The information in this California Privacy Notice is provided to help Users who reside in California understand their rights and to provide other information required under the California Consumer Privacy Act of 2018 and the California Privacy Rights Act of 2020 (together, the “CCPA”).
Users residing in California should consult this document in addition to Via’s primary Privacy Notice. Please refer to the information in this California Privacy Notice if there are any conflicts between the two. The terms used in this California Privacy Notice have the same definitions provided in the Privacy Notice, unless they are expressly given a new definition here or in the CCPA.
As with the primary Privacy Notice, this California Privacy Notice does not apply to instances in which Via serves as a processor or service provider to Enterprise Customers. In those instances, Via will collect, use, share, disclose, and otherwise process personal information of individuals using their services as directed by each individual Enterprise Customer.
WHAT IS THE PERSONAL INFORMATION OF CALIFORNIA USERS?
In California, “personal information” is any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household. However, personal information does not include:
- Publicly available information, which may be found in publicly available government records.
- Deidentified or aggregated information.
- Certain types of information that are not covered by the CCPA, including certain types of health or medical information, certain information collected for certain financial products and services or for credit reports, certain information held by the department of motor vehicles, and certain information about motor vehicle ownership.
In this California Privacy Notice, “consumers” and “Users” refers to California residents, as defined under the CCPA.
COLLECTION AND DISCLOSURE OF PERSONAL INFORMATION
The categories of personal information Via collects depends on how you use the Via Services. For example, we collect and use information differently depending on whether a consumer is a Rider, Driver, Delivery User, Enterprise Platform User, or Visitor.
Via may disclose personal information to third parties who are authorized as our service providers or business partners and have contractual limitations as to their use and disclosure of personal information. Additionally, we may disclose personal information to third parties if you use the Via Services to interact with those third parties or direct us to share your personal information with them. We disclose this information for “business purposes,” as defined in the CCPA, in a manner that is reasonably necessary and proportionate to achieve the relevant operational purpose. For more information about the business purposes for which we collect, use, share, disclose, and otherwise process personal information, please see the “How We Use Personal Information” and “How We Share Or Disclose Personal Information” sections of our Privacy Notice.
In the last 12 months, we have collected, used, and disclosed the following categories of personal information, as these categories are defined in the CCPA.
- Identifiers. Examples of personal information in this category include names, email addresses, User names, phone numbers, postal addresses, government-issued identifiers, online identifiers, internet protocol addresses, and similar identifiers. We have disclosed certain information in this category for a business purpose to service providers (including but not limited to security and fraud prevention vendors, background check providers, analytics providers, customer support providers, payment processing providers), as well as to other third parties such as regulators, government agencies, and insurers. As noted in the Privacy Notice, limited information in this category is also provided to Drivers and Riders to enable them to use the Via Services to arrange and provide transportation or delivery services.
- Personal information as defined in Cal. Civ. Code § 1798.80(e). Examples of personal information in this category include names, email addresses, phone numbers, driver’s license or state identification card numbers, physical characteristics or descriptions, insurance policy numbers, employment, and bank account information. We have disclosed certain information in this category for a business purpose to service providers (including but not limited to security and fraud prevention vendors, background check providers, analytics providers, customer support providers, payment processing providers), as well as to other third parties such as regulators, government agencies, and insurers. As noted in the Privacy Notice, limited information in this category is also provided to Drivers, Riders, and Delivery Users to enable them to use the Via Services to arrange and provide transportation or delivery services.
- Protected classification characteristics under California or federal law. Examples of personal information in this category include information about Users’ medical conditions or disability, collected solely where required by Enterprise Customers to verify User eligibility for paratransit services. To the extent we collect information that is considered to have protected classification characteristics under the CCPA, we may disclose it for a business purpose to service providers (including but not limited to customer support providers), as well as to other third parties such as government agencies.
- Commercial information. Examples include transaction records showing services obtained, considered, or requested through your use of the Via Services. We have disclosed certain information in this category for a business purpose to service providers (including but not limited to customer support providers, payment processing providers), as well as to other third parties such as regulators and government agencies.
