Privacy Policy - Annapolis Bus

PRIVACY POLICY AND NOTICE AT COLLECTION

Effective Date: July 1, 2024

Student Transportation of America and its operating groups, subsidiaries and affiliates (“STA,” “we,” or “us”) respect your right to privacy and are committed to the protection of your personal information. This Privacy Policy and Notice at Collection (“Privacy Policy” or “Policy”) summarizes what personal information we may collect from you through your use of our website, https://ridesta.com/, and when we interact with you through other online and offline methods, the personal information we may maintain, how we might use it, and to whom we may disclose it. This Policy also describes other important topics relating to your privacy.

This Policy does not address our processing of the personal information of our job applicants, employees, and independent contractors for human resources, employment, benefits administration, health and safety, and other similar business-related and legal compliance purposes. If your information pertains to one of the above listed categories of individuals, please refer to our Privacy Notice and Notice at Collection for California Employees, Privacy Notice and Notice at Collection for California Job Applicants, and Privacy Notice and Notice at Collection for California Independent Contractors, as appropriate, for information about our collection, use, disclosure, and retention of your personal information. This Policy also does not apply to information that has been de-identified, aggregated, or is otherwise exempted from applicable data protection legislation.

Individuals with disabilities may access this Policy in an alternative format by contacting [email address or telephone number]. Certain terms used in this Privacy Policy have the meanings given to them in the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act and implementing regulations (collectively the “CCPA”).

1. Personal Information We Collect

Depending on your interactions with us, we may not have collected each of these categories of personal information about you. However, we may collect (and may have collected during the 12-month period prior to the effective date of this Policy) the following categories of personal information about you:

Identifiers, such as name, address, telephone number, or e-mail address, unique personal identifier (e.g., device identifier, unique pseudonym, or user alias/ID), online identifiers, IP addresses, and other similar identifiers.

Internet or other electronic network activity information, such as information about your device(s) when accessing our websites and your usage details of our websites, you provide when filling in forms on our websites, the type of browser you use, the files you request, and the domain name and country from which you request information, or information you provide when requesting further information, products, or services from us.

Categories of personal information described in California Civil Code § 1798.80, such as name, signature, telephone number, financial information such as bank account number, credit card number or debit card number, or other financial information, passport number, state identification card number, and driver’s license number.

Professional and employment-related information, such as information relating to your position, (e.g., job title, job description, or department), employment status, employment history, or business email address.

Commercial Information, such as records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

Geolocation data, such as time and physical location related to use of an internet website, application, device, or physical access to an office location.

Sensory or surveillance information, such as video surveillance of our offices and other physical locations, as well as video and audio surveillance of our buses.

Inferences and profiles based on other personal information, such as information about your behavior, preferences, characteristics, psychological trends, or predispositions.

Other information you choose to provide.

We do not collect or process “sensitive personal information” (as defined by the CCPA) for the purpose of inferring characteristics about individuals.

2. Sources of Personal Information

We collect and receive, and during the 12-month period prior to the effective date of this Privacy Policy, may have collected and received personal information from the following sources:

Directly from you when you provide it to us;

From third parties, such as our service providers, business partners, and customers like public school districts that outsource the provision of transportation services to us; and

Automatically and indirectly from you, such as through logging and analytics tools, cookies, pixel tags, and other similar technologies on our website.

When you visit our website, third parties with whom we work may use cookies and other technologies to collect personal information and other information about your online activities over time and across third-party websites or online services. The information generated by the cookies may include your IP address, your browser type, the date and time of your visit, the pages you visit and the amount of time spent on each, your device’s operating system, your mobile device identifier, your geographical area, referring URLs, and other information on your interaction with our site. You may be able to modify your cookie settings or turn off all or certain types of cookies by adjusting your browser settings. Please note, however, that if you delete or turn off cookies, you may not have access to some of the features that make your experience on our site smoother, you may not be able to store your preferences, and some portions of our website may not function properly.

3. Purposes for Using and Disclosing Personal Information

We may use, disclose, or otherwise process (and may have used, disclosed, or otherwise processed in the 12-month period prior to the effective date of this Policy) personal information for the following purposes:

Providing our websites and supporting the features and contents available to you.

Providing our products and services.

Personalizing your digital experience with us, including enhancing features and designing relevant alerts, products, or services, sending you marketing offers and serving targeted advertising.

To respond to your inquiries and supply you with requested information on Student Transportation of America’s products and services.

Understanding how you and others use our websites and to determine what features and services may interest you or our other customers.

Operating and improving our organization and our services.

Communicating with you and others, including but not limited to providing promotional content, information about the services we provide, and transactional messages.

Troubleshooting, de-bugging, and otherwise addressing issues that may arise with the functionality of the websites.

