Privacy Policy

1. Who We Are

Bob Rohrman Collision Repair Center ("we," "us," "our," or the "Shop") is an auto body and collision repair facility located at 3400 National Drive, Lafayette, IN 47905. We are part of the Rohrman Automotive Group, one of the Midwest's largest dealer networks. We operate the website at www.rohrmanbodyshop.com ("Site"), including the Spanish-language version at www.rohrmanbodyshop.com/es/.

This Privacy Policy applies to personal information we collect through the Site and through our in-shop interactions with you. It does not apply to information you provide directly to your insurance carrier, to WreckedLeads (the third-party photo-estimate and appointment-scheduling service whose widget is embedded on our Site), to Carwise (which aggregates the customer reviews displayed on our Reviews page), or to other third parties even if you reach them through links on our Site. Those companies have their own privacy policies that we encourage you to read.

2. Information We Collect

We collect the categories of personal information described below. Some of this is information you give us directly; some is collected automatically when you use the Site; and some we receive from third parties (like your insurance company) when they refer a claim to us.

2a. Information you give us directly

• Identifiers: first and last name, email address, postal address, telephone number, date of birth (if provided for age-verification), and IP address.
• Vehicle information: make, model, year, VIN, license plate, mileage, and photos of damage submitted with an estimate request.
• Insurance and claim information: insurance carrier name, policy number, claim number, deductible, and adjuster contact information.
• Communication content: messages you send through the contact form, in person, by phone, by email, by SMS (if applicable), or through the WreckedLeads photo estimate and appointment scheduling platform embedded on our Site.
• Eligibility information for special programs: for the Purdue Student & Family Program, we may verify Purdue ID, faculty/staff ID, enrollment letter, or @purdue.edu email address.
• Payment information: we do not store credit card numbers on our website. In-shop card payments are processed through our payment terminal provider; bank transfer or insurance direct billing flows through standard banking channels.

2b. Information collected automatically when you visit the Site

• Device and connection information: IP address (which can suggest approximate location), browser type and version, operating system, language preference, time zone, screen resolution, and referring URL.
• Usage information: pages viewed, time spent on each page, scroll depth, links clicked, and search terms used to find the Site.
• Session recordings: Microsoft Clarity records anonymized sessions including mouse movements, clicks, and scrolling patterns to help us identify usability problems. Form input fields are masked by default.
• Cookie data: small text files stored in your browser. See Section 6 for the full cookie inventory.

2c. Information from third parties

• Insurance referrals: when an insurance company refers you to us, they may share your contact information, claim number, vehicle details, and adjuster notes.
• WreckedLeads platform: when you submit an online photo estimate (on our Free Estimate page) or schedule an appointment (on our Book Appointment page) through the WreckedLeads widget embedded on our Site, WreckedLeads collects your submission on our behalf and shares it with us so we can respond. The information shared includes your name, contact details, vehicle details, damage photos, and any notes you provide. WreckedLeads operates the AI-assisted preliminary estimate engine and processes this data as our service provider under a written agreement.
• Review platforms: if you leave a public review on Google, Carwise, SureCritic, or Yelp, that review and its associated profile information becomes visible to us through those platforms' standard merchant tools.

2d. Sensitive information

We do not intentionally collect sensitive personal information as defined under California or Indiana law (e.g., health, racial, religious, or sexual orientation data). If you choose to share information about an injury sustained in an accident in connection with your repair, we will use that information only to coordinate with your insurance company on your behalf.

3. How We Use Your Information

We use the information described above for the following purposes:

• To provide repair services: assess damage, prepare estimates, complete collision repairs, perform ADAS calibration, and return your vehicle in pre-accident condition.
• To communicate with you: respond to inquiries, provide repair status updates, schedule and confirm appointments, deliver completion notifications, and follow up to confirm satisfaction.
• To process insurance claims: coordinate with your insurance carrier, submit estimates and supplements, exchange documentation, and facilitate direct billing.
• To administer special programs: verify eligibility for the Purdue Student & Family Program, deductible payment plans, and similar offerings.
• To improve the Site: understand traffic patterns, identify usability problems, test new features, and measure the effectiveness of our content.
• For legal and safety reasons: comply with applicable laws, respond to lawful requests from law enforcement, prevent fraud, enforce our Terms of Service, and protect the safety of our customers and employees.
• For our internal business operations: staff training, quality control, accounting and tax compliance, and customer service review.

