RideMETRO Privacy Policy
See ridemetro.org/privacy-policy for additional information.
METRO values your use of our automated Fare Collection System (‘Fare System’) including our RideMETRO Card (‘Fare Card’) and other fare payment products and services. METRO is committed to ensuring your privacy when you choose to use our Fare System products and services. This Fare System Privacy Policy addresses how we protect the information and Data collected whenever you use the Fare Card and/or other forms of fare payment accepted by METRO across the Fare System as well as the RideMETRO mobile application (‘Mobile App’), and whenever you use METRO’s Online RideStore (‘Website’). By using the Fare System, you acknowledge that you’ve read and agree to METRO’s Fare System privacy policy.
1. Definitions
The following definitions apply to this policy:
Aggregate Data – Aggregate Data is statistical information derived from collective Data that relates to a group or category of persons. Aggregate Data reflects the characteristics of a large group of anonymous people. METRO may use Aggregate Data for agency purposes. For example, METRO may use Aggregate Data to guide internal operations.
Anonymous Data or Anonymous Information – Anonymous Data or Anonymous Information is disaggregated Data from which all Personal Information has been removed, that does not identify or describe a person and that cannot be directly linked to a specific individual. METRO may use Anonymous Data for any of its statutorily authorized purposes and may make Anonymous Data available to third parties.
Cookie – A cookie is a small text file that a website can place on your computer’s hard drive in order, for example, to collect technical information about your activities on the website or to make it possible for you to use an online shopping cart to keep track of items you wish to purchase. The Cookie transmits the information back to the website’s computer and is the only computer that can read it.
Data – Data is a representation of information, including digital and non-digital formats, that is unorganized and not classified as actual “information” but may be classified as information once organized and/or interpreted.
Digital Wallet – Digital Wallet means a software application owned and offered by a third-party provider that stores a customer’s Fare Card as a fare payment credential. Digital Wallets allow users to store credit or debit card information in their mobile devices and enable the use of a mobile (virtual) credit/debit payment card in making Fare System payments.
Digital Wallet Provider – Digital Wallet Provider means a third-party entity that provides digital wallet products and services. METRO accepts Digital Wallets provided by Apple and Google.
Fare System – Fare System refers to METRO’s automated fare collection system, which in turn refers to the following collectively: fare collection equipment and facilities; the RideMETRO Card and other METRO fare payment products; the RideMETRO App, Online RideStore, METRO websites, mobile applications, and other web-based METRO fare collection items; fare collection data and information captured by METRO; and other products, items, supplies and services directly related to and utilized by METRO for the automated fare collection system.
Location Data or Location Information – Location Data or Location Information is mobile device geo-location data, including but not limited to, geolocation Data from GPS, cellular, Wi-Fi services, your mobile device IP address, or other similar technology. Location Data also includes your current, past, or future location based on mobile application usage or any route planning, trip planning, or multi-modal tools accessed by you.
Non-Personal Information – Non-Personal Information describes technical and related information that is not Personal information including deidentified and/or anonymized information and some publicly available information.
Online RideStore – The Online RideStore, referred to as the (‘Website’) in this policy, is METRO’s public Fare System website where users can find more information about the Fare Card and Mobile App, in addition to related products, services, features and programs. Go to https://fares.ridemetro.org for more information.
Personal Information – Personal information is information that is or can be about or related to an identifiable individual. If information is about a person, that information is personal information as long as one can identify the person that it is about. Information is not personal information if it, is deidentified, meaning it does not provide a way to identify the person it is about, otherwise made anonymous, or in some cases, if it is publicly available.
Personal Identifying Information (“PII”) – PII is Personal information that identifies or describes a person or can be directly linked to a specific individual by inference. Examples of PII collected by METRO include, but are not limited to, your name, billing address, employer information, telephone number, email address, security questions and answers, and information related to your mobile device and location if you use METRO’s mobile applications.
