also have adopted a policy under which employee misuse of personally identifiable data about you is treated as a serious offense for which disciplinary action may be taken. You should, however, be aware that there is no method of transmitting or storing data that is completely secure. Although their physical characteristics are different, postal mail, telephone calls, faxes and transmissions over the Internet all present possibilities of loss, misrouting, interception and misuse of the data being transmitted.

When we decide what data to seek from or communicate to you, or how to seek or communicate it, we try to strike a reasonable balance between the security of your data and your convenience. We do this because we believe our customers attach value to both. As a result, we sometimes use a method of communication that is less secure than some of its less convenient alternatives. An important example of this occurs in the case of e-mail. When we send e-mail to you, we send it as plain text without encrypting it. We do this because we believe that many of our customers do not currently have the capability to receive encrypted e-mail. As a consequence, though, if our unencrypted e-mail intended for you were misrouted or intercepted, it could be read more easily than encrypted e-mail.

To protect personally identifiable data about you effectively, we need your help. Because e-mail to and from us is not encrypted, please do not include any other information you regard as confidential in any e-mail you send us. A more secure way to communicate with us over the Internet is to click on the "Contact Us" link on the home page of our website www.hertzcarsales.com and complete the form that you are presented.

Use of Data

Parties to Which We Disclose Data

We may disclose all of the personally identifiable data about you, in the manner described below, to third parties such as the following:
  • Financial service providers, such as banks and insurance companies;
  • Non-financial companies, such as Hertz licensees, direct marketers, hotels and airlines; and
  • Others, such as non-profit organizations.

Type I Uses

We may use personally identifiable data about you for a variety of purposes as described in this section, including using personally identifiable data about you to make and process your vehicle purchase from us or our licensees, provide you with customer assistance, prepare your sale documents and maintain and develop software. We may use affiliates in our corporate family and non-affiliated parties to perform such services for us. We also may disclose information in response to requests from law enforcement agencies or government regulators. A more detailed description of the above uses and all other "Type I Uses" appears below.

By purchasing a vehicle from us or our licensees, you are consenting to our use and disclosure of personally identifiable data about you for Type I Uses. If you do not wish to consent to such use and disclosure of personally identifiable data about you, please do not purchase a vehicle from us or our licensees.

Initial Uses. We may initially use the personally identifiable data that we collect from you to complete the sale of a vehicle to you, including the transfer of title and the collection of the amounts owed in the sale. If you seek to pay a portion of the amount you owe by a debit, charge or credit card, we may disclose personally identifiable data about you to the company issuing the card and to other companies that assist in processing the charges. If you apply for a loan from a financial institution to pay any or all of the amount you owe, we will disclose your personally identifiable data to that institution and to companies that assist it in processing the loan or the loan application.

Protective Uses. We may use and disclose personally identifiable data about you as we reasonably believe is necessary to protect our business; to comply with applicable law; to protect the rights, privacy, safety or property of you or others; and to permit us to pursue available remedies or limit the damages that we may sustain. For example, if you breach an agreement with us or any of our licensees or affiliates, personally identifiable data about you may be used, disclosed to third parties or publicly disclosed to the extent necessary to enforce the agreement and recover any amounts owed. As another example, we may, to the fullest extent the law allows, disclose personally identifiable data about you to law enforcement agencies to assist them in identifying individuals who have been or may be engaged in illegal activities.

Disclosure in Corporate Acquisitions and Sales. As we develop our businesses, we may acquire or sell assets, including ownership interests in companies, and companies may acquire financial interests in us. In those transactions, personally identifiable data about you may be among the transferred business assets. We may disclose personally identifiable data about you to any company in connection with a proposed or actual sale, merger, transfer, or exchange of all or a portion of a business or operating unit if you do business or have done business with that business or operating unit, but only if that company agrees to use the data solely for the purpose of making its acquisition decision and to observe the relevant provisions of our Privacy Policy with respect to the data. In the event that personally identifiable data about you is transferred to a company acquiring assets from us, we will require that company to agree to observe the relevant provisions of our Privacy Policy with respect to personally identifiable data about you (including any choices you have made under our Privacy Policy to limit the use of your data).

Disclosure to Agents. We may disclose personally identifiable data about you to any individual or company that we retain to assist us in the conduct of our business, including an individual or company that performs marketing services on our behalf, but only if that individual or company agrees to use the personally identifiable data about you solely for the purposes of performing the tasks on behalf of, and under the instruction of, us and to observe the relevant provisions of our Privacy Policy with respect to the data.

