This privacy policy is effective as of October 29, 2026. Please note that this privacy policy will be updated to reflect any important changes in the way we handle your personal data or any changes in applicable laws.

This privacy policy describes how J.D. Power and its affiliates (“J.D. Power” or “we” or “our” or “us”) collect, use, and disclose information about you as well as your rights and choices about such collection, use, and disclosure. This privacy policy applies to your use of any J.D. Power website, app, or service that references this policy or that we identify as a J.D. Power offering or method of information collection (collectively, the “Service”). It also covers offline collection of information. It does not apply to information collected by third parties processing information on their own behalf or to information collected in the context of your employment with us.

This privacy policy applies to all visitors globally. Due to country-specific laws, in addition, please check your Country Policies under “Supplements.” Both this privacy policy and the applicable supplement will apply. Please review the applicable Supplement on how to exercise your privacy rights, including your rights to delete.

This privacy policy describes the broadest range of our personal data processing activities globally. In some jurisdictions, those activities are more limited based on local law. For example, the laws of a country may limit the types of personal data we can collect or the way we process it. In those instances, we adjust our internal policies and practices to reflect the requirements of local law.

If you have any questions about our privacy practices, please contact us as set forth in the “Contact Us” section.

THIS PRIVACY POLICY COVERS THE FOLLOWING:

• How do we collect information?

• What types of information do we collect?

° Information automatically collected through your browser or device

° Information we infer

° Sensitive Information

° Information on behalf of our clients

• How do we use your information?

• How do we disclose information?

• Tracking technologies

• Other services

• Analytics and advertising

• Your rights and choices

• How is information protected and retained?

• International transfers

• Special note about children

• Changes to this privacy policy

• Contact us

HOW DO WE COLLECT INFORMATION?

We collect information about you in the following ways:

• Through your survey responses in connection with market research conducted by J.D. Power or commissioned by one of our enterprise customers.

• Through your use of our websites, including jdpower.com (and its subdomains) and jdpowervalues.com, and any other website that links to this privacy policy.

• Through your use of our mobile applications that link to this privacy policy.

• Through phone calls, emails, and/or other forms of communications with you.

• Through our business relationships with you, for example, where you provide your business contact information to us

• From other sources, including automobile dealers and other third parties where we operate such programs. The categories of other sources from which we collect information include:

° affiliates with your consent;

° clients who ask us to process personal information on their behalf;

° service providers/processors acting on our behalf;

° social media platforms where you choose to interact with us or through tools provided by these platforms;

° automobile dealers with whom we have contractual relationships, as noted above;

° data brokers from which we purchase demographic, location, and other data to supplement the data we collect;

° partners with which we offer co-branded services, sell, or distribute our products, or engage in joint marketing activities; and

° demographic or aggregate information from publicly available sources such as open government databases or other data in the public domain.

WHAT TYPES OF INFORMATION DO WE COLLECT?

The information we collect sometimes includes information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to you. The categories of information we collect about you include:

Information you provide to us:

• Contact identifiers, including your first and last name, email address, postal address, and phone number.

• Professional information, including employer or company name, job title, job function, and industry sector, collected primarily from business professionals using our business to business products and services

• Information you provide to us via the Chatbot Service, including any conversation history or content you provide to us via the Chatbot Service

• Credentials and authentication information, including your username, password, password hints, and other information for authentication and account access.

• Payment information, including payment instrument number (such as a credit card number), and the security code associated with your payment instrument.

• Vehicle transaction and service information collected from automotive dealers and other third parties where we operate such programs.

• Profile information, including your interests and favorites.

• Content that you create, load, or share on the Service, such as survey responses, recordings, photos, videos and product reviews.

Please do not provide any information that we do not request.

INFORMATION AUTOMATICALLY COLLECTED THROUGH YOUR BROWSER OR DEVICE:

• Device identifiers, including your device’s IP address and device advertising ID (e.g., IDFA or AAID).

• Device information, including your device’s operating software, regional and language settings, carrier, time zone, network status, and internet service provider.

• Internet activity, including information about your browsing history and interactions, the features you use, the pages you visit, the emails, content and ads you view, the products you purchase and consider, the time of day you browse, and your referring and exiting pages.

• Non-precise location data, such as location derived from an IP address or data that indicates a city or postal code level.

• We also use cookies and similar tracking technologies to collect information automatically. See the “Tracking Technologies” section below, and the European and UK Supplement for additional information applicable to EEA/UK visitors.

INFORMATION WE INFER:

We infer new information from other information we collect, including using automated means to generate information about your likely preferences or other characteristics.

Information collected from third parties:

We may obtain your business contact information, including your job role and business contact information from third party databases.

We process this data for the purposes of marketing our products and services to your business or the business you work for. We do this by contacting you and we may do this through email, over the phone or by other means. We may also use your personal data for analytics purposes and measuring how well our marketing campaigns have performed; product development; and research purposes.

SENSITIVE INFORMATION:

Where applicable law permits, and where required by law only with your explicit consent, we may collect information considered sensitive under applicable law. For example, in our North American automotive market research studies we may collect and disclose to the applicable vehicle manufacturer personal information that identifies your ethnic origin. To the extent any of the categories of information we collect are sensitive categories of information under applicable law, we process such information only for the limited purposes permitted by applicable law.

INFORMATION ON BEHALF OF OUR CLIENTS:

In connection with providing services to our clients, we collect and process information about individuals (including through Tracking Technologies, defined below) at our clients’ direction and on their behalf (“Client Data”). Client Data has historically included contact identifiers, characteristics or demographics, content, device identifiers, device information, internet activity, and non-precise location data, among other information. Our processing of Client Data is governed by the terms of our service agreements with our clients, and not this privacy policy. We are not responsible for how our clients treat the information we collect on their behalf, and we recommend you review their own privacy policies. In the event we are permitted to process Client Data for our own purposes, we will process the Client Data in accordance with the practices described in this privacy policy.

HOW DO WE USE YOUR INFORMATION?

We collect and use information in accordance with the practices described in this privacy policy. In addition to the “Additional details about how we use survey research” section below, our purposes for collecting and using information include to:

• manage the Service.

• perform services requested by you and provide customer service.

• conduct market research into consumer preferences and attitudes around a variety of products and services, including surveys.

• undertake deal tracking, forecast roll-ups, pipeline analytics, prepare reporting dashboards, in order to improve forecast accuracy, pipeline visibility, and revenue/financial planning. We will use AI powered tools to support this.

• use artificial intelligence-powered productivity and assistant tools, which may be integrated with our customer relationship management and other business systems, to help our personnel draft communications, summarize information, and perform similar administrative and business support tasks more efficiently.

• verify consumer responses if needed to ensure the accuracy of our research.

• enter you for a sweepstakes, contest, or other promotion.

• share your product reviews on the Service and on other services.

• communicate with you, including to respond to inquiries.

• process payment information for your purchases.

• manage our contractual relationship with you.

• send you technical notices, updates, security alerts, information regarding changes to our policies, and support and administrative messages.

• link or combine your information with other information we get from other sources.

• create data for analytics, segmentation for personalized advertising, or statistical market models.

• develop and send you direct marketing for products and services including ads and communications about our and other entity products, offers, promotions, rewards, events, and services.

• serve advertising tailored to your interests on our Service and other services.

• enhance security, monitor and verify identity or service access, combat spam, or other malware or security risks.

• comply with law or a legal process (including a court or government order or subpoena), enforce this privacy policy or our legal rights, prevent and address fraud, and protect the rights, property or safety of J.D. Power, our clients, our users and/or the public.

• conduct audits, collect and assess feedback, identify usage trends, measure ad effectiveness and evaluate and improve our products, services, marketing, and client relationships.

• as otherwise permitted under this privacy policy or as otherwise authorized by you.

Notwithstanding the above, we may use information that does not identify you (including information that has been de-identified) without obligation to you except as prohibited by applicable law.

