California Personnel Privacy Notice

Last Updated: January 1, 2023

This California Personnel Privacy Notice (“Notice”) explains how Via Transportation, Inc. and its subsidiaries (collectively, “Via,” “we,” “our,” or “us”) collects, uses, discloses, and otherwise processes personal information about our California-based employees, officers, directors, contractors, freelancers, contingent workers, consultants and other outsourced and temporary workers, as well as applicants for any such role (collectively, “personnel”). This Notice also applies to family members or other individuals about whom we process personal information as a result of the relationships those individuals have with personnel (collectively, “related persons”).

This Notice does not apply to individuals who provide – or seek to provide – transportation, delivery, logistics, or other services by using the Via Platform (“Drivers”). In services featuring autonomous vehicles, Drivers may also include vehicle safety operators who support the operation of autonomous vehicles, which may not require manual human operation. The processing of Drivers’ personal information is addressed in Via’s Privacy Notice at https://ridewithvia.com/legal/privacy/.

This Notice is not a contract and does not create any legal rights or obligations. This Notice also is not intended to replace other notices or disclosures we may provide to you in connection with your role in our organization, which will supersede any conflicting disclosures contained in this Notice.
‍

What is Personal Information?

When we use the term “personal information” in this Notice, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an individual within the context of the individual’s role as a member of our personnel or a related person. It does not include aggregated information or de-identified information that is maintained in a form that is not capable of being associated with or reasonably linked to an individual person.

Our Collection and Use of Personal Information

1. Personnel

Collection of Personal Information

In connection with your role as a member of our personnel, we collect certain personal information about you, which may include:
‍

• Contact Information: such as your full name, email address (personal and work), home address, business address, telephone number and emergency contact information.
• Identification Materials: such as your image, social security number or other national identification number, passport number, driver’s license number or vehicle license plate number.
• Professional Information: such as your hire date, employment location, business unit, department, supervisor, job title, position/grade, hours and days worked, working arrangement, work restrictions or accommodations, employee identification number, licenses and certifications, attendance, career goals, performance reviews, disciplinary records and information needed to establish your eligibility to work for us, including visa information.  
• Education & Training Information: such as your highest level of education, the schools you attended and when you were in attendance, degrees, certificates or other educational qualifications you earned, and your transcripts or training records.
• Financial Information: such as your salary, bonus, benefits, expenses, stock or equity grants, bank account and routing information and corporate credit card number.
• Benefits Information: such as your eligibility for benefits, information about your family members and other related persons under your benefits, and claims relating to your benefits.
• Equal Opportunity Information: such as age, race, ethnicity, national origin, citizenship, sex, gender identity, sexual orientation, religion, disability or accommodation request, or marital or veteran status when you choose to provide it, but it will not be used in employment-related decisions unless specifically permitted by law.
• Audio / Visual Recordings: such as a recording of your image or voice in connection with phone calls, virtual meetings and conferences, and other events, where permitted by law.  
• Security Information: such as your work-related accounts and passwords, technical details about your use of work-related devices, your access to physical and electronic work-related locations, and photographs, videos and other visual images of you.
• Other Work-Related Information: We also collect any personal information you choose to share with us or we receive from a third party in connection with your work for us, a grievance you are involved in, an agreement you enter into with us or additional roles you take on as a part of our organization.

Although we often collect the personal information described above directly from you, we also collect this information from supervisors, colleagues, customers, vendors, publicly available sources and other third parties you may interact with as a member of our personnel. In addition, we may also collect this information through service providers and other third parties that collect it on our behalf, such as communications providers, payroll providers and benefits providers.

Please note that some of the information described above may also be considered “sensitive information” under applicable law. For more information, please see the “Sensitive Information” section below for more information.

Use of Personal Information

We use the personal information we collect about our personnel to:

• Conduct organizational planning and development, including budget planning and administration;
• Analyze and monitor compliance with our personnel and compliance policies and practices;
• Administer recruiting, onboarding, staffing, leave, personnel evaluations, promotions, performance management, training, discipline, participation in available activities or programs and any other processing in connection with work-related purposes;
• Authorize, grant, administer, monitor (including by video surveillance) and terminate access to or use of company systems, facilities, records, property and infrastructure;
• Communicate with and between personnel, as well as with designated emergency contacts;
• Support and manage personnel, including providing resources needed for personnel to perform their roles with us;
• Facilitate personnel compensation, payroll, and benefit planning and administration (e.g., salary, tax withholding, insurance);
• Conduct performance reviews and evaluations, as well as make decisions about promotions and job mobility;
• Manage business travel (e.g., car service/rentals, flights, hotels) and personnel expenses (e.g., reimbursement, corporate credit card);
• Operate our business, including marketing our personnel to customers, facilitating the work of our personnel and providing the products and services made available to our customers;
• Investigate, document and report work-related injuries, illness or grievances;
• Conduct internal investigations, audits, compliance, risk management, problem resolution and security operations;
• Fulfill contractual obligations to you and other third parties;
• Comply with applicable law, rule, regulation, legal proceeding and government investigations, including relating to tax reporting and immigration.