Use of Data from Others. We may obtain personally identifiable data about you from our licensees and affiliates and from other companies with which we have business relationships. Such information may be merged with or used to enhance personally identifiable data that we have collected previously, as permitted by applicable law.

Disclosure to Affiliates. We may share personally identifiable data about you among ourselves and disclose such data to affiliates to enable us to perform the functions described above. In the event that personally identifiable data about you is shared among ourselves or disclosed to our affiliates, the party to which we disclose or with which we share such data will be required to agree to observe the relevant provisions of our Privacy Policy with respect to personally identifiable data about you (including any choices you have made under our Privacy Policy to limit the use of your data).

Type II Uses

The uses of personally identifiable data about you described under this heading are called "Type II Uses." Type II Uses relate to uses of personally identifiable data about you for marketing purposes. You have the right to "opt out" of Type II Uses in the manner described below under the heading "Options to Limit Use of Data."

We may aggregate and analyze all of the personally identifiable data about you to enable us to develop targeted marketing programs and service offerings that we believe are tailored to the needs of particular groups of customers. We may then use the personally identifiable data about you to contact you regarding programs and services we believe might be of interest to you. If you wish us not to contact you for this purpose, you may choose Option B described below under "Options to Limit Use of Data."

We may share all of the personally identifiable data about you among ourselves and disclose such data to our affiliates and licensees for marketing purposes, provided the affiliates and licensees to which we disclose the data agree to observe the relevant provisions of our Privacy Policy with respect to the data being disclosed (including any choices you have made under our Privacy Policy to limit the use of your data). If you wish us not to disclose personally identifiable data about you to our affiliates and licensees for marketing purposes, you may choose Option B described below under "Options to Limit Use of Data."

We may also disclose all of the personally identifiable data about you to companies that are not our affiliates or licensees for their marketing purposes. When we disclose personally identifiable data about you to companies that are not our licensees or affiliates for their marketing purposes, we do not require those companies to observe any particular policies with respect to their use or disclosure of the data. They may treat privacy issues very differently from the way we do. If you wish us not to disclose personally identifiable data about you to companies that are not our affiliates or licensees for their marketing purposes, you may choose Option A described below under "Options to Limit Use of Data."

Sensitive Data

In some countries and states, we are legally required to treat certain personally identifiable data about you as sensitive and to employ additional safeguards when collecting and using that data. We will observe those requirements. If a country or state legally requires us to treat certain personally identifiable data about you as sensitive and not to collect, use or disclose it without your consent, then by purchasing a vehicle from us or our licensees and providing that data to us, you are consenting to the collection, use and disclosure of that data by us and our licensees, but only for Type I Uses. We do not disclose that data to our affiliates or our business partners other than as authorized by the applicable law, and we do not use that data for marketing purposes. If you do not wish to consent to the collection, use and disclosure of that data for Type I Uses, then please do not provide that data to us; if under our and our licensees' policies, a vehicle purchase cannot be made without that data, please do not purchase a vehicle from us or our licensees.

Options to Limit Use of Data

Options and Their Effect. You may elect either or both of the following options to limit the use of personally identifiable data about you:

A. You may direct us not to disclose personally identifiable data about you collected in the course of our car sales business to companies that are not our affiliates or licensees for their marketing purposes. If you do this, we will not, after your direction becomes effective, disclose that personally identifiable data to those companies for marketing purposes. (We are not, however, responsible for any subsequent use by third parties of data disclosed to them before your direction became effective.)

B. You may direct us not to communicate any marketing offers or materials to you in the course of our car sales business and not to disclose personally identifiable data about you collected in the course of our car sales business to our affiliates or licensees for marketing purposes. If you do this, we will not, after your direction becomes effective, either communicate those marketing offers or materials to you or disclose that personally identifiable data about you to our affiliates and licensees for marketing purposes. (We are not, however, responsible for any subsequent use by affiliates or licensees of data disclosed to them before your direction became effective.)

How to Choose an Option. You may choose Option A, Option B or both options by mailing the attached form to Director, Car Sales Privacy Services, in care of the Sales Manager at the facility at which you purchase the vehicle. You may also make your choice by mailing the attached form to Director, Car Sales Privacy Services, The Hertz Corporation, P.O. Box 25301, Oklahoma City, OK 73125, U.S.A. or Director, Car Sales Privacy Services, Hertz Europe Financial Centre, Swords Business Park, Swords, Co. Dublin, Republic of Ireland. Any direction will become effective by the end of the 20th business day following the date on which it is received at one of the indicated addresses.

