Privacy Statement

LITHIA MOTORS PRIVACY POLICY

This Privacy Policy is effective as of June 1, 2024.

Lithia Master LP Company (“Lithia”, “we”, “our”, “us”) recognizes the importance of your right to privacy and wants you to be familiar with how we collect, use, and disclose any personal information that individually identifies you and our commitment to meet our obligations under applicable Canadian privacy laws.

This Privacy Policy explains how we collect, use, disclose and protect your personal information when you use our websites and our mobile sites (collectively, the “Site”), when you use our services, including our motor vehicle leasing services (collectively, the “Services”), when you purchase our products (collectively, the “Products”) and when you contact us by phone, email or other media, or visit our dealerships to inquire about or obtain products and services that we offer. It also explains how you can contact us if you have questions about how we handle your information. We will only collect, use and disclose your personal information in accordance with this Privacy Policy.

Depending on the Service or Product, we may provide additional or different privacy notices for specific relations you have with us or to highlight how we use your personal information for specific Services or Products. Where we do this, it will be clear which notices apply to which relations, Services and Products.

By using our Site and Services and supplying your personal information, you acknowledge that you have read and understood this Privacy Policy, and you agree and consent to the collection, use, disclosure, and other processing of your personal information as outlined in this Privacy Policy. If you do not agree to the terms of this Privacy Policy, please do not use our Site or Services or supply your personal information to us.

• Scope

This Privacy Policy also applies to all personal information that Lithia and its affiliates, dealerships, and other entities (collectively, the “Lithia Group”, and all references to “Lithia”, “we”, “our”, “us” shall also include such entitles) collect from you, including but not limited to:

• Guelph-S, LP, d.b.a. Pfaff Subaru
• L817, Inc., d.b.a. Woodbridge Hyundai
• Lithia Canada Leasing, LP, d.b.a. Pfaff Leasing
• Markham-B, LP, d.b.a. BMW Markham, d.b.a. MINI Markham
• Markham-P, LP, d.b.a. Porsche Centre Markham, d.b.a. Centre Markham Porsche
• Mississauga-B, LP, d.b.a. Pfaff BMW
• Motus Car Rental, LP, d.b.a. Motus Car Rental
• Newmarket-A, LP, d.b.a. Audi Newmarket, d.b.a. Audi Newmarket, Newmarket Audi
• Newmarket-V, LP, d.b.a. Volkswagen of Newmarket
• Richmond Hill-H, LP, d.b.a. Pfaff Harley-Davidson
• Thornhill-A, LP, d.b.a. Acura of Thornhill
• Thornhill-H, LP, d.b.a. Honda of Thornhill
• Vancouver-MP, LP, d.b.a. McLaren Vancouver, d.b.a. Pfaff Reserve
• Vaughan-A, LP, d.b.a. Audi Vaughan, d.b.a. Audi Vaughan Pre-Owned, d.b.a. Pfaff Audi Pre-Owned
• Vaughan-D GP, Inc., d.b.a. Ducati Toronto
• Vaughan-P, LP, d.b.a. Porsche Centre Vaughan
• Vaughan-S, LP, d.b.a. Singer
• Woodbridge-MC, LP, d.b.a. McLaren Toronto, d.b.a. Pfaff Reserve
• Woodbridge-PA, LP, d.b.a. Pagani of Toronto

This Privacy Policy governs the Lithia Group’s practices with respect to the personal information we collect from you through its various Sites, including but not limited to the following (together with any additional websites and mobile sites owned by the Lithia Group from time to time):

• www.pfaffauto.com
• www.pfaffaudi.com
• www.hjpfaffaudi.com
• www.pfaffbmw.com
• www.bmwmarkham.com
• www.minimarkham.ca
• www.pfaffsubaru.com
• www.vwofnewmarket.com
• www.pfaffporsche.com
• www.porschecentremarkham.com
• www.mclarentoronto.ca
• www.mclarenvancouver.ca
• www.pfaffleasing.com
• www.pfaffreserve.com
• www.pfafftuning.com
• www.pfaffautoworks.com
• www.pfaffmotorsports.com
• www.pfaffmarine.com
• www.hondaofthornhill.com
• www.acuraofthornhill.com
• www.ducatioftoronto.com
• www.woodbridgehyundai.ca

• What Personal Information Do We Collect?