2. Related Persons

Collection of Personal Information

At times, we receive personal information about our personnel’s family members and other related persons in connection with emergency contacts and the benefits and services we provide, which may include:
‍

• Contact Information: such as full name, email address, home address, business address, telephone number and emergency contact information.
• Identification Materials: such as image, social security number or other national identification number, passport number, driver’s license number or vehicle license plate number.
• Benefits and Services Information: We also collect personal information necessary to extend benefits and benefit-related services, including insurance-related information, claims-related information, and disbursement-related information.

Although we often collect the personal information described above directly from our personnel, we also may collect this information directly from the related person, and from our benefit administrators. In addition, we may also collect this information through service providers and other third parties that collect it on our behalf, such as communications providers.

Use of Personal Information

We use the personal information we collect about related persons to:
‍

• Communicate about eligibility benefits and services, events or activities that are happening, or in the event of an emergency;
• Administer benefits and services;
• Respond to requests and inquiries;
• Conduct internal investigations, audits, compliance, risk management, problem resolution and security operations;
• Fulfill contractual obligations;
• Comply with applicable law, rule, regulation, legal proceeding and government investigations, including relating to tax reporting and immigration.

Processing of Sensitive Information

We may process personal information about our personnel or our personnel’s family members and other related persons that is sensitive in nature and is subject to special protection under applicable law ("sensitive information"). This information may include the following:
‍

• Social security number, driver’s license, state ID, passport number;
• Account log-in credentials, including passwords;
• Precise geolocation information;
• Financial account information for payroll purposes;
• Biometric data for the purpose of uniquely identifying personnel;
• Religious, political or philosophical beliefs, trade union membership; or
• Information relating to your health, disabilities, racial and ethnic origin, sexual orientation, and gender identity.

We collect this information from a variety of sources, including directly from you, from our benefits administrators, our service providers, or other third parties that perform services on our behalf. We process this sensitive information for a variety of reasons, which include understanding our employee demographics and addressing legal requirements. We do not share your sensitive information except when necessary for a business purpose or to provide you with applicable benefits, or when required for Via to fulfill a legal obligation or enforce our rights.

Via does not use or disclose your sensitive information except in the context of the employer-employee relationship, to prevent and investigate security incidents and fraudulent or malicious activity, for short-term transient use, to perform services on behalf of a business, to fulfill our legal obligations, to process the information without the purpose of inferring any characteristics about you, or with your consent. If we need to use or disclose your sensitive information for other reasons, we may provide you with an opportunity to limit our use of such information consistent with the applicable law.

Deidentified Information

We may at times receive – or process personal information to create – deidentified information that can no longer reasonably be used to infer information about, or otherwise be linked to, a particular individual or household. Where we maintain deidentified information, we will maintain and use the information in deidentified form and not attempt to reidentify the information except as required or permitted by law.
‍

Disclosure of Personal Information

Via does not sell your personal information to third parties or share your data for the purposes of cross-context behavioral advertising.

We may share personal information with the following third parties for the purposes described below:  

‍Within Via: We may share personal information relating to personnel and related persons within our family of companies for internal administrative purposes and uses that are consistent with this Notice. For example, the entity responsible for payroll may receive personal information about personnel employed by another Via entity in order to determine the proper compensation to be provided.

‍Benefit Administrators: We may share personal information with the third parties we engage to offer and administer benefits and services for personnel and related persons on our behalf. These third parties may also collect additional personal information from you in connection with these benefits and services, which will be subject to the relevant third party’s own privacy policies and notices.

‍Payroll and Tax Providers: We may share personal information with third parties who assist us in processing our payroll and other compensation-related obligations, including our tax withholding and reporting obligations.

‍Other Service Providers: We may engage other third parties to perform certain functions on our behalf in connection with the uses of personal information described in the “Our Collection and Use of Personal Information” section above. These third parties include but are not limited to fraud prevention and security services, background check services, communications services, and recruiting services. Depending on the function the third party serves, the service provider may process personal information on our behalf or have access to personal information while performing functions on our behalf.

‍Public Disclosure: We may disclose certain personal information about our personnel, such as name, job title, work-related contact information and experience, publicly in connection with our recruiting and business operations.

‍Business Transaction or Reorganization: We may take part in or be involved with a corporate business transaction, such as a merger, acquisition, joint venture, or financing or sale of company assets. We may disclose personal information to a third party during negotiation of, in connection with or as an asset in such a corporate business transaction. Personal information may also be disclosed in the event of insolvency, bankruptcy, or receivership.