Additional details about how we use survey research:

Your participation in market research surveys helps our clients measure customer satisfaction and produce better quality products and services. As a survey participant, your information will be used in accordance with this privacy policy, except that you will never be contacted for sales or marketing based on your survey responses without your express consent. Submission is always optional, and we will only conduct this type of analysis with your express consent. You can withdraw your consent at any time.

HOW DO WE DISCLOSE INFORMATION?

We disclose information in accordance with the practices described in this privacy policy. In addition to the “Additional details about how we disclose survey research” section below, we disclose information about you to the following categories of persons:

• To our service providers/processors as necessary to enable them to provide services to us. Examples include service providers/processors who help with marketing, billing, accounting, processing credit card payments, data analysis, data matching, technical support and customer service, credit reference and debt recover services (such as credit reference agencies, financial organizations, debt collectors, and tracing agencies used to verify identity, assess creditworthiness, process transactions, or recover amounts owed), and auditing and professional advisory services (such as external auditors, accountants, and other professional advisers assisting with audits, financial statements, or professional advice). We also engage service providers that provide important business support, such as revenue intelligence platform providers. Service providers/processors are prohibited from using your information for any purpose other than to provide this assistance, although we may permit them to use aggregate information which does not identify you or de-identified data for other purposes except as prohibited by applicable law.

• To providers of artificial intelligence-powered tools that we use internally to support business operations, such as tools integrated with our customer relationship management systems that assist with drafting, summarizing, and organizing business information. These providers are prohibited from using your information for any purpose other than to provide this assistance, except as permitted under applicable law.

• To our partners that are engaged in joint sales or product promotions. We also allow certain partners to integrate components of our services into their own websites and apps. Please be aware that we do not control our business partners’ use of such information. Our partners are responsible for managing their own use of the information collected in these circumstances.

• To third party vendors and other entities, such as ad networks and analytics providers, in connection with tailoring ads, measuring and improving our Service and advertising effectiveness. These entities may act as our service providers or, in certain contexts, independently decide how to process your information. For more information on advertising and analytics, see the “Analytics and Advertising” section below.

• To our clients in connection with our processing of your information on their behalf or to provide them with our products or services. For example, we disclose your information with our clients to conduct market research services, respond to your questions and comments, comply with your requests, market and advertise to you, and otherwise comply with applicable law.

• To the public. We disclose information you make public. Please think carefully before making information public as you are solely responsible for any information you make public. Once you have posted information, you may not be able to edit or delete such information, subject to any rights you have under applicable law.

• For promotions. When you voluntarily enter a sweepstakes, contest, or other promotion, we disclose information as set out in the official rules that govern the promotion as well as for administrative purposes and as required by law (e.g., on a winners list). By entering a promotion, you agree to the official rules that govern that promotion, and may, except where prohibited by applicable law, allow the sponsor and/or other entities involved in the promotion to use your name, voice, and/or likeness in advertising or marketing materials.

• For legal purposes, as reasonably necessary to comply with law or a legal process (including a court or government order or subpoena), to detect, prevent, or otherwise address fraud, security or technical issues, to enforce this privacy policy, and to protect the rights, property or safety of J.D. Power, our users, and/or the public.

• To our affiliates and subsidiaries for purposes consistent with this privacy policy, including customer support, marketing, and technical operations. In such cases, our subsidiaries and corporate affiliates will also meet the data protection obligations contained in this policy.

• During a corporate transaction, such as a merger, consolidation, acquisition, reorganization or sale of assets or in the event of bankruptcy, we reserve the right to sell, transfer or otherwise disclose some or all of our business or assets, including your information. We will make reasonable efforts to require the recipient to honor this privacy policy.

• Facilitating Requests. We disclose information at your direction, such as when you request that we disclose your interest in a vehicle with a dealership or when you request that our clients disclose your interest in a service with a third party, such as an after-market warranty service provider.

• Consent. We may disclose your information with notice to you and with your express consent.

Without limiting the foregoing, in our sole discretion, we may disclose aggregated information which does not identify you (or de-identified information about you) with third parties or affiliates for any purpose except as prohibited by applicable law. Sometimes we anonymize or de-identify information so it is no longer considered personal information under applicable law. Where we de-identify information, we commit to maintain and use the de-identified information in de-identified form and not attempt to re-identify it. We may use non-personal information for any purpose to the extent permitted by applicable law.

MARKETING

From time to time, we may want to market our products or services to you. We may also want to market products and services offered by a third party, including where we are discontinuing a product or service we previously offered directly and where we may be transitioning you to a third-party provider.

You may object to our marketing at any time, either by unsubscribing to our emails or by contacting us at [email protected].

TRACKING TECHNOLOGIES

We use various technologies to automatically collect the information identified under the “Information automatically collected through your browser or device” subsection above (“Tracking Technologies”), including the following:

Cookies and pixels:

Cookies are small data files that contain a string of characters, such as a unique browser identifier. Cookies are stored on your computer or other device and act as tags that identify your device. Our servers and those of other entities we work with send your browser or device a cookie when you visit our websites, and we, along with our clients and partners, do likewise on their websites or through their multi-site platforms. A pixel tag (also known as a web beacon) is an invisible 1 x 1 pixel that is placed on certain web pages. When you access a webpage, pixel tags generate a notice of the visit and permit us to set or read our cookies. Pixel tags are used to track activity on a site by a particular device. Even if you turn off cookies, pixel tags may be able to detect a unique website visit. We and the entities we work with use cookies and pixels to remember you between visits, track user trends, measure ad effectiveness, and collect information about how you use our websites, how you use our clients’ websites, and how you interact with our or our partners’ advertising. We also use cookies and pixels to provide relevant content to you and deliver ads that better match your interests.

Mobile technologies:

We also use, or work with clients or partners that use, mobile SDKs to collect information, such as device identifiers, connected to mobile device usage. An SDK (Software Development Kit) is computer code that app developers can include in their apps to enable ads to be shown, data to be collected, and related services to be implemented. We use this technology for purposes similar to cookies and pixels.

Where required by local law, including in the EEA, the UK, Switzerland, and Quebec, we deploy cookies and similar technologies only with your consent, which you can manage through the cookie consent banner on our websites.

Where we make decisions that produce legal or similarly significant effects on you using solely automated processing of your personal data, we apply the safeguards required by local law and as further described in the applicable Supplement.

OTHER SERVICES

Our Service contains content from, and hyperlinks to, websites, locations, platforms, and services owned and operated by unaffiliated third parties. We may also allow you to connect our Service to another service, or we may offer our Service through another service (such as a brand page on a social media platform). Except where these entities act as our service providers, they and not us, control the purposes or means of processing any information they collect about you, and you should contact them directly to address any concerns about their processing. The information collected and stored by those entities, whether through our Service or another service, remains subject to their own policies and practices, including what information they disclose to us, your rights and choices on their services and devices, and whether they store information in the U.S. or elsewhere.

ANALYTICS AND ADVERTISING

Our Service contains Tracking Technologies used by us to understand trends, usage, and activities. For example, we incorporate Tracking Technologies from analytics providers, such as Google Analytics, to help us analyze your use of the Service, compile statistical reports on the Service’s activity, and provide us with other services relating to Service activity and internet usage.

We also work with ad serving services, advertisers, and other entities to place ads about our products and services on other websites. For example, we place ads through Google that you may view on its platform as well as on other websites and services. As part of this process, we incorporate Tracking Technologies into our own Service as well as into our ads displayed on other websites and services, which are often owned and operated by third parties. Some of these Tracking Technologies may track your activities over time and across non-affiliated services and obtain or infer information about you for purposes of showing you relevant advertising based on your preferences and interests (“targeted advertising”).

