Every dealer needs a good Dealer Management System (DMS) to help run an efficient and profitable business.
By necessity, dealers trust DMS providers with some of their most sensitive data. But are dealers paying attention to what DMS providers can do with their data? In reviewing several sets of terms and conditions with DMS providers, we learned that some DMS providers adopt a fairly traditional software provider approach of agreeing to implement reasonable data security measures along with confidentiality commitments to only use your data for other purposes if that data is anonymized and aggregated. Other DMS providers appear to provide very little information about data security and have very few terms relating to use of a dealer’s information for other purposes.
This analysis included a review of multiple DMS providers owned by Constellation Software and revealed that Constellation Software terms and conditions have included significantly different (and concerning) terms relating to their authorized use of a dealer’s information. Constellation Software is a publicly-traded company that has acquired many DMS providers offering products and services to equipment dealers. These providers include the following brands: c-Systems, Catalyst, Charter, DIS, Ibcos, Ideal, IDS and Paulson Computer Systems. The privacy policies and terms and conditions for the brands reviewed are generally similar and most of the key terms are set forth in a document referred to as their General Terms and Conditions or “GTCs” with brand specific versions. While these terms and conditions state that data may be anonymized by removing references to “individual natural persons”, the GTCs specifically indicated that:
- Constellation claims ownership over all DeIdentified Data, which is misleadingly defined to include information that is still IDENTIFIABLE to any specific business or entity.
- Constellation can use and disclose such information for any business purpose, even if it is still identifiable to a specific business or entity.