‍Legal Obligations and Rights: We may disclose personal information to third parties, such as legal advisors, regulators, and law enforcement:
‍

• Social security number, driver’s license, state ID, passport number;
• Account log-in credentials, including passwords;
• Precise geolocation information;
• Financial account information for payroll purposes;
• Biometric data for the purpose of uniquely identifying personnel;
• Religious, political or philosophical beliefs, trade union membership; or
• Information relating to your health, disabilities, racial and ethnic origin, sexual orientation, and gender identity.

Consent: We may disclose personal information about you to certain other third parties with your consent.
‍

Your Privacy Rights

As a California resident, you may be able to exercise the following rights in relation to the personal information that we have collected about you (subject to certain limitations under applicable laws):
‍

• Right to know personal information. California residents have the right to know what personal information we have collected about them, including the categories of personal information; the categories of sources from which the personal information is collected; the business or commercial purpose for collecting, selling, or sharing personal information; the categories of third parties to whom we disclose personal information; and the specific pieces of personal information we have collected about them.
• Right to request deletion of personal information. California residents have the right to request that we delete personal information that we have collected from them. This right is subject to a number of limitations and exceptions, including when personal information is necessary to comply with other laws applicable to us, to protect against fraudulent or malicious activity, or where we need the information to exercise or defend against legal claims.
• Right to correction. California residents have the right to request a correction of inaccuracies in the personal information we have collected about them.
• Right to non-discrimination. Consumers have the right not to be discriminated against because they exercised any of these privacy rights.

Additionally, California consumers have the right to opt out of the sale of their personal information, the right to opt out of the sharing of such personal information with third parties for cross-context behavioral advertising purposes, and the right to limit the use of sensitive personal information if a business collects or processes that information to infer characteristics about a consumer. As noted above, Via does not sell or share personal information with third parties for these purposes and Via already makes limited use of sensitive personal information consistent with applicable laws.

How to Exercise Your Privacy Rights

To exercise any of the rights identified above, please submit a request specifying the right you wish to exercise by:
‍

• Contacting us at (917) 877-0915; or
• Emailing us at notices@ridewithvia.com.

Please note that we will only respond to verifiable requests. If we receive a request for information about you, we need to determine that it is actually coming from you, or somebody legally authorized to act for you. For this reason, if you request access to or deletion of personal information, we will ask for your name, contact information, state of residency, or other information about you and your account. We will also try to use any information that we have already collected about you in order to verify your request. We will apply authentication procedures that are appropriate to the nature of the request (e.g., deletion or access to information) and the type of personal information requested (e.g., the sensitivity and value of the information, the likelihood of fraudulent or malicious requests, and the risk of harm posed by unauthorized access or deletion). If we collect any additional personal information in response to your request, we will use that information only to verify your request.

In certain circumstances, we may decline a privacy rights request, particularly where you are not a resident of the State of California or where we are unable to verify your identity.

You may be permitted to use an authorized agent, as defined under the applicable law, to submit requests on your behalf. If an individual or entity claiming to be your authorized agent submits a request to access, delete, or correct your personal information, we will require the following information to verify the request: (a) a power of attorney valid under the laws of California from you or your authorized agent; or (b) sufficient evidence to show that you have: (i) provided the authorized agent signed permission to act on your behalf; and (ii) verified your own identity directly with us pursuant to the instructions set forth in this Notice or otherwise directly confirmed with us that you provided the authorized agent permission to submit the request on your behalf.
‍

Data Retention

We retain your information for as long as necessary to fulfill the purposes set out in this Notice and in accordance with the business purpose of processing that information and the applicable law. The criteria used to determine the period for which personal information about you will be retained varies depending on the business purpose under which we process the Personal Information. For example, where we process your personal information based on contractual obligations, we will generally retain the information for the duration of the contract plus some additional limited period of time that is necessary to comply with the law or which represents applicable statutes of limitations. As another example, if we have to apply a legal hold to information that is relevant to establishing a claim or defending against an actual or likely claim, we may retain your personal information for as long as the legal hold is in effect.
‍

Updates to this Notice

We will update this Notice from time to time, including to address changes in the Via Services, clarify or update our processes, and to comply with changing laws and regulations. When we make changes to this Notice, we will change the “Last Updated” date at the beginning of the Notice. If we make material changes, we will notify you. Such notice may be through email, pop-up notification, or by other means, including a prominently posted notice at the beginning of this Notice. All changes shall be effective from the date of publication unless otherwise provided in the notification. We encourage you to review this Notice periodically.
‍

Contact Us

If you have any questions or requests in connection with this Notice or other privacy-related matters, please contact notices@ridewithvia.com.