4. How We Share Your Information

We do not sell or rent your personal information to third parties for their own marketing purposes. We share information only in the following circumstances:

4a. Service providers (data processors who work on our behalf)

The following companies process personal information for us under written agreements that limit how they may use that information. We provide these names so you can read their privacy policies if you wish:

Service provider	What they do	Their privacy policy
Google LLC (Google Analytics 4)	Site traffic and behavior analytics	policies.google.com/privacy
Google LLC (Google Ads / Google Marketing Platform)	Conversion tracking and remarketing for our paid search and display advertising. Builds anonymized audiences to show our ads to people who've visited the Site.	policies.google.com/privacy · ads policy
Microsoft Corporation (Clarity)	Anonymized session recordings, heatmaps, click tracking	privacy.microsoft.com
Cloudflare, Inc.	Website hosting (Cloudflare Pages), CDN, edge security and bot management	cloudflare.com/privacypolicy
DEALERPLATEGUY, LLC (d/b/a WreckedLeads)	Embedded photo-estimate widget on our Free Estimate page and embedded appointment-scheduling widget on our Book Appointment page. Receives the name, contact details, vehicle information, damage photos, and notes you submit through the widget, then shares the submission with us.	wreckedleads.com/privacy
Carwise, Inc.	Review aggregation. The verified-reviews widget on our Reviews page pulls our public Carwise review feed. Carwise no longer provides our photo-estimate or appointment-scheduling widgets (that role moved to WreckedLeads in May 2026).	carwise.com/privacy
FormSubmit (formsubmit.co)	Email-relay handler for our Spanish-language contact and estimate forms (forwards submissions to [email protected])	formsubmit.co/privacy
Trustindex.io	Embedded Google reviews widget	trustindex.io/privacy-policy

4b. Insurance carriers

If your repair is covered by insurance, we share with your insurance carrier the documentation required to process the claim: estimates, photos, supplements, parts invoices, and labor records. This sharing is at your authorization — signing a repair authorization with us authorizes this exchange.

4c. Affiliated Rohrman Automotive Group entities

For administrative coordination, we may share limited information (such as customer name and repair status) with other entities in the Rohrman Automotive Group. This sharing is for legitimate operational purposes only, not for the marketing of unrelated products.

4d. Legal and safety

We may disclose personal information to comply with applicable law, respond to lawful subpoenas or court orders, cooperate with law enforcement investigations, defend our legal rights, or protect the safety of our customers, employees, or the public.

4e. Business transfers

If we are involved in a merger, acquisition, sale of all or part of our assets, or other corporate reorganization, personal information may be transferred to the successor entity as part of that transaction. The successor would be bound by the privacy commitments in this Policy or a substantially equivalent successor policy.

5. How Long We Keep Your Information

We retain personal information only as long as we need it for the purposes described in this Policy or as required by law. Specifically:

• Contact form data (name, email, phone, message): 24 months from the last interaction, then deleted unless you have an active or pending repair.
• Repair records (estimates, invoices, photos, parts records, supplemental documentation): 7 years, matching standard IRS recordkeeping and Indiana motor vehicle service-record requirements.
• Damage photos uploaded through online estimate forms: 12 months if no repair proceeds; if a repair does proceed, the photos become part of the repair record retained for 7 years.
• Website analytics data (Google Analytics): 14 months, the default GA4 retention. We do not extend this retention.
• Session recordings (Microsoft Clarity): 30 days, the Clarity default. We do not export or extend this retention.
• Cookies: see Section 6 for individual cookie durations.

You may request earlier deletion of your data — see Section 8 for how. We may retain information beyond these periods if required by a legal hold, ongoing legal claim, or insurance dispute.