We also use audience matching services (which are a form of targeted advertising) to reach people (or people similar to people) who have visited our Service or are identified in one or more of our databases (“Matched ads”). This is done by us providing a list of hashed email addresses to a third party or incorporating a pixel from a third party into our own Service, and the third party matching common factors between our data and their data. For instance, we incorporate the Facebook pixel on our Service and may disclose your hashed email address to Facebook as part of our use of Facebook Custom Audiences.

As indicated above, these entities may act as our service providers, or in certain contexts, independently decide how to process your information. We encourage you to familiarize yourself with and consult their privacy policies and terms of use.

For further information on the types of Tracking Technologies we use on the Service and your rights and choices regarding analytics, targeted advertising, and Matched ads, please see the “Information automatically collected through your browser or device” subsection above, and the “Tracking technologies” and “Your rights and choices” sections.

We also use email tracking technologies to understand how recipients engage with our email communications. For example, we incorporate tracking technologies from providers such as Hubspot, Oracle and Salesforce Account Engagement into our emails, which generate an pseudonymous recipient identifier and allow us to track activity such as whether an email has been opened, forwarded, or clicked. This information is used to measure the effectiveness of our email communications and improve the relevance of content we send to you. If you do not wish to be tracked in this way, you can disable image loading in your email client or opt out of our email communications entirely by following the unsubscribe instructions in any email we send.

YOUR RIGHTS AND CHOICES

Where required by applicable law (including in the EEA, the UK, and certain US states), we will obtain your prior consent before processing your personal information for purposes such as marketing communications, cookies and similar tracking technologies, and targeted advertising. Where opt-out (rather than opt-in) applies under the law of your jurisdiction, you may exercise those rights as described below. Additional rights and choices for individuals in the EEA and the UK are described in the European and UK Supplement, and additional rights for residents of certain US states are described in the applicable US Supplement.

To exercise any of the rights, including your right to delete the information we process about you, please submit a request through our online form available at jdpower.com/Privacy/DSAR or call our toll free number at (866) 467-8688 x327. If you have an account with us, we may require you to use the account to submit the request. In the request, please specify which right you are seeking to exercise and the scope of the request. We will confirm receipt of and respond to your request consistent with applicable law. We may require specific information from you to help us confirm your identity and process your request. If we are unable to verify your identity, we may deny your requests in accordance with applicable law.

Accounts. If you hold an account with us, you can delete your account through your account settings. We will address your request in accordance with our data retention practices.

Browser and device controls:

• Cookies and pixels. You may be able to instruct your browser, by changing its settings, to decline or delete cookies. If you use multiple browsers on your device, you will need to instruct each browser separately. Your ability to limit cookies is subject to your geographic location, browser settings, and limitations.

• Mobile technologies. You can reset your device advertising Id at any time through your device settings, which is designed to allow you to limit the use of information collected about you. You can stop all collection of information via an app by uninstalling the app.

Please be aware that if you disable or remove Tracking Technologies some parts of the Service may not function correctly.

Third-party opt-out tools for Tracking Technologies:

Some of the partners we work with offer their own opt-out tools for Tracking Technologies. You can opt-out of your data being used by Google Analytics through cookies by visiting tools.google.com/dlpage/gaoptout and downloading the Google Analytics Opt-out Browser Add-on.

Industry opt-out tools for targeted advertising:

Some of the entities we work with participate in industry self-regulatory programs that allow you to opt out of receiving targeted advertising from program participants. The specific tools and links available in your jurisdiction are described in the applicable Supplement.

Matched ads:

To opt-out of us disclosing your hashed email address for Matched ads purposes, please contact us as set forth in the “Contact Us” section below and specify that you wish to opt out of matched ads. We will remove your email address from any subsequent lists disclosed to third parties for Matched ads purposes. Visitors from the EEA or UK should refer to the European and UK Supplement. In those regions we only engage in matched advertising with your consent, which you may withdraw at any time.

COMMUNICATIONS:

• Email. You can opt-out of promotional emails or surveys at any time by following the instructions as provided in emails or surveys, clicking on the unsubscribe link, or emailing us at the email address set forth in the “Contact Us” section with the word UNSUBSCRIBE in the subject line. Withdrawing consent does not affect the lawfulness of processing carried out before your withdrawal, and we may continue to send you transactional or service-related communications. Please note that you cannot opt-out of non-promotional emails, such as those about your account, transactions, and servicing.

• Text messages and phone calls. If you are located in the United States, when you complete a market research survey, we may request your phone number. If you provide your phone number to us, or to one of our market research clients, we will ask for your consent before we or our service providers may call or text you on your mobile phone, including calls or texts using automated technology or pre-recorded calls). With your consent, we may contact you for market research surveys, to provide reminders, or to offer you additional survey opportunities. Consent is not a condition of purchasing goods/services. You can opt-out of receiving text messages or calls to your phone number at any time by (i) for text messages, texting “STOP, QUIT, END, REVOKE, OPT OUT, CANCEL, or UNSUBSCRIBE” in response to any text message you receive from us or contacting us as set forth in the “Contact Us” section and specifying you want to opt-out of text messages; and (ii) for calls, requesting opt-out during any call you receive from us or contacting us as set forth in the “Contact Us” section and specifying you want to opt-out of calls.

HOW IS INFORMATION PROTECTED AND RETAINED?

We take appropriate steps including physical, technical, human, and organizational measures designed to help protect your information from loss, theft, misuse and unauthorized access, disclosure, alteration, or destruction. Unfortunately, the Internet cannot be guaranteed to be 100% secure, and we cannot ensure or warrant the security of any information you provide to us.

We retain information for the length of time that is reasonably necessary for the purpose for which it was collected, and as necessary to comply with our legal obligations, resolve disputes, prevent fraud, and enforce our agreements.

INTERNATIONAL TRANSFERS

J.D. Power is headquartered in the United States and has affiliates and service providers globally. Your information may be transferred to the United States or other locations outside your state, province, or country, where privacy laws may differ from those in your jurisdiction. If you access the Service from outside the U.S., information collected through the Service, including personal data, may be transferred to and processed in the U.S. and other jurisdictions, in accordance with appropriate safeguards described below and in the applicable Supplement.

Where we transfer your personal data outside your jurisdiction, we rely on appropriate safeguards permitted under applicable law, such as European Commission-approved Standard Contractual Clauses. Additional information about transfers from the EEA and UK is available in the European and UK Supplement

SPECIAL NOTE ABOUT CHILDREN

Our Service is not intended for children.

We do not knowingly collect information from children as defined by the U.S. Children’s Online Privacy Protection Act (“COPPA”) or other applicable law. If we learn that we have inadvertently collected information from a child, we will delete that information as quickly as possible. If you believe that we might have any information from a child, please contact us as set forth in the “Contact Us” section.

In the EEA and UK, we do not knowingly collect personal data from anyone under the applicable digital age of consent. If we learn we have inadvertently collected information from a child, we will delete it as soon as possible.

CHANGES TO THIS PRIVACY POLICY

This privacy policy is current as of the effective date listed at the top. We may update this privacy policy at any time, and any update will be effective immediately upon posting on the website. We encourage you to review this privacy policy on an ongoing basis. If the changes are material, we may provide additional notice to you as required by applicable law, such as through email or prominent notice on the website. Your continued use of the Service after an update indicates your awareness of the changes, subject to any consents we are separately required to obtain under applicable law. In the event of any inconsistencies between the English version and a translated version of this privacy policy or a country or region supplement, the English version shall prevail.

CONTACT US

If you have any questions about, or trouble accessing, this privacy policy, contact us via email or postal mail at the addresses below. Additional methods of contacting us are listed in the country and region supplements and policies linked on this page.

Email: [email protected]

Address: Privacy Officer, J.D. Power, 320 East Big Beaver Road, Suite 500, Troy, MI 48083

Additional information for visitors who are Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Rhode Island, Tennessee, Texas, Utah or Virginia Residents

 

This supplement is effective as of October 29, 2026.

If you are resident of the United States, this supplement describes additional privacy rights available under the applicable law in your state.