RideMETRO Card (‘Fare Card’) – The RideMETRO Card, interchangeable with “Fare Card” throughout this policy, is METRO’s transit Fare System payment card that can be issued to individuals and organizations. Use of this card is limited to the instructions, terms, and procedures established by METRO. A RideMETRO Card may be either physical (plastic), to be scanned like a standard payment card or it may be mobile (virtual) presented on a mobile device via the RideMETRO mobile application.
RideMETRO Mobile Application (‘Mobile App’) – The RideMETRO mobile application, interchangeable with “Mobile App” in this policy, is a METRO mobile application with features for customer account, fare payment management, and fare payment card management.
Transaction Data or Transaction Information – Transaction Data or Transaction Information are details relating to the ticket transactions made to access METRO services, including but not limited to, ticket purchase, activation, validation, access, and usage.
Website – The capitalized term “Website” is used interchangeably throughout this policy to refer to the Online RideStore. On the other hand, common use of the word “website” in this Fare System Privacy Policy retains its common meaning; notwithstanding the context in which the word, “website” is used should affect your interpretation.
2. Applicability
Effective Date
Changes to this Fare System Privacy Policy are effective on the date of the last update to this policy indicated in the policy itself or as indicated on our current Fare System website; when a policy document is linked on METRO’s webpage and made separately accessible, deference will be given to the last update reflected in the policy document itself, exclusive of any update reflected on METRO’s webpage.
The Fare System Privacy Policy applies upon your accessing the Website and to any and all Fare System-related use of the Mobile App and controls. This policy also applies once you share information to acquire from METRO or have otherwise gained possession of a physical or digital Fare Card and whenever you transact with the METRO Fare System using a personal credit card, debit card, prepaid card, or Digital Wallet. If you have any questions or concerns about the Fare System Privacy Policy, please contact webmaster@ridemetro.org.
Scope of Policy
This Fare System Privacy Policy covers customer privacy for METRO Fare System payments made using the following:
RideMETRO Card (i.e. physical cards)
RideMETRO App (i.e., use of a virtual RideMETRO Card)
Credit, Debit, or Prepaid cards (MC, Visa, Amex, Discover); and
Using stored credit/debit cards in Apple Pay and/or Google Wallet (‘Digital Wallets’)
This Fare System Privacy Policy supplements and incorporates METRO’s most recent Privacy Policy https://www.ridemetro.org/privacy-policy and https://transitiq.com/privacy/houston, which addresses METRO’s primary public-facing website (i.e. ridemetro.org) and the Mobile App. In the event of conflicting language or interpretation between the Privacy Policy and this Fare System Privacy Policy, the most specific language in this Fare System Privacy Policy, as last updated, controls.
3. Personal Information Collected
METRO may collect information from you when you utilize our Fare System. Examples of such information include but are not limited to: information used to create your account for your Fare Card, and information that may be created when you fund and pay for trips using your Fare Card including when you use it together with the Mobile App. Additional information is made available to METRO when you access or use the Mobile App, and Website.
METRO may use this information in the following ways:
To improve our Fare Card, Mobile App, and other Fare System products and services, in order to better serve you;
To optimize and improve the Website or other related METRO websites;
To respond to requests from public and government authorities;
To detect, prevent, or investigate potential security incidents, fraud, harmful, unauthorized, unethical, or illegal activity;
To provide important safety notices or otherwise notify you of emergency situations;
To allow METRO to better respond to your customer service requests;
To quickly process your transactions;
To send periodic emails or alerts regarding your card or mobile application use including but not limited to email, text, and push notifications; and
To protect the rights, privacy, safety or property, and security of you, us, and others.
