Last Modified: 14th January 2021

Your privacy is important to us and we have prepared this Privacy Policy to explain how we collect, use and share your personal information. This Privacy Policy governs all mobile applications and websites owned or operated by Delerrok Inc., a wholly-owned subsidiary of Cubic Transportation Systems, Inc. or Cubic Transportation Systems, Inc (“Delerrok”, “Cubic” or “We”) ), related to the UMO Pass application (formerly known as TouchPass, the “App”), any other websites or mobile applications (e.g., iPhone applications, iPad applications, Android applications, etc.) offered by Cubic under the UMO. UMOPass and UMO Pass brands, and any other applications, interactive features, widgets and resources offered by Cubic through traditional Internet websites, mobile devices or social media platforms (all of which are collectively referred to as the “UMO Services” or “Services”). This Privacy Policy does not cover any services offered by Cubic outside of the UMO and UMO Pass Services which are covered by one or more separate privacy policies.

• By downloading the App and using the Services, you consent to the collection and use of your personal information as outlined in this Privacy Policy. Please read this Privacy Policy carefully, and if you have any questions, feel free to contact us. When you use the Services, you also consent to our terms and conditions as detailed at https://umomobility.com/pass/terms-and-conditions/

1. Questions and Opt-Out.

If you would like to ask questions or provide comments regarding this Privacy Policy you may do so by sending us an e-mail at umo.privacy@cubic.com or by writing to us at Cubic Transportation Systems, Inc., 9233 Balboa Ave., San Diego, CA 92123, Attn: UMO Customer Service – Privacy

We will not disclose personal information to third parties for their direct marketing purposes without your consent. If, after providing consent, you want to opt-out of having your personal information disclosed to third parties for their direct marketing purposes, please let us know by sending us an e-mail at umo.privacy@cubic.com.com or by writing to us at Cubic Transportation Systems, Inc., 9233 Balboa Ave., San Diego, CA 92123; Attn: Customer Service – Privacy. Please be sure to include your full name, the e-mail address you used to sign up with Cubic and your mailing address and specifically state that you do not want your personal information shared with third parties for their direct marketing purposes.

2. Updating Your Personal Information and Controlling Your Profile.

The Services provide tools for you to correct, update or edit your personal information and control your profile. You can edit your profile and other information at any time through the App or website.

3. Information We Collect.

“Personal Information” can include any information you provide to us about you. It includes:

When you register for the Services, we collect certain information about you which may include such information as your name, email address, telephone number(s), and UMO Card number. When you use the Services, we may collect additional information such as location information (for example, an address to help you find the nearest bus stop or train station) and payment card information, including your card number, expiration date, card security code and billing address. We may also collect information that you provide to us through the Services or in connection with any promotions offered by us.

We automatically collect certain information to help us understand how our users use the Service:

We may collect information about the computer or device you use to access our Services, including the hardware model, operating system and version, MAC address, unique device identifier (“UDID”), phone number, International Mobile Equipment Identity (“IMEI”) and mobile network information. We may also collect mobile advertising IDs (for example, Google Advertising ID and Apple IDFA).

We may also collect your device location with your consent so that you can use location-based features.

We may also automatically collect and use the data contained in log files. The information in log files may include your IP address, your ISP, the Web browser you used to visit the Services, the time you visited the Services, which pages you visited within the Services, information about the site you came from, the parts of our Services you access, and the site you visit next and other usage data.

4. Cookies and Tracking Technologies.

We may use a technology called “cookies” and similar technologies. A cookie is a small file that identifies you as a unique user. We may use cookies to improve the quality of our Services and make the Services easier to use. We do this by storing information (for example, settings preferences) about a particular user session in cookies in order to provide you with a better experience during a particular session. Certain of our “Service Providers” and “Transit Partners” (as defined below) may use cookies or similar technologies in connection with the services they perform on our behalf. If you choose to do so, you can configure your browser to delete existing cookies or disable cookies altogether. However, certain features of the Services may not work if you delete or disable cookies.

We may work with third-party advertising companies that may use information about your use of the Services in order to provide advertisements about goods and services that may be of interest to you on the Services and on third party websites. From the Services, these companies may place or recognize a unique cookie on your computer or use other technologies such as web beacons or pixel tags. Our Privacy Policy does not cover any use of information that a third-party ad serving company may collect from you. For more information about ad cookies and companies that provide users the ability to “opt-out” of the collection of information from such cookies, please click here: http://www.networkadvertising.org/managing/opt_out.asp.

5. Do Not Track.

The Services do not respond to web browser “do not track” signals or other mechanisms that provide consumers the ability to exercise choice regarding the collection of personal information about an individual consumer’s online activities over time. Visit www.donottrack.us to find out more about “do not track.”