You have the following rights under applicable law in your region:

• To confirm whether or not we are processing your personal data
• To access your personal data
• To correct inaccuracies in your personal data
• To delete your personal data
• To obtain a copy of your personal data that you previously provided to us in a portable and readily usable format
• To not receive discriminatory treatment by us for the exercise of any your rights
• To opt out of, or obtain information about, decisions concerning you that are made by solely automated processing and produce legal or similarly significant effects, where required by applicable state law (including, in California, the right not to be subject to automated decision-making technology in the contexts specified by CalPrivacy regulations).

Designated Methods. To exercise any of these rights, please submit a request through our online form available at jdpower.com/Privacy/DSAR or call our toll-free number at (866) 467-8688 x327. If you have an account with us, we may require you to use the account to submit the request. In the request, please specify which right you are seeking to exercise and the scope of the request.

We will confirm receipt of your request within the time frame required by applicable law. We may require specific information from you to help us verify your identity and process your request. If we are unable to verify your identity, we may deny your requests.

RIGHT TO OPT-OUT OF SALE, SHARING, AND TARGETED ADVERTISING

Where J.D. Power sells or shares your personal data, or uses it for targeted advertising, you have the right to opt-out. To submit a request to opt-out of sharing not related to tracking technologies, click here. To opt-out of the sale or sharing of your personal information related to tracking technologies, click here and select the Online Do Not Sell or Share My Information button in the privacy banner or turn on a recognized opt-out preference signal, such as Global Privacy Control, in your browser or extension. We do not knowingly sell or share the personal information of minors under 16 years old.

When you click the Online Do Not Sell Or Share My Personal Information button or broadcast the Global Privacy Control signal from a supported browser, we also signal certain tracking technology partners to limit their use of your data to permitted purposes. Your opt-out applies only to data collected from tracking technologies on the specific browser or device from which you opted out. If you delete or reset your cookies, change devices, or use a different browser, you will need to reconfigure your settings. Opting out will not stop you from seeing ads.

AUTHORIZED AGENT

You can designate an authorized agent to submit requests on your behalf. Except for opt-out requests, we will require written proof of the agent’s permission to do so and verify your identity directly. Requests must be submitted through the designated methods listed above.

If personal data about you has been processed by us as a service provider/processor on behalf of a client and you wish to exercise any rights you have with such personal data, please inquire with our client directly. If you wish to make your request directly to us, please provide the name of our client on whose behalf we processed your personal data. We will refer your request to that client, and will support them to the extent required by applicable law in responding to your request.

Where required by applicable state law, you may appeal our decision if we are unable or refuse to take action on your request by contacting us at [email protected] and specifying your wish to appeal. We will review and respond to your appeal, in accordance with applicable law. If the appeal is denied, you may submit a complaint as follows:

Alabama, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Louisiana, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oklahoma, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia.

RIGHT TO NON-DISCRIMINATION

We are committed to ensuring that you will not be subjected to discriminatory treatment for exercising any of your rights.

DISABILITY

If you have a disability and would like to access the privacy policy and this supplement in an alternative format, call us at (888) 537-6937.

California

For details on the categories of personal information collected, sources, business purposes, and categories of third parties to whom information is disclosed, see the corresponding sections of the Global Privacy Policy.

The California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (“CPRA”) provides additional rights to residents of California. Terms have the meaning ascribed to them in the CPRA, unless otherwise stated.

Under the CPRA, “sale” is defined broadly to include any disclosure of personal information for something of value, and “share” includes any disclosure of personal information for cross-context behavioral advertising. Some of our disclosures of personal information may be considered a “sale” or “share.” For example:

• If you participate in an automotive market research study conducted by JD Power, and you consent at the time of the survey, your survey responses and demographic information (including ethnic origin where provided) may be appended with your vehicle identification number and licensed to the manufacturer of your vehicle.
• Where you submit your vehicle purchase interests through one of our or a third party’s consumer-facing lead forms, and you consent to the disclosure, we share your information with the dealerships you select and with manufacturers in their networks. Our consumer leads business is operated by our affiliate Autodata Solutions, Inc., which is separately registered as a data broker in California. For more information, see the Autodata Solutions, Inc. Privacy Policy.
• We may engage in cross-context behavioral advertising activities such as those disclosed in the “ANALYTICS AND ADVERTISING” section of our privacy policy.

We collect, sell, or share the following categories of personal information for commercial purposes: contact identifiers, characteristics or demographics, commercial or transactions information, user-generated content, device identifiers, device information, internet activity, non-precise geolocation data, and inferences drawn from any of the above. The categories of third parties to whom we sell or share your personal information include, where applicable, vehicle manufacturers and third parties involved in cross-context behavioral advertising. For details on your rights regarding sales and shares, see the “Right to Opt-Out of Sales and Sharing” section below.

Some of the personal information we collect may be considered sensitive personal information under CPRA. For example, information that identifies your ethnic origin. We collect, use, and disclose such sensitive personal information for the permissible business purposes for sensitive personal information under the CPRA as well as for the purposes listed above in this Section. For details about your right to limit the use or disclosure of your sensitive personal information, see the “Right to Limit the Use of Sensitive Personal Information” section below.

In addition to the rights set out above, California residents, have the right to know certain information about our data practices. In particular, you may request the following from us:

• The categories of personal information we have collected about you;
• The categories of sources from which the personal information was collected;
• The categories of personal information about you we disclosed for a business purpose or sold or shared;
• The categories of persons to whom the personal information was disclosed for a business purpose or sold or shared;
• The business or commercial purpose for collecting or selling or sharing the personal information; and
• The specific pieces of personal information we have collected about you.

RIGHT TO LIMIT THE USE OF SENSITIVE PERSONAL INFORMATION

To the extent we use or disclose your sensitive personal information for purposes other than those specified as permissible business purposes, you have the right to limit the use or disclosure of your sensitive personal information. To exercise this right click here. In addition, you may exercise this right by clicking on the Your Privacy Choices link or by calling our toll-free number at (866) 467-8688 x327.

FINANCIAL INCENTIVES

Financial incentives, as defined under the CPRA, include programs, benefits, or other offerings, including payments to consumers as compensation, related to the collection, deletion, or sale of personal information about them. J.D. Power offers participants in market research surveys or studies gift cards or complimentary sweepstakes admissions. Although we do not consider these activities to be a “financial incentive,” it may be interpreted to be one under California law. To the extent the gift cards and sweepstakes admissions are considered financial incentives, the following notices are provided to California resident participants.

To opt-in to the financial incentive and receive the gift card or sweepstakes admission code, a participant is required to complete all questions and agree to the terms and conditions of that specific market research survey. You can find a full description of the terms and conditions within each market research survey. We collect identifiers such as your name and email address, and commercial information such as survey responses related to the type of survey you participated in.

If you have participated in our market research surveys or studies, you have the right to withdraw from the financial incentive at any time. Exercise your right to withdraw by emailing us at [email protected] and include “Withdraw from Market Research Survey Incentive” in the subject line of your email.

We generally do not treat consumers differently if they exercise a privacy right under California law. However, where you need to voluntarily provide the personal information requested in order to receive the gift card or sweepstakes admission, we are offering you a benefit that is reasonably related to the value of your data to us in connection with the benefit. Our reasonable determination of the estimated value of the personal information you provide to us when you sign up for that benefit takes into consideration a number of factors, including, among other things, our estimates regarding the anticipated revenue generated from the personal information and the actual and anticipated expenses that we incur in the collection, storage, and use of such personal information in connection with the survey or study.

SHINE THE LIGHT

If you are a California resident and have an established business relationship with us, you have the right to request a list of the categories of personal information (as defined by Shine the Light) disclosed by us to third parties for their own direct marketing purposes during the immediately preceding calendar year, along with the names and addresses of such third parties. To exercise this right, write us at [email protected] or J.D. Power, 30870 Russell Ranch Road, Suite 300, Westlake Village, CA 91362 and specify that you are making a “California Shine the Light Request.” We will respond to requests received in accordance with Shine the Light.

