Can your dealer website provider access or use your customer data?

Why access is unavoidable

Your dealer website provider hosts your website. That means:

• Your database of leads and customers sits on their servers
• Their staff can query it (with varying levels of restriction)
• Their analytics systems process it to generate reports
• Their software has full read/write access by design

There’s no way around this — a hosted service inherently has access to the data it hosts. What matters is what they’re permitted to do with that access.

What “use” actually looks like

Common categories of vendor data use, from least to most concerning:

1. Providing service to your dealership. They query your data to make your admin panel work, generate your reports, send emails from your site, etc. This is uncontroversial and necessary.

2. Aggregate / anonymized analytics. They combine your customer data with other dealers’ data to create benchmarks (“dealers in your region see X leads per month”). Individual customers can’t be identified, but your customer counts and patterns feed the aggregate.

3. Product improvement. They analyze your data to improve their platform’s ML models, recommendation systems, or design decisions. Usually anonymized, sometimes not.

4. Marketing to your customers. Some vendors reach out to your customers directly — with your customers’ consent, technically — for their own marketing. “Since you inquired at [dealership], you might like our other [service].”

5. Selling data to partners. Some vendor contracts include broad language permitting sharing of “de-identified data” with third parties. In practice, “de-identified” data can often be re-identified through combining data sources.

6. Selling to industry data brokers. The most concerning: some legacy dealer platforms have monetized aggregated dealer data through partnerships with market intelligence firms. Your competitor’s benchmarking report may include your dealership’s numbers.

How to find out what your vendor is doing

Three documents to review:

Your contract — specifically the “Data Use,” “Licensed Rights,” and “Aggregate Data” sections. Look for phrases like:

• “Vendor may use de-identified data for any purpose”
• “Vendor retains license to use customer data for analytical purposes”
• “Aggregated data may be shared with third parties”
• “Vendor may use data to improve services”

Each of these grants specific permissions. Read them carefully.

Vendor’s privacy policy — often more permissive than the contract. It’s how vendors interact with your customers directly (via the site) and often reserves broad rights that go beyond what the contract explicitly grants your dealership. Your customers technically agree to it by using your website.

Vendor’s DPA (Data Processing Agreement) — required if you have any European customers under GDPR, but useful even for domestic dealers. Specifies exactly what data is processed, for what purposes, by whom, and with what safeguards. Reputable vendors will provide one on request.

The CCPA implications

If any of your customers are California residents (increasingly likely for any dealer near CA or with online reach into CA), CCPA imposes specific requirements:

• Customers can request what personal data has been collected about them
• Customers can request deletion of that data
• Customers can opt out of “sale” of their data (broadly defined)
• The dealer is generally the “business” responsible for compliance, but the vendor is the “service provider” or in some cases “third party”

If your vendor’s contract grants them broad use rights that fall under CCPA’s “sale” definition, you may have compliance exposure you didn’t realize. And if a California customer requests deletion, your vendor needs to actually be able to delete their data — including from aggregated datasets they may have built.

Practical steps

1. Request the DPA from your current vendor. If they can’t provide one or hedge, that’s revealing.
2. Ask directly: “Do you use our customer data for any purpose other than providing services to our dealership? Do you share aggregated or anonymized data with any third parties?” Get the answer in writing.
3. Check your privacy policy on your own website. If it points to your vendor’s privacy policy (rather than being your own), your customers may be agreeing to your vendor’s data practices without realizing it.
4. In your NEXT contract, demand narrow use rights: vendor may use data only to provide services to the dealership, no aggregation without permission, no third-party sharing.

The Zoomshop position

Zoomshop’s data use is contractually limited to: providing the dealer website service to your dealership. No aggregate analytics for other customers. No data sold, licensed, or shared with third parties. No use for ML training. No use for marketing to your customers on our behalf. Full DPA available on request.

You get more permissive data use rights from us only if you specifically opt in to a shared benchmarks program (and even then, only aggregate counts with clear opt-out at any time).