Last Modified: 4th May 2022

Overview

UMO® is a registered trademark of Cubic Corporation in the United States.

This Privacy Policy applies to UMO®, a division of Cubic Transportation Systems, Inc. and all associated brands including Delerrok and UMO®.

As used herein, “you”, “your” or “User” refers to individual persons who the use services provided by UMO® and/ transit Partners and other transportation services providers (“Transit Partners”).

Your privacy is important to us. This Privacy Policy explains how we collect, track, process, share, use, and protect your Personal Information when you (i) access our online properties including our website (“Online Sites”), (ii) download and use our mobile application (‘Mobile App”), (iii) use any transit services or navigation services contained in the Mobile App or on the Online Sites such as transit schedule tracking, fare payment, transit onboarding with mobile pass or QR code (“Transit Features”) , or (iv) participate in any loyalty program provided or sponsored by us (“Loyalty Program”) (collectively the Online Sites, Mobile App, Transit Features and Loyalty Program are referred to herein as the “Services”).

As you review this Privacy Policy, here are a few general principles to keep in mind:

• • Our online services are intended for a U.S. audience. If you visit or use one of our online services, your information may be transferred or processed in the United States.
  • If you have a UMO account or Transit Partner account with us, we will use and share any information that we collect from or about you in accordance with this Privacy Policy.
  • By accessing or using our Services you are accepting the practices, terms and conditions stated in this Privacy Policy. If you disagree with any term provided herein, you may not access or use the Services and should immediately stop using the Services.

Data Collection

This Section describes the type of information we collect about you.

• • Personal Information

Personal Information or PII means information that identifies or is capable of being associated with you.

When you visit or use our Services, we may ask for and collect Personal Information from or about you where we believe it is reasonably required for ordinary business purposes.

This information may include:

• First Name
• Last Name
• Email Address
• Phone Number
• UMO Pass™ serial number
• Account password
• Location information
• Sensor data
• Demographics:
  • age
  • gender
  • marital status
  • income range
  • education
  • children
  • hobbies and interests
  • pets
    
• Payment card information:
  • your card number
  • expiration date
  • card security code
  • billing address

Usage Information

In addition to the Personal Information described above, we may automatically collect certain information about your use of our Services in order to ensure that you see the best custom content, product offerings, and get rewarded accurately. This information may include the following:

• • Unique device identifier.
  • Device IP address.
  • Device operating system and browser.
  • Device screen resolution and other device settings.
  • Analytical information about your mobile device usage.
  • The site you come from
  • The site you visit next.
  • Your activities and interaction on the App and Website.
  • Your activities and interaction with the Loyalty Program.

If you use Transit Features, the following information will also be collected in the ordinary course of business:

• • Public transit account/card number and status.
  • Payment card information including card number, expiration date, card security code, and billing address.
  • Transit card transactions.
    • Public transit history.
    • Interaction with our email communications and offerings.

Additional Sources of Information

We or our third-party partners may also use cookies, pixel tags or other technologies to collect and store other information about your visit to, or use of, our online services. In addition, we may later associate the usage and other information we collect online with Personal Information about you. See below for a detailed description of data tracking and use of cookies and other tracking technology.

We may also collect information about you from additional online and offline sources including from commercially available third-party sources, such as credit reporting agencies and identity authentication companies.

We may combine this information with the personal and other information we have collected about you under this Privacy Policy.

UMO Rewards™ card-linked offer terms are offered by separately by DOSH. Please review the UMO Rewards™ Card-Linked Offer Powered by DOSH Terms of Service and Privacy Policy for card-linked offer terms.

Use of Data

We use the information we collect in a number of ways, such as:

• • Processing of account applications and transactions.
    Identity verification for account access and other security purposes.
  • Internal reporting and analytics to optimize User experience, our product offerings and loyalty program.
  • Accounting recording, auditing, and other internal function requirements.
  • User preferences management.
  • Customer support communications.
  • Loyalty Program reward and redemption.
  • Travel behavior incentivization.
  • Compliance of enforcing applicable legal requirements, relevant industry standards, contractual obligations and our policies.
  • Prevention of fraud and enhancement of the security of your account or our services;
  • Promotional and survey messages by email, SMS, direct text messages, push notifications, web chat, and similar forms of communication.
  • For any other purposes that we may specifically disclose at the time you provide or we collect your information.