- Biometric information. This category includes an individual’s physiological, biological or behavioral characteristics which can be used to establish individual identity, including imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings. To the extent we collect information that is considered to be biometric information under the CCPA, we may disclose it for a business purpose to service providers (including but not limited to customer support providers), as well as to other third parties such as government agencies.
- Internet or other electronic network activity. This category includes information about how consumers interact with the Via Websites, Via Apps, or the Enterprise Platform, including device information, online identifiers, usage information, access logs, or analytics data. We have disclosed certain information in this category for a business purpose to service providers (including but not limited to security and fraud prevention vendors, analytics providers).
- General geolocation data. Consumers’ internet protocol addresses may provide information about their general locations. We may disclose information in this category for a business purpose to service providers (including but not limited to analytics providers).
- Sensory data. Examples include audio, electronic, visual, and similar information, including photographs or recordings that may be provided to our customer support team or collected through in vehicle recording. We have disclosed certain information in this category for a business purpose to service providers (including but not limited to customer support providers), as well as to other third parties such as government agencies and insurers.
- Professional or employment-related information. Examples include employment information provided when a consumer signs up for certain Via Services or marketing communications, or information relevant to background checks and eligibility to use the Via Services as a Driver. We have disclosed certain information in this category for a business purpose to service providers (including but not limited to background check providers, communications providers), as well as to other third parties such as regulators or government agencies.
- Inferences drawn from any of the information above. We may draw inferences based on information that you provide to us or which is collected automatically during your interaction with the Via Services. To the extent we collect information that is considered to be inferences under the CCPA, we may disclose it for a business purpose to certain service providers (including but not limited to communications providers, marketing and social media services).
- Sensitive personal information, as defined in the CCPA. We may collect use and disclose sensitive personal information for limited purposes, including to perform the services reasonably expected by a consumer; to prevent, detect, or investigate security incidents; to prevent and address malicious, deceptive, fraudulent, or illegal actions; to protect individuals’ safety; for short-term transient uses; to enable service providers to perform their contracted services; to maintain or improve the quality or safety of a service; and to otherwise collect or process sensitive personal information without the purpose of inferring characteristics about the consumer. Below are the specific categories of sensitive personal information that we collected, used and disclosed in the last 12 months:
- Driver’s license and Social Security numbers: We collect drivers’ license numbers and Social Security Numbers from Drivers to comply with regulatory requirements and for security and fraud prevention. We have disclosed certain information in this category for a business purpose to service providers (including but not limited to security and fraud prevention vendors, background check providers, analytics providers, customer support providers, payment processing providers), as well as to other third parties such as regulators, government agencies, and insurers.
- Account login information: We collect your User Account credentials, including login information, to be able to provide the Services to you and for security and fraud prevention. We may disclose certain information in this category to service providers, including for security and fraud prevention purposes.
- Precise geolocation as defined in Cal. Civ. Code 1798.140(w): California’s Civil Code defines your precise geolocation as data that could be used to locate an individual within a radius of 1,850 feet. We collect this information when Riders, Drivers, and Delivery Users use the Via Apps to request and receive transportation or delivery services. We disclose certain information in this category for a business purpose to service providers, as well as to other third parties such as regulators, government agencies, and insurers.
- Other sensitive personal information. We do not generally collect other types of sensitive personal information. However, Users or others communicating with us on their behalf may choose to provide this information in response to optional surveys, in customer support communications, or in order to facilitate services available through the Via Services (e.g., a Rider may decide to inform us that she has a medical condition when requesting wheelchair-accessible service or may provide us with their own medical documentation to verify eligibility for paratransit services). We may disclose this information for a business purpose to service providers (including customer support providers), as well as to other third parties such as regulators, government agencies, and insurers.
Please note that only a limited subset of information in each category of personal information and sensitive personal information identified above may be collected from California consumers or disclosed to third parties for a business purpose. Some personal information included in these categories may overlap with other categories. Please see the “What Information Is Collected” section of our Privacy Notice for information about the sources from which we may collect personal information.