Personal information means any information about an identifiable individual. Anonymous data means data that is not associated with or linked to any individual’s personal information or will not easily permit the identification of individuals (“Anonymous Data”). Lithia does not consider personal information to include Anonymous Data.

The types of personal information that we may collect include, but is not limited to:

• contact information, such as your name, postal address, e-mail address and telephone number;
• your payment information;
• your date of birth;
• information we receive from you in connection with your application for credit, including employment information, income information, bank statements (and proof of income, information regarding your debts and expenses, information from credit reporting agencies, insurance information, home rental or ownership information, the amount of your rental or mortgage payments, financial institution information, and other information to assist in obtaining a credit report;
• your driver’s license information;
• banking information, including your account number and other information needed for pre- authorized payments;
• information about the use of your vehicle, including operational and safety related information such as GPS location data (“GPS Data”), speed, air bag deployments, crash avoidance alerts, impact data, camera image and sensor data, voice command information, stability control or anti-lock events, security/theft alerts;
• information and documents to help us verify your identity;
• information regarding the vehicle that you lease or propose to lease and in connection with your lease or proposed lease transaction, including your payment or loan history;
• the type and version of your browser, your service provider, your IP address, and any search engine you may have used to locate our Site;
• log information such as details of how you used our Site;
• personal information you give us that we did not request (such as personal information you voluntarily put into an email to us);
• Warranty or protection products purchased; and
• Service transaction history.

You are not required to provide us with your social insurance number (“SIN”). However, if you do provide your SIN to us, with your consent, we may use your SIN as a unique identifier to ensure that the credit information we are requesting is about you, rather than someone else with the same or similar name.

• Purposes for Collecting Your Personal Information

We may collect, use and disclose your personal information in order to provide you with our Site and Services and so that you may purchase our Products. We also collect, use, and disclose your personal information to comply with legal and regulatory requirements and as otherwise may be permitted or required by applicable laws. We will only use the personal information that we collect for the purposes for which it was collected. We collect your personal information for the following purposes and in accordance with applicable laws:

• to provide you with access to our Site and our Services;
• to evaluate your credit application and ongoing creditworthiness and solvency;
• to enter into a lease or loan with you;
• to manage, administer, collect amounts owing under and enforce any such lease or loan;
• to respond to your inquiries regarding any credit application and any resulting lease or loan;
• to manage, administer, collect amounts owing under and enforce any such lease or loan;
• to verify and confirm your identity;
• to establish and maintain commercial relations with you, including fulfilling your orders through our Site and responding to your questions regarding our Services;
• to respond to questions that you send by email or through our Site;
• to contact you about the Products you have purchased, including notifying you about updates or to send you any Products you have purchased from us;
• subject to applicable law, to notify you about other products, services and events provided by us which may be of interest to you;
• to customize the appearance of the Site displayed to you;
• to obtain your feedback regarding our Site and Services, including our surveys;
• to track behavioral information on the Site to serve similar content upon future visits;
• subject to applicable law, to provide you with newsletters, promotions and articles;
• to improve the Site and help us develop new products, services, apps, tools, and Site features;
• to support our business functions such as internal business processes, marketing, and advertising; and
• to meet any legal or regulatory requirements.

• When Do We Collect Personal Information?

We may collect your personal information when you voluntarily provide it to us by using our Site, our Services or purchasing our Products, or from third party sources. For example, we may ask you to provide personal information if you:

• use our Site and our Services;
• purchase a Product on our Site;
• register, update, or create an account on our Site and our Services;
• sign into your account;

• call into a call centre;
• send us a question or comment by email or phone;
• post comments or other content on our Site and our Services;
• register to receive newsletters, articles and updates about our Site and Services; and
• otherwise participate in features of our Site and our Services that ask for personal information.

We may receive personal information about you from other members of the Lithia Group or from third party sources, such as financial institutions, credit reporting agencies and credit card processors. We use this information to: (i) assist with our business operations; and (ii) to provide our Services and Products. You authorize the collection of your personal information from these sources and, if applicable, you authorize these sources to give us your personal information for the above-mentioned purposes.

If you speak with one of our representatives by telephone, the call may be recorded or monitored. We do this for the following reasons:

• To establish a record of the information that you provide;
• To take or verify instructions from you;
• To confirm your identity;
• To maintain quality service levels; and
• To assist in staff training.