6. Cookies and Tracking Technologies

A "cookie" is a small text file placed on your browser by a website. A "web beacon" or "image tag" is a small image file or invisible script that records that a page or email was loaded. We use both, along with similar technologies. Here is what we use them for:

6a. Essential cookies (always on)

Required for the Site to function. We do not give you the option to disable these because the Site would not work without them. These are exempt from consent under GDPR and CCPA because they're required to deliver the service you've requested.

• Session cookies — maintain your visit context (typically deleted when you close your browser).
• Cookie consent preference — remembers your cookie banner choices so we don't ask again on every visit. Stored in your browser's localStorage for 13 months.
• Cloudflare bot-protection cookies (__cf_bm, cf_clearance) — identify automated bots vs. real visitors, required to keep the Site secure and online.
• WreckedLeads widget cookies — loaded on /pages/free-estimate (photo-estimate widget) and /pages/book-appointment (appointment-scheduling widget). The widget loads inside an iframe served from app.wreckedleads.com, so any cookies it sets are first-party to WreckedLeads, not to rohrmanbodyshop.com. Required for the widget to function. WreckedLeads is a separate company (DEALERPLATEGUY, LLC) and its cookies and data handling are governed by the WreckedLeads Privacy Policy.

6b. Analytics cookies (you can opt out)

• Google Analytics 4 — cookies named _ga, _ga_*, and similar. Track aggregate site usage for up to 14 months. Opt out site-wide via our cookie banner, or globally via the Google Analytics Opt-out Browser Add-on.
• Microsoft Clarity — cookies named _clck, _clsk, CLID, MUID, and similar. Used for anonymized session recording for 30 days. Opt out site-wide via our cookie banner, or globally per Microsoft's privacy statement.

6c. Marketing and advertising cookies (you can opt out)

We use Google Ads (also called Google AdWords) for paid search and display advertising. Google Ads sets cookies that allow us to: (i) measure which ads led to conversions on our Site (a contact-form submission, a phone call from a Google ad, etc.), and (ii) build anonymized audiences for remarketing — showing our ads on other sites to people who have already visited rohrmanbodyshop.com. The cookies do not contain your name or contact information; they identify the device or browser only.

• Google Ads conversion & remarketing — cookies named _gcl_au, _gcl_aw, _gac_*, IDE, NID, and similar. These can persist for up to 13 months.
• Opt out site-wide: use our cookie banner (decline Marketing) or click "Privacy Settings" in our footer to change your choice anytime.
• Opt out globally across the web: Google Ads — Google Ads Settings; advertising industry — Network Advertising Initiative opt-out and Digital Advertising Alliance opt-out.

If you decline Marketing cookies in our banner, the Google Ads pixel does not load and no conversion or remarketing data is sent. We may still serve you our ads through Google's broader targeting (location, search terms), but we will not target you based on your past visits to our Site.

Note on California "sharing": California's Consumer Privacy Act defines "sharing" broadly to include cross-context behavioral advertising. The Google Ads remarketing described above qualifies as "sharing" under California law. California residents can opt out using our Your Privacy Choices page or the cookie banner; we will honor the opt-out for both the Site and any Google Ads served from our account that target your device.

6d. Managing your cookie preferences

The cookie banner that appeared on your first visit lets you accept or decline non-essential cookies. You can re-open the preference panel any time using the Privacy Settings link in our footer or by visiting our Your Privacy Choices page. You can also control cookies through your browser settings (typically under Privacy or Security), and you can install browser extensions like Privacy Badger or uBlock Origin for more granular control.

7. Your Privacy Rights

The rights you have depend on where you live. We honor the rights of every visitor to the Site to the extent applicable law allows, regardless of state.

7a. Indiana residents (Indiana Consumer Data Protection Act)

If you are an Indiana resident, the Indiana Consumer Data Protection Act (Ind. Code § 24-15) gives you the following rights, effective January 1, 2026:

• Right to confirm whether we are processing your personal data.
• Right to access the personal data we hold about you.
• Right to correct inaccurate personal data.
• Right to delete personal data we have collected about you, subject to legal retention requirements (e.g., 7-year repair records).
• Right to data portability — obtain a copy of your personal data in a portable, technically feasible format.
• Right to opt out of (i) the sale of personal data, (ii) targeted advertising, and (iii) certain forms of profiling. We do not sell personal data for monetary consideration. We do conduct targeted advertising via Google Ads remarketing — you can opt out using our cookie banner, our Your Privacy Choices page, or by following the global opt-out instructions in Section 6c. We do not perform automated profiling that produces legal or similarly significant effects.
• Right to appeal our refusal of a request — see Section 8.

