This Passport Payments Privacy Supplement (“Supplement”) explains how Passport Labs, Inc. (“Passport,” “we,” or “us”) collects, uses, and shares personal information when we provide payment-related services under the Passport Payments brand (the “Payments Services”).

This Supplement applies in addition to the Passport Privacy Notice and, where applicable, Your U.S. State Privacy Rights notice. If there is any conflict between this Supplement and the Passport Privacy Notice with respect to the Payments Services, this Supplement will prevail.

1. Scope

This Supplement applies when:

• You use Passport Payments in connection with parking, permits, citations, or other public-sector payments.
• You are a Customer (e.g., municipality or public-sector entity) or Customer Employee who uses Passport Payments to accept, process, or reconcile payments.
• You are a Consumer who pays a fee, fine, or other amount through a payment page, portal, POS terminal, or integration powered by Passport Payments.

When we provide Passport Payments to a Customer, we may act as a service provider/processor or as a business/controller (for example, when we act as merchant of record). Our role in a particular transaction may affect which privacy rights you can exercise and with whom. If you have questions about how a specific Customer uses your information, please contact that Customer directly.

2. Additional Categories of Personal Information for Payments

In addition to the categories described in Passport Privacy Notice, we may collect, generate, or receive the following types of information when providing the Payments Services:

• Payment credentials and account details
  • Payment card number, expiration date, and security code (CVV/CVC)
  • Bank account and routing numbers or other ACH details
  • Digital wallet identifiers (e.g., tokenized card IDs)
• Transaction information
  • Transaction date and time, amount, currency, merchant/customer name, and location
  • Payment channel (e.g., online, mobile)
  • Invoice, permit, ticket, or citation identifiers associated with the payment
• Fraud-prevention and risk data
  • Device and network identifiers, geolocation data (where permitted), and usage patterns
  • Risk scores, flags, or other assessments generated by us or our fraud-prevention providers
• Regulatory and compliance information
  • Information needed to comply with card-network rules, anti-money-laundering (AML), sanctions, and other financial or public-sector regulations (for example, identity verification data or records of screening checks), where applicable.

3. How We Use Personal Information for Payments

We use payment-related personal information for the purposes described in Passport Privacy Notice, and, in particular, to:

• Authorize, process, and settle transactions, including routing transactions through acquiring banks, card networks, payment processors, or ACH networks.
• Provide a unified payment platform for our Customers, including reconciliation, reporting, refunds, chargebacks, and dispute handling across departments and payment channels.
• Prevent fraud and secure the Payments Services, including detecting card testing, unusual transaction patterns, or other suspicious activity, and enforcing velocity or other risk controls.
• Comply with legal, regulatory, and card-network requirements, including recordkeeping, audit, accounting, and risk management obligations.
  Support Customer finance and operations, for example by providing dashboards, reports, and analytics about payment flows (typically in aggregated or de-identified form where feasible).

We do not use payment card numbers, bank account numbers, or similar financial credentials for cross-context behavioral advertising or for unrelated marketing.

4. How We Share Personal Information for Payments

In addition to the sharing described in our Passport Privacy Notice, we may share payment-related personal information with:

• Financial institutions and payment networks
  • Acquiring banks, card networks, and payment processors that authorize and settle transactions.
  • ACH operators and financial institutions involved in bank transfers.
• Fraud-prevention, security, and risk-management providers
  • Service providers that offer fraud screening, device fingerprinting, address verification, and chargeback management.
• Customer’s systems and vendors
  • Where a Customer has integrated Passport Payments with its own finance, court, enforcement, or ERP systems, we may transmit payment and transaction data into those systems and, where directed by the Customer, to their other vendors.
• Regulators and public authorities
  • Government agencies, courts, or law-enforcement entities where necessary to comply with law, support audits, or respond to lawful requests.

We do not sell or share payment credentials (such as full card numbers or bank account numbers) for targeted advertising or for third parties’ independent marketing purposes.

5. Security

Passport Payments is designed to align with industry security standards, including PCI-DSS Level 1 for payment processing and SOC 2 Type II for broader controls.

Among other measures, we:

• Use encryption and tokenization to protect card data and other sensitive payment information in transit and at rest.
• Limit access to payment data to personnel and service providers with a legitimate need.
• Monitor systems for potential fraud and security incidents.

No system is completely secure, and we cannot guarantee absolute security, but we design Passport Payments with industry-standard protections in mind.

6. Retention of Payment Information

We retain payment-related personal information for as long as reasonably necessary to:

• Complete the transactions you request and provide the Payments Services;
• Support our Customers’ reconciliation, reporting, and audit needs; and
• Comply with legal, regulatory, tax, accounting, and card-network requirements.

Because those obligations can vary by jurisdiction and transaction type, retention periods differ across record types. We apply an internal retention schedule to payment data and securely delete or de-identify records when they are no longer needed, unless a longer period is required or permitted by law.

7. Your Privacy Rights and Payments

Your rights with respect to personal information, including access, deletion, correction, portability, and opt-out rights where available, are described in our U.S. State Privacy Rights Notice and any other region-specific supplements that apply to you.

Where we process your payment information as a service provider/processor on behalf of a Customer, we may be required to redirect your request to that Customer, and we will inform you if that is the case.

You can exercise your rights using the methods described in the Privacy Policy and U.S. State Privacy Rights Notice (for example, through the “your privacy choices” tab, data subject rights (DSR) center, or by emailing privacy@passportinc.com), or by contacting the relevant Customer if you made a payment directly to them.