Children's Personal Information
Pursuant to the Children’s Online Privacy Protection Act (“COPPA”), children under 13 years of age must have permission from a parent or legal guardian before providing Personal Information on a website or application. METRO complies with the requirements of COPPA and the Federal Trade Commission’s Rule interpreting COPPA. METRO’s Fare System products and services, including the Fare Card, along with its related online applications and store, are not directed to children nor are they intended for use by children. METRO does not knowingly collect Personal Information from children under the age of 13 without parental consent; notwithstanding , by interacting with this Fare System, you acknowledge and agree that Personal Information submitted in an email or through an online transaction will be treated as though it was submitted by an adult, and may, unless exempted by federal or state law, be subject to public release or public availability. If METRO learns that it has Personal Information on a child under the age of 13 without parental consent, access to that information by the child or any third party will immediately be denied and the information removed from METRO’s system(s).
Third Parties with whom METRO may share Personal Information
The Personal Information you voluntarily provide may be disclosed to third-party companies for the limited purposes of (1) reliably delivering, managing, administrating, and maintaining the Fare Card product and broader Fare System for your use, including corresponding products and services; (2) improving METRO's operations to align with customer needs; and (3) other purposes consistent with this Fare System Privacy Policy. METRO requires these third-party companies to maintain the security and confidentiality of the Personal Information and general METRO Data that they may receive to the same extent as METRO and prohibits them from using Personal Information for any other purposes. METRO will not otherwise disclose your information to a third party for reasons inconsistent with the aforementioned purposes; notwithstanding disclosure may be appropriate under the following exceptions: you agree to its disclosure; disclosure is required by law or court order; and when disclosure is legally required in connection with a law enforcement investigation or other legal proceeding.
METRO and its Fare System contractor(s) (e.g. third-party companies and other entities) do not sell, trade, lease, or otherwise disclose for commercial gain your Personal Information to anyone and will not do so, except when the purpose and manner of the disclosure has been disclosed to you prior to your providing that information. Additionally, METRO may hire companies to provide limited ancillary services on our behalf, such as processing credit card transactions, sending emails, or answering customer questions about our services. These companies may be provided with the Personal Information collected for and in the use of your fare payment card in order to deliver the service for which they are hired.
Retention of Personal Information
METRO and third parties will only store Personal Information that is necessary to maintain METRO customer accounts, to perform account functions such as billing, account settlement, or enforcement activities, to provide Fare System products and services, or as otherwise permitted by the Fare System Privacy Policy. The information collected through our Fare System is retained by us in accordance with the applicable records retention and disposition requirements of Texas and federal law.
Updating Personally Identifiable Information
METRO does not collect PII when you visit our websites or use our mobile applications unless you choose to provide that information to us. PII that you have provided to METRO can be reviewed and edited through the Online RideStore, (https://fares.ridemetro.org) and in the Mobile App. The Website and Mobile App use functions that can collect and store self-reported Personal Information. These functions enable customers to revise, update or review information that has been previously submitted by going back to the applicable function, logging- in and making the desired changes.
Complaints or problems regarding updating Personal Information should be submitted via the applicable METRO website or by email or telephone. If an adequate resolution is not received, please contact METRO customer service.
Emails Sent to METRO Containing Personal Information
The Fare System Privacy Policy does not apply to the content of emails transmitted directly to METRO. We discourage customers from sending Personal Information in an email directly to METRO in order to keep content, information or Data private.
4. Non-Personal Information Collected
Aggregate Data and Information
METRO may also combine the Personal Information provided by METRO Fare System customers in a non- identifiable format with other information to create Aggregate Data that may be disclosed to third parties. Aggregate Data is used by METRO to manage, evaluate and improve the METRO Fare Card program and Fare System, to inform other METRO initiatives and for the marketing of METRO’s fare cards, mobile app, and other Fare System products and services. Aggregate Data does not contain any information that could be used to contact or identify individual METRO Fare System customers or their accounts. For example, METRO may inform third parties regarding the number of METRO Fare Card accounts within a particular zip code. METRO requires third parties with whom Aggregate Data is shared to agree that they will not attempt to make information personally identifiable, such as by combining it with other databases. METRO may use Aggregate Data and provide Aggregate Data to others to generate statistical reports for the purpose of managing METRO operations.
Anonymous Data and Information
METRO may remove all Personal Information from Data developed as a byproduct of the use of the Fare System to create Anonymous Data that may be disclosed to third parties. METRO may use Anonymous Data for any of its statutorily authorized purposes and may make Anonymous Data available to third parties.
Anonymous Data does not contain any information that could be used to track, contact or identify individual METRO customers or their accounts. For example, METRO may share a dataset that includes information such as where and approximately when a sample of anonymous Fare Card and app users traveled on certain days in a given month. METRO requires third parties with whom Anonymous Data is shared to agree that they will not attempt to make Data or information personally identifiable, such as by combining it with other databases or reverse engineering the Data.
Website Information Collected and Stored Automatically
In the course of operating the Website, certain information may be collected automatically in logs or by Cookies. You may set your web browser to warn you whenever a website attempts to place a Cookie on your computer, or you may refuse to accept Cookies. METRO will use Cookies collected during your visit to its websites for the purpose of facilitating your use of our websites and for maintaining statistics concerning your use of our websites that will help us make improvements. Technical information collected by Cookies will not be linked to your Personal Information.
If you create, or are issued, a password in connection with the Website or Mobile App, actions or communications utilizing it will be attributed to you, even if someone else is using it. It is recommended that you keep your password confidential and not share it with anyone you have not authorized to use it on your behalf.
By using the Website and Mobile App, you acknowledge and agree that viewing, printing, or downloading any content from the Website or Mobile App grants you only a limited, nonexclusive, revocable license for use solely by you for your own personal use and not for republication, distribution, assignment, sublicense, transfer, sale, preparation of derivative works or other non-personal use. No part of any content, graphic or document may be reproduced in any form or incorporated into any information retrieval system, electronic or mechanical, other than for your personal use. Except for the limited rights expressly granted herein, all rights, title and interests in METRO websites and apps and all materials contained therein are retained by METRO. Your right to access the Website, Mobile App, and any other METRO websites and apps may be terminated at any time by METRO without notice.
METRO Website Log Activity for Statistical Analysis
METRO may track activity and functions on its Website in the form of log files on web servers. These logs are analyzed by third-party statistical analysis software solutions such as Google Analytics and Siteimprove, to provide visitor activity trend data. The Data gathered is used to better organize information contained on our websites and to improve your experience. These files log visitors to the Website, usually a standard procedure for hosting companies and a part of hosting services analytics. The information inside the log files includes internet protocol (“IP”) addresses, browser type, Internet Service Provider (“ISP”), date/time stamp, referring/exit pages, and possibly the number of mouse clicks. This information may be used to analyze trends, administer METRO websites, track your movement around our websites, and gather demographic information. IP addresses and other such information are not linked to any information that is PII and are not used to identify you on an individual level.
METRO may use third-party services to assist us in analyzing how our websites and mobile applications are used, including but not limited to the following:
Google Analytics and Google Firebase are analytics services offered by Google to track and report website and mobile application traffic. Google uses the Data collected to track and monitor the use of our services. This Data is shared with other Google services. Google may use the collected data to contextualize and personalize the advertisements of its own advertising network. For more information on the privacy practices of Google, please visit the Google privacy policy located at https://policies.google.com/privacy?hl=en(Open external link). You can opt-out of having your site activity available to Google Analytics by installing the Google Analytics opt-out browser add-on(Open external link). The add-on prevents the Google Analytics JavaScript (gtag.js, ga.js, analytics.js, and dc.js) that is running on websites from sharing information with Google Analytics about your visit activity.
Siteimprove is an analytics service utilized to track and report website traffic and accessibility compliance. Siteimprove uses the data collected to track and monitor the use of our services. This data is shared with other Siteimprove services. For more information on the privacy practices of Siteimprove, please visit the Siteimprove privacy policy located at https://siteimprove.com/en/privacy/(Open external link). To stop Siteimprove from storing Data about your usage of our websites, you can opt-out using an opt-out button.
Location Data and Information
Your use of the METRO Website and METRO mobile applications may also include collection of information about your location. The mobile applications use your precise current location via global positioning system (“GPS”) or other network location sources like Wi-Fi and cell towers. In order to use these location services, they must be turned on and available on your device. You are not required to provide Location Data for participation in the services and you have the option of declining collection of geolocation data. METRO will use geographic location information only for the limited purpose of improving its services. METRO will not distribute, sell or transfer this information to third parties. METRO may also combine Location and Transaction Data provided by you in a non-identifiable format that may be disclosed to third parties. The combined Data is used by METRO to improve METRO’s operations and Fare System. This combined Data does not contain any information that could be used to contact or identify individual METRO customers or their accounts.
5. Additional Data Privacy Considerations
METRO Website Security and Intrusion Detection
For METRO website security purposes and to ensure that the Website and related items remain available to all users, METRO may employ software programs to monitor network traffic to identify unauthorized attempts to upload or change information or otherwise cause damage. Except for authorized law enforcement investigations, court order, or other legal proceedings, no other attempts are made to identify individual users or their usage habits.
Accessing Mobile App and Website Using Personal Mobile Device
When the customer accesses the Website (https://fares.ridemetro.org/) or the Mobile App using a mobile device, location information, IP address, and other information may be collected by the mobile device’s platform provider, operating system provider, and/or the customer’s Data carrier. Before a customer accesses the Website or the Mobile App using a mobile device, he or she should review the terms of use and privacy policies of the customer’s platform provider, operating system provider, and data carrier to determine how they collect, use, and/or retain Personal Information including PII. METRO is not responsible for the terms of use or privacy policies of the platform providers, operating system providers, or data carriers, or the use of your Personal Information, by such entities.
Use of Digital Wallets with the METRO Fare System
Digital Wallets and Digital Wallet Providers are NOT subject to any METRO privacy or security policy. Digital Wallets are governed by separate terms of use, security, and privacy policies, which are likely accessible via their respective Digital Wallet Provider websites, listed respectively as follows:
1) Apple’s Digital Wallet
https://www.apple.com/legal/sla/
https://support.apple.com/en-us/HT210665
https://support.apple.com/en-us/HT203027
2) Google’s Digital Wallet
https://payments.google.com/payments/apis-secure/get_legal_document?ldt=googlepaytos&ldr=US
https://policies.google.com/privacy?hl=en-US
https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=en-GB
You agree and understand that your use of Digital Wallets to engage with METRO’s Fare System is at your own risk and that to use such Digital Wallets you should visit the individual sites of the Digital Wallets and review and agree to their privacy and security policies and other terms and conditions, as they may be different from those of METRO. METRO does not endorse Digital Wallets and Digital Wallet Providers. METRO EXPRESSLY DISCLAIMS ANY LIABILITY FOR DIGITAL WALLETS AND DIGITAL WALLET PROVIDERS. METRO does not guarantee and is not responsible for the privacy or security of Digital Wallets or the Digital Wallet providers’ websites, including the accuracy, completeness or reliability of their information.
Notifications and Beacons
METRO may send messages in the form of mobile notifications through its mobile applications. The mobile applications may use Location Data or Location Information to display notifications. Also, messages may be activated by beacon devices in a public space, which communicate location, transit, or event information.
Links to Other Websites
The METRO Website may contain links that allow access to third-party websites. These linked websites are not under the control of METRO, and METRO is not responsible for the content of any linked websites. METRO provides the links only as a convenience. A link does not constitute an endorsement by METRO of the content, viewpoint, accuracy, opinions, policies, products, services, or accessibility of its linked website. Once you follow the link to the third-party website, you are subject to the terms and conditions of that website, including, but not limited to, its privacy policy, if any.
Notice Regarding Texas Public Information Act
METRO is a government entity under Chapter 451 of the Texas Transportation Code. As such, METRO is subject to any requests for disclosure under the Texas Public Information Act, Chapter 552 of the Texas Government Code. All information, with certain limited exceptions, provided to METRO through the Website, mobile applications, and web forms may be subject to disclosure to the public upon request.