Any personal information posted, used, or disclosed on a Facebook page, Instagram page, Twitter page, YouTube page or other social networking page or site is subject to that website’s privacy policy, and is not subject to this Privacy Policy.

• Limiting Collection of Personal Information

We limit the collection of personal information to that which is necessary to fulfill the purposes identified in this Privacy Policy and we collect, use, and disclose your personal information only in accordance with this Privacy Policy.

• Use, Disclosure and Retention of Personal Information

Your personal information will not be used without your consent for purposes other than those for which it was collected or in accordance with applicable laws. From time to time, we may wish to use personal information for new or additional purposes, in which case we will amend the Privacy Policy to include these new or additional purposes and will obtain your consent through your continued use of our Site and Services.

We may generate Anonymous Data from personal information collected through the Site and Services by removing information that makes the data personally identifiable to an individual. Such Anonymous Data includes, but is not limited to, information we collect from your use of our Site and Services. We may use this Anonymous Data and aggregated data for any reasonable purpose subject to applicable laws and disclose such data to third parties in our sole discretion.

We retain your personal information only for as long as we need it to fulfill the purposes for which it was collected and to comply with our legal obligations.

We may also use and disclose your personal information to other members of the Lithia Group and to service providers, data processors and other third parties (“Third Parties”) under the following limited circumstances:

• to other members of the Lithia Group or Third Parties that assist with our operations and Site and Services including, without limitation, for customer services, our business operations, monitoring and analyzing Site activity, and operating and maintaining the Site and Services;
• to other members of the Lithia Group or Third Parties that assist in processing your lease or loan application or administering your lease or loan application, including, without limitation, credit reporting bureaus, financial institutions, insurance companies, insurance brokers, vehicle manufacturers, motor vehicle dealers, government agencies, and persons to whom you have applied for credit;
• when necessary to protect our safety, property or other rights, our representatives, customers and users of the Site, including to detect and prevent fraud;
• if we sell or transfer all or a portion of our business or assets to a related company or a third party. Your personal information will remain subject to our pre-existing Privacy Policy unless you agree to the privacy policy of the company or third party that acquires your personal information;
• with your consent; or
• as otherwise required or permitted by law.

Your personal information may be transferred to a Third Party to be used for the same purposes described herein if a lease or loan agreement that you enter into with Lithia is transferred or assigned to such Third Party, or to an organization in connection with the due diligence for, and completion of, a business transaction, including, without limitation, a securitization or financing involving Lithia or its subsidiaries or affiliates. If you enter into a lease or loan agreement with us, with your consent, we may from time to time disclose details of your lease or loan agreement, including payment history information, to credit reporting agencies, which may assist other lenders in assessing your creditworthiness.

• GPS Data

All GPS Data shall remain our sole and exclusive property. We may collect, use and disclose GPS Data in connection with credit applications and test drives for vehicles for purposes such as tracking the location of a vehicle, preventing theft and in order to comply with applicable law and legal and regulatory requirements.

• Data Transfers

As discussed above, we may engage Third Parties to perform certain services on our behalf and to otherwise provide the Services and assist in the purchase of our Products by you through our Site. These Third Parties may store, process and transfer personal information on servers located outside of Quebec or Canada in jurisdictions whose data protection laws may differ from those of Quebec or other Canadian provinces, such as the United States of America. As a result, personal information may be subject to access requests from governments, courts, or law enforcement in those jurisdictions according to the laws in those jurisdictions. For example, information may be shared in response to valid demands or requests from government authorities, courts and law enforcement officials in those countries. Subject to applicable laws in such other jurisdictions, we will use reasonable efforts to ensure that appropriate protections are in place to require our Third Parties to maintain protections on personal information that are equivalent to those that apply in Quebec or, as applicable, other provinces in Canada.

If you have questions regarding our policies and practices with respect to our use of service providers outside of Canada, including with respect to the collection, use, disclosure or storage of personal information by service providers outside of Quebec or Canada for us or on our behalf, please contact us as set out in Section 18.

• Links to Other Sites

Our Site may contain links to other sites that are independently owned and operated by third parties. These other sites may have their own privacy policies and are not governed by this Privacy Policy. We are not

responsible for the privacy practices or the content of any sites owned and operated by any third parties. Other sites may collect and treat information collected differently, so we encourage you to carefully read and review the privacy policy of each site you visit.

