Privacy Policy
This Privacy Statement for Pon Luxury Cars North America (doing business as IndiGo Auto Group) governs the collection, use and other forms of processing of personal data by indiGO Auto Group related to our services, our indiGO Auto Group products and this website.
Who is responsible for processing your personal data?
indiGO Auto Group (13911 North Freeway, Houston, TX 77090) is the legal entity responsible for all collection and all processing of your personal data in connection with the products, services and websites of indiGO Auto Group.
indiGO Auto Group is part of Pon Holdings B.V. its affiliates and its subsidiaries (“Pon”). indiGO and Pon are committed to respecting and safeguarding your privacy and the security of your personal data you share with us.
Why do we process your personal data?
Personal data is information that identifies you as an individual or relates to an identifiable individual. When you choose to register your personal data, contact us, or visit our websites, we will process some personal data about you. We process these personal data for the following purposes:
- communicate with you in a personal way or to inform you about indiGO Auto Group products or services, consistent with your choices;
- provide customer service, including service around the purchase of services and products, fulfil warranty obligations and product recalls for our own services and those of related companies, and to deal with any enquiries or complaints;
- administer and fulfil your purchases of indiGO Auto Group products including the financial and logistic handling;
- administer your indiGO Auto Group account;
- administer your participation in any contests, promotions, surveys or website features;
- perform market research and improve our business, services and indiGO Auto Group products or to develop new business, services and products;
- perform statistical analyses and reporting;
- providing services on the internet;
- communicating with participants and offering a loyalty program;
- provide app functionality, including providing relevant commercial messages;
- to communicate future promotional and marketing information including direct marketing purposes and retargeting;
- to aggregate and/or anonymize personal data in order to generate other data for our use;
- to comply with our legal obligations, resolve disputes, or enforce our agreements;
- to protect the safety and health of individuals;
- (to support) the security of (access to) indiGO Auto Group buildings and premises;
- to prevent break-ins, theft, and vandalism;
- to surveil the property and information located in indiGO Auto Group buildings or premises;
- to record incidents;
- as otherwise stated at or about the time information is collected.
Which personal data do we process?
Which personal data we exactly process, depends on which websites, products or services you use. We process the following personal data.
Personal data you provide to us:
● This is the personal data that you enter when you use our websites, products or services. This data includes e.g. your name, address, gender, email address, phone number, age, birth date, indiGO Auto Group products you bought, the account name and password that you create, bank details for buying indiGO Auto Group products etc.
Metadata and Log files:
● This is data that is collected or generated automatically when you use the websites, products, or services of indiGO Auto Group. Metadata is often collected or generated when using a computer or device when you send data via a computer network, such as the Internet.
● This may include Internet Protocol (IP) address, geographic location, device identifier, hardware information, browser type, browser language, the number of times you access the Site, when you access the Site, information about referring websites, and other information.
How do we process your personal data?
In the table below we describe per way of processing: the personal data and the purposes for which we process the personal data as well as the legal basis for the processing:
|
Ways of processing |
Personal data processed |
Purposes for processing the personal data |
Legal basis |
|---|---|---|---|
Ways of processing Registration for our newsletter | Personal data processed Personal data you provide | Purposes for processing the personal data The above-described purposes: 1, 2, 6, 7, 8, 11, 12, 13 and 19 | Legal basis Consent or legitimate interest |
Ways of processing Contact form customer service | Personal data processed Personal data you provide | Purposes for processing the personal data The above-described purposes: 1, 2, 6, 7, 8, 11, 12, 13 and 19 | Legal basis Performance of a contract or legitimate interest |
Ways of processing indiGO Auto Group account creation | Personal data processed Personal data you provide | Purposes for processing the personal data The above-described purposes: 1, 2, 4, 6, 7,8, 9, 11, 12, 13 and 19 | Legal basis Consent, legitimate interest or performance of a contract |
Ways of processing Buying indiGO Auto Group products on the website | Personal data processed Personal data you provide | Purposes for processing the personal data The above-described purposes: 1, 2, 3, 6, 7, 8, 9, 11, 12, 13 and 19 | Legal basis Performance of a contract or legitimate interest |
Ways of processing Attend to product promotion, events or online forum | Personal data processed Personal data you provide | Purposes for processing the personal data The above-described purposes: 1, 5, 6, 8, 11, 12, 13 and 19 | Legal basis Consent or legitimate interest |
Ways of processing Visit our websites (cookies) | Personal data processed Metadata | Purposes for processing the personal data The above-described purposes: 6, 7, 8, 11, 12, 13 and 19 | Legal basis Consent or legitimate interest |
Ways of processing Log on our websites via social media | Personal data processed Personal data you provide (please note: we never get access to your social media account) | Purposes for processing the personal data The above-described purposes: 1, 6, 7, 8, 11, 12, 13 and 19 | Legal basis Consent or legitimate interest |
Ways of processing Entering our buildings or premises | Personal data processed Footage | Purposes for processing the personal data The above-described purposes: 14, 15, 16, 17, 18 | Legal basis Legitimate interest |
Our legitimate interests include: marketing, advertising, security, (crime) prevention, IT management, research and analysis of our products or services, business management, legal affairs, internal management.
