CCPA Notice at Collection

This Notice at Collection is provided pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA"). It describes the categories of personal information that Ekho, Inc. and its affiliates (collectively, "Ekho," "we," "us," or "our") collect about California residents and the purposes for which we use that information. As used in this notice, "affiliates" includes any subsidiaries, parent companies, and entities under common control with Ekho, Inc.

Ekho is a vehicle commerce platform that facilitates end-to-end vehicle transactions — including financing, titling, registration, insurance verification, tax remittance, and compliance — on behalf of dealerships, OEMs, and their buyers. This notice covers personal information collected through our website (www.ekho.com), our checkout and buyer portal applications, our dealer admin portal, and any other services we provide.

1. Categories of Personal Information We Collect

Ekho, Inc. and its affiliates may collect the following categories of personal information, as defined by the CCPA:

2. Sensitive Personal Information

We collect the following categories of sensitive personal information, as defined under the CCPA:

• Social Security Numbers — required for financing applications and lender underwriting
• Driver's license and state ID numbers — required for identity verification, KYC compliance, and vehicle titling
• Financial account information — required to process payments and facilitate financing
• Precise geolocation — derived from addresses provided for tax calculation, registration, and delivery
• Biometric information — facial geometry or other biometric identifiers may be derived from identification documents by our third-party identity verification providers for the purpose of verifying your identity

We use sensitive personal information only for the purposes of completing vehicle transactions, processing financing applications, fulfilling regulatory and compliance requirements, and preventing fraud. We do not use sensitive personal information for purposes beyond what is necessary to provide our services, and we do not use it to infer characteristics about you.

3. Purposes for Collection

We collect and use personal information for the following business and commercial purposes:

• Vehicle transaction processing — completing purchases, generating sales documentation, processing payments, and coordinating delivery
• Financing — submitting applications to lending partners, matching buyers with appropriate loan products, processing F&I product selections
• Titling, registration, and compliance — preparing and submitting DMV documentation, calculating and remitting taxes and fees, ensuring compliance with state-specific vehicle sale requirements across all 50 states
• Identity verification and fraud prevention — KYC and AML screening, real-time fraud detection, verifying buyer identity and insurance
• Platform operations — maintaining and improving our services, analytics, troubleshooting, and customer support
• Communications — sending transaction-related notifications, order status updates, and responding to inquiries
• Legal compliance — fulfilling obligations under GLBA, state motor vehicle laws, tax regulations, and other applicable legal requirements

4. Data Retention

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, or as required by law. Specific retention periods vary by data category:

• Credit application data (SSNs, income, employment submitted for financing) — retained for a minimum of 25 months as required by Regulation B (Equal Credit Opportunity Act), then securely disposed of within 2 years of last use per the FTC Safeguards Rule, unless a longer retention period is required by other applicable law
• Transaction records and financial data — retained as required by federal and state tax, financing, and motor vehicle regulations (typically 5–7 years)
• Identity verification records — retained for a minimum of 5 years as required by KYC/AML and Bank Secrecy Act regulations
• Platform activity data (browsing, analytics, cookies) — retained for up to 24 months for analytics and fraud prevention, then anonymized or deleted
• Sensitive personal information (SSNs, financial accounts) — encrypted at rest with AES-256 and retained only as long as required for the specific transaction or regulatory obligation, then securely purged

5. Sale and Sharing of Personal Information

Ekho does not sell personal information. We do not sell, rent, or trade your personal information to third parties for monetary or other valuable consideration.

We may share personal information with the following categories of third parties solely to provide our services:

• Lending partners — to process financing applications and fund approved loans
• Partners (dealerships, OEMs, distributors, and others) — to fulfill vehicle orders, coordinate delivery, and manage the partner-buyer relationship
• Payment processors — to process deposits, down payments, and other transaction payments
• Government agencies — to submit titling, registration, and tax documentation as required by law
• Identity verification and fraud prevention providers — to verify buyer identity and screen for fraud
• Insurance carriers — to verify insurance coverage as required for vehicle registration
• F&I product providers — to underwrite and bind selected aftermarket protection products

All third-party partners who handle personal information on our behalf are contractually required to maintain appropriate security measures, including SOC 2 compliance or equivalent certifications.