Advertisements

We do not sell your information to third parties, and we will not otherwise disclose your information to third parties, without your express permission or as expressly disclosed in this Privacy Policy.

You may see advertisements when you use our Services. These advertisements may be for new or existing products or services provided by UMO® or by third parties. Which advertisements you see is often determined using the information we or our service providers, Transit Partners, and other companies that we work with have about you. To that end, where permitted by applicable law, we may share with others the information we collect from and about you on an anonymous basis.

We may also use and collect on an aggregate or anonymous basis (such that it does not include any Personal Information) for various business purposes, where permissible under applicable laws and regulations.

Disclosure of Information

We may share the information we collect from and about you with certain parties that use our or provide support to our services. For example, we may share your information with:

• Transit Partners that subscribe to use UMO®;
• Cubic third-party service providers;
• Third parties or affiliates in connection with a corporate transaction, such as a sale, consolidation or merger of the Cubic businesses; and other third parties to comply with legal requirements such as the demands of applicable subpoenas and court orders; to verify or enforce our terms of use, our other rights, or other applicable policies; to address fraud, security or technical issues; to respond to an emergency; or otherwise to protect the rights, property or security of our customers or third parties.

We will not disclose personal information to third parties for their direct marketing purposes without your consent. If, after providing consent, you want to opt out of having your Personal Information disclosed to third parties for their direct marketing purposes, please let us know by sending us an e-mail at umo.privacy@cubic.com or by writing to us at Cubic Transportation Systems, Inc., Attn: Customer Service – Privacy, 9233 Balboa Avenue, San Diego, CA 92123. Please be sure to include your full name, the e-mail address you used to sign up with Cubic and your mailing address and specifically state that you do not want your personal information shared with third parties for their direct marketing purposes. Residents of the European Union and the United Kingdom have additional rights with respect to direct marketing as set forth below.

Data Tracking and Use of Cookies

UMO®, our service providers, and other authorized companies we work with may deploy and use web browser cookies, mobile device cookies, pixel tags, email address (when provided during account registration or loyalty opt-in), IP address, phone number, and mobile advertisement ID (MAID), and other tracking technologies to track you when visiting the App or the Online Sites. Some of these tracking tools may detect the characteristics or settings of the specific device you use to access our services.

“Cookies” are small amounts of data a website can send to a visitor’s web browser. They are often stored on the device you are using to help track your areas of interest. Cookies may also enable us or our service providers and other authorized companies we work with to relate your use of our services over time to customize your experience. Most web browsers allow you to adjust your browser settings to decline or delete cookies but doing so may degrade your experience with our Services.

Pixel tags (also known as clear GIFs or web beacons) are typically one-pixel, transparent images located on a webpage or in an email or other message or similar technologies may be used on our sites and in some of our digital communications (such as email or other marketing messages). They may also be used when you are served with advertisement or you otherwise interact with advertisements outside of our services. These are principally used to help recognize users, assess traffic patterns, and measure site or campaign engagement.

When you register to use our Services, we use the email address or phone number you provide to generate an account ID as a reference for our data tracking.

When you opt in to our Loyalty Program, we use the email address or phone number you provide to generate a loyalty account ID, which is tied to your email address and/or phone number as a reference for our data tracking.

Every time you land on our Mobile App or Online Sites, our system checks for the presence of an existing tracking cookie or ID. If one does not exist, you are tracked anonymously until you accept the cookie tracking for website visits or until you register to use our services. Once you opt into cookies tracking for website visits or register to use our services, the system will associate your past web and app engagement activities and, if applicable, travel history data (all as specified in Data Collection above) for the purpose of providing better services and loyalty reward offerings.

If you opt out of our cookie tracking on our Online Sites properties when you stay signed out or opt out of the Loyalty Program, all your Personal Information related to your Online Sites and/or Loyalty Program activities will be eradicated. However, for customer support, and legal compliance requirements, we may maintain records of your activity and transactional data related to your transit transaction history and Stars Loyalty Program (as set forth in Data Collection above).

If you have opted out of the Loyalty Program and later opt into the program again, you will be recognized as a new participant.