Disclaimers Regarding Website Usage
While we attempt to maintain accurate and current information on our Website, METRO does not warrant the accuracy or completeness of any material displayed on its websites or on any links accessed from its websites. METRO updates its websites periodically and may change any of the material at any time without notice. The materials posted on the Website may be out of date and METRO makes no commitment to update the materials.
METRO Utilizes GovDelivery To Send Email & SMS Alerts
Granicus GovDelivery terms and conditions(Open external link)
Granicus GovDelivery privacy policy(Open external link)
Payment Card Data
METRO accepts, processes, and transmits credit, debit card, and prepaid data from Fare System customers. (I.e. Visa, Mastercard, Discover, and American Express.) METRO and third parties secure credit or debit card account numbers and other payment card data. In doing so, METRO complies with and requires third-party contractors to implement and certify compliance with the latest Private Payment Card Industry Data Security Standards (PCI DSS).
Security and Safeguarding Information
METRO is committed to the security of your Personal Information. In addition to physical safeguards and mechanisms that we implement to protect and secure hardware containing Personal Information, your Personal Information is contained behind secured networks and is only accessible by a limited number of persons who have special access rights to such systems and are required to keep the information confidential. METRO complies with and requires third parties to comply with NIST Cybersecurity Framework, standards consistent with NIST or ISO27001 security standards and guidelines and all applicable state and federal laws. We implement a variety of security measures when you place an order, enter, submit or access your information, in order to maintain the safety of your Personal Information. The data and information that we receive may be stored on our servers which are scanned on a regular basis for security risks and known vulnerabilities, in order to make your use of our Fare System as safe as possible. We may also perform regular malware scanning.
6. Entire Fare System Privacy Policy
No warranties
METRO’s security measures and other safeguards are intended to deter and prevent hackers and others from unauthorized access to information that you provide to us. However, due to the nature of internet communications and information technology, we cannot provide, and expressly disclaim, assurance that the information you provide to us will remain free from loss, misuse, or alteration by third parties who, despite our efforts, obtain unauthorized access.
By using the METRO fare cards, METRO apps, METRO websites, and our Fare System, you acknowledge and agree that there is a risk that unauthorized third parties may engage in illegal activity, such as hacking or intercepting transmissions of Personal Information. You agree that the METRO is not responsible for any Data or Personal Information obtained: (i) in an unauthorized manner; (ii) by a third party as a result of your negligence or misuse of METRO fare cards, METRO apps, METRO websites, and our Fare System; or (iii) as a result of your disclosure of Personal Information to third parties. The information provided in this Fare System Privacy Policy should not be construed as giving business, legal, or other advice, or warranting as fail proof, the security of information provided through the METRO fare cards, METRO apps, METRO websites, and our Fare System.
Changes to the Fare System Privacy Policy
By using the METRO fare cards, METRO apps, METRO websites, and our Fare System, you acknowledge and agree that METRO reserves the right to change its Fare System Privacy Policy at any time. (I.e. a material change or non-material change.) You should periodically review this Policy to remain aware of such changes. A material change occurs when METRO proposes use of your Personal Information in a way that is materially different from the purposes for which you initially provided your Personal Information to us. If METRO makes material changes to the Fare System Privacy Policy, METRO will notify affected Fare System customers by means of posting a conspicuous notice on the current METRO Fare System website that material changes have been made. Non-material changes are those changes that do not affect the permissible uses or disclosures of Personal Information. In these instances, METRO does not need to post a special notice on the METRO Fare System website.
Severability
In the event that any language or provision in our Fare System Privacy Policy is held to be unenforceable or invalid, the remaining language or provisions in the Fare System Privacy Policy, as last updated, shall remain in full force and effect.
Governing Law and Venue
Our Fare System Privacy Policy shall be construed in accordance with the laws of the State of Texas, without regard to any conflict of law provisions. Any dispute arising under this policy shall be resolved exclusively by the state or federal courts located in Harris County, Texas that have jurisdiction over the matter.