English
Last Updated: July 4th 2023
This section
provides notice and specific information to consumers in California, Virginia,
Colorado, Connecticut and Utah, including information required by the
California Consumer Privacy Act, as amended by the California Privacy Rights
Act (the California Consumer Privacy Act and the California Privacy Rights Act
shall be regarded collectively herein as “CCPA”
), the Virginia Consumer Data Protection Act (“VCDPA”), the Colorado Privacy Act (“CPA”), the Connecticut Data Privacy Act (”CTDPA”) and the Nevada Revised Statutes Chapter 603A (“NPA”) and the Utah Consumer Privacy Act
(”UCPA”, and collectively with the
CCPA, VCDPA, CPA, CTDPA, NPA and UCPA, the “US Privacy Laws”). Please note that the notice, information, and
rights for residents in Colorado and Connecticut are only effective July 1,
2023, and for residents in Utah are only effective December 31, 2023.
For the purposes
of this document, Personally Identifiable Information (“PII”) is used interchangeably to indicate “Personal Information” as
defined by the CCPA and “Personal Data” as defined by the CPA, VCDPA, CTDPA and
UCPA, and “Covered information” as defined by the NPA.
We do not sell
or otherwise disclose your PII in exchange for money except as described by our
We do not collect
or process special categories of personal information other than location data,
which is defined as sensitive information under some US Privacy Laws. Location
data is essential for providing you with our navigation services and is only
collected when you allow the app to collect this data from your device. You may
opt-out of this collection by adjusting your App and device settings
accordingly, but provisioning of some services, such as live navigation, will
become impossible.
PERSONAL INFORMATION WE COLLECT AND SHARE
We may collect, use, and disclose
your PII as required or permitted by applicable law. We collect the following
categories of PII from the corresponding sources and for the corresponding
purposes set forth in the table below. The table also includes information as
to categories of third parties with whom PII is shared and the business and
commercial purposes for selling, sharing or otherwise
transferring or disclosing PII to third parties.
As permitted by applicable law, we do not treat deidentified data or aggregate consumer information as PII, and we reserve the right to convert, or permit others to convert, your PII into deidentified data or aggregate consumer information.
We may collect, use and disclose your PII for commercial purposes such as for interest-based advertising and sharing PII in a manner that is deemed a “sale” or “share” under the US Privacy Laws. Subject to restrictions and obligations of the US Privacy Laws, our advertising partners (including those that facilitate interest-based and other direct advertising and marketing), and/or other third parties may also use your PII independently.
Our vendors and service providers may themselves process PII for business purposes or operational purposes permissible under the US Privacy Laws, including processing to detect data security incidents, protecting against fraudulent or illegal activity, creation of datasets of aggregate consumer information and deidentified information, or appointing service providers, contractors, or Processor any cognate terms under the US Privacy Laws.
If you instruct us to share your PII we may do so based on such instruction, and such sharing is not considered a sale of your PII. Also, sharing PII amongst the Moovit group of entities that operate the Services provided to you is not considered a sale of your PII under the US Privacy Laws.
Notwithstanding anything to the contrary in our Privacy Policy, we typically restrict use of your PII that is shared with our vendors and service providers for our business purposes, or we treat such disclosures as sales of your PII subject to your Do Not Sell rights, where such apply.
While there is not
yet a consensus, data practices of third-party cookies and tracking
technologies associated with the Services may constitute a "sale" of
your PII as defined by the US Privacy Laws. Please review the "Cookies &
Similar Technologies" section of our
EXERCISING YOUR CONSUMER RIGHTS
To
process consumer requests, we need to verify your identity by providing
information about yourself or your account. Authorized agents can make a
request on your behalf if you have given them legal power of attorney or we are
provided proof of signed permission, verification of your identity, and, in
some cases, confirmation that you provided the agent permission to submit the
request. We will be unable to fulfill your request if we cannot verify your
identity. We reserve the right to modify our verification procedures and may
request additional information from you as needed or as required by applicable
law.
We will make commercially reasonable efforts to identify
PII that we collect, process, store, disclose and otherwise use and to respond
to your consumer privacy rights requests. We will typically not charge a fee to
fully respond to your requests; provided, however, that we may charge a
reasonable fee, or refuse to act upon a request, if your request is excessive,
repetitive, unfounded or overly burdensome. If we
determine that your request warrants a fee, or that we may refuse it, we will
give you notice explaining why we made that decision. You will be provided a cost estimate and the opportunity to accept such
fees before we charge you for responding to your request.
We provide California Consumers the privacy rights under the CCPA as described in this
Section 1. You have the right to exercise these rights via an authorized agent
who meets the agency requirements of the CCPA and related regulations. As
permitted by the CCPA, any request you submit to us is subject to an
identification process ("Verifiable
Consumer Request").
To make a request according to
your rights to know or to request deletion of your PII as set forth below, please
contact us at privacy@moovit.com
and respond to any follow up inquiries we may
make. We will take steps to verify your identity before complying with the
request to protect your privacy and security. We will send you an email to the
email address that you provide to us, and you must take
action as described in the email. This will enable us to verify that the
person who made the request controls and has access to the user account
associated with the request.
Some PII we maintain about
Consumers is not sufficiently associated with enough PII about the Consumer for
us to be able to verify that it is a particular Consumer’s PII when a Consumer
request that requires verification pursuant to the CCPA's verification
standards is made (e.g., clickstream data tied only to a pseudonymous browser
ID). As required by the CCPA we do not include that PII in response to those
requests. We will use PII provided in a Verifiable Consumer Request only to
verify your identity or authority to make the request and to track and document
request responses, unless you also gave such PII to us
for another purpose.
Your CCPA privacy rights are as
follows:
1.1.
The Right to Know:
1.1.1.
Information Rights -- You have the right to send us a request, no
more than twice in a 12-month period, for any of the following for the period
that is 12 months prior to the request date: the categories of PII we have
collected about you; the categories of sources from which we collected your
PII; the business or commercial purposes for collecting or selling your PII;
the categories of third parties with whom we shared your PII; the specific
pieces of PII we have collected about you; a list of the categories of PII
disclosed for a business purpose in the prior 12 months, or that no disclosure
occurred; a list of the categories of PII sold about you in the prior 12
months, or that no sale occurred. If we sold your PII,
we will explain the categories of your PII we have
sold and the categories of third parties to which we sold PII.
1.1.2.
Obtaining Copies of PII – You have the right to make or obtain a
transportable copy, no more than twice in a 12-month period, of your PII that
we have collected in the period that is 12 months prior to the request date and
are maintaining.
Please note that PII is retained by us for various time periods and we do not have any obligation to retain it
longer than we need it just to be able to respond to your requests, so we may
not be able to fully respond to what might be relevant going back 12 months
prior to your request.
1.2.
Deletion: Except to the extent we
have a basis for retention under CCPA, you may request that we delete your PII
that we have collected directly from you and are maintaining. Our retention
rights include, without limitation, to complete transactions and services you
have requested or that are reasonably anticipated, for security purposes, for
legitimate internal business purposes, including maintaining business records,
to comply with law, to exercise or defend legal claims, and to cooperate with
law enforcement. Note also that we are not required to delete your PII that we
did not collect directly from you.
You may alternatively exercise more limited control of your
PII by opting out of receiving further commercial emails by clicking
“Unsubscribe” or “Manage my email preferences” in any email from Moovit. Please note that if you opt out of receiving
further commercial emails, you may still receive transactional emails.
1.3.
Do Not Sell: You have the right to opt out of the sale of
your PII by clicking the “DNSMI” button (found under the Setting Menu) or by
contacting us at privacy@moovit.com.
You will be able to opt out of the sale of your PII maintained by Moovit, including, for purposes of interest-based
advertising.