If you delete your web cookies, you will be considered a new, anonymous visitor and will be assigned a new cookie (unless you are using the Mobile App or stay signed in to your UMO account, in which case the Online Sites will still recognize you). If you stay signed out on the mobile App, the mobile App will still recognize you by referring to your account ID and phone number.

If you share a single device with another UMO user (such as a computer, tablet, or phone) to use our services, your activities will be associated with the same contact record unless you sign in with your own account. If two Users share a single account or use the same email address to log in to their account, your activities will also be associated to the same contact record.

Our system will also attribute activities to you if you click a link in a tracked email which directs to a page with our cookies installed.

If you do not wish for your Personal Information to be collected on the Online Sites or Mobile App, you may (i) stay signed out of the account on the Online Sites and Mobile App and clear your web browser’s cookies cache, (ii) clear your web browser’s cookies cache without signing in to your account, or (iii) use private mode on your web browser without signing in to your account.

Security

The security of your Personal Information is important to us. We use standard security procedures and practices appropriate to the nature of the information we collect in an effort to protect the Personal Information from unauthorized access, destruction, use, modification or disclosure. We also require our Service Providers to implement and maintain reasonable security procedures and practices appropriate to the nature of the information we share with them. No data transmission over the Internet or any wireless network can be guaranteed to be 100% secure. So, while we strive to protect Personal Information, we cannot and do not guarantee or warrant the security of any information you transmit to or from the Services, and you do so at your own risk.

Processing in The United States.

Please be aware that your Personal Information may be transferred to and maintained on servers or databases located outside your state, province, or country. If you are located outside of the United States, please be advised that we may process and store all information in the United States. The laws in the United States may not be as protective of your privacy as those in your location. By using our Services, you agree that the collection, use, transfer and disclosure of your Personal Information and communications will be governed by the applicable laws in the United States.

Additional Rights Applicable to European Union and EEA Residents and United Kingdom Residents

If you are a resident of the EU or EEA, you have additional rights under the General Data Protection Regulation (“GDPR”) and if a resident of the United Kingdom under the Data Protection Act of 2018 (“UK GDPR”), including the right to access, rectify, download or erase your Personal Information, as well as the right to restrict and object to certain processing of your Personal Information. While some of these rights apply generally, certain rights apply only in certain limited circumstances. We describe these rights below.

Under GDPR and the UK GDPR, you have the following rights:

• To obtain access to the Personal Information that we hold about you. If You wish to validate or access your data, you may do so by logging in to your account or contacting us at umo.privacy@cubic.com. A copy of your data in CSV/XLS format file will be sent to you via email within 30 business days upon receipt of request.

• To object to our processing activities on grounds relating to your particular situation where you feel they have a disproportionate impact on your interests, rights, and freedoms.

It may take us up to 30 days to complete the request from our receipt of the data processing restriction request.

You have the right to object to your Personal Information being processed by sending us an email to umo.privacy@cubic.com. We will respond to your request within 30 days upon receipt of your request.

You also have the right to object to your Personal Information related to the Loyalty Program being processed by opting out of the Loyalty Program via your UMO account on the Mobile App or Online Sites. Your data will be removed within 30 days upon receipt of request.

• To correct information. If you believe that your Personal Information that we possess is, or has become, incorrect or is incomplete, you may request to review, revise, correct, or update any of the Personal Information we may have about you free of charge.
If any Personal Information is inaccurate or incomplete, You may log in to your transit account on the Online Sites or the Mobile App to correct or update such data or send us your request to do so at umo.privacy@cubic.com.

You can only request information that is about you personally and not your access levels or other system- generated data. If for some reason such requested changes cannot be made in our system, an explanation email will be sent to you to explain why your request cannot be honored within 30 days from the date we receive your request.

• To restrict the processing activities related to your Personal Information (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before withdrawal); At any point in time, you can revoke your consent related to the Loyalty Program by opting out of the Loyalty Program via your transit account on the Mobile App and we will stop using and processing your data related to the Loyalty Program.

It may take us up to 30 days from the receipt date of the loyalty opt-out request to process the deletion of data.

If you opt out of the loyalty program, you will no longer be eligible for any rewards, and you will forfeit all accumulated reward points

• To request that we erase your Personal Information You have the right to request the erasure of all Personal Information if the data is no longer necessary for its original purpose or if you withdraw consent.

