Privacy Policy

1. Who we are

Regio Systems, LLC, doing business as Regio Title ("Regio", "we", "us"), is a New Jersey limited liability company that operates a business-to-business titling and registration service for licensed motor-vehicle dealers in the United States. To the extent Regio is regulated as a "financial institution" under the Gramm-Leach-Bliley Act (GLBA), it functions as a third-party service provider to dealerships that arrange consumer financing and this Privacy Policy is intended to comply with GLBA.

Regio's principal place of business is in New Jersey. Regio does not currently process personal information outside of the United States.

2. Scope of this Privacy Policy

This Privacy Policy describes how Regio collects, uses, shares, retains, and protects personal information in connection with its dealer-facing titling and registration services, including: the dealer portal at dashboard.regiotitle.com; the administrative clerk workbench at admin.regiotitle.com (used by Regio employees, not customers); the public website at regiotitle.com; and any related service, application, or communication that links to this Privacy Policy.

This Privacy Policy does not apply to: the privacy practices of dealers, financial institutions, lenders, insurers, state departments of motor vehicles, or any other third party with whom a consumer separately transacts; any data processing performed by a dealer's own systems before the dealer transmits information to Regio; or any data processing performed by a state department of motor vehicles after Regio submits a title or registration application on the dealer's behalf. You should review the privacy notices of third parties to the extent you have questions about their own practices.

3. The data subjects whose information we receive

Regio's services are delivered to dealers, not directly to end consumers. The personal information we receive concerns three categories of natural persons: Consumers — end purchasers, lessees, or transferees of motor vehicles for whom a dealer engages Regio to obtain title and registration in the consumer's destination state; Dealer signers and dealer-portal users — individuals associated with our dealer customers who sign service agreements, authorize ACH debits, or access the dealer portal; Website visitors — individuals who visit regiotitle.com for general information about the service.

4. Information we collect

4.1 Information about consumers (received from dealers)

When a dealer submits a deal to Regio for titling and registration, the dealer may transmit the following categories of consumer nonpublic personal information ("NPI") to Regio: full legal name, date of birth, and residential address; driver's license number and state of issuance; Social Security number, where the destination state's title or registration application requires it; vehicle purchase or lease terms, including price, fees, trade-in details, financing terms, and loan amount; lienholder name, address, and account or loan identifier; co-buyer or co-lessee information of the same categories above, where applicable; scanned copies of supporting documents required for titling and registration; and power of attorney executed by the consumer authorizing the dealer or Regio to act on the consumer's behalf with the state titling authority.

Regio receives this information from the dealer; Regio does not collect it directly from the consumer. The consumer's relationship is with the dealer, and the dealer is responsible for providing the consumer with any disclosures or consents that may be required by applicable law.

4.2 Information about dealer signers and dealer-portal users

In the course of onboarding a dealership as a customer and operating that dealership's account, Regio may collect: business identity of the dealership (legal name, trade name, state(s) of licensure, address, federal employer identification number); identifying information about the authorized signer (name, title, business email, business phone); identifying information about additional dealer-portal users (name, business email, role); authentication information for dealer-portal accounts; and the dealership's business bank account for ACH debits, connected and verified through a third-party bank-account verification service at onboarding. Regio retains only a tokenized payment-method reference plus the bank name and last four digits — not the full account or routing number.

4.3 Information from website visitors

Visitors to regiotitle.com are not required to provide personal information to view the site. The site uses cookies necessary for operation and security, and a third-party analytics and lead-management service that sets its own cookies to track page views, returning visits, and form interactions. This service does not receive consumers' nonpublic personal information; it processes only website visitor behavior and any contact information voluntarily submitted through the site's forms. The site does not deploy third-party advertising trackers or behavioral advertising pixels. Server logs capture standard request metadata (IP address, requested URL, user agent, timestamp) for operational and security purposes and are retained according to the schedule in §8 below.

5. How we use the information we receive

Regio uses the personal information received from dealers and dealer users only for the purposes for which the dealer engages Regio: preparing, completing, and submitting state-required title and registration applications and supporting forms; computing taxes, fees, and other amounts collected by the destination state; performing automated and human-review quality checks on dealer-uploaded documents; communicating with the dealer about the status of the deal; communicating with the destination state titling authority as required; maintaining audit records of access to NPI; billing the dealership for service fees and remitting state fees and taxes; detecting, investigating, and responding to security incidents and suspected fraud; and complying with Regio's own legal, regulatory, and contractual obligations.

Regio does not use consumer NPI for marketing to consumers, for behavioral advertising, for training of artificial-intelligence models, or for sale or rental to any third party.

6. Sharing of information

6.1 With the destination state titling authority. Regio submits title and registration applications, supporting documents, and associated taxes and fees to the state department of motor vehicles, county clerk, or equivalent titling authority in the consumer's destination state, as necessary to perform the service the dealer engaged Regio to perform.

6.2 With the dealer. The dealer that submitted the deal can view, through the dealer portal, the information submitted, the documents uploaded, the quote and fee breakdown, and the status of the application.

6.3 With sub-processors. Regio engages a limited set of third-party service providers ("sub-processors") to perform specific operational functions on Regio's behalf, under written agreements requiring appropriate safeguards. The current list of sub-processors is maintained in Regio's Sub-Processor Schedule, which is available to dealers on request. Material additions of sub-processors that will process NPI are announced to active dealers as provided in the Sub-Processor Schedule.

