Privacy Policy

Great Little Cars(“we,” “us,” or “our”) is a used car dealership based inSanta Fe, NM. We take your privacy seriously. This policy explains what information we collect, how we use it, who we share it with, and the choices you have. We try to keep this in plain English. If anything is unclear, call us or email us — our contact details are at the bottom of this page.

Because we offer vehicle financing and related services, we are a “financial institution” under the federal Gramm-Leach-Bliley Act (GLBA). We are also subject to the New Mexico Data Breach Notification Act and, where applicable, the California Consumer Privacy Act (CCPA).

Information We Collect

The information we collect depends on how you interact with us. We collect information directly from you, automatically through our website, and in some cases from third parties.

Directly from you

• Contact details: name, email address, phone number, mailing address.
• Identity and licensing details: date of birth, driver's license number and image of your license.
• Financial details used for credit decisions: Social Security number, employment, income, housing, and other details required on a credit application.
• Insurance details: proof of auto insurance.
• Proof of address: a recent utility bill, lease, or bank statement when needed to close a deal.
• Vehicle and transaction details: vehicles you browse, save, or deposit on; trade-in information; deposits and payments; deal paperwork.
• Messages you send us through the site, email, text, or in person.

Automatically, when you use the site

• A device identifier we generate and store in your browser so we can recognize returning visitors and resume your saved searches and favorites. This is not a third-party advertising cookie.
• Basic activity data: pages viewed, vehicles viewed, time on page, referring site, approximate location inferred from your IP address, and general device information such as browser and operating system.
• Server and security logs used to detect abuse, debug problems, and audit access to sensitive records.

We do not use Google Analytics or third-party advertising trackers on this site. Our analytics are first-party only and are used to understand what cars people are interested in so we can do our job better.

From third parties

• Credit bureaus and lenders, when you submit a credit application and we pull a credit report or receive a lender decision.
• Vehicle history providers, when we decode a VIN or pull a history report on a car you are buying or trading in.
• Title and payoff services, when we verify a lien or payoff on a trade-in.

How We Use Your Information

• To sell you a vehicle and complete the paperwork.
• To process credit applications, obtain credit reports, and submit your application to lenders on your behalf.
• To request missing documents (ID, insurance, proof of address) when your deal is active and needs them to move forward.
• To send a one-time magic link by text message when you ask to sign in.
• To follow up on inquiries, test drives, trade-in appraisals, and deposits.
• To keep required business records and comply with tax, title, and licensing laws.
• To secure our systems, prevent fraud, and enforce our terms.

Financial Information and Credit Applications (GLBA)

When you submit a credit application, you are giving us permission to collect financial information about you and to share it with credit bureaus, credit unions, banks, and other lenders so they can make a credit decision on your loan. We only share what is reasonably needed for that decision. This sharing is a normal and necessary part of financing a vehicle.

We do not sell your personal or financial information to anyone, and we do not share it with third parties for their own marketing purposes.

Under federal law, you have the right to limit some sharing of your financial information. Because we do not share your information for marketing or joint marketing purposes, there is nothing for you to opt out of in that regard. Sharing that is necessary to process your credit application or service your account cannot be limited by law.

If you would like a copy of our standalone GLBA Privacy Notice, contact us using the details below and we will provide one.

How We Protect Your Information (Security)

• Social Security numbers are encrypted at rest using AES-256-GCM authenticated encryption. They are never stored in plain text.
• Access to sensitive records (SSN, driver's license images, financial documents) is limited to the employees who need it to work your deal, and every access is logged.
• All traffic to the site is protected in transit with HTTPS.
• We use role-based access controls, audit logs, and routine security reviews on the systems that hold your information.

No system is 100% secure. If something goes wrong, see the breach-notification section below.

Data Retention

• Social Security numbers are automatically purged from our systems 30 days after your credit application is decisioned, regardless of outcome. We keep your application record; we do not keep your SSN past that window.
• Driver's license images, insurance documents, and proof-of-address documents are retained for the duration of your deal and for the regulatory retention period required of New Mexico dealers afterward.
• Deal and transaction records (contracts, titles, tax records) are retained for the period required by federal and New Mexico state law.
• Account, messaging, and analytics datais retained only as long as needed for the purposes described above. You may request deletion at any time — see “Your Rights” below.