6. How We Use Personal Information.

We may use your Personal Information for the following purposes:

• Processing UMO Account applications and transactions, including credit card payment transactions;
• Verifying your identity (such as when you access your account information);
• Providing you with tailored advertising and content;
• Providing you with pertinent transportation information for nearby services;
• Operating, evaluating and improving our business (including developing new products and services; improving existing products and services; performing data analytics; and performing accounting, auditing and other internal functions);
• Managing your preferences;
• Complying with and enforcing applicable legal requirements, relevant industry standards, contractual obligations and our policies;
• Preventing fraud or other illegal or unauthorized activities;
• Enhancing the security of your account or our online services;
• Sending you notices regarding the Services and new product releases;
• Responding to your requests and communicating with you;

For promotions conducted on or through the Services, and for support and other inquiries, we use the Personal Information that you provide to communicate with you regarding such promotion in accordance with the applicable rules and to respond to your inquiries.

7. How We Share Your Personal Information.

We do not sell your Personal Information to third parties, and we will not otherwise disclose your Personal Information to third parties, without your express permission or as expressly disclosed in this Privacy Policy.

The Services allow you to use the services offered by transit agencies and other transportation services providers (“Transit Partners”). When you use the services of Transit Partners through the UMO Services, we may share relevant Personal Information with them as necessary for them to perform their services on your behalf. The Personal Information we share with Transit Partners through our Services will be owned by those Transit Partners and subject to their applicable privacy policies.

We may sometimes use other businesses (“Service Providers”) to perform certain services for us, e.g., to provide certain services on our behalf, such as payment processing for in-app purchases, hosting and maintenance, data storage and management services, production and fulfillment services, and marketing and promotions. We provide our Service Providers with the Personal Information reasonably necessary for them to perform the services on our behalf. Each Service Provider must agree (a) to implement and maintain reasonable security procedures and practices appropriate to the nature of the Personal Information involved in order to protect your Personal Information from unauthorized access, destruction, use, modification or disclosure and (b) not to retain, use, or disclose the Personal Information for any purpose other than for the specific purpose of performing the services for us, or as otherwise permitted by law.

We use third-party software and services for various needs, including to collect and process Personal Information or provide you with an enhanced experience. Among the third-party software and service providers we may use are the following:

• We use Google Analytics, a web analytics service of Google, Inc. (“Google”), to collect and summarize data regarding usage of the Services. Google uses cookies to obtain this Personal Information. We use the information obtained from Google Analytics to improve the Services. To learn more about Google Analytics and Google’s privacy practices, please visit: www.google.com/policies/privacy/partners/. For information on how to opt-out of data collection by Google Analytics visit: https://tools.google.com/dlpage/gaoptout?hl=en
• We use Moovit to provide public transportation information which allows users to plan and optimize public transportation trips as well as to provide travel and tourist information which may be of interest to you. Moovit may access, collect, store, analyze, process, display, transfer, cross-border transfer and use your data in order to provide and operate the Moovit services accessed through the App and in order to (i) develop, improve and customize any and all services and offering available through any Moovit services, including such services’ accuracy and interface; (ii) allow Moovit and/or its third-party service providers, to the extent permitted by law, use, transact in and/or disclose aggregate, non-personally identifiable and (iii) to comply with any applicable law or regulation. To learn more about Moovit and its privacy practices, please visit https://moovitapp.com/en-us/legal/privacy-policy-en/
• Payment SDKs- We use payment SDK’s to facilitate payment when using the App
• Advertising SDK’s- We use advertising SDK’s including Facebook Conversion Tracking Pixel and Google AdWords, to deliver UMO-related advertisements.
• We use Facebook Custom Audiences, to display advertisements to website visitors on Facebook, based upon email addresses provided by users to UMO.

We may disclose aggregate usage data in order to describe the use of the Services to our existing or potential business partners, sponsors, advertisers, investors or other third parties. However, this aggregate data will not involve the disclosure of personal information and will not personally identify you or other users of the Services.

8. Other Authorized Disclosures.

Notwithstanding anything in this Privacy Policy to the contrary, you understand and agree that Cubic may access, preserve, and disclose any Personal Information we have collected about you or that you have submitted: (a) if we are legally required to do so (for example, in response to subpoenas, court orders or legal process) or to establish, protect or exercise our legal rights or defend against legal claims; (b) to protect the rights and property of Cubic, its affiliates, other users, or the public; (c) if we believe it is necessary in order to investigate, prevent or take action regarding illegal activities, fraud, copyright violations, trademark violations or other violations of the personal or intellectual property rights of others or situations involving potential threats to the safety of any person; (d) to our corporate affiliates, joint venture partners or other companies under common control with Cubic (in which case we will require those entities to honor this Privacy Policy); and (e) if Cubic is acquired by or merged with another entity or in connection with a sale of our assets.

9. Public Areas.

Your use of areas of the Services, if any, that are intended for interaction with other users such as a user forum may reveal your name, and other personal information from your profile and may allow you to publish certain personal information about you. By choosing to use these areas, you understand and agree that anyone with access to those areas may access, copy and forward any information about you that is contained in or that you post to those areas. You should use care when disclosing any your personal information to strangers.

10. Links to Other Sites.

The Services may contain links to websites operated and maintained by third parties, including Transit Partners and Moovit. We have no control over those third parties. Privacy policies on such linked websites may be different from our Privacy Policy. You access such linked websites at your own risk. We encourage you to review the privacy policy of any such linked website you visit to understand how they collect, store, and use your Personal Information.

11. Security.

The security of your Personal Information is important to us. We use standard security procedures and practices appropriate to the nature of the information we collect in an effort to protect the Personal Information from unauthorized access, destruction, use, modification or disclosure. We also require our Service Providers to implement and maintain reasonable security procedures and practices appropriate to the nature of the information we share with them. No data transmission over the Internet or any wireless network can be guaranteed to be 100% secure. So, while we strive to protect personal information, we cannot and do not guarantee or warrant the security of any information you transmit to or from the Services, and you do so at your own risk.

12. Children’s Privacy Statement.

Protecting children’s privacy is important to us. For that reason, no part of our App is targeted to attract anyone under the age of 13. Users from ages 13 to 15 must represent and warrant that they are using the App under the supervision of a parent or guardian and we may ask your parent or guardian to provide prior written consent for you to use theApp. While we may collect Personal Information of children under the age of 13 who wish to use the UMO Services, we do not solicit this Personal Information from the child directly – we will seek parental consent for any personal information provided for children under the age of 16. Cubic also complies with the Children’s Online Privacy Protection Act (COPPA), and if you believe we have Personal Information regarding a child under the age of 16 that you have not authorized, you may contact us at the contact information at the end of this Notice to request that we delete it.

For GDPR and UK GDPR purposes, the Privacy Notice is not directed to “children,” as defined per Member State implementation legislation. Where a prospective user is classified as a child, we will make reasonable efforts to verify that consent is given or authorized by the holder of parental responsibility over the child, where Personal Information of the child is to be processed.

13. Processing in the United States.

Please be aware that your personal information communications may be transferred to and maintained on servers or databases located outside your state, province, or country. If you are located outside of the United States, please be advised that we may process and store all information in the United States. The laws in the United States may not be as protective of your privacy as those in your location. By using our Services, you agree that the collection, use, transfer and disclosure of your personal information and communications will be governed by the applicable laws in the United States.

14. Additional Rights Applicable to European Union and EEA Residents and United Kingdom Residents

If you are a resident of the EU or EEA, you have additional rights under the General Data Protection Regulation (“GDPR”) and if a resident of the United Kingdom under the Data Protection Act of 2018 (“UK GDPR”), including the right to access, rectify, download or erase your Personal Information, as well as the right to restrict and object to certain processing of your Personal Information. While some of these rights apply generally, certain rights apply only in certain limited circumstances. We describe these rights below.

Under GDPR and the UK GDPR, you have the following rights:

• To obtain access to the Personal Information that we hold about you;
• To object on grounds relating to your particular situation to our processing activities where you feel they have a disproportionate impact on your interests, rights, and freedoms;
• If you believe that your Personal Information that we possess is, or has become, incorrect or is incomplete, you may request to review, revise, correct, or update any of the Personal Information we may have about you free of charge;
• To restrict the processing activities related to your Personal Information (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before Direct withdrawal);
• To request that we erase your Personal Information;
• To have Personal Information, which you have voluntarily provided to us, produced in a structured, commonly used, and machine-readable format, including for the purpose of transmitting it to another party; and
• To require us not to send you marketing communication.

Please note that the above individual rights are not absolute, and we may be entitled to refuse requests where certain exceptions apply. If you have given your consent and you wish to withdraw it, please contact us by phone or email using the contact details provided at the end of this document. Please note that where our processing of your Personal Information relies on your consent and where you then withdraw that consent, we may not be able to provide all or some aspects of our services to you and/or it may affect the provision of those services.

If you have any questions about your rights regarding your Personal Information, please simply write to us at the postal address or contact by phone or email using the contact details provided at the end of this document, where you may initiate a request to access, reject, correct, restrict, or erase your Personal Information, or where you may initiate a request for transfer of your Personal Information or initiate a request that we refrain from sending you marketing information.

Please note that the above individual rights are not absolute and we may be entitled to refuse requests where certain exceptions apply. Please note that where our processing of your personal information relies on your consent and you withdraw it we may not be able to provide some or all aspects of the UMO Services to you and/or it may affect the provision of those services.

15. California Residents.

This Privacy Notice is for California Residents and applies solely to all visitors, users, and others who reside in the State of California (“Consumers”). We adopt this Notice to comply with the California Consumer Privacy Act of 2018 (“CCPA”). Any terms defined in the CCPA have the same meaning when used in this Section.

UMO collects certain types of personal information about you during your relationship with UMO as a user or visitor. In particular, our Site has collected the following categories of Personal Information from its consumers within the last twelve (12) months:

Category Collected
A. Identifiers. YES
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). YES
C. Protected classification characteristics under California or federal law NO
D. Commercial information YES
E. Biometric information. NO
F. Internet or other similar network activity. YES
G. Geolocation data. YES
H. Sensory data. NO
I. Professional or employment-related information. YES
J. Non-public education information
(per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)). NO
K. Inferences drawn from other personal information. NO

For purposes of the CCPA, Personal information does not include:

• Publicly available information from government records.
• Deidentified or aggregated consumer information.
• Information excluded from the CCPA’s scope, like:
• health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
• personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994.

Under California law, if you are a resident of California, under certain circumstances, you have the right to request certain information that we collect about you, including:

1. The categories of Personal Information we have collected from you;
2. The categories of sources from which we collected the Personal Information;
3. The business purpose we have for collecting or sharing that Personal Information;
4. The categories of third parties with whom we share such Personal Information; and
5. The specific pieces of Personal Information we have collected about you.

In addition, you may request that we provide you with:

1. The categories of Personal Information that we sold about you, and the categories of third parties to whom the personal information was sold, by category or categories of Personal Information for each category of third parties to whom the information was sold;
2. The categories of Personal Information that we have disclosed about you for a business purpose;
3. The category or categories of consumers’ Personal Information that we have sold, or if we have not sold consumers’ Personal Information; and
4. The category or categories of consumers’ Personal Information that we have disclosed for a business purpose, or if we have not disclosed that information for a business purpose.

Please note that if we collected information about you for a single one-time transaction and do not keep that information in the ordinary course of business, that information will not be retained for purposes of a request under this section. In addition, if we have de-identified or anonymized data about you, we are not required to re-identify or otherwise link your identity to that data if it is not otherwise maintained that way in our records.

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

However, we may offer you certain financial incentives permitted by the CCPA that can result in different prices, rates, or quality levels. Any CCPA-permitted financial incentive we offer will reasonably relate to your personal information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior opt in consent, which you may revoke at any time.

DO NOT SELL MY PERSONAL INFORMATION

As a California resident, you also have the right, at any time, to tell us not to sell Personal Information – this is called the “right to opt-out” of the sale of Personal Information. We do not sell your Personal Information.

You may make a written request to us to request this information. We may require you to confirm your identity and your residency in order to obtain the information, and you are only entitled to make this request twice a year. You may call, email or write us with your request at the contact information below. Please include “California Privacy Rights” as the subject line. You must include your full name, email address, and attest to the fact that you are a California resident by including a California postal address in your request. We will respond to your request within 45 days or let you know if we need additional time.

To make a request, you may contact us via mail, email, or phone:

Cubic Transportation Systems, Inc.
Attn: Customer Service – Privacy
9233 Balboa Ave., San Diego, CA 92123
Attn: UMO Customer Service – Privacy
Email: umo.privacy@cubic.com
Phone: +1-858-268-3100

In order to respond to your requests, we may need to verify your identity. We will not discriminate against you in the provision of the Services in response to your exercise of these privacy rights. We will respond to your request within 45 days of receipt of your request, after verification, unless we need additional time, in which case we will let you know and may extend the period an additional 45 days as permitted by the CCPA.

15. Changes.

Cubic may, in its sole and absolute discretion, change this Privacy Policy from time to time. All changes to the Privacy Policy will be effective when posted, and we will provide notification of such changes to you via the Services or contact information you may have provided to Cubic upon registration. If we make material changes to our Privacy Policy or practices, we may seek your affirmative consent to such changes. If you object to any such changes, your sole recourse shall be to cease using the UMO Services.

The last updated legend at the top of the Privacy Policy indicates when it was last updated.