Subsequent Choices. If you choose Option A, Option B or both options to limit the use of personally identifiable data about you and you later choose different options, or choose to no longer to limit the use of personally identifiable data about you, then we will observe the terms of your latest effective choice as if it were the only instruction we had received from you with respect to the use of personally identifiable data about you.

Option to Limit Non-Marketing Uses of Data. We will not make any non-marketing use of personally identifiable data about you collected in the course of our car sales business unless either: (i) we give you notice of that use and provide you the opportunity to direct us not to make that use of the personally identifiable data about you, or (ii) applicable law or where applicable, the Safe Harbor Principles, authorize us to make that use of personally identifiable data about you without providing you the opportunity to direct us not to do so. Please note that all Type I Uses of personally identifiable data about you as described in our Privacy Policy constitute uses that are so authorized.

How to Access or Correct Data

We make reasonable efforts to ensure that the personally identifiable data we have about you is as accurate, current and complete as necessary for the purposes for which we use that data.

You have a reasonable right to access and review personally identifiable data about you collected by us. You may correct factual errors in that data by sending a request to us that credibly shows the error. You should contact our main office in the country in which you reside for information about how to exercise these rights. As an alternative, you may obtain the information by writing to Director, Car Sales Privacy Services, The Hertz Corporation, P.O. Box 25301, Oklahoma City, OK 73125, U.S.A. or Director, Car Sales Privacy Services, Hertz Europe Financial Centre, Swords Business Park, Swords, Co. Dublin, Republic of Ireland. To protect your privacy and security, we will take reasonable steps to verify your identity before granting access or making corrections.

Future Changes in Policy

We make our Privacy Policy available at car sales locations and through a link on the home page of our website www.hertzcarsales.com. We reserve the right to change our Privacy Policy in the future. Subject to applicable laws, any changes to our Privacy Policy will be effective upon posting of the revised Privacy Policy on the Internet, accessible from a link appearing on the home page of our website www.hertzcarsales.com. If we make changes, we will revise the "Last Updated" date on the top or cover page of our Privacy Policy.

If we change our Privacy Policy in a way that is less protective of your privacy, then the change will not apply to our use of any personally identifiable data about you that was collected by us before the change was made, unless we notify you and provide you with the opportunity to direct us not to make new uses of personally identifiable data about you.

Coordination with Applicable Law

We do business in many countries and states. Depending on where you live and where and how you rent from us, our collection and use of personally identifiable data about you may be governed by federal and state laws of the United States (including the Gramm-Leach-Bliley Act), the laws of other countries or the Safe Harbor Principles. Where applicable, we will comply with such laws and the Safe Harbor Principles regarding our collection and use of personally identifiable data about you and will limit any disclosures of data accordingly.

Information Regarding Former Customers

We disclose personally identifiable data about former customers or customers with inactive accounts only in accordance with our Privacy Policy.

Customer Questions

We hope our Privacy Policy answers your questions about our collection and use of personally identifiable data about you. If it does not, or if you have questions about whether we are observing our Privacy Policy, please write to us at Director, Car Sales Privacy Services, The Hertz Corporation, P.O. Box 25301, Oklahoma City, OK 73125, U.S.A. or Director, Car Sales Privacy Services, Hertz Europe Financial Centre, Swords Business Park, Swords, Co. Dublin, Republic of Ireland. If, after we respond to you, you feel that we have not satisfactorily addressed your questions or concerns, we will refer you to a neutral, independent third party dispute resolution organization.

What You Consent and Agree To

By providing us with personally identifiable data about yourself, you consent and agree to the following:

  • You consent to the collection and use of personally identifiable data about you as described in the "Collection of Data" and "Use of Data" sections above, subject only to any choices you have made as described under "Options to Limit Use of Data," and to your right to access and correct data as described in "How to Access or Correct Data" above.
  • You specifically consent to:
    The disclosure of personally identifiable data about you in connection with corporate acquisitions and sales as described under "Use of Data - Type I Uses - Disclosure in Corporate Acquisitions and Sales"; and The collection and use of any sensitive data about you for Type I Uses as described under "Use of Data - Sensitive Data."
  • You acknowledge you accept the risks described under "Data Security" and agree to take the precautions to assist us in protecting your data described under "Data Security."
  • You agree that we may make changes in our Privacy Policy as described under "Future Changes in Policy."

© 2001 The Hertz Corporation. All rights reserved.