6. Gramm-Leach-Bliley Act (GLBA) Exemption

Ekho facilitates vehicle financing by submitting buyer applications to lending partners and processing F&I products. In connection with these activities, Ekho may be considered a "financial institution" as defined under the Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.).

Pursuant to Cal. Civ. Code section 1798.145(e), personal information that is collected, processed, sold, or disclosed subject to the GLBA and its implementing regulations is exempt from certain provisions of the CCPA. This exemption applies on a data-level basis — it covers specific categories of nonpublic personal information ("NPI") collected in connection with providing financial products or services, including:

• Information a consumer provides on a credit or financing application (SSN, income, employment, housing)
• Information resulting from a financing transaction (loan terms, payment history, F&I product selections)
• Information otherwise obtained in connection with providing a financial product or service

This exemption does not apply to personal information collected outside the financing context, including website browsing data, marketing analytics, cookies, and data from visitors who have not applied for or received a financial product through our platform. Such data remains fully subject to the CCPA, and your rights described in Section 7 below apply in full to that data.

For information about how we handle NPI subject to the GLBA, including your rights under that law, please contact us at [email protected].

7. Your Rights Under the CCPA

As a California resident, you have the following rights regarding your personal information that is subject to the CCPA (i.e., not exempt under the GLBA as described in Section 6):

• Right to Know — You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for collection, and the categories of third parties with whom we shared it.
• Right to Delete — You may request that we delete personal information we have collected about you, subject to certain legal exceptions (e.g., data required for regulatory compliance, to complete an ongoing transaction, or that is subject to the GLBA exemption).
• Right to Correct — You may request that we correct inaccurate personal information we maintain about you.
• Right to Limit Use of Sensitive Personal Information — You may direct us to limit the use of your sensitive personal information to purposes necessary to provide our services. Note: we already limit our use of sensitive personal information to these purposes.
• Right to Non-Discrimination — We will not discriminate against you for exercising any of your CCPA rights. You will not receive different pricing, a different quality of service, or be denied service for making a privacy request.

8. How to Exercise Your Rights

To submit a request to know, delete, or correct your personal information, you may:

• Email us at [email protected]

We will verify your identity before processing your request. For transaction-related data, we may ask you to confirm details associated with your vehicle purchase (e.g., order number, vehicle information) to verify your identity. We will respond to verifiable consumer requests within 45 days, as required by the CCPA.

You may also designate an authorized agent to submit requests on your behalf. Authorized agents must provide written authorization from the consumer and may be required to verify their own identity.

9. Cookies, Targeted Advertising, and Sale/Sharing of Personal Information

When you visit our website, we and our third-party analytics and marketing partners may collect information about you using cookies, pixels, and similar technologies. This data is not subject to the GLBA exemption described in Section 6, and is fully subject to the CCPA. Under the CCPA, this activity may be considered a "sale" or "sharing" of personal information for cross-context behavioral advertising purposes.

The following categories of personal information may be shared with or sold to third parties in connection with analytics and marketing:

• Online identifiers — IP address, device identifiers, cookie identifiers
• Internet or network activity — browsing behavior, pages visited, interactions with our platform

These categories may be shared with analytics providers and marketing platforms to help us understand site usage, measure campaign effectiveness, and improve our services.

To opt out of the sale or sharing of your personal information for targeted advertising purposes, you may adjust your cookie preferences using the cookie settings available on our website. You may also submit an opt-out request by emailing [email protected].

Our services are intended for users age 18 or over. We do not knowingly sell or share the personal information of individuals under the age of 18.

10. Financial Incentive Programs

We do not offer financial incentive programs that require the collection of personal information at this time.

11. Updates to This Notice

We may update this Notice at Collection from time to time to reflect changes in our data practices or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page.

12. Contact Us

If you have questions about this notice or our privacy practices, contact us at:

Ekho, Inc.
Email: [email protected]
Address: 31 East 32nd Street, Floor 3, New York, New York 10016