Text Messages (SMS)

Our use of SMS is narrow and customer-initiated. You will not receive marketing texts from us. Specifically:

• Document requests. When you have an active deal with us and we still need a piece of paperwork from you (ID, proof of insurance, proof of address), we may text you to let you know and give you a link to upload it.
• Magic-link sign-in. When you ask to sign in, we send you a one-time sign-in link by text. The link is good for seven days. We do this so you do not have to remember a password.

We do not send marketing texts, price-drop alerts, drip campaigns, or automated chat replies. If that ever changes, we will update this policy and obtain your consent separately before sending that kind of message.

Standard message and data rates from your wireless carrier may apply. Message frequency varies based on your deal activity. Reply STOP to any text to unsubscribe from further messages from that sender; reply HELP to get help, or contact us directly. Opting out of document-request texts does not opt you out of magic-link sign-in texts that you request yourself.

Our SMS messaging is sent over an A2P 10DLC-registered campaign with our messaging provider. Mobile information, including phone numbers and opt-in status, is not shared with third parties or affiliates for marketing purposes.

Cookies and First-Party Tracking

We use strictly necessary cookies to keep you signed in and to remember your preferences. We also generate a random “device ID” and store it in your browser the first time you visit. This ID lets us:

• Show you the cars you were looking at last time when you come back.
• Tie your saved searches, favorites, and test-drive requests to your session before you have an account.
• Score interest internally so our team knows which customers would benefit from a call or email.

The device ID does not contain personal information on its own and it is not shared with third parties. You can clear it at any time by clearing your browser storage.

Who We Share Information With

• Lenders and credit bureaus, when you submit a credit application.
• Title, registration, and DMV services, as required to title and register the vehicle.
• Service providers that power our site and operations (hosting, SMS delivery, payment processing, email delivery, document storage). These providers are bound by contract to use your information only to provide services to us.
• Legal and safety, when we are required to disclose information by law, subpoena, or to protect the rights, property, or safety of our customers, our employees, or the public.
• A successor business, in the event of a merger, acquisition, or sale of assets. We would notify affected customers in that situation.

We do not sell your information, and we do not share it with third parties for their own marketing.

Your Rights

You have the right to:

• Access the personal information we have about you.
• Correct information that is wrong or out of date.
• Delete your personal information, subject to records we are required by law to keep (for example, signed contracts and tax records).
• Obtain a portable copy of your information, where reasonably practical.
• Withdraw consent for communications that depend on your consent.

To exercise any of these rights, contact us at info@greatlittlecars.com or call 5059928122. We may need to verify your identity before acting on your request.

California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act as amended: the right to know what personal information we collect, use, disclose, and (where applicable) sell or share; the right to delete; the right to correct; the right to limit the use of sensitive personal information; and the right not to be discriminated against for exercising your rights. We do not sell or share your personal information for cross-context behavioral advertising. To exercise these rights, contact us at info@greatlittlecars.com.

New Mexico Data Breach Notification

In the unlikely event of a security breach that exposes your unencrypted personal identifying information, we will notify you in accordance with the New Mexico Data Breach Notification Act (NMSA 1978, §§ 57-12C-1 to -11). Notice will be provided within forty-five (45) calendar days of discovery of the breach, unless a shorter period is required by law, and will describe the nature of the breach, the types of information involved, what we are doing in response, and steps you can take to protect yourself. We will also notify the New Mexico Attorney General and major consumer reporting agencies where required.

Children's Privacy

Our site is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with information, please contact us and we will delete it.

Changes to This Policy

We may update this policy from time to time. When we do, we will update the “Last updated” date at the top of the page. If the change is significant — for example, a new category of data collection or a new purpose for SMS — we will post a notice on the homepage and, where we have your contact details and it is appropriate, notify you by email.

Contact Us

For privacy questions or to exercise your rights, contact: