Last Modified: June 29, 2023

Overview

UMO® is a registered trademark of Cubic Corporation in the United States.

This Privacy Policy applies to UMO®, a division of Cubic Transportation Systems, Inc. (“Umo”) including its wholly owned subsidiary, Delerrok Inc., and all associated brands including UMO®. This Privacy Policy does not cover services offered by Cubic Transportation Systems, Inc. outside of UMO®. Those services are covered by one or more separate privacy policies.

As used herein, “you”, “your” or “User” refers to individual persons who use services provided by Umo and its agency transit partners and transit operators (“Transit Partners”).

Your privacy is important to us. This Privacy Policy explains how we collect, track, process, share, use, and protect your Personal Information when you (i) access our online properties including our website (“Online Sites”), (ii) download and use our mobile applications (“Mobile App”), (iii) use any transit services or navigation services contained in the Mobile App or on the Online Sites such as journey planning, (iv) use any services or features in conjunction with a Transit Partner such as schedule tracking, fare product purchase, or fare payment using a dynamic QR code to board a Transit Partner vehicle (“Transit Features”) , or (v) participate in any loyalty program provided or sponsored by us (“Loyalty Program”). (Collectively the Online Sites, Mobile App, Transit Features and Loyalty Program are referred to herein as the “Services”).

Personal Information means information that identifies or is capable of being associated with you. As you review this Privacy Policy, here are a few general principles to keep in mind:

• Cubic is a U.S. Company. If you visit or use one of our Services, your Personal Information may be transferred or processed in the United States.
• If you have a Umo account and/or a related account profile with one of our Transit Partners, we will use and share any information that we collect from or about you in accordance with this Privacy Policy and you will be subject to their privacy policies and terms and conditions relevant to your engagement with them and the services they provide.
• By accessing or using our Services you are accepting the practices, terms and conditions stated in this Privacy Policy. If you disagree with any term provided herein, you may not access or use the Services and should immediately stop using the Services.
• The Services may contain links to websites operated and maintained by third parties, including Transit Partners. If you register your Umo Card through our Online Services, you may be doing so with one of our Transit Partners, the transit agency you have selected, and will be subject to their privacy policy. We have no control over Transit Partner privacy policies or those of other third-party partners.  Privacy policies on linked websites may be different from our Privacy Policy.  You access such linked websites at your own risk.  We encourage you to review the privacy policy of any such linked website you visit to understand how they collect, store, and use your Personal Information.

Umo reserves the right to change this Privacy Policy at any time. In the event of any substantial change of this Policy, we will provide you with 7 days’ prior notice via any of the communications mean available to us, or by posting notice of the change on the Online Sites or the Mobile App. After this 7-day notice period, all changes to this Privacy Policy shall be deemed accepted and effective on both Umo and you.

Data Collection

As described below we collect Personal Information about you when you provide it to us and automatically when you use the Services. When you visit or use our Services, we may ask for and collect Personal Information from or about you where we believe it is reasonably required for ordinary business purposes.

This information may include:

• First Name
• Last Name
• Email Address
• Phone Number
• Umo Card number
• Birthdate (but only if required by a Transit Partner for certain discounted fare types)
• Location information
• Sensor data
• Payment card information
  • full name,
  • your card number,
  • expiration date,
  • card security code
  • billing address

Usage Information

In addition to the Personal Information described above, we may automatically collect certain information about your use of our Services in order to ensure access to certain Transit Features, that you see the best custom content, product offerings, and get rewarded accurately. This information may include the following:

• Unique device identifier.
• Device IP address.
• Device operating system and browser.
• Device screen resolution and other device settings.
• Analytical information about your mobile device usage.
• The site you come from.
• The site you visit next.
• Your activities and interaction with the Services.
• Your activities and interaction with the Loyalty Program.

If you use Transit Features, the following information will also be collected in the ordinary course of business:

• A Umo account is required to use Transit Features and so we will collect either your existing Umo card number, if converting from one to our using our Mobile App, or registering it in our Online Services, a phone number if you opt to use that for your account setup, or an email address and password, which is optional in some cases. We may share this information with Transit Partners and third parties in order to provide these Services to you. If using a phone number or email address, we may ask you to verify what you have submitted to aid in ensuring recovery of your account should it become necessary for our Transit Partner to assist you with this.
• We send text messages to your phone number (if provided) to aid in secure multi-factor authentication to your Umo account when registered from the Mobile App. We send emails, if you have opted in to this functionality, to send you alerts when your stored value balance is low, a pass is expiring or running out of rides, if/when your profile information has changed, and in the event of a regular or autoload purchase, but only if you have opted in to this convenient functionality and confirmed your email address, and only if you have provided us an email address, which is optional.
• We send push notifications to aid with relevant Mobile App functionality, for instance, where the functionality is available, to call your attention back to the Mobile App if you are in the middle of a journey and have requested to be notified when you should get off the vehicle at your particular stop (e.g., “next stop alerts”). We also infrequently send push notifications where our Transit Partners are interested in your opinion about your experience with riding their vehicles and using their services.
• If you have provided us access to your device’s location, we use this for providing our trip planning service in conjunction with third parties so that we know where you are when you select your destination and can provide you with relevant journey options. We may also use your location to provide relevant advertising to you and may share location information with Transit Partners so that they may provide customer service to you and improve their transit services designed for you. A mobile device is not required to use many of our Services made available with our Transit Partners.
• If you choose to buy fare product (passes and/or stored value) through our Services, we collect and then share Payment card information including your full name, card number, expiration date, card security code, and billing address with third parties but only those necessary to effect the purchase transaction (e.g., our third-party provider with our Mobile App and the relevant payment gateway selected by our Transit Partner). We do not store this information and use 3rd party vaulting services to “tokenize” your credit card for further use though you may self-delete this token at any time through the Mobile App or our Online Sites.
• When you make fare product purchases and use your Umo QR Code to ride transit with our Transit Partners, that activity creates transactions which are kept while there is business use for this data, and where retention is required per applicable law, which may be owned by either Umo or by any of our Transit Partners.
• We may send email communications from time to time for other offerings or services.

Additional Sources of Information

We or our third-party partners may also use cookies, pixel tags or other technologies to collect and store other information about your visit to, or use of, our online services.  In addition, we may later associate the usage and other information we collect online with Personal Information about you.  See below for a detailed description of data tracking and use of cookies and other tracking technology.

We may also collect information about you from additional online and offline sources including from commercially available third-party sources.

We may combine this information with the personal and other information we have collected about you under this Privacy Policy.

Use of Data

We use the information we collect in a number of ways, such as:

• Processing of account applications and transactions.
• Identity verification for account access and other security purposes.
• Internal reporting and analytics to optimize User experience, our Services and Loyalty Program.
• Accounting recording, auditing, and other internal function requirements.
• User preferences management.
• Customer support communications.
• Loyalty Program reward and redemption.
• Travel behavior incentivization.
• Compliance of enforcing applicable legal requirements, relevant industry standards, contractual obligations, and our policies.
• Prevention of fraud and enhancement of the security of your account or our Services.
• Promotional and survey messages by email, SMS, direct text messages, push notifications, web chat, and similar forms of communication.
• For any other purposes that we may specifically disclose at the time you provide or we collect your Personal Information.

Advertisements

You may see advertisements when you use our Services. These advertisements may be for new or existing products or services provided by Umo, its Transit Partners, or by third parties. Which advertisements you see is often determined using the information we, Transit Partners, or our third-party partners have about you. To that end, where permitted by applicable law, we may share with others the information we collect from and about you on an anonymous basis.

We may also use and collect information on an aggregate or anonymous basis (such that it does not include any Personal Information) for various business purposes, where permissible under applicable laws and regulations.

Disclosure of Information

The Services allow you to use the services offered by our Transit Partners. When you use the services of Transit Partners in conjunction with Umo Services, we may share relevant Personal Information with them as necessary for them to perform their services on your behalf. The Personal Information we share with Transit Partners through our Services will be owned by those Transit Partners and subject to their applicable privacy policies.

We may sometimes use other third-party partners to perform certain services for us, e.g., to provide certain services on our behalf, such as payment processing for in-app purchases, hosting and maintenance, data storage and management services, production and fulfillment services, marketing and promotions, and other relevant business purposes. We provide our third-party partners with the Personal Information reasonably necessary for them to perform the services on our behalf. Each third-party partner must agree

(a) to implement and maintain reasonable security procedures and practices appropriate to the nature of the Personal Information involved in order to protect your Personal Information from unauthorized access, destruction, use, modification, or disclosure and,

(b) not to retain, use, or disclose the Personal Information for any purpose other than for the specific purpose of performing the services for us, or as otherwise permitted by law.

We may also share your Personal Information with third parties or affiliates in connection with a corporate transaction, such as a sale, consolidation or merger of the Cubic businesses and with other third parties to comply with legal requirements such as the demands of applicable subpoenas and court orders; to verify or enforce our terms of use, our other rights, or other applicable policies; to address fraud, security or technical issues; to respond to an emergency; or otherwise to protect the rights, property or security of our customers or third parties.

We will only disclose Personal Information to third parties for their direct marketing purposes with your consent.  If, after providing consent, you want to opt out of having your Personal Information disclosed to third parties for their direct marketing purposes, please let us know by sending us an e-mail at umo.privacy@cubic.com or by writing to us at Cubic Transportation Systems, Inc., Attn: Customer Service – Privacy, 9233 Balboa Avenue, San Diego, CA 92123.  Please be sure to include your full name, the e-mail address, username, or phone number you used to sign up with Umo and your mailing address and specifically state that you do not want your Personal Information shared with third parties for their direct marketing purposes.

Data Tracking and Use of Cookies

Umo, our Transit Partners, and other third-party service providers we work with may deploy and use web browser cookies, mobile device cookies, pixel tags, email address (when provided during account registration or loyalty opt-in), IP address, phone number, and mobile advertisement ID (MAID), and other tracking technologies to track you when utilizing the Services. Some of these tracking tools may detect characteristics or settings of the specific device you use to access our Services.

“Cookies” are small amounts of data a website can send to a visitor’s web browser. They are often stored on the device you are using to help track your areas of interest. Cookies may also enable us or our service providers and other authorized companies we work with to relate your use of our services over time to customize your experience. Most mobile devices allow you to adjust your device settings to decline or delete cookies but doing so may degrade your experience with our Services.

Pixel tags (also known as clear GIFs or web beacons) are typically one-pixel, transparent images located on a webpage or in an email or other message or similar technologies which may be used by our Services and in some of our digital communications (such as email or other marketing messages). They may also be used when you are served with an advertisement or you otherwise interact with advertisements outside of our Services. These are principally used to help recognize users, assess traffic patterns, and measure site or campaign engagement.

When you register to use our Services, we use the email address, username, or phone number you provide us to create a Umo account who’s account number services as a reference for our data tracking.

When you opt into our Loyalty Program, we use the email address or phone number you provide to generate a loyalty account ID, which is tied to your email address and/or phone number as a reference for our data tracking.

Every time you use our Services, our system checks for the presence of an existing tracking cookie or ID. If one does not exist, you are tracked anonymously until you accept the cookie tracking for website visits or until you register to use our Services. Once you opt into cookies tracking for website visits or register to use our Services, the system will associate your past web and app engagement activities and, if applicable, travel history data for the purpose of providing better Services and loyalty reward offerings.

For customer support, financial requirements, obligations to our Transit Partners, and other legal compliance requirements, we may maintain records of your activity and transactional data related to your use of Umo Services, including our Loyalty Program.

If you have opted out of the Loyalty Program and later opt into the program again, you will be recognized as a new participant.

If you delete your web cookies, you will be considered a new, anonymous visitor and will be assigned a new cookie (unless you are using the Mobile App or stay signed in to your Umo account, in which case the Online Sites will still recognize you). If you stay signed out on the Mobile App, the Mobile App will only recognize you by referring to your account ID, username, and/or phone number if you subsequently sign-in again.

If you share a single device with another Umo user (such as a computer, tablet, or phone) to use our Services, your activities will be associated with the same contact record unless you sign-in with your own account. If two Users share a single account or use the same email address to log in to their account, your activities will also be associated to the same contact record. We encourage every Umo user to have their own account and also extend optional functionality to our Transit Partners in order to aid in blocking fraudulent activity.

Our system will also attribute activities to you if you click a link in a tracked email which directs to a page with our cookies enabled.

If you do not wish for your Personal Information to be collected on the Online Sites or Mobile App, you may (i) stay signed out of the account on the Online Sites and Mobile App and clear your web browser’s cookies cache, or (ii) delete the Mobile App from your device and when prompted, also delete the data associated with that Mobile App.

Security

The security of your Personal Information is important to us.  We use standard security procedures and practices appropriate to the nature of the information we collect in an effort to protect the Personal Information from unauthorized access, destruction, use, modification, or disclosure.  We also require our third-party service providers to implement and maintain reasonable security procedures and practices appropriate to the nature of the information we share with them.  No data transmission over the Internet or any wireless network can be guaranteed to be 100% secure.  So, while we strive to protect Personal Information, we cannot and do not guarantee or warrant the security of any information you transmit to or from the Services, and you do so at your own risk.

Children’s Privacy Statement.

Protecting children’s privacy is important to us.  For that reason, no part of our Online Services or Mobile App are targeted to attract anyone under the age of 13.   Users from ages 13 to 15 must represent and warrant that they are using the Services under the supervision of a parent or guardian and we may ask your parent or guardian to provide prior written consent for you to use the Services. Transit Partners may have separate policies with respect to the use of their services by children and you should refer to their policies in that respect.

While we may collect Personal Information of children under the age of 13 who wish to use the Umo Services, we do not solicit this Personal Information from the child directly – we will seek parental consent for any Personal Information provided for children under the age of 16.   We also comply with the Children’s Online Privacy Protection Act (COPPA), and if you believe we have Personal Information regarding a child under the age of 16 that you have not authorized, you may contact us at the contact information at the end of this Privacy Policy to request that we delete it.

California Residents.

California residents have additional rights as set forth in the Privacy Notice for California Residents appended hereto.

Nevada Residents

If you are a Nevada resident, you have the right to request certain information from us regarding the collection and sale of your Personal Information (as defined in Nevada Revised Statutes 603A.320) during your use of the Services or when you otherwise interact with us online. If you have sought or acquired, by purchase or lease, any goods or services for personal, family, or household purposes from the Services, you may ask us to disclose whether we have sold (for monetary consideration) certain information about you (including your first and last name, physical address, email address, telephone number, social security number, an identifier that allows you to be contacted either physically or online, or other contact information that allows us to identify you personally).

As a Nevada resident, you may also request to opt out of us sharing such information about you.  To make this inquiry, please submit a request in writing to umo.privacy@cubic.com with “Nevada Privacy Rights” in the subject line. You must include your full name, email address, and attest that you are a Nevada resident by providing a Nevada postal address in your request. Please state whether you are requesting information and/or opting out. You must complete a separate request for each Umo company.

We will process your request within 60 days, or we will let you know if we need additional time. We may require additional information to verify your identity before we can respond.

California / Delaware Do Not Track Disclosures

Do Not Track (“DNT”) is a web browser setting that requests that a web application disable its tracking of an individual user. When you choose to turn on the DNT setting in your mobile device, you prevent your mobile device from allowing the Mobile App to send a special signal to websites, analytics companies, ad networks, plug in providers, and other web services you encounter while browsing to stop tracking your activity. Various third parties are developing or have developed signals or other mechanisms for the expression of consumer choice regarding the collection of information about an individual consumer’s online activities over time and across third-party websites or online services (e.g., mobile device and browser do not track signals), but there is no universally agreed upon standard for what a company should do when it detects a DNT signal. Currently, we do not monitor or take any action with respect to these signals or other mechanisms. You can learn more about Do Not Track here https://allaboutdnt.com/ .

Processing in The United States

Please be aware that your Personal Information may be transferred to and maintained on servers or databases located outside your state, province, or country.  If you are located outside of the United States, please be advised that we may process and store all information in the United States.  The laws in the United States may not be as protective of your privacy as those in your location.  By using our Services, you agree that the collection, use, transfer and disclosure of your Personal Information and communications will be governed by the applicable laws in the United States.

Additional Rights Applicable to Canada Residents.

Residents of Canada have the following additional rights regarding the collection and use of Personal Information under Canada’s Personal Information Protection & Electronic Documents Act, Alberta residents under Alberta’s Personal Information Protection Act, British Columbia residents under British Columbia’s Personal Information Protection Act and Québec residents under Québec’s Act respecting the protection of personal information in the private sector (collectively “Canada’s Privacy Laws”)

• To obtain access to the Personal Information that we hold about you. If you wish to validate or access your data, you may do so by logging in to your account or contacting us at umo.privacy@cubic.com. A copy of your data will be sent to you via email within 30 business days upon receipt of request.
• To correct information. If you believe that your Personal Information that we possess is, or has become, incorrect or is incomplete, you may request to review, revise, correct, or update any of the Personal Information we may have about you free of charge. If any Personal Information is inaccurate or incomplete, you may log in to your Umo account in the Mobile App to correct or update such data or send us your request to do so at umo.privacy@cubic.com. You can only request information that is about you personally and not your access levels or other system-generated data. If for some reason such requested changes cannot be made in our system, an explanation email will be sent to you to explain why your request cannot be honored within 30 days from the date we receive your request.
• To withdraw consent. Where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before withdrawal; At any point in time, you can revoke your consent related to the Loyalty Program by opting out of the Loyalty Program via your Umo account on the Mobile App and we will stop using and processing your data related to the Loyalty Program or you may send us a request to do so at umo.privacy@cubic.com.

Please note that where our processing of your Personal Information relies on your consent and where you then withdraw that consent, we may not be able to provide all or some aspects of our Services to you and/or it may affect the provision of those Services.

If you opt out of the Loyalty Program, you will no longer be eligible for any rewards, and you will forfeit all accumulated reward points.

Please note that the above individual rights are not absolute, and we may be entitled to refuse requests where certain exceptions apply.  If you have given your consent and you wish to withdraw it, please contact us by email using the contact details provided at the end of this document.

If you would like to ask questions or provide comments regarding this Privacy Policy you may do so by sending us an e-mail at umo.privacy@cubic.com or by writing to us at Cubic Corporation, Attn: Customer Service – Privacy, 9233 Balboa Avenue, San Diego, CA 92123, United States.

Privacy Contact

If you would like to ask questions or provide comments regarding this Privacy Policy you may do so by sending us an e-mail at umo.privacy@cubic.com or by writing to us at Cubic Corporation, Attn: Customer Service – Privacy, 9233 Balboa Avenue, San Diego, CA 92123, United States.

© Cubic Corporation 2023

Last updated: June 29, 2023

California Privacy Rights

Your California Privacy Rights

This Privacy Notice is for California Residents and applies solely to all visitors, users, and others who reside in the State of California (“Consumers”). We adopt this Notice to comply with the California Consumer Privacy Act of 2018 (“CCPA”). Any terms defined in the CCPA have the same meaning when used in this Section.

Umo collects certain types of Personal Information about you during your relationship with Umo as a user or visitor. In particular, our Site has collected the following categories of Personal Information from its consumers within the last twelve (12) months. The categories and examples provided in the chart below are those defined in the CCPA. This does not mean that all examples of that category of Personal Information were in fact collected but reflects our good faith belief to the best of our knowledge that some of that information may have been collected about consumers. We will update this disclosure from time to time as appropriate.

For purposes of the CCPA, Personal information does not include:

• Publicly available information from government records.
• Deidentified or aggregated consumer information.
• Information excluded from the CCPA’s scope, like:
  • health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
• Personal Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994.

Under California law, if you are a resident of California, under certain circumstances, you have the right to request certain information that we collect about you, including:

(1) The categories of Personal Information we have collected from you;

(2) The categories of sources from which we collected the Personal Information;

(3) The business purpose we have for collecting or sharing that Personal Information;

(4) The categories of third parties with whom we share such Personal Information; and

(5) The specific pieces of Personal Information we have collected about you.

In addition, you may request that we provide you with:

(1) The categories of Personal Information that we sold about you, and the categories of third parties to whom the Personal Information was sold, by category or categories of Personal Information for each category of third parties to whom the information was sold;

(2) The categories of Personal Information that we have disclosed about you for a business purpose;

(3) The category or categories of consumers’ Personal Information that we have sold, or if we have not sold consumers’ Personal Information; and

(4) The category or categories of consumers’ Personal Information that we have disclosed for a business purpose, or if we have not disclosed that information for a business purpose.

Please note that if we collected information about you for a single one-time transaction and do not keep that information in the ordinary course of business, that information will not be retained for purposes of a request under this section. In addition, if we have de-identified or anonymized data about you, we are not required to re-identify or otherwise link your identity to that data if it is not otherwise maintained that way in our records.

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

However, we may offer you certain financial incentives permitted by the CCPA that can result in different prices, rates, or quality levels. Any CCPA-permitted financial incentive we offer will reasonably relate to your Personal Information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior opt in consent, which you may revoke at any time. As a California resident, you also have the right, at any time, to tell us not to sell Personal Information – this is called the “right to opt-out” of the sale of Personal Information.

You may make a written request to us to request this information. We may require you to confirm your identity and your residency in order to obtain the information, and you are only entitled to make this request twice a year. You may email or write us with your request at the contact information below. Please include “California Privacy Rights” as the subject line. You must include your full name, email address, and attest to the fact that you are a California resident by including a California postal address in your request. We will respond to your request within 45 days or let you know if we need additional time.

Attention: Privacy Officer
umo.privacy@cubic.com

9233 Balboa Avenue, San Diego, CA 92123