Toma procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Toma's infrastructure and support teams are located in the United States. The Services are intended for use within the United States. We do not intentionally market to or knowingly collect data from residents of the European Economic Area (EEA) or the United Kingdom. If you are located outside the United States and choose to use the Services, you understand that your information will be transferred to and processed in the United States, where data-protection laws may differ from those in your jurisdiction.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Automatically collected data (usage data, cookies) is retained for up to twenty-four (24) months.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Right to delete: You may request that we delete personal information we have collected from you, subject to certain exceptions. Upon receiving a verified deletion request, we will also instruct our service providers and sub-processors to delete the relevant information.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Specifically:” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Web Chat conversations and associated contact information are retained for up to thirty-six (36) months from the date of the interaction, or longer if required by the applicable dealer's data-retention requirements or applicable law.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ After the applicable retention period, personal information is deleted or de-identified in accordance with our data-retention policies.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Dealer User account information is retained for the duration of the dealer's active subscription and for a reasonable period thereafter for legal and business purposes.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ When we receive a verified deletion request (either directly from a consumer or forwarded by the applicable dealer), we will delete the relevant personal information from our systems and instruct our service providers and sub-processors to delete that information as well, unless retention is required by applicable law or falls within a recognized exception.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We share information with trusted third-party service providers who perform services on our behalf, such as cloud hosting (e.g., AWS), analytics, SMS delivery, telephony, and customer support. These providers are contractually obligated to use your information only for the purposes of providing services to Toma and to maintain appropriate security measures.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Dealer operations: sharing Chat User information with the applicable dealer for customer relationship management, sales follow-up, and service operations” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ For Dealer Users and at the dealer's direction, we may share information with the dealer's DMS, CRM, OEM systems, or other integrated platforms to support the dealer's business operations.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ When you interact with the Web Chat on a dealer's website, your contact information, vehicle interest, conversation transcript, and related data are shared with that dealer for the purposes of customer service, sales follow-up, and dealer operations. The dealer is the data controller with respect to personal information collected through the Web Chat on its website. You should review the dealer's own privacy policy for information about how the dealer processes your data.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ If Toma is involved in a merger, acquisition, reorganization, sale of assets, or bankruptcy, your information may be transferred as part of that transaction. We will provide notice if your information becomes subject to a different privacy policy.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We may receive information from third-party sources, including dealer management systems (DMS), customer relationship management (CRM) platforms, OEM systems, and data providers that dealers integrate with the Toma platform. This may include vehicle inventory data, customer records (where the dealer has obtained appropriate consent), and transaction history.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ With respect to personal information collected from Chat Users through the Web Chat embedded on a dealer's website, the dealer (not Toma) acts as the data controller. Toma processes this personal information on behalf of, and at the direction of, the applicable dealer as a service provider (or "processor"). As a service provider under the CCPA/CPRA, Toma is contractually prohibited from retaining, using, or disclosing Chat User personal information for any purpose other than the specific business purposes set forth in our agreement with the dealer, or outside the direct business relationship between Toma and the dealer. Toma does not combine Chat User personal information received from one dealer with personal information received from other dealers or from other sources, except as permitted by applicable law. Dealers are responsible for complying with all applicable data-privacy and data-protection laws, including providing required notices and obtaining required consents from Chat Users. Chat Users should refer to the privacy policy of the applicable dealer to understand how their personal information is processed by the dealer.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ The Site may link to third-party sites. Toma is not responsible for their content, privacy practices, or availability.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We may disclose information if we believe in good faith that disclosure is necessary to: (a) comply with applicable law, regulation, legal process, or governmental request; (b) enforce our Terms of Service; (c) detect, prevent, or address fraud, security, or technical issues; or (d) protect the rights, property, or safety of Toma, our users, or the public.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Where Toma acts as a service provider on behalf of a dealer with respect to Chat User data, consumers should direct rights requests to the applicable dealer, who will coordinate with Toma to fulfill the request. Toma will assist the dealer in responding to verified consumer requests in accordance with our contractual obligations and applicable law.” | Captured 2026-09-25Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.