DATA BROKER: CONSUMER REQUESTS

The number of consumer requests received by J.D. Power which have been complied with, in whole or in part, and denied in the calendar year 2025.

Type of Request	Requests Received	Requests Completed In Whole	Requests Completed In Part	Requests Denied*	Median # of Days for Responding	Mean # of Days of Responding
Delete Personal Information	26048	25946	0	102	39	45
Know/Access Personal Information JDP was collecting	108	98	0	10	30	32
Know Personal Information JDP was selling or sharing and to whom	38	28	0	10	38	45
Opt-out of sale or sharing of Personal Information	549712	549712	0	0	6	3
Limit Use and Disclosure of Sensitive Personal Information	108286	108286	0	0	3	1

* Includes requests that expired on account of the Data Subject not verifying their email address with JDP.

Right to obtain a list of third parties

Residents of Connecticut, Delaware, Maryland, Minnesota, and Oregon may request a list of specific third parties or categories of third parties to whom we have disclosed or sold personal data, as applicable.

FLORida

We may respond to consumer rights requests from Florida residents as a courtesy. Doing so does not subject J.D. Power to the Florida Digital Bill of Rights or grant additional rights beyond those expressly described.

Nevada

Nevada law (NRS 603A.340) requires each business to establish a designated request address where Nevada consumers may submit requests directing the business not to sell certain kinds of personal information that the business has collected or will collect about the consumer. A sale under Nevada law is the exchange of personal information for monetary consideration by the business to a third party for the third party to license or sell the personal information to other third parties. If you are a Nevada consumer and wish to submit a request relating to our compliance with Nevada law, please contact us as at [email protected].

Texas

The entity maintaining this website is a data broker under Texas law. To conduct business in Texas, a data broker must register with the Texas Secretary of State (Texas SOS). Information about data broker registrants is available on the Texas SOS website.

ADDITIONAL INFORMATION FOR VISITORS FROM EUROPE, SWITZERLAND AND THE UK

DATA CONTROLLER

EEA, Switzerland and UK data protection law makes a distinction between organizations that process personal data for their own purposes (known as “controllers”) and organizations that process personal data on behalf of other organizations (known as “processors”).

 

J.D. Power, and its affiliates set forth in the table below (collectively, “J.D. Power”) may act as either a controller or a processor depending on the circumstances. J.D. Power, is the controller with respect to information you provide through the Service. If your information is collected in Europe or the United Kingdom, international transfers of your personal data will be subject to appropriate or suitable safeguards, such as EU standard contractual clauses.

J.D. POWER AFFILIATES

Entity Name	Address
J.D. Power UK Ltd.	FF3, Ethos, Kings Road, Swansea SA1 8AS
J.D. Power Europe GmbH	Leopoldstraße 8-10, 80802 Munich, Germany
Autovista Group Limited	Suite 1, 7th Floor, 50 Broadway, London, United Kingdom, SW1H 0BL
Glass’s Information Services Limited	Suite 1, 7th Floor, 50 Broadway, London, United Kingdom, SW1H 0BL
Autovista France sarl	1 Rue Favart, 75002 Paris
Autovista Limited	Suite 1, 7th Floor, 50 Broadway, London, United Kingdom, SW1H 0BL
Eurotax Österreich GmbH	Donau-City-Straße 7/40. OG, 1220 Wien
Autovista Benelux N.V.	Kolonienstraat, 56 / Rue des Colonies, 56, 1000 Brussels
Eurotax Holding GmbH	Churerstrasse 135, 8808 Pfäffikon, Switzerland
Autovista International AG	Churerstrasse 135, 8808 Pfäffikon, Switzerland
Autovista Czech s.r.o.	Nádražní 344/23, Smíchov, 150 00 Praha 5
Schwacke GmbH	Westendstraße 28, D-60325 Frankfurt am Main, Germany
Autovista Spain SA	Calle Principe de Vergara, 211 28002 Madrid
Autovista Oy	c/o Rantalainen, Keskuskatu 3 A (7. Floor), 00100 Helsinki, Finland
Autovista Magyarorszag Kft	1062 Budapest, Váci út 1-3. “A” torony. ép. 6. em.
Autovista Italia s.r.l.	Piazza Tre Torri, 2 20145 Milano, Italy
Rødboka AS	Sandakerveien 140, 0484 Oslo, Norge
Autovista Polska Sp. Zo.o	ul. Grzybowska 2/29, 00-131 Warszawa
Autovista Eurotax Portugal Lda.	Centro Empresarial Sintra/Estoril, V, Av. Pedro Álvares Cabral, nº. 169, Armazém A1, Linhó 2710-144 Sintra
Autovista Romania S.R.L.	Ion Mihalache Blvd, No. 15-17, 1st Floor, 1st District, OS17, Bucharest, 011171, Romania
Autovista Inter-Global AB	C/O Win Win Ekonomi AB Box 92138 120 08 Stockholm
Riio Marknad & Strategi AB (t/a EV Volumes)	C/O Win Win Ekonomi AB Box 92138 120 08 Stockholm
Eurotax d.o.o	Bleiweisova cesta 30, 1000 Ljubljana, Slovenia
Autovista Slovakia s.r.o.	Karadžičova 2, 811 08 Bratislava, Slovakia

 

The Global Privacy Policy contains a broad description of the way in which we as Data Controller process Personal Data. This document supplements the description set out in the Global Privacy Policy. To understand in greater detail how your Personal Data is processed you can also refer to any personal communications you have received in addition to this privacy notice or contact us at: [email protected].

 

Sometimes J.D. Power operates as a processor on behalf of a client, a separate legal entity, which is the data controller. For example, J.D. Power provides market research services to its clients and processes personal data on their behalf through collection and analysis of survey responses. Please visit the applicable client’s privacy policy for information about their privacy practices. Any questions that you may have relating to such personal data and your rights under data protection law should therefore be directed to the client as the controller, not to J.D. Power.

In the EEA the age of digital consent varies by Member State between 13 and 16. In the UK, digital consent age is age 13. We apply the age in your country of residence. If you are below the applicable digital age of consent, you should not provide personal data to us without the involvement of a parent or guardian.

YOUR RIGHTS AND OUR DATA PROTECTION OFFICER

If you are a data subject in the EEA, the United Kingdom, or Switzerland, you have the right to access, rectify, or erase the personal data we have collected about you through the Service. You also have the right to data portability and the right to restrict or object to our processing of that data. You also have the right to object to our processing of your personal data (or to our providing it to other entities for processing) for marketing purposes, or for purposes materially different from those for which it was originally collected or to which you subsequently consented. You may withdraw your consent at any time for any data processing we do based on consent you have provided to us.

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Where we carry out such processing, you have the right to request human involvement, express your point of view, and contest the decision.

 

Our Data Protection Officer. We have appointed a Data Protection Officer (DPO) for our European operations. You can contact our DPO or the J.D. Power Privacy Team for queries or comments relating to the processing of personal data by emailing [email protected].

Data protection complaints (United Kingdom). If you are located in the United Kingdom, you have a statutory right to make a data protection complaint to us about how we process your personal data.

To submit a data protection complaint, please email us at [email protected] with “UK Data Protection Complaint” in the subject line. To help us investigate efficiently, please include (i) your name and contact details, (ii) a description of your complaint and the personal data involved, (iii) the date(s) on which the matter occurred, and (iv) any supporting documentation or correspondence.

We will acknowledge your complaint within 30 days of receipt and will respond substantively without undue delay. Where the matter is complex or requires additional investigation, we will keep you informed of progress and the expected timeframe for our response.