You have the right to withdraw your consent which you may have given to the processing of your personal data at any time by sending your withdrawal request to privacy@pon.com.
How do we share or transfer your personal data?
indiGO Auto Group may share your personal data also with third parties to perform certain processing activities on behalf of indiGO Auto Group and to facilitate services they provide to us. These can include providers of services such as website hosting, data analysis, payment processing, order fulfilment, information technology and related infrastructure provision, customer service, email delivery, auditing, and other services. indiGO Auto Group may also share your personal data to third parties, to permit them to send you marketing communications, consistent with your choices. indiGO Auto Group requires these third parties to process and protect your personal data diligently. indiGO Auto Group will not sell your personal data to third parties.
indiGO Auto Group is part of a business group within Pon (www.pon.com) and therefore departments (like IT, marketing) can be located in other Pon companies. As a consequence, your personal data may be shared within and/or transferred to other Pon companies when there is a legal basis for this, such as your consent or a legitimate interest.
indiGO Auto Group or Pon might reorganize, merge or in any other way sell or dispose (part of) a business company to another company. Where such business relates to indiGO Auto Group, such transfer of ownership may include the transfer of your personal data to the new owner and its advisors.
We will otherwise only disclose your personal data if so required or authorized by law, where necessary for preventing or combating fraud, where necessary for dispute resolution, or for any other pressing legitimate need which under the circumstances must outweigh your privacy interests, such as the security of our business and the safety of our staff.
How do we protect your personal data?
indiGO Auto Group will take appropriate technical and organizational security measures against loss or unlawful processing of personal data. This may include using secure registration forms, encryption of data, and restricting access to your personal data.
How long do we retain your personal data?
We retain personal data for as long as needed or permitted in light of the purpose(s) for which it was obtained and consistent with applicable law.
The criteria used to determine our retention periods include:
● The length of time we have an ongoing relationship with you and provide our services to you (for example, for as long as you have an account with us or keep using our services);
● Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them); or
● Whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation or regulatory investigations).
Cookies, web beacons and similar techniques
If you are using our websites, services, applications, communications (including email) and accessing or using tools, we may use cookies, web beacons and other similar technologies for storing information to provide you with a better, faster and safer browser experience.
Please refer to our Cookie Policy for the explanation of cookies, web beacons and similar techniques, how we use these techniques and how you can control these techniques.
Your rights
If you would like to request to review, correct, update, suppress, restrict or delete personal data, object to the processing of personal data, or if you would like to request to receive an electronic copy of your personal data for purposes of transmitting it to another company (to the extent these rights are provided to you by applicable law), you may contact us via privacy@indigoautogroup.com or mail to: indiGO Auto Group Attn: Privacy Department 13911 North Freeway, Houston, TX 77090. We will respond to your request consistent with applicable law.
In your request, please make as clear as possible what personal data your request relates to. For your protection, we may only implement requests with respect to the personal data associated with the particular email address that you use to send us your request, and we may need to verify your identity before implementing your request. We will try to comply with your request as soon as reasonably practicable and in any event within any applicable legally required timeframes.
Contact, questions, feedback and Data Protection Officer
If you have any questions about this Privacy Statement, please contact us at privacy@pon.com.
You may also contact our Data Protection Officer (DPO) via privacy@pon.com. You have the right to lodge a complaint with a data protection authority for your country or region or where an alleged infringement of applicable data protection law occurs.
