The Dealer Data Addendum
Eight clauses every dealership should require from a DMS, CRM, or any vendor that holds your data. Free to use. No form, no email, no gate.
Most dealers have never read the data section of their own vendor contracts. It is usually three paragraphs, and it decides whether you can get your own records out, in what format, at what cost, and whether you can ever switch systems.
Ownership is the wrong frame. Data is not property under American law and facts are not copyrightable, so there is no deed to hand anyone. What a dealership actually has is whatever access, export, and use rights its contracts grant. That is why this page is contract language rather than an argument.
Before negotiating, sort every sentence of your data clause into a right (the vendor shall provide) or a favor (the vendor may provide, subject to availability, or in accordance with then-current policies). The number of favors is your real position.
Your leverage peaks before you sign and again 120 to 180 days before renewal. Send the addendum to contracts or legal rather than your account executive, and attach the identical addendum to every technology agreement so it reads as policy rather than accusation.
Most of this language already exists in law. Arizona's dealer data statute bars a DMS or CRM provider from limiting a dealer's ability to protect, store, copy, share, or use their own system data by contract or by technical means, requires all fields to be accessible, and caps fees at the direct cost of providing access. Oregon, Montana, and North Carolina have their own versions, and North Carolina requires annual disclosure of third parties that received dealer data. Confirm current statutory text with counsel.
This is not legal advice. QoreAI sells data infrastructure to dealerships and benefits if dealers decide their data is worth controlling. The page is ungated anyway, and every clause here is enforceable against us too.
- Clause 1 (tier one) — Define dealer data broadly: All data entered into, generated by, or derived from your operations, including records the vendor creates about your operations.
- Clause 2 (tier one) — Export right: Complete export. All fields. Documented machine-readable format. At a frequency you designate and no less than daily. At no charge beyond the direct cost of provision.
- Clause 3 (tier one) — No defeat by other means: The vendor will not restrict access by contract, technical measure, rate limiting, endpoint deprecation, or by requiring your chosen integration partner to join a paid program.
- Clause 4 (tier one) — Termination delivery: On termination for any reason: complete export in machine-readable format within a stated number of days, continued read access for a stated period after termination, at a stated cost, followed by certified deletion.
- Clause 5 (tier two) — Permitted use, running the other direction: The vendor may use your data only to provide the contracted services. Any aggregation, anonymization, model training, benchmarking product, derived data product, or disclosure to an OEM or third party requires your separate written consent.
- Clause 6 (tier two) — Your choice of integrator: You may designate third parties to access your data on your behalf. Their access is not conditioned on that party paying the vendor for the privilege.
- Clause 7 (tier two) — No unilateral change: Strike every instance of then-current policies, then-current documentation, and then-current program terms. Pin the terms to the version in effect at signing. Amendments in writing, signed by both parties.
- Clause 8 (tier two) — Transparency: An annual written list of every third party that received your data, what they received, and when.
Frequently asked questions
Who owns dealership data?
The honest answer is that ownership is the wrong frame. Data is not property under American law and facts are not copyrightable, so there is no deed to point at. What a dealership actually has is whatever access, export, and use rights its contracts grant. Several states have passed dealer data laws that grant statutory rights on top of contract, but outside those states the contract is the whole story.
Can my DMS provider charge me to access my own data?
Under most contracts, yes. Under the dealer data laws in Arizona, Oregon, Montana, and North Carolina, fees are limited to the direct cost of providing access, which is meaningfully different from a certification program fee or a per-record charge. Outside those states you would need the cap written into your agreement.
Can a DMS provider block a third-party integration I have authorized?
Under a standard agreement, generally yes, including by requiring your integration partner to pay for certification. The dealer data laws in several states prohibit conditioning your access on a third party's participation in a paid program. This is what clause 3 and clause 6 above are for.
Can my vendor use my dealership data to train AI models?
Check your permitted use language. Most agreements grant broad rights to aggregate, anonymize, and build derived products, including models, and most dealers signed that without negotiating it. Clause 5 above is the fix.
What happens to my data if I switch DMS providers?
Whatever your termination clause says, and most termination clauses are thin. Look for the format you receive, the deadline for delivery, how long you retain read access, the cost, and the vendor's deletion obligation. If your agreement is silent on any of those, assume the answer is unfavorable. This is clause 4.
Why is my vendor eliminating automated reporting?
The stated reasons are usually security and platform modernization, and the security concern is often real. The test is what replaces it. A security-driven change produces an encrypted, authenticated, field-scoped export at the same cost. If the replacement is view-only, or costs money it did not cost before, the driver was not security.
Is dealership data protected by state law?
In some states. Arizona, Oregon, Montana, and North Carolina have dealer data statutes that grant access and use rights and limit what a DMS provider can restrict. Comprehensive consumer privacy laws in many other states govern consumer personal data but do not address the dealer-versus-vendor access question. Confirm current law with counsel.
What should be in a DMS contract data clause?
At minimum: a broad definition of dealer data, a guaranteed export right covering all fields in a machine-readable format at a frequency you set, a prohibition on defeating that right through technical means, and a termination delivery obligation. The eight clauses above cover those plus permitted use, integrator choice, protection against unilateral change, and third-party transparency.