Helping to ensure security and integrity, to the extent the use of your personal data is reasonably necessary and proportionate for these purposes.

Protecting the legal rights, property, safety, and security of records or information, our customers, riders, and website users, our organization and others, including detecting and preventing security incidents, fraud, misuse, harassment, and other malicious, deceptive, unauthorized, or illegal activity.

Complying with industry standards, applicable law, judicial process, any properly authorized civil, criminal, or government or regulatory investigation or request, or any subpoena or summons issued by a competent authority.

Enforcing our policies, terms of use, or rights arising from contracts.

For certain short-term transient uses.

In addition, we may also use, disclose, or otherwise process your personal information for such purposes as you may authorize at the time you submit the information or as otherwise compatible with the above purposes or your reasonable expectations.

We may also de-identify personal information by removing any details that identify you personally. If we do so, we will maintain and use the de-identified personal information without attempting to re-identify it. De-identified personal information will not be subject to this Policy and will be used to the extent permissible under applicable law.

4. “Sales,” “Sharing,” and Disclosures of Personal Information for a Business Purpose

We do not:

Use sensitive personal information for purposes other than those allowed by the CCPA as set out in Cal. Code Regs. tit. 11 § 7027(m); or

Sell or share the personal information of individuals under 16 years of age as those terms are defined under the CCPA.

We generally disclose, and in the preceding 12 months we may have disclosed, the categories of personal information listed above in Personal Information We Collect to the below categories of entities, including for business or commercial purposes as described in Purposes for Using, Disclosing, and Otherwise Processing Personal Information above:

To our subsidiaries and affiliates;

To our service providers we use to support our business, such as IT operating system and platform vendors, security vendors, monitoring and data analytics providers, payment service providers; and

To other third parties, such as regulatory authorities or other third parties in response to legal process or other legal reporting requirements; to potential buyers (and their agents and advisors) in connection with any proposed merger, acquisition, or any form of sale or transfer of some or all of our stock or assets (including in the event of a reorganization, dissolution or liquidation); and to other similar third parties where disclosure is required for an ordinary business purpose in connection with our provision of services.

Our business model does not include selling your personal information to third parties in exchange for money. However, we may share online identifiers and internet or other electronic network activity information, such as cookies and the advertising identifier associated with your computer or mobile device, with our marketing and advertising partners, including platforms that enable or participate in targeted and cross-context behavioral advertising, social media platforms, and analytics partners, to show ads that are targeted to your interests. Under certain state privacy laws, sharing personal information with partners in exchange for some benefit, such as providing more relevant ads, can be considered a “sale” or “sharing” in some circumstances. As such, we may be considered to “sell” or “share” or otherwise process your personal information for targeted or cross-contextual behavioral advertising. Apart from these “sales” we do not sell your personal information.

Residents of certain states may opt out of the “sale” or “sharing” of personal information as described in Your Privacy Rights and Choices, below. Please note that the right to opt out applies only to “sales” or “sharing” of personal information and does not restrict our ability to disclose information to third parties for valid business purposes.

5. Retention of Personal Information

We retain personal information for as long as necessary to carry out the processing activities described in this Privacy Policy, including but not limited to providing and administering the websites, providing you with customer service, answering your queries, complying with applicable laws, regulations, rules, and requests of relevant law enforcement and/or other governmental agencies, and protecting our, our employees’, and our business partners’ and customers’ rights, property, or safety and the rights, property and safety of others. We may retain personal information for a longer period of time if a longer retention period is required or permitted by applicable law. In specific circumstances, we may also retain your personal information for longer periods of time so that we have an accurate record of your dealings with us in the event of any complaints or challenges.

6. Confidentiality and Protection of Your Personal Information

We have implemented appropriate physical, technical, and organizational security measures designed to secure your personal data against accidental loss and unauthorized access, use, alteration, or disclosure. In addition, we take measures to limit access to personal data to those employees, agents, contractors, and other third parties that have a legitimate business need for such access. Although we use appropriate security measures once we have received your personal data, the transmission of information over the internet is never completely secure, so we cannot guarantee that your personal data will remain secure in all circumstances.

7. Third-Party Links

We may provide links to other websites and services for your convenience, which are not subject to this Policy. The operators of the linked websites and services may have posted their own privacy policies that you should review to learn more about their privacy practices. If you decide to access any of the third-party websites linked to our websites, you do so entirely at your own risk and subject to the terms and conditions of use for such third-party websites.

8. Your Privacy Rights and Choices

Depending on your state of residence, you may have specific legal rights regarding your personal information. This section describes the legal rights that are available to some individuals and explains how to exercise them.

Know and Access: Residents of certain states may have the legal right to request, subject to certain limitations, that we disclose the personal information we have collected about them, such as the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about them.