To exercise any of these rights, contact us using the information in Section 13. We will respond within 45 days; if your request requires more time, we will explain why and may extend by an additional 45 days.

7b. California residents (CCPA / CPRA) and Nevada residents (SB 220)

If you are a California or Nevada resident, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act ("CCPA") and Nevada Senate Bill 220 give you rights similar to those above, plus:

• Right to know the categories and specific pieces of personal information we have collected, used, or shared in the preceding 12 months.
• Right to opt out of "sale" or "sharing" of personal information. Use the Your Privacy Choices page to submit an opt-out request. We do not sell personal information for monetary consideration; some uses of analytics cookies may meet California's broader definition of "sharing," and we honor opt-outs for those uses.
• Right to non-discrimination for exercising any of these rights. We will not deny goods or services, charge different prices, or provide a different level of quality because you exercised a privacy right.
• Right to limit use of sensitive personal information. We do not use your sensitive personal information beyond what is necessary to provide the services you request.

7c. EU / EEA / UK residents (GDPR / UK GDPR)

If you are in the European Union, European Economic Area, or United Kingdom, the General Data Protection Regulation gives you rights of access, rectification, erasure, restriction, data portability, objection, and the right to lodge a complaint with your supervisory authority. We rely on the lawful bases of contract performance (when you request services), legitimate interests (when we improve the Site), and consent (when you accept analytics cookies).

8. How to Exercise Your Rights

To make a privacy request — access, correction, deletion, portability, opt-out, or appeal of a denial — contact us using one of the following methods:

• Email: [email protected] with the subject line "Privacy Request"
• Mail: Privacy Request, Bob Rohrman Collision Repair Center, 3400 National Drive, Lafayette, IN 47905
• Phone: (765) 448-1100 — ask for the General Manager

To protect your privacy, we will verify your identity before responding. For most requests we will ask you to confirm two pieces of information already on file with us (e.g., the email and phone number on a recent estimate). If you authorize someone else to act on your behalf, we will need written authorization and may verify the authorized agent's identity.

Response timeline: we will respond within 45 days of a verifiable request. If we need an additional 45 days, we will explain why before the original deadline expires.

Appeals: if we deny your request, you may appeal by replying to our denial email within 30 days. Appeals are reviewed by a different person than the original responder. If your appeal is denied, you may contact the Indiana Attorney General at in.gov/attorneygeneral, the California Privacy Protection Agency at cppa.ca.gov, or your state attorney general.

9. Email and SMS Communications

9a. Email

We may send you transactional emails about a repair you've requested or scheduled (estimate confirmations, status updates, completion notifications, quality-follow-up messages). We comply with the federal CAN-SPAM Act: every commercial email we send identifies us as the sender, includes our physical address, and provides a clear unsubscribe link. To stop all marketing emails immediately, click "unsubscribe" in any email or email [email protected].

9b. SMS / text messaging

We do not currently send SMS or text-message marketing. If we begin offering text-based appointment confirmations or status updates in the future, we will obtain your prior express written consent under the federal Telephone Consumer Protection Act (TCPA) before texting you. You will see explicit opt-in language at the point of collection and instructions to reply STOP to opt out at any time. Standard message and data rates from your wireless carrier may apply.

10. Data Security and Breach Notification

10a. How we protect your information

We use commercially reasonable administrative, technical, and physical safeguards to protect personal information. These include access controls limiting who can view repair records, encryption-in-transit (TLS) for the website and email, secure backups, and staff training on privacy and information security. The Site is hosted on Cloudflare's enterprise edge network with built-in DDoS protection and Web Application Firewall.

No system is perfectly secure, however. Despite our safeguards, we cannot guarantee absolute security of information transmitted to or stored by us.