Please note that opting out of the sale of your PII for
purposes of interest-based advertising does not mean that you will stop seeing
ads on the Services or that you will no longer see interest-based ads. You may
still see ads on the Services that are tailored to your interests based on PII
that (i) is not sold by Moovit,
(ii) was sold to other digital advertising companies ninety (90) days or more
before you opted out of sales of your PII for purposes of interest-based
advertising, or (iii) is sold by sources from which you have not opted out.
For more information about cookies and other tracking
technologies used on the Services and your choices regarding certain kinds of
online interest-based advertising, please see the “Cookies &
Similar Technologies” section of our
Please note: we do not knowingly sell the PII of Consumers
we know are under the age of 16 unless we receive an opt-in from the Consumer who is at least 13 but under 16, or from
the parent or guardian of a Consumer younger than 13. Consumers who opt-in to
PII sales may opt-out at any time by following the Do Not Sell instructions
above. If you think we may have unknowingly collected PII for sale belonging to
yourself or to your child under the age of 13, or if you are at least 13 but
under 16, exercising the opt-out will stop our selling of the PII. We may sell
PII of Consumers who are 16 or older where such PII
was collected by us before they turned 16.
ADDITIONAL CALIFORNIA PRIVACY RIGHTS
California's "Shine the
Light" law permits California residents to request certain information
regarding our disclosure of PII to third parties for their own direct marketing
purposes. If applicable, you may obtain the categories of personal information
shared and the names and addresses of all third parties that received personal
information for their direct marketing purposes during the calendar year
immediately prior to the year in which the request is made. To make such a
request, please send an email message to us at privacy@moovit.com. Any such request
must include "Shine the Light California Privacy Rights Request" on
the subject line and in the body of your message and must attest to the fact
that you are a California resident and include your name, street address, city,
state, and ZIP code and other sufficient information for us to determine this
law applies to you. We will provide the requested information to you at your e-mail
address in response. Please be aware that not all information sharing is
covered by the "Shine the Light" requirements and only information on
covered sharing will be included in our response. Note that we are only
required to respond to one request per customer each year.
As these rights and your CCPA
rights are not the same and exist under different laws, you must exercise your
rights under each law separately.
Virginia law provides Virginia
consumers with the following rights:
2.1. Right to confirm and access – you may have the right to request that we disclose to you the PII that we have collected, used, disclosed and/or sold about you and to access such PII.
2.2. Right to correct inaccuracies in the consumer's PII - You have the right to request that we correct inaccuracies in the PII we have collected about you. We may deny certain requests, or fulfill a request only in part, based on our legal rights and obligations.
2.3. Right to delete PII provided by or obtained about the consumer - You may have the right to request that we delete certain PII we have collected from you, subject to certain exceptions under the law. We may deny certain requests, or fulfill a request only in part, based on our legal rights and obligations. In the case of requests submitted online, if we are able to verify your identity (as described above), we may ask you to confirm that you would like your PII deleted prior to deleting any of your PII.
2.4. Right to data portability – you may have the right to obtain a copy of your PII in a portable and, to the extent technically feasible, readily usable format.
2.5. Right to opt out – you may have the right to opt out of the processing of your PII for purposes of targeted advertising, from the sale of your PII (as defined under Virginia law), and from profiling in furtherance of decisions that produce legal or similarly significant effects.
Exercising Your Virginia
Privacy Rights. To request
access to or deletion of your PII, or to exercise any other privacy rights
under Virginia law, please contact us at privacy@moovit.com or
using an in-app screen.
To appeal our decision regarding a
request related to these rights, you contact us at legal@moovit.com.
Colorado law provides Colorado consumers with the following rights:
3.1. Right to Opt-Out of Sale. You have the right to opt-out of the sale of your PII to third parties for the purpose of targeted advertising, profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer or for monetary return. However, as noted above, we do not currently sell any PII.
3.2. Right to confirm and access – you may have the right to confirm whether or not we have collected PII about you and, if so what PII we collect, use, disclose, and/or sell, as applicable and to access such PII;
3.3. Right to correct inaccuracies in the consumer's PII - you may have the right to request that we correct inaccurate PII about you.