Policy changes
We may change this Privacy Statement from time to time. Any changes will become effective when we post the revised Privacy Statement. If necessary, we will inform you when we change the Privacy Statement.
PRIVACY NOTICE ADDENDUM FOR CALIFORNIA RESIDENTS
California Privacy Notice Statement
California law requires that indiGO Auto Group provide you with a summary of your privacy rights under the California Consumer Privacy Act of 2018, as amended (“CCPA”). As required by CCPA, this supplement identifies specific rights regarding certain personal information collected, disclosed and sold by certain businesses. This supplement describes those rights and explains how to exercise them. This supplement does not apply to personal information to which the CCPA does not apply. This supplement applies exclusively to California residents.
Definition: CCPA defines “personally identifiable information” as individually identifiable information about an individual consumer collected online by a corporation from an individual and maintained by the corporation in an accessible form, and may include any of the following: (1) a first and last name; (2) a home or other physical address, including street name and name of a city or town; (3) an email address; (4) a telephone number; (5) a social security number; (6) any other identifier that permits the physical or online contacting of a specific individual; and (7) information concerning a user that the web site collects online from the use, and maintains in personally identifiable form, in combination with an identifier described within this supplement.
Information We Collect
indiGO Auto Group collects information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer. In particular, indiGO Auto Group has collected the following categories of personal information from consumers within the last twelve (12) months:
|
Category |
Examples |
Collected |
|
A. Identifiers. |
A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiers. |
YES |
|
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). |
A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories. |
YES |
|
C. Protected classification characteristics under California or federal law. |
Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information). |
NO |
|
D. Commercial information. |
Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. |
YES |
|
E. Biometric information. |
Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data. |
NO |
|
F. Internet or other similar network activity. |
Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement. |
YES |
|
G. Geolocation data. |
Physical location or movements. |
YES |
|
H. Sensory data. |
Audio, electronic, visual, thermal, olfactory, or similar information. |
NO |
|
I. Professional or employment-related information. |
Current or past job history or performance evaluations. |
NO |
|
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)). |
Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records. |
NO |
|
K. Inferences drawn from other personal information. |
Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. |
YES |
|
L. Sensitive information. |
social security number, driver license number, state identification card, passport number, financial data, genetic data, biometric data, precise geolocation, and racial and ethnic origin, content of consumer communications (email, mail, or text), unless the business is the intended recipient, genetic data, and information collected concerning a consumer’s health, sex life, or sexual orientation. |
YES |
Personal information does not include:
● Publicly available information from government records.
● De-identified, anonymized, or aggregated consumer information.
● Information excluded from the CCPA's scope, like:
o Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
o Personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994.
indiGO Auto Group obtains the categories of personal information listed above from the following categories of sources:
● Directly from you. For example, from forms, verbal questions and answers, or online submissions that you have completed and provided to us related to the services you inquire about or engage us to perform.
● Indirectly from you. For example, through information we collect from our clients, vendors, or third parties in the course of providing services to you.
● Directly and indirectly from activity on our websites and applications. For example, from submissions through our website portal or website usage details collected automatically.
● From third-party data processors or business partners to provide data driven market insight.
● Publicly available data bases.
Use of Personal Information
indiGO Auto Group may use or disclose the personal information we collect, for either itself or its business partners or associations, for one or more of the following business purposes:
● To fulfill or meet the reason for which the information is provided. For example, if you share your name and contact information while inquiring about our services, requesting information or materials, or ask a question about our products or services, indiGO Auto Group will use that personal information to respond to your inquiry.
● To provide you with information, products or services that you request from us.
● To process your requests, transactions, and payments and prevent transactional fraud.
● To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collections.
● To improve our website and present its contents to you.
● For testing, research, analysis and product development.
● As necessary or appropriate to protect the rights, property or safety of us, our clients or others.
● To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
● As described to you when collecting your personal information or as otherwise set forth in the CCPA.
indiGO Auto Group will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you any required notice.
Sharing Personal Information
indiGO Auto Group may share your personal information to a third party for a business purpose, only when explicitly consented or authorized by you. In the preceding twelve (12) months, we may have shared the following categories of personal information for a business purpose:
Categories:
Category A: Identifiers
Category I: Professional or employment-related information.
We share your personal information for a business purpose to the following categories of third parties:
● Our affiliates.
● Service providers.
● Third parties with whom we partner to offer products and services to you.