• Providing Payment Information

We use Third Parties to process transactions through our Site. We use commercially reasonable efforts to select an appropriate company to maintain the confidentiality and security of your payment information. At present, when you pay for our Products or Services on our Site, your payment will be processed by TD Merchant Solutions and/or Stripe, Inc. (collectively, the “Third Party Processor”). When paying for our Products or Services, the applicable Third Party Processor will collect payment information from you, such as your credit card numbers and expiration dates and any other personal information necessary to process your payment.

Lithia and the Third-Party Processors will send emails to you regarding the processing of your online payment. Your use of the Third Party Processors services is governed by the agreement between you and the applicable Third Party Processor. If you have any questions or concerns about your payment information or your agreement with TD Merchant Solutions, please contact TD Merchant Solutions at 1-800-363-1163. For more information about TD Merchant Solutions’ privacy practices, you should review its privacy policy available at https://www.td.com/ca/en/about-td/privacy-and-security/our-privacy-commitments. If you have any questions or concerns about your payment information or your agreement with Stripe, please contact Stripe at https://support.stripe.com/contact. For more information about Stripe’s privacy practices, you should review Stripe’s privacy policy available at https://stripe.com/us/privacy.

• Cookies, Web Beacons and Other Similar Technology

As you interact with this Site and Services, we may use automatic data collection technology and services that record and collect information that identifies your computer, tracks your use of this Site and Services and collects certain other information about you and your surfing habits. This data collection technology may include cookies, web beacons and other similar devices on this Site and Services to enhance functionality and navigation for our visitors.

A cookie is a small data file that is placed on the hard drive of your computer so that your computer will “remember” information when you visit a site. Web beacons and tags are small strings of code that are used in conjunction with a cookie and allow us to record activity on our Site. Internet tags, graphic tags and similar web beacon type functions allow us to count the number of users who have visited a particular web page or to access certain cookies. We may use web beacons on this Site to count users and to recognize users by accessing our cookies. Being able to access our cookies allows us to personalize this Site and improve your experience at our Site. We may also include web beacons in HTML-formatted e-mail messages that we send to determine which e-mail messages were opened. Information tracked through these mechanisms includes but is not limited to: (i) your IP address; (ii) the type of web browser and operating system being used; (iii) the pages of the Site a user visits; and (iv) other sites a user visited before visiting our Site.

We may also employ cookies and action tags (also known as single pixel gifs or web beacons) to collect information about your use of, and activities on, our Site for our use but also for use by third parties that serve advertisements about Lithia on other sites you may visit. For instance, we may use Third Party programs/services, such as AdSense or AdWords run by Google Inc. and through Eyereturn Marketing Inc, Instagram/Facebook ad manager and YouTube, in each case to serve advertisements on our behalf across the Internet. These Third Party programs/services may collect information about your visits to our Site. In addition to the information about your visits to our Site, Third Parties may also use the information about your visits to other sites to target advertisements for services available from Lithia.

You can set your internet browser up so that you are notified when cookies are stored. You can decide in each individual case whether you want to accept cookies, or you can refuse to accept any cookies. However, if you do not accept cookies, you may be restricted in how you are able to use our Site. You can delete cookies that are already stored on your hard disk at any time. You will find more details on how to do this in the operating guide for your Internet browser program.

As described above, you may be able to set your browser to refuse cookies. If you refuse cookies, you may still receive online advertising, but it may be less personalized.

• Third Party Analytics

Our Site uses third party analytics services such as Google Analytics, a web analytics service of Google LLC. (“Google”).

Google Analytics uses cookies to analyze how you use our Site. The information generated by the cookie about your use of our Site (including your IP address) is sent to a Google server in the U.S. and stored there. Google will use this information to evaluate your use of our Site, compile reports on Site activity for our Site operators and to provide other site activity related internet services. Additionally, Google may transfer this information to a third party when required by law or in the case of a third party processing information on Google’s behalf. In no case will Google use your IP address in connection with any other information held by Google. You can set your internet browser to prohibit the installation of cookies, although we must point out that some features and functions of our Site will then be unusable. By using our Site, you consent to the processing of data about you collected by Google in the manner described and for the above-mentioned purpose. The consent for collection and storage of data can be withdrawn at any time in the future by clicking on the following link: https://tools.google.com/dlpage/gaoptout?hl=en. Given the debate concerning the use of analytical tools using full IP addresses, we wish to point out that our Site uses the “Anonymize IP” function of Google Analytics that works with a shortened form of IP addresses to avoid direct personal identification.