For your UMO account, you may request the erasure of all Personal Information by sending us an email to umo.privacy@cubic.com.

For the Loyalty Program you may do so by opting out of the Loyalty Program on the Mobile App or Online Sites.

For our business operations, customer support requirements, or for legal reasons, we may maintain records of your transactional data in our systems up to three (3) years from receipt of the deletion request. Furthermore, we cannot honor any deletion request where you have active or pending transactions with us or are the subject of any legal process or investigation, as the deletion of your record would prevent us from carrying out the required activities.

• To have Personal Information, which you have voluntarily provided to us, produced in a structured, commonly used, and machine-readable format, including for the purpose of transmitting it to another party. A copy of your data will be exported into CSV/XLS format file and sent to your designated email address within 30 days of receipt of request.

• To require us not to send you marketing communication. We may still communicate with you regarding your account and other transactional matters even if you no longer wish to receive marketing materials.

Please note that the above individual rights are not absolute, and we may be entitled to refuse requests where certain exceptions apply. If you have given your consent and you wish to withdraw it, please contact us by phone or email using the contact details provided at the end of this document.

Please note that where our processing of your Personal Information relies on your consent and where you then withdraw that consent, we may not be able to provide all or some aspects of our services to you and/or it may affect the provision of those services.

If you have any questions about your rights regarding your Personal Information, please contact us using the contact details provided at the end of this Privacy Policy, where you may initiate a request to access, reject, correct, restrict, or erase your Personal Information, or where you may initiate a request for transfer of your Personal Information or initiate a request that we refrain from sending you marketing information.

Children’s Privacy Statement.

Protecting children’s privacy is important to us. For that reason, no part of our Online Services or Mobile App are targeted to attract anyone under the age of 13. Users from ages 13 to 15 must represent and warrant that they are using the Online Services or Mobile App under the supervision of a parent or guardian and we may ask your parent or guardian to provide prior written consent for you to use the Online Services or Mobile App. Transit Partners may have separate policies with respect to the use of their services by children and you should refer to their policies in that respect.

While we may collect Personal Information of children under the age of 13 who wish to use the UMO® Services, we do not solicit this Personal Information from the child directly – we will seek parental consent for any Personal Information provided for children under the age of 16. We also comply with the Children’s Online Privacy Protection Act (COPPA), and if you believe we have Personal Information regarding a child under the age of 16 that you have not authorized, you may contact us at the contact information at the end of this Notice to request that we delete it.

For GDPR and UK GDPR purposes, the Privacy Notice is not directed to “children,” as defined per Member State implementation legislation. Where a prospective user is classified as a child, we will make reasonable efforts to verify that consent is given or authorized by the holder of parental responsibility over the child, where Personal Information of the child is to be processed.

California Residents.

California residents have additional rights as set forth in the Privacy Notice for California Residents appended hereto.

Your Nevada Privacy Rights

If you are a Nevada resident, you have the right to request certain information from us regarding the collection and sale of your Personal Information (as defined in Nevada Revised Statutes 603A.320) during your visit to our Online Sites or Mobile App or when you otherwise interact with us online. If you have sought or acquired, by purchase or lease, any goods or services for personal, family, or household purposes from the UMO® Site(s), you may ask us to disclose whether we have sold (for monetary consideration) certain information about you (including your first and last name, physical address, email address, telephone number, social security number, an identifier that allows you to be contacted either physically or online, or other contact information that allows us to identify you personally).

As a Nevada resident, you may also request to opt out of us sharing such information about you. To make this inquiry, please submit a request in writing to umo.privacy@cubic.com.com with “Nevada Privacy Rights” in the subject line. You must include your full name, email address, and attest that you are a Nevada resident by providing a Nevada postal address in your request. Please state whether you are requesting information and/or opting out. You must complete a separate request for each UMO® company.

We will process your request within 60 days, or we will let you know if we need additional time. We may require additional information to verify your identity before we can respond.