TARGETED ADVERTISING AND ANALYTICS
Our use of tracking technologies, such as pixels and cookies, may be considered a “sale” or “sharing” of personal information under applicable law but we do not otherwise sell your personal information. We use third-party tools that market our Via Services online, measure the marketing efforts, identify users that are interested in our Via Services, etc. This is done through tracking technologies on our Via Website. By using this technology, we may share information, such as device information, online identifiers, and online behavior information, with these third parties. These disclosures may qualify as the sale of personal information or the sharing or processing of personal information for the purpose of displaying advertisements that are selected based on personal data obtained or inferred over time from an individual’s activities across businesses or distinctly-branded websites, applications, or other services (otherwise known as “cross-context behavioral advertising”).
You can opt out of the disclosure of your personal information for these purposes at any time through our cookie preference tool on our Website or by contacting us as provided below.
We do not sell or share the personal information of individuals we know to be under the age of sixteen (16), as our Services are not designed for use by individuals under this age threshold.
WHAT ARE MY RIGHTS AS A CALIFORNIA RESIDENT?
In addition to the rights listed in the “Your Rights” section of our main Privacy Notice, and as detailed in the Targeted Advertising and Analytics section, California consumers may have certain rights with respect to their personal information, subject to certain limitations and exceptions in the CCPA, which may include:
- Right to know personal information. Consumers have the right to know what personal information we have collected about them, including the categories of personal information; the categories of sources from which the personal information is collected; the business or commercial purpose for collecting, selling, or sharing personal information; the categories of third parties to whom we disclose personal information; and the specific pieces of personal information we have collected about them.
- Right of non-discrimination. Consumers have the right not to be discriminated against because they exercised privacy rights provided under the CCPA.
- “Shine the Light.” Consumers may also have the right to request information about whether and how their information is disclosed to third parties for their direct marketing purposes under California’s “Shine the Light” law (Cal. Civ. Code §1798.83).
- Right to limit the use or disclosure of sensitive personal information. Consumers have the right to limit the use of their personal sensitive information.
Under Cal. Civ. Code § 1789.3, California residents may report complaints to the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs by contacting them in writing at 1625 North Market Blvd., Suite N 112 Sacramento, CA 95834, or by telephone at (800) 952-5210 or (916) 445-1254. You can also write to the relevant address listed here, or contact us by telephone at (917) 877-0915.
DO NOT TRACK
Our website responds to 'Do Not Track' (DNT) and Global Privacy Control (GPC) signals, and when such a signal is detected, we will disable certain tracking technologies.
AS A CALIFORNIA RESIDENT, HOW CAN I EXERCISE MY RIGHTS?
To submit requests to Via to exercise your rights described above, please use one of the following methods:
- Email support@ridewithvia.com with the subject line “Attn: Legal, California Rights Request”
- Call us at 1-833-917-0697
- You may also be able to submit a request to delete your personal information in the “Account” page of your Via App
Please note that we will only respond to verifiable requests. If we receive a request for information about you, we need to determine whether it is actually coming from you, or somebody legally authorized to act for you. For this reason, if you request access to or deletion of personal information, we will ask for your name, contact information, state of residency, or other information about you and your account. We will also try to use any information that we have already collected about you in order to verify your request. We will apply authentication procedures that are appropriate to the nature of the request (e.g., deletion or access to information) and the type of personal information requested (e.g., the sensitivity and value of the information, the likelihood of fraudulent or malicious requests, and the risk of harm posed by unauthorized access or deletion). If we collect any additional personal information in response to your request, we will use that information only to verify your request.
In certain circumstances, you may be permitted to use an authorized agent, as defined in the CCPA, to submit requests on your behalf. If an individual or entity claiming to be your authorized agent submits a request to access, delete, or correct your personal information, we will require the following information to verify the request: (a) a power of attorney valid under the laws of California from you or your authorized agent; or (b) sufficient evidence to show that you have: (i) provided the authorized agent signed permission to act on your behalf; and (ii) verified your own identity directly with us pursuant to the instructions set forth in this California Privacy Notice or otherwise directly confirmed with us that you provided the authorized agent permission to submit the request on your behalf.