We also use the cookies to carry out frequency assessments, page usage assessments and marketing assessments. For these assessments, we use this cookie information without a link to your personal information, so it is completely anonymous.

• Security

We maintain reasonable technical, physical and administrative security safeguards to protect your personal information against loss, theft, and unauthorized access. Any personal information that you provide to us is exchanged on a secured server. Unfortunately, no data transmission over the Internet can be guaranteed to be 100% secure. As a result, while we are committed to protecting your personal information, we cannot ensure or warrant the security of any information you provide to us.

We take reasonable steps to verify your identity before granting you access to your account on our Site, however, you are solely responsible for maintaining the secrecy of your username, password and any other account information. We also take reasonable steps to ensure that our employees are aware of the importance of maintaining the confidentiality of personal information and that unauthorized persons do not gain access to personal information that we have disposed of or destroyed.

• Individual Access and Accuracy of Personal Information

You may request access to your personal information which we may hold by contacting us at the contact information set forth below, and we will respond within the time periods provided for under applicable laws. We will need to verify your identity before providing you with the personal information we hold about you.

There is no cost for such access request unless you require copies of records. We may not be able to provide you with access to your personal information if the information cannot be separated from the personal information of others, cannot be disclosed for reasons of security or commercial confidentiality, or is protected by legal privilege. If we cannot provide you with access to your personal information, we will advise you of the reasons access is being denied, unless we are prohibited by law from doing so.

You may request to update and change your personal information at the contact information set forth below. We will endeavor to correct or complete any personal information which you advise us is inaccurate or incomplete. Where appropriate, the amended information will be transmitted to third parties having access to such information.

• Electronic Communications

As part of using the Site or Services or registering your account with us, you may have also opted in to receive email communications from us. If you opted-in to receive such communications, we may use the information to: communicate with you regarding our Products, Services and promotions; provide you with other information that you request; and/or improve our Product and service offerings.

You will always have the opportunity to “unsubscribe” from receiving any of our e-mail or other communications at any time and we will ensure that our e-mails include instructions on how to unsubscribe if you no longer wish to receive future e-mails from us. We provide an on-going opportunity to unsubscribe or opt-out of contact by us by accessing our Site or by e-mail to [email protected].

If you decide to unsubscribe, we will only contact you (i) for the purposes allowed under applicable law; (ii) to send you notices of changes to our Privacy Policy; or (iii) to receive transactional or Service related messages.

• Changes to this Privacy Policy

We reserve the right to change or replace this Privacy Policy at our sole discretion at any time. Please check back from time to time to ensure that you are aware of any updates or changes in this Privacy Policy. We will post the most current version on our Site and we will indicate at the top of this page the date this Privacy Policy was last revised. Your continued access or use of this Site after any such changes constitutes your acceptance of the Privacy Policy as revised.

• Your Consent to the Terms of this Privacy Policy

By using our Site and Services and providing us with your personal information, you agree that Lithia may collect your personal information and you voluntarily consent to the collection, use, disclosure, and transfer of your personal information in accordance with this Privacy Policy. If you do not agree with any terms of this Privacy Policy, please do not use our Site or our Services or provide us with any personal information. If you do not understand the nature, purpose and consequences of us collecting, using and disclosing your personal information, please do not use our Site or our Services or provide us with any personal information, and contact us at the contact information set forth below so that we can address your questions or concerns.

Subject to legal and contractual requirements, you may refuse or withdraw your consent to certain of the purposes identified in this Privacy Policy at any time by contacting us at the contact information set forth below. If you refuse or withdraw your consent, you acknowledge that we may not be able to provide you or continue to provide you with certain services or information that may be of value to you. However, you may not be permitted to withdraw your consent to certain necessary collections, uses and disclosures of your personal information (for example, Lithia needs to maintain reasonable business and transaction records).

• How to Contact Us

We welcome your feedback. If you have questions, comments or concerns about this Privacy Policy, or would like to do any of the following:

• see your personal information that you have already sent us so that you can correct, update or delete it from our files;
• if your child under 13 has used this Site and sent us personal information, delete that personal information from our files;
• ask that we not send you electronic communications or otherwise contact you; or
• report any violation of this Privacy Policy,

Please contact our Privacy Officer at [email protected] and we will endeavour to get back to you promptly. Our Privacy Officer oversees our privacy policies and procedures and information handling practices.