Correction: Residents of certain states may have the legal right to request that we correct the personal information we maintain about them, if that information is inaccurate.

Deletion: Residents of certain states may have the legal right to request that we delete certain personal information we have collected about them, subject to certain exceptions.

Portability: Residents of certain states have the legal right of portability, or the right to have us transfer their personal information to other persons or entities upon their request, subject to certain exceptions.

Opt–Out of Sale or Sharing: Residents of certain states have the legal right to opt out of the sale of their personal information or disclosure of their personal information for targeted or behavioral advertising.

Non-Discrimination: Residents of certain states have the legal right to not be discriminated against for exercising their privacy rights.

How to Submit a Request. Residents of states that provide the specific legal rights listed above, may exercise their privacy rights by submitting a request to us at [website link] or calling us at [phone number]. The verifiable request must provide sufficient information that allows us to reasonably verify they are the person about whom we collected personal information or an authorized representative. The verifiable request must also describe their request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

Verifying Requests. To help protect the privacy of individuals requesting to exercise their privacy rights (“Requestors”) and maintain security, we will take steps to verify the Requestors’ identity before granting access to their personal information or complying with their request. If a Requestor asks us to provide them with specific pieces of personal information, we may require they sign a declaration under penalty of perjury that they are the individual whose personal information is the subject of the request and provide appropriate proof of identity.

For requests to know or delete information about a child under the age of 13, we accept requests for information regarding minors under the age of 13 if we can determine that such requests were submitted by a parent or guardian.

Authorized agents may initiate a request on behalf of an individual using the same methods described above. Authorized agents will be required to provide proof of their authorization, and we may also require that the individual directly verify their identity and the authority of the authorized agent. Individuals may also provide us with a signed and dated power of attorney naming the authorized agent as their representative.

Responding to Requests. Within 10 days of receiving a request to delete, to correct, or to know, we will confirm receipt of the request and provide information about how we will process the request. We endeavor to respond to a verifiable request within forty-five (45) days of its receipt. If we require more time (up to 90 days), we will inform the Requestor of the reason and extension period in writing. We may deny the request if we cannot verify the individual’s identity or are legally permitted to deny the request, such as if doing so proves impossible or would involve disproportionate effort.

If we deny the request, we will explain the basis for the denial, provide or delete any personal information that is not subject to the denial, and refrain from using the personal information retained for any purpose other than permitted by the denial. Where required by law, we will also provide instructions on how the Requestor may appeal our decision or submit a complaint. We will maintain a record of the request and our response for 24 months. We do not charge a fee to process or respond to verifiable requests unless they are excessive, repetitive, or manifestly unfounded or if we are allowed to do so by law. If we determine that the request warrants a fee, we will tell the Requestor why we made that decision and provide them with a cost estimate before completing the request. If applicable state law grants the Requestor the right to appeal our denial of their request to exercise their privacy rights, they may appeal our denial by contacting us at [website link] or calling us at [phone number].

Do Not Sell or Share My Personal Information. To the extent we “sell” your personal information or disclose your personal information for targeted or behavioral advertising, you may have the right to opt out of those “sales” or disclosures on a going-forward basis at any time. To exercise this right, visit the “Do Not Sell or Share My Personal Information” link [hyperlink or put in footer of webpage].

You may also be able to restrict the collection of personal information through your device’s operating system or by disabling cookies, but doing so may prevent you from using the functionality of the websites. If your browser supports it, you can turn on the Global Privacy Control (GPC) to opt out of the “sale” or “sharing” of your personal data. We honor the GPC and other universal opt out signals where we are required to do so by applicable law. These are signals you can send from your browser to a website to convey your choice to exercise certain opt-out rights granted by individual states.

Some internet browsers have a “Do Not Track” feature that lets you tell websites that you do not want to have your online activities tracked. Given that there is not a uniform way that browsers communicate the “Do Not Track” signal, our website does not currently interpret, respond to or alter its practices when it receives “Do Not Track” signals.

Even if you opt out of the sharing or processing of your personal information for targeted or cross-context behavioral advertising, you may still see our ads online at other sites and apps, and we may still base aspects of ads on your interactions with us and the websites.

9. Children’s Privacy

Our websites are not intended for or designed to attract children under the age of 18, and we will not knowingly solicit or collect personal information from children we actually know are under 18.

10. Changes to this Policy

We may update this Policy to reflect changes in our privacy practices at any time and without prior notice to you. When we do so, we will update the Effective Date of the Policy, above. We encourage you to periodically review this Policy for the latest information on our privacy practices.

11. Contact Us

If you have any questions or comments about this Policy or our privacy practices, please contact us at [phone number] or [email].