Selling Personal Information
In the preceding twelve (12) months, indiGO Auto Group has not sold any personal information.
Your Rights and Choices: You have the right to request that indiGO Auto Group disclose certain information to you about indiGO Auto Group’ collection and use of your personal information over the past 12 months. Once indiGO Auto Group receives and confirms your verifiable consumer request, indiGO Auto Group will disclose to you:
• The categories of personal information indiGO Auto Group collected about you;
• The categories of sources for the personal information indiGO Auto Group collected about you;
• indiGO Auto Group’ business or commercial purpose for collecting or selling that personal information;
• The categories of third parties with whom indiGO Auto Group shares that personal information; or
• The specific pieces of personal information indiGO Auto Group collected about you (also called a data portability request).
You have the right to limit our use of sensitive Information to only the purposes necessary to perform the certain business and commercial purposes described above.
You have the right to correct inaccuracies to your personal information. You may contact us as set forth below to request the correction. We will use commercially reasonable efforts to honor your requests within the limits defined by statute.
Data Retention: For customer data, we generally retain this data for an appropriate period considering the nature of such data and the purposes for which they are processed. Please note that additional retention periods may apply should the data concerned be required to be retained to satisfy our legal or other obligations (such as a pending claim, litigation, law enforcement investigation, government audit or other situation requiring records to be preserved).
Deletion Request Rights: You have the right to request that indiGO Auto Group delete any of your personal information that indiGO Auto Group collected from you and retained, subject to certain exceptions. Once indiGO Auto Group receives and confirms your verifiable consumer request, indiGO Auto Group will delete (and direct our service providers to delete) your personal information from indiGO Auto Group records, unless an exception applies. indiGO Auto Group may deny your deletion request if retaining the information is necessary for indiGO Auto Group or our service providers to:
1. Complete the transaction for which indiGO Auto Group collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of indiGO Auto Group’ ongoing business relationship with you, or otherwise perform indiGO Auto Group’ contract with you.
2. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
3. Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
4. Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 seq.).
5. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
6. Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with indiGO Auto Group.
7. Comply with a legal obligation.
8. Make other internal and lawful uses of that information that are compatible with the context in which you provided it.
Exercising Access, Data Portability, and Deletion Rights: To exercise the access, data portability, and deletion rights described above, please submit a verifiable consumer request to us by:
• Calling us at 877-570-6568;
• Contacting us via this webpage or emailing us at privacy@indigoautogroup.com;
• Mail at the following address:
indiGO Auto Group
Attn: Privacy Department
13911 North Freeway
Houston, TX 77090
Only you or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:
• Provide sufficient information that allows us to reasonably verify you are the person about whom indiGO Auto Group collected personal information or an authorized representative;
• Describe your request with sufficient detail that allows indiGO Auto Group to properly understand, evaluate, and respond to it.
indiGO Auto Group cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Requests must indicate the type of request and be accompanied by your full name, California residential address and email address (if available). If submitted by your authorized agent, the request must include the same details plus evidence of your written permission to submit a request on your behalf. Making a verifiable consumer request does not require you to create an account with us. indiGO Auto Group will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.
Response Timing and Format: indiGO Auto Group endeavors to respond to a verifiable consumer request within 45 days of its receipt. If indiGO Auto Group requires more time (up to 90 days), indiGO Auto Group will inform you of the reason and extension period in writing. If you have an account with indiGO Auto Group, indiGO Auto Group will deliver its written response to that account. If you do not have an account with indiGO Auto Group, indiGO Auto Group will deliver its written response by mail or electronically, at your option. Any disclosures indiGO Auto Group provides will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response indiGO Auto Group provides will also explain the reasons indiGO Auto Group cannot comply with a request, if applicable. For data portability requests, indiGO Auto Group will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance. indiGO Auto Group does not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If indiGO Auto Group determines that the request warrants a fee, indiGO Auto Group will tell you why it made that decision and provide you with a cost estimate before completing your request.
California “Do Not Track” Notice. Unlike some websites, we do not track your website activities over time and across third party websites. For that reason, we do not respond to Do Not Track (DNT) signals.
Non-Discrimination: indiGO Auto Group will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, indiGO Auto Group will not:
• Deny you goods or services;
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;
• Provide you a different level or quality of goods or services; or
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.
Last Updated: January 17, 2025