3.4. Right to delete PII provided by or obtained about the consumer - you have the right to request that we delete the PII we have collected about you.
3.5. Right to data portability – No more than two times per calendar year, you have the right to request a copy of your PII we have collected and maintained about you that allows you to transfer the data to another entity.
This section describes your Colorado consumer and explains how to exercise those rights and also describes various exclusions and exceptions under Colorado law.
We will respond to your request within forty-five (45) days after receipt of a consumer request and no more than two times per calendar year. We reserve the right to extend the response time by an additional forty-five (45) days when reasonably necessary and provided consumer notification of the extension is made within the first forty-five (45) days.
We will not process personal information in violation of state or federal laws that prohibit unlawful discrimination against consumers.
Exercising Your Colorado Privacy Rights. To request access to or deletion of your PII, or to exercise any other privacy rights under Colorado law, please contact us at privacy@moovit.com or using an in-app screen.
To appeal our decision regarding a request related to these rights, you contact us at legal@moovit.com.
Connecticut law provides Connecticut consumers with the following rights:
4.1. Right to confirm and access – you may have the right to confirm whether or not we have collected PII about you and to access such Personal Data;
4.2. Right to correct inaccuracies in the consumer's Personal Data – you may have the right to request that we correct inaccurate PII.
4.3. Right to delete PII provided by or obtained about the consumer - you have the right to request that we delete the PII we have collected about you.
4.4. Right to data portability – you have the right to obtain a copy of your PII in a portable and, to the extent technically feasible, readily usable format.
4.5. Right to opt out – you have the right to opt out of the processing of your PII for purposes of targeted advertising, from the sale of your PII (as defined under Connecticut law), and from profiling in furtherance of decisions that produce legal or similarly significant effects.
Exercising Your Connecticut Privacy Rights. To request access to or deletion of your PII, or to exercise any other privacy rights under Connecticut law, please contact us at privacy@moovit.com or using an in-app screen.
We will respond to your request within forty-five (45) days after receipt of a consumer request and for no more than two times per calendar year. We reserve the right to extend the response time by an additional forty-five (45) days when reasonably necessary and provided consumer notification of the extension is made within the first forty-five (45) days.
To appeal our decision regarding a request related to these rights, you contact us at legal@moovit.com.
Utah law provides Utah consumers with the following rights:
5.1. Right to confirm and access – you may have the right to confirm whether or not we have collected PII about you and to access such PII;
5.2. Right to delete PII provided by or obtained about the consumer - you may have the right to request that we delete the PII we have collected about you.
5.3. Right to data portability – you may have the right to obtain a copy of your PII in a portable and, to the extent technically feasible, readily usable format which allows you to transmit the data to another controller without impediment, where the processing is carried out by automated means.
5.4. Right to opt out – you may have the right to opt out of the processing of your PII for purposes of targeted advertising, from the sale of your PII (as defined under Utah law).
Exercising Your Utah Privacy Rights. To request access to or deletion of your personal data, or to exercise any other privacy rights under Utah law, please contact us at privacy@moovit.com or using an in-app screen.
We will respond to your request within forty-five (45) days after receipt of a consumer request and for no more than two times per calendar year. We reserve the right to extend the response time by an additional forty-five (45) days when reasonably necessary and provided consumer notification of the extension is made within the first forty-five (45) days.
To appeal our decision regarding a request related to these rights, you contact us at legal@moovit.com.
Nevada law provides Nevada consumers with the right to opt out – you may have the right to opt out of the processing of your PII for purposes of targeted advertising, from the sale of your personal data (as defined under Nevada law).
Exercising Your Nevada Privacy Rights. To request access to or deletion of your personal data, or to exercise any other privacy rights under Utah law, please contact us at privacy@moovit.com or using an in-app screen.
We will respond to your request within 60 days after receipt of a Verified Request (as defined under Nevada Law). We reserve the right to extend the response time by an additional 60 days when reasonably necessary and provided consumer notification of the extension is made within the first 60 days.
To appeal our decision regarding a request related to these rights, you contact us at legal@moovit.com.