10b. Data breach notification

If we discover a security incident that affects your personal information, we will investigate promptly, take steps to contain and remediate the incident, and provide notification to affected individuals and the Indiana Attorney General as required under the Indiana Disclosure of Security Breach Act (IC 24-4.9). Notification will occur as soon as reasonably possible after we determine the scope of the incident and identify affected individuals.

11. Children's Privacy

Our Site is not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will delete it. Parents or guardians who believe a child under 13 has submitted personal information to us may contact us at [email protected].

For visitors aged 13 to 17, our Site is not designed to market to minors. Although we do not block teen visitors, we encourage anyone under 18 to involve a parent or guardian before submitting personal information to us. The Purdue Student & Family Program is open to current Purdue University students and their immediate families; participants under 18 should have parental involvement when scheduling a repair.

12. AI / Machine Learning and Site Content

Public Site content (blog articles, service descriptions, business hours, address, FAQ answers) may be accessed, indexed, summarized, or used by AI assistants (such as ChatGPT, Claude, Perplexity, or Gemini) and search engines to answer questions about our business. We currently allow such access — this helps customers find accurate information about us. We do not provide your personal information (e.g., contact form submissions, repair records, damage photos) to AI training providers.

13. Third-Party Sites and Services

The Site contains links to and embeds from third-party websites and services that we do not control, including WreckedLeads (photo-estimate and appointment-scheduling widget), Carwise (review aggregation), Google Maps, our parent company's website (rohrman.com), and social media platforms. This Privacy Policy does not apply to those third-party properties. We encourage you to read their privacy policies before sharing personal information with them.

14. International Visitors

The Site is operated from the United States. If you visit from outside the U.S., you should be aware that your information may be transferred to, stored, and processed in the United States. By using the Site, you consent to that transfer. For visitors in the European Union, European Economic Area, or United Kingdom, the legal bases for transfers are described in Section 7c.

15. California "Shine the Light" Law

California Civil Code § 1798.83 permits California residents to request, once a year, certain information about disclosures of personal information to third parties for direct marketing purposes. We do not share personal information with third parties for their own direct marketing purposes, so we have no such disclosures to report.

16. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, services, or applicable law. When we update it, we will:

• Update the "Last Updated" and "Effective Date" at the top of this page.
• Add an entry to the version history at the bottom of this page describing what changed.
• If the change is material (a new category of data processed, a new third-party recipient, or a change that reduces your privacy rights), provide at least 30 days' prior notice via a banner on the Site or, where required by law, by direct contact.

Your continued use of the Site after a Privacy Policy update means you accept the updated terms.

17. Contact Us

For privacy questions, requests, or complaints, contact our designated privacy contact:

• Bob Rohrman Collision Repair Center — Privacy Office
• Attn: General Manager
• 3400 National Drive, Lafayette, IN 47905
• Email: [email protected]
• Phone: (765) 448-1100
• Hours: Monday–Friday 7:30 AM – 5:00 PM Eastern

For California-specific opt-out requests, you can also use our Your Privacy Choices page.

18. Version History

• May 15, 2026: Added WreckedLeads (DEALERPLATEGUY, LLC) as a service provider for the embedded photo-estimate and appointment-scheduling widgets. Narrowed the Carwise entry to review aggregation only (the photo-estimate and scheduling roles moved to WreckedLeads). Updated cookie disclosure to reflect that both /pages/free-estimate and /pages/book-appointment now load the WreckedLeads iframe.
• April 29, 2026: Comprehensive rewrite. Added Indiana Consumer Data Protection Act section, full third-party service-provider table (named Microsoft Clarity, Cloudflare, formsubmit.co, Trustindex), specific data retention periods per category, SMS placeholder language, data breach notification commitment, AI training disclosure, expanded children's privacy section, version history. Effective date set to publication date.
• April 2026 (prior): Initial site privacy policy at relaunch.

This Privacy Policy is published in English. A Spanish-language translation is available at www.rohrmanbodyshop.com/es/pages/privacidad. In case of any conflict between the English and Spanish versions, the English version controls for purposes of U.S. legal compliance.