 

Right to complain to a supervisory authority in the EEA. If you are not satisfied with the response you receive from our DPO or the J.D. Power Privacy Team, you have the right to lodge a complaint with a supervisory authority. You may complain to the supervisory authority in the EEA Member State where you live, work, or where the alleged infringement took place. A list of EEA supervisory authorities is available from the European Data Protection Board at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. If you are located in the United Kingdom, you may complain to the Information Commissioner’s Office (ICO) at https://ico.org.uk/make-a-complaint/; please note that, under the DUAA, the ICO may decline to consider your complaint, or take it into account in how it responds, where you have not first raised the matter with us as described above.

 

We will respond to your request within thirty (30) days. We may request specific information from you to help us confirm your identity and process your request. Applicable law may require or permit us to decline your request. If we decline your request, we will tell you why, subject to legal restrictions.

J.D. Power acknowledges that you have rights in connection with Client Data to the extent it contains your personal data. If your information has been processed by J.D. Power on behalf of a client and you wish to exercise any rights you have with such information, please inquire with our client directly. If you wish to make your request directly to J.D. Power, please provide the name of the J.D. Power client on whose behalf J.D. Power processed your information. We will refer your request to that client, and we will support them to the extent required by applicable law in responding to your request.

SWITZERLAND

If you are located in Switzerland, the Swiss Federal Act on Data Protection (“FADP”) applies to our processing of your personal data. We process personal data of Swiss residents in accordance with the FADP and the principles described in this supplement.

In addition to the rights described above, Swiss residents have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (“FDPIC”) at www.edoeb.admin.ch. Cross-border transfers of personal data from Switzerland are subject to safeguards approved by the FDPIC, including the standard contractual clauses as supplemented for Swiss-law purposes.

References in this supplement to the EEA or to GDPR rights should be read, in the case of Swiss residents, as references to Switzerland and the corresponding FADP rights and remedies, where applicable.

LEGAL BASIS FOR PROCESSING

We will not process your personal data unless we have a lawful basis for processing. Our lawful bases include where: (a) you have given your consent to our processing for a specific purpose, either to us or to our service providers, partners or clients; (b) processing is necessary for the performance of a contract with you or to comply with a legal obligation; or (c) processing is necessary for the purposes of the legitimate interests pursued by J.D. Power or a third-party controller, including our clients. Special-category data is processed only on the basis of explicit consent obtained at the point of collection.

 

JD Power relies legitimate interests in the following ways:

 

• When you contact us with a query, either by email or one of the methods shown on our contact page (including on social media), we may collect your name, contact details, and any other information you choose to share with us as part of your communication because it is in our legitimate interests to make sure we can properly respond to your query, including to provide technical support.
• When we do business with you, we may collect your professional information, including employer or company name, job title, job function, and industry sector, collected primarily from business professionals using our B2Bbusiness to business products and services. This is because it is in our legitimate interest to manage our business relationship with you.
• When you provide us with feedback, we may use your feedback to make improvements to our website, our ways of communicating with you, and our wider offerings, because it is in our legitimate interests to make these improvements.
• To market research into consumer preferences and attitudes around a variety of products and services, including This is because it is in our legitimate interest to understand consumer preference and attitudes in the market.
• When you use our website, we may collect information using essential cookies about your device and how you use our website. For example, we may collect your device identification number, browser type and version, operating system and platform, hardware used, browser plug-in types and versions, IP address (which may reveal your location), URLs, referrer URL, date and time of access, information about page response times, length of visits to certain pages, interaction information (such as scrolling, clicks, and mouse-overs), error reports and performance data. We may use your personal data contained within this device information because it is in our legitimate interests to ensure the proper use, functioning, maintenance and security of our website.
• When you attend one of our events or a third-party event we also attend (including virtual events via video conferencing providers), we will usually collect your name, address, email address and phone number. We collect this personal data because it’s in our legitimate interests to promote our business and to know who is attending our events.
• Where you enter a competition, sweepstake, promotion or other contest we are running, we will collect your name, email address and any other personal data that forms a part of the competition entry (this may differ depending on the competition). We do this under our legitimate interests to run our competitions effectively and to award the prizes to the winner.

 

• Where we conduct deal tracking and forecasting involving your business contact information and our business relationship with. We do this under our legitimate interests, in order to improve forecast accuracy, pipeline visibility, and revenue/financial planning.

 

• When you interact with our chatbot service, we may collect your name, contact details, and the contents of your chat messages. We process this personal data because it is in our legitimate interests to provide and improve the chatbot service, respond to your queries, and train our systems.

 

• Where you use our vehicle valuation, forecasting, or vehicle registration tracking tools as a business, customer, we process vehicle identification information (VIN) and related business contact information because it is in our legitimate interests to provide accurate valuation, forecasting, and marketing analysis services to our business customers.

 

 

Where we rely on legitimate interests, we have considered the impact of our processing on your rights and freedoms and have determined that our interests are not overridden by yours, taking into account the nature of the data, the purposes of processing, and the safeguards in place.

 

MARKETING

From time to time, we may want to market our products or services to you. We may also want to market products and services offered by a third party, including where we are discontinuing a product or service we previously offered directly and where we may be transitioning you to a third-party provider.

 

Where we send you marketing communications we may rely on your consent for that marketing (where required under the ePrivacy rules implemented in your country of residence) or we may rely on legitimate interests.

 

You may object to our marketing at any time, either by unsubscribing to our emails or by contacting us at [email protected].

 

Where you’ve provided your consent, you may withdraw your consent at any time

HOW LONG DO WE KEEP YOUR INFORMATION?

We retain your information for as long as necessary to fulfill the purposes for which it was collected and as permitted by applicable law.

We will only retain your personal data for as long as we need it unless we are required to keep it for longer to comply with our legal, accounting or regulatory requirements.  The specific retention periods we apply vary depending on the category of personal data, the purposes for which it is processed, and any longer period required by applicable law, contract, audit, or our legitimate business needs. Our retention schedule, which sets out these periods in detail, is available on request through the contact details in this supplement.
J.D. Power retains the contents of chats for a period of up to 3 years, for training and analysis purposes. We also hold statistical information about the Chatbot service, but this does not contain any personal data. J.D. Power uses a third party, Salesforce Inc, to provide technical support for the chatbot.

COOKIES AND TRACKING TECHNOLOGIES

Our website uses cookies and similar technologies. A cookie is a small file of letters and numbers that we put on your device when you access our website. Some cookies are strictly essential for the website to function properly and help provide you with a better experience online. They include, for example, cookies that enable you to log into secure areas of our website, use a shopping cart or make use of e-billing services.

We also use performance cookies, which allow us to recognise and count the number of visitors and to see how visitors move around the website when they are using it. This helps us to improve the way our website works, for example by ensuring that users are finding what they are looking for easily.

We also use cookies for commercial, and targeting messages tailored to your interests based on your browsing habits. These cookies record your visit to our website, the pages you have visited and the links you have followed.

We also use functionality cookies. These are used to recognise you when you return to our website. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).

We will only set non-essential cookies on your device if you give your consent by clicking “Accept all” or by accepting specific categories of cookies using the settings below. Strictly essential cookies do not require your consent and will always be active, as they are necessary for the website to function. If you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our website.

For more information about the exact cookies we use, please visit our Cookies Transparency Page.

EMAIL TRACKING

For details on email tracking technologies, see the main privacy policy. In the EEA and UK, we deploy email tracking pixels and engagement analytics only where we have a lawful basis to do so. You may withdraw your consent at any time via the Email Preference Centre.

INTERNATIONAL TRANSFERS

Where necessary, we may transfer personal data to countries or territories around the world in full compliance with applicable data protection laws. We do so only where:

the European Commission or the UK Government has decided that a third country ensures an adequate level of protection;

the third party receiving the Personal Data has provided us with adequate safeguards in the form of standard data protection clauses approved by regulatory authorities;

we comply with a code of conduct approved by a supervisory authority;

we hold certification under an approved mechanism as provided for in applicable Data Protection legislation;

or we have agreed contractual clauses authorised by a competent supervisory authority (including in EEA., Switzerland and the UK).