6.4 With financial institutions, lienholders, and insurers. Where the consumer's transaction involves a financial institution, lienholder, or insurer, Regio may communicate with that party as necessary to verify lien status, request lien releases, or complete the title transfer, sharing only the information necessary for the specific communication.

6.5 In legal or regulatory contexts. Regio may share personal information when reasonably necessary to comply with legal process, cooperate with law enforcement, respond to a regulatory inquiry, establish or defend a legal claim, or protect the rights, property, or safety of Regio, our dealers, our dealers' customers, or the public.

6.6 In connection with a corporate sale or transaction. In a transaction involving all or a portion of Regio's business or assets, your personal information may be shared with a third-party purchaser and/or advisors in connection with the evaluation and consummation of the transaction.

6.7 What we do not do. Regio does not sell personal information. Regio does not share personal information with third parties for those parties' own marketing or advertising purposes. Regio does not engage in cross-context behavioral advertising. Regio does not share personal information with data brokers.

7. How we protect the information we receive

Regio maintains a written Information Security Program designed to meet the elements of the industry and legal standards, including the GLBA Safeguards Rule (16 CFR 314.4), documented in full in Regio's Information Security Policy ("ISP"). At a high level: encryption in transit (HTTPS/TLS 1.2/1.3 across public-facing endpoints); encryption at rest (Azure Managed Disk SSE, plus application-layer encryption for dealer-uploaded NPI documents); access control and multi-factor authentication; audit logging of every NPI access; vulnerability management with severity-based remediation SLOs; encrypted backups and a documented disaster-recovery plan; and a documented incident-response plan with defined detection, containment, eradication, notification, and post-incident review phases.

No information-security program can guarantee perfect protection against every threat. Regio's program is designed to provide reasonable safeguards appropriate to the sensitivity of the information processed.

8. Retention and disposal

Regio retains personal information only as long as necessary for the purposes for which it was collected, except where a longer period is required or permitted by law. The retention schedule applied by Regio's nightly automated disposal process: completed deal records and uploaded documents — 5 years from completion; quote-only records that never became deals — 1 year from creation; multi-factor authentication codes — on expiration or first use; device-trust tokens — on expiration; NPI access audit log — 7 years. Disposal actions are themselves logged for the lifetime of the audit retention period.

9. Your privacy rights

The rights you have with respect to personal information about you depend on the state in which you reside and the nature of your relationship with Regio.

Important: If you are a dealer's customer, you will need to contact the dealer directly if you want to exercise your privacy rights.

To the extent you are a current or former employee of a dealer with whom we have interacted, the following rights are available subject to verification of identity.

9.1 Rights available to consumers under state law. Subject to verification of identity and applicable statutory exceptions, you may have the right to: know what categories of personal information Regio has received about you, the sources, the purposes, the categories of third parties with whom it is shared, and the specific pieces of information held; correct inaccurate personal information; delete personal information, subject to legal/regulatory/audit-trail/contractual retention exceptions; receive a portable copy of information you provided; opt out of any sale or sharing for cross-context behavioral advertising or significant-effect profiling (Regio does not engage in these activities); and be free from retaliation or discrimination for exercising your rights. You also have the right to appeal any decision we make about your privacy rights. Rights vary by state; however, Regio honors verified requests from residents of any U.S. state.

9.2 How to submit a privacy-rights request. Requests may be submitted to Regio at the contact information in §13. A request should identify the requester, the right being exercised, and sufficient detail to locate the requester's information (typically the dealership, approximate transaction date, and VIN). Regio may request additional verification information and reserves the right to deny unverifiable or statutorily-excepted requests. Regio will respond within the time required by applicable state law (typically 45 days, extendable once where reasonably necessary).

9.3 Authorized agents. Where permitted by applicable law, you may designate an authorized agent to submit a request on your behalf, subject to written authorization and identity-verification requirements.

10. GLBA framework: the dealer's privacy notice and Regio's role

Where Regio receives consumer NPI in the course of providing services to a dealer that arranges consumer financing, to the extent applicable, Regio is a "service provider" to the dealer under the GLBA Safeguards Rule and Privacy Rule. Where GLBA applies, the dealer is the "financial institution" with the direct consumer relationship and is responsible for providing the consumer with the dealer's own initial and annual GLBA privacy notices. Regio uses the consumer NPI it receives only for the purpose for which the dealer disclosed it and for the limited additional purposes permitted by the GLBA Privacy Rule (16 CFR 313.13–313.15) without further notice to the consumer.

11. Cookies and similar technologies

The dealer portal and administrative portal use session cookies necessary for authentication and security (flagged Secure, HttpOnly, and SameSite=Lax; not used for cross-site tracking). The public website at regiotitle.com uses cookies necessary for operation and security, along with cookies set by a third-party analytics and lead-management service to track page views, returning visits, and form interactions, as described in §4.3; it does not deploy third-party advertising trackers or behavioral advertising pixels. Regio does not respond to "Do Not Track" browser signals because no industry consensus exists on the meaning of that signal in our service context.

12. International data transfers

Regio's services are operated in the United States. Personal information processed by Regio is stored and processed on infrastructure located in the United States. Regio does not currently offer its services to dealers or consumers outside the United States.

13. How to contact Regio about privacy

Privacy-rights requests, privacy questions, or questions about this Privacy Policy: support@regiotitle.com.

14. Changes to this Privacy Policy

Regio may update this Privacy Policy from time to time. The current version is always available at this path and, in some cases, may be announced through the dealer portal before the change takes effect, except where a shorter period is necessary to address an urgent legal or security requirement.