California / Delaware Do Not Track Disclosures

Do Not Track (“DNT”) is a web browser setting that requests that a web application disable its tracking of an individual user. When you choose to turn on the DNT setting in your browser, your browser sends a special signal to websites, analytics companies, ad networks, plug in providers, and other web services you encounter while browsing to stop tracking your activity. Various third parties are developing or have developed signals or other mechanisms for the expression of consumer choice regarding the collection of information about an individual consumer’s online activities over time and across third-party websites or online services (e.g., browser do not track signals), but there is no universally-agreed upon standard for what a company should do when it detects a DNT signal. Currently, we do not monitor or take any action with respect to these signals or other mechanisms. You can learn more about Do Not Track here https://allaboutdnt.com.

Links to Other Sites.

The Services may contain links to websites operated and maintained by third parties, including Transit Partners. We have no control over those third parties. Privacy policies on such linked websites may be different from our Privacy Policy. You access such linked websites at your own risk. We encourage you to review the privacy policy of any such linked website you visit to understand how they collect, store, and use your Personal Information.

Changes to The Privacy Policy

UMO® reserves the right to change this Privacy Policy at any time. In the event of any substantial change of this Policy, we will provide you with 7 days’ prior notice via any of the communications mean available to us, or by posting notice of the change on the Online Sites or the Mobile App. After this 7-day notice period, all changes to this Privacy Policy shall be deemed accepted and effective on both UMO® and you.

Privacy Contact

If you would like to ask questions or provide comments regarding this Privacy Policy you may do so by sending us an e-mail at umo.privacy@cubic.com or by writing to us at Cubic Corporation, Attn: Customer Service – Privacy, 9233 Balboa Avenue, San Diego, CA 92123.

© Cubic Corporation 2022

California Privacy Rights

Your California Privacy Rights

This Privacy Notice is for California Residents and applies solely to all visitors, users, and others who reside in the State of California (“Consumers”). We adopt this Notice to comply with the California Consumer Privacy Act of 2018 (“CCPA”). Any terms defined in the CCPA have the same meaning when used in this Section.

UMO® collects certain types of Personal Information about you during your relationship with UMO® as a user or visitor. In particular, our Site has collected the following categories of Personal Information from its consumers within the last twelve (12) months:

For purposes of the CCPA, Personal information does not include:

• Publicly available information from government records.
• Deidentified or aggregated consumer information.
• Information excluded from the CCPA’s scope, like:
• health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
• Personal Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994.

Under California law, if you are a resident of California, under certain circumstances, you have the right to request certain information that we collect about you, including:

(1) The categories of Personal Information we have collected from you;
(2) The categories of sources from which we collected the Personal Information;
(3) The business purpose we have for collecting or sharing that Personal Information;
(4) The categories of third parties with whom we share such Personal Information; and
(5) The specific pieces of Personal Information we have collected about you.

In addition, you may request that we provide you with:

(1) The categories of Personal Information that we sold about you, and the categories of third parties to whom the Personal Information was sold, by category or categories of Personal Information for each category of third parties to whom the information was sold;
(2) The categories of Personal Information that we have disclosed about you for a business purpose;
(3) The category or categories of consumers’ Personal Information that we have sold, or if we have not sold consumers’ Personal Information; and
(4) The category or categories of consumers’ Personal Information that we have disclosed for a business purpose, or if we have not disclosed that information for a business purpose.

Please note that if we collected information about you for a single one-time transaction and do not keep that information in the ordinary course of business, that information will not be retained for purposes of a request under this section. In addition, if we have de-identified or anonymized data about you, we are not required to re-identify or otherwise link your identity to that data if it is not otherwise maintained that way in our records.

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

However, we may offer you certain financial incentives permitted by the CCPA that can result in different prices, rates, or quality levels. Any CCPA-permitted financial incentive we offer will reasonably relate to your Personal Information ’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior opt in consent, which you may revoke at any time.
As a California resident, you also have the right, at any time, to tell us not to sell Personal Information – this is called the “right to opt-out” of the sale of Personal Information.

You may make a written request to us to request this information. We may require you to confirm your identity and your residency in order to obtain the information, and you are only entitled to make this request twice a year. You may call, email or write us with your request at the contact information below. Please include “California Privacy Rights” as the subject line. You must include your full name, email address, and attest to the fact that you are a California resident by including a California postal address in your request. We will respond to your request within 45 days or let you know if we need additional time.

Attention: Privacy Officer
umo.privacy@cubic.com
9233 Balboa Avenue, San Diego, CA 92123