Additional information for visitors from Canada

The file containing your personal data is maintained on our servers or those of our service providers and will be accessible by authorized employees, agents and representatives who require access for the purposes described in this policy. You may request access to or correction of the personal data in our custody or control by writing to our Privacy Official as set forth in the “Contact Us” section. Your right to access and correct personal data is subject to applicable legal restrictions. We may take reasonable steps to verify your identity before providing access or making corrections.

This supplement is effective as of November 29, 2018.

Informations complémentaires pour les visiteurs du Canada

Le fichier contenant vos renseignements personnels est conservé sur nos serveurs ou ceux de nos prestataires de services et sera accessible par les employés, agents et représentants autorisés qui ont besoin d’y avoir accès aux fins décrites dans la présente Politique. Vous pouvez demander à y avoir accès ou à ce que vos renseignements personnels en notre possession ou sous notre contrôle soient rectifiés, en écrivant à notre Responsable des questions de confidentialité comme indiqué dans la section « Pour nous joindre ». Votre droit d’accès et de rectification des renseignements personnels est régi par les restrictions légales en vigueur. Nous pouvons procéder à une vérification de votre identité avant de vous donner accès ou de faire des rectifications.

Ce supplément prend effet à compter du 29 novembre 2018.

J.D. Power México, S. de R.L. de C.V (the “Company”), with address at Prado Sur No. 150 2do Piso, Colonia Lomas de Chapultepec C.P. 11000, Mexico City, Mexico, is the data controller for purposes of processing and protecting your personal data.

Your personal data will be used by the Company to (i) manage and formalize the contractual relationship with you; (ii) manage the services we render; (iii) perform services requested by you and provide customer service; (iv) conduct market research into consumer preferences and attitudes around a variety of products and services, including surveys; (v) verify consumer responses if need to ensure the accuracy of our research; (vi) enter you for sweepstakes, contest or other promotion; (vii) communicate with you, including to respond to inquiries or recontact you for additional survey opportunities; (viii) send you technical notices, updates, security alerts, information regarding changes to our policies and support and administrative messages; (ix) develop and send you direct marketing for products and services including ads and communications about ours and third party products, offers, promotions, rewards, events and services; (x) serve advertising tailored to your interests on our services and third party services; (xi) enhance security, monitor and verify identity or service access, combat spam or other malware or security risks; (xii) comply with law or a legal process (including a court or government order or subpoena), enforce this privacy notice or our legal rights, prevent and address fraud and protect the rights, property or safety of the Company, our clients, users and/or the public; (xiii) conduct audits, collect and assess feedback, identify usage trends, measure ad effectiveness and evaluate and improve our products, services, marketing and client relationships; (xiv) collect, process and analyze consumer data for research; (xv) collect, process and analyze client data for research purposes; (xvi) for access to our reporting/analytical tools; and (xvii) in connection with a possible merger, acquisition, restructuring or sale of assets or shares of the Company.

For the purposes established in the above paragraph, the Company will collect the following personal data: name, domicile, phone number and email address.

In order to comply with the above-mentioned purposes, the Company will share with third parties, whether national or foreign, some or all of your personal data. Likewise, the Company will ensure, through the execution of agreements and/or any other binding documents, that such third parties maintain adequate administrative, technical and physical security measures to protect your personal data, as well as that such third parties only use your personal data for the purposes for which it was collected and pursuant to the provisions set forth in this Privacy Notice.

You have the right to access, rectify and cancel your personal data, oppose to the processing of such personal data, limit its use or disclosure, or revoke the consent that you have granted us to process your personal data, by emailing a request to [email protected] (the “Request”).

The Request shall contain at least the following information: (i) complete name and e-mail or address to inform you of the answer to the Request; (ii) the documents evidencing your identity (i.e. official identification in force) or, as the case may be, the legal representation of the individual processing the Request on your name and behalf (i.e. signed proxy letter signed before two witnesses attaching copy of the official identifications of the proxy letter grantor and the legal representative); (iii) a clear description of the personal data with respect to which you seek to exercise the aforementioned rights; and (iv) any other information or document that may facilitate the location of the personal data. In the case of rectification of personal data, you shall indicate the modifications to be carried out and provide the supporting documentation for your request.

In accordance with the Federal Law for the Protection of Personal Data in Possession of Individuals (the “Law”), the Company has a term of twenty (20) business days from the date of reception of your Request to notify you through email or to the address you provided in your Request, the response, and in the event the response is favorable, the Company will have an additional term of fifteen (15) business days from the date of the notification to comply with it. The aforementioned term may be extended once for an equal period of time only if such extension is appropriate under the circumstances.

The Company or our third-party service providers may use cookies (or other anonymous tracking technologies that do not collect personally-identifiable information) when you visit our websites. A “cookie” is a small text file placed on your computer or device, which helps our Web sites function better.

Please note that by using our websites, you consent to the use of certain cookies.

Any changes to this Privacy Notice will be available on the link jdpower.com/privacy/Mexico.

As holder of the personal data, you have to right to appear before the National Institute of Information Access and Protection of Personal Data in Possession of Individuals (INAI) in the event you deem that your personal data protection right has been violated.

For further information, please refer to the Global Privacy Policy on the link: jdpower.com/privacy. In the event of conflict between the terms of this Privacy Notice and the Global Privacy Policy, the terms and conditions of this Privacy Notice will prevail.

J.D. Power México, S. de R.L. de C.V (la “Sociedad”), con domicilio en Prado Sur No. 150 2do Piso, Colonia Lomas de Chapultepec C.P. 11000, Ciudad de México, México, es responsable del tratamiento y protección de sus datos personales.

Sus datos personales serán utilizados por la Sociedad para (i) administrar y formalizar la relación contractual con usted; (ii) administrar los servicios que prestamos; (iii) realizar los servicios que sean solicitados por usted y proveer servicio al cliente; (iv) realizar estudios de mercado sobre las preferencias y actitudes del consumidor alrededor de una variedad de productos y servicios, incluyendo encuestas; (v) verificar respuestas del consumidor si hay necesidad para asegurar mayor precisión en nuestra búsqueda; (vi) inscribirlo para sorteos, concursos u otras promociones; (vii) comunicarnos con usted, incluso para responder consultas o para volver a contactarlo para mayor oportunidad en encuestas adicionales; (viii) enviarle notificaciones técnicas, actualizaciones, alertas de seguridad, información con respecto a cambios en nuestras políticas y soporte y mensajes administrativos; (ix) desarrollar y enviarle publicidad directa para productos y servicios que incluyen anuncios y comunicados sobre nuestros productos y ofertas, promociones, recompensas, eventos y servicios de terceros; (x) publicar publicidad adaptada a sus intereses en nuestros servicios y servicios de terceros; (xi) mejorar la seguridad, controlar y verificar el acceso al usuario o al servicio, combatir el correo no deseado (spam) u otro malware o riesgos de seguridad; (xii) cumplir con la ley o proceso legal (incluyendo una orden o requerimiento judicial o gubernamental), cumplir este aviso de privacidad o nuestros derechos legales, prevenir y señalar fraudes y proteger los derechos, propiedad o seguridad de la Sociedad, nuestros clientes, usuarios y / o el público; (xiii) conducir auditorías, recolectar y evaluar comentarios, identificar tendencias de uso, medir la efectividad de los anuncios y evaluar y mejorar nuestros productos, servicios, publicidad y relaciones con los clientes; (xiv) recopilar, procesar y analizar datos de consumidores para investigación; (xv) recopilar, procesar y analizar datos de clientes con fines de investigación; (xvi) acceder a nuestras herramientas de informes/análisis; y (xvii) en relación con una posible fusión, adquisición, restructuración o venta de activos o acciones de la Sociedad.

Para las finalidades establecidas en el párrafo anterior, la Sociedad recabará sus siguientes datos personales: nombre, domicilio, número telefónico y dirección de correo electrónico.

A fin de cumplir con las finalidades descritas anteriormente, la Sociedad podrá compartir con terceros, nacionales o extranjeros, algunos o todos sus datos personales. Asimismo, la Sociedad se asegurará, a través de la firma de convenios y/o la adopción de otros documentos vinculantes, que dichos terceros mantengan medidas de seguridad, administrativas, técnicas y físicas adecuadas para resguardar sus datos personales, así como que dichos terceros únicamente utilicen sus datos personales para las finalidades para los cuales fueron recabados y de conformidad con el presente Aviso de Privacidad.

Usted tiene derecho de acceder, rectificar y cancelar sus datos personales, oponerse al tratamiento de los mismos, limitar su uso o divulgación, o revocar el consentimiento que ha otorgado a la Sociedad para el tratamiento de dichos datos, enviando una solicitud al correo electrónico a [email protected] (la “Solicitud”).

La Solicitud deberá contener, por lo menos, la siguiente información: (i) nombre completo y correo electrónico o domicilio para comunicarle la respuesta a la Solicitud; (ii) los documentos que acrediten su identidad (i.e. identificación oficial vigente) o, en su caso, la representación legal de la persona que tramita la Solicitud en su nombre y representación (i.e. carta poder firmada ante dos testigos acompañada de copia de las identificaciones oficiales del otorgante de la carta poder y del representante legal); (iii) una descripción clara de los datos personales respecto de los que busca ejercer alguno de los derechos antes mencionados; y (iv) cualquier otro elemento o documento que facilite la identificación de sus datos personales. En caso de solicitudes de rectificación de datos personales, usted deberá indicar las modificaciones a realizar y aportar la documentación que sustente su petición.

De conformidad con lo dispuesto por la Ley Federal de Protección de Datos Personales en Posesión de los Particulares (la “Ley”), la Sociedad cuenta con un plazo de 20 (veinte) días hábiles contados a partir de la fecha de recepción de su Solicitud para notificarle la determinación adoptada a través del correo electrónico o domicilio que usted haya proporcionado en la Solicitud y, en caso de resultar procedente, la Sociedad contará con un plazo adicional de 15 (quince) días hábiles siguientes a la fecha de notificación para hacerla efectiva. Los plazos antes referidos podrán ser ampliados una sola vez por un periodo igual, siempre y cuando así lo justifiquen las circunstancias del caso.

La Sociedad o nuestros proveedores de servicios externos podemos utilizar cookies (u otras tecnologías de seguimiento anónimas las cuales no recolectan información que pueda identificarle personalmente) cuando usted visita nuestros sitios web. Una “cookie” es un pequeño archivo de texto colocado en su computadora o dispositivo, que ayuda a que funcionen mejor nuestros sitios web

Tenga en cuenta que al utilizar nuestros sitio web usted acepta el uso de ciertas cookies.

Cualquier modificación a este Aviso de Privacidad estará disponible en el vínculo: jdpower.com/privacy/Mexico.

Como titular de los datos personales, usted tiene derecho a acudir ante el Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI) en caso de considerar que su derecho a la protección de datos personales ha sido vulnerado.

Para mayor información, favor de referirse a la Política de Privacidad Global ubicada en el vínculo: jdpower.com/privacy. En caso de conflicto entre los términos del presente Aviso de Privacidad y la Política de Privacidad Global, los términos y condiciones de este Aviso de Privacidad serán los que prevalecerán.

This supplement is effective as of October 29, 2026.

ADDITIONAL INFORMATION FOR VISITORS FROM AUSTRALIA

If you are located in Australia, this supplement applies to you in addition to the Global Privacy Policy. It describes how J.D. Power handles your personal information under the Privacy Act 1988 (Cth) (the “Privacy Act”) and the Australian Privacy Principles (“APPs”), and your rights in connection with that information.

In Australia, J.D. Power’s activities are conducted by Glass’s Information Services Pty Limited (ACN 004 382 478), 2 Riverside Quay, Southbank, Victoria 3006 (“Glass’s”). Glass’s is the entity responsible for personal information collected in connection with our Australian operations and is the contact point for any questions or requests under Australian privacy law.

OUR AUSTRALIAN ACTIVITIES

Our Australian operations primarily support business clients who submit vehicle identification numbers (VINs) to be decoded by make, model, year, trim, and options, and to which valuations are added. These activities are consistent with our equivalent business activities in the United States and Europe. We do not operate consumer-facing market research surveys or consumer lead generation programs in Australia.

As a result, our direct collection of personal information from Australian residents is limited. Where we do collect personal information, we do so in accordance with the APPs and as described in the Global Privacy Policy and this supplement.

KINDS OF PERSONAL INFORMATION WE COLLECT AND HOLD

The categories of personal information we collect and hold in connection with our Australian operations are described in the Global Privacy Policy. In Australia, this typically includes business contact details (such as name, employer, job title, and business email address) of individuals interacting with us on behalf of business clients, technical and device information collected through our websites, and, where provided, information submitted through contact, demonstration, or support requests.

We do not generally collect sensitive information (as defined in the Privacy Act) in Australia. Where collection of sensitive information becomes necessary to carry out a  purpose or activity of our business, we will collect it only with your consent and once you have read this policy or an appropriate statement.

HOW WE COLLECT AND USE PERSONAL INFORMATION

We collect personal information directly from individuals, from our business clients, and from publicly available sources. We use personal information for the purposes described in the Global Privacy Policy, including to provide our products and services, communicate with you, respond to inquiries, conduct analytics and improve our services, comply with our legal obligations, and protect our rights and the rights of others.

DIRECT MARKETING

Where we send you direct marketing communications, we will do so in accordance with APP 7 and the Spam Act 2003 (Cth). You can opt out of receiving direct marketing communications at any time by following the unsubscribe instructions in the communication or by contacting us as set out below. Once we receive your opt-out request, we will action it within a reasonable period.

DISCLOSURE OF PERSONAL INFORMATION OVERSEAS

J.D. Power is headquartered in the United States and operates globally. Personal information collected in Australia may be disclosed to, and processed by, our affiliates and service providers located outside Australia, including in the United States and the United Kingdom. In particular, we are likely to disclose personal information to recipients located in the United States and the United Kingdom in connection with the operation of our products and services.

Where we disclose personal information overseas, we take reasonable steps in the circumstances to ensure the overseas recipient does not breach the APPs in relation to that information, or otherwise rely on a permitted basis for the disclosure under APP 8.2.

ACCESS, CORRECTION, AND COMPLAINTS

Subject to the exceptions in the Privacy Act, you have the right to request access to, and correction of, personal information we hold about you. To make a request, please use the methods set out in the “Contact Us” section below.

We will respond to access and correction requests within a reasonable period and, where required, in accordance with the timeframes in the Privacy Act. We may take reasonable steps to verify your identity before responding.

If you have a complaint about how we have handled your personal information, please contact us as set out below. We will acknowledge your complaint, investigate the matter, and respond to you. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (“OAIC”) at www.oaic.gov.au.

AUTOMATED DECISION-MAKING

We do not currently make decisions that have a legal or similarly significant effect on you using solely automated processing of your personal information. To the extent the recent amendments to the Privacy Act under the Privacy and Other Legislation Amendment Act 2024 introduce transparency obligations for automated decision-making, we will update this supplement and our practices to comply with those requirements as they come into force.

CONTACT US

If you have any questions about this supplement, wish to exercise your rights, or wish to make a complaint, please contact our Privacy Team at [email protected]. To submit a request relating to your personal information, please use our online form at www.jdpower.com/Privacy/DSAR or email [email protected].

Postal address:

Privacy Team

Glass’s Information Services Pty Limited

2 Riverside Quay, Southbank, Victoria 3006