This California Privacy Notice and Notice at Collection (“California Notice”) supplements our general Privacy Policy and is provided pursuant to the California Consumer Privacy Act, as amended (“CCPA”). It applies only to California residents and describes our online and offline practices for collecting, processing, and disclosing personal information when we act as a “business” under the CCPA.

1. Notice at Collection

We may collect (and may have collected during the last 12 months of the US Notice) the following categories of personal information about you:

2. Categories of Sources of Personal Information

We collect personal information from the following sources:

• Directly from you, for example when you use our Digital Platforms to park, obtain a permit, or when Customers provide your contact details to use our Services.
• Indirectly from you, by observing your activity on our Website and Digital Platforms.
• From our Customers and their employees.
• From third parties, such as analytics providers and other service providers.

We use personal information for the following business purposes:

• To provide our Services, including parking, permit, and payment services. This includes collecting data Consumers submit through our Website and Digital Platforms and transferring that data to our Customers.
• To manage our relationships with Customers, including providing account access and facilitating communications.
• To help ensure security and integrity, where the use of personal information is reasonably necessary and proportionate for those purposes.
• To debug and repair errors that impair existing intended functionality.
• To perform services on behalf of our Customers, such as maintaining or servicing accounts, providing customer support, processing or fulfilling orders and transactions, verifying Customer information, providing analytics or storage, and similar support services.
• To support our advertising and marketing activities, as permitted by law.
• To conduct internal research for technological development and analytics.
• To improve, upgrade, and enhance the Services.

For more information about the purposes for which we collect personal information and our sources of collection, please see our Privacy Notice.

3. Disclosure of Personal Information

In the last 12 months of the US Notice, we may have shared the categories of personal information listed below for a business purpose with the corresponding categories of third parties. For more details on the business purpose(s) for which, and the third parties, we share data with, see What We Collect and How We Use It section in our Privacy Policy.

Sensitive Personal Information

Some of the personal information described in the categories above is considered “Sensitive Personal Information” under the CCPA. This may include:

• Government identifiers such as driver’s license number, state identification card number, and, where applicable, social security number;
• Financial information such as credit or debit card number together with any required security code or access credentials, and bank account information; and
• Precise geolocation information derived from your device when you enable location services for parking, permitting, or related features.

We use Sensitive Personal Information only as reasonably necessary and proportionate to:

• Provide the services you request (for example, processing payments and facilitating parking, permits, and citations);
• Verify your identity and eligibility where required;
• Prevent fraud and secure our services, systems, and users; and
• Comply with legal, regulatory, and contractual obligations.

We do not use Sensitive Personal Information to infer characteristics about you, and we do not sell or share Sensitive Personal Information for cross-context behavioral advertising.

4. Sale or Sharing of Personal Information

In the last 12 months, we have disclosed certain personal information (such as network identifiers and inferences about your preferences) to third-party analytics and advertising providers in connection with operating and improving our Website and Digital Platforms. Depending on how such activities are interpreted under California law, this disclosure may be considered a “sale” or “sharing” of personal information. You can opt out of such “sales” or “sharing” by visiting our “your privacy choices” page.

We do not sell the personal information of individuals we know are under 16 years of age.

5. Data Retention

We strive to limit retention of your personal information for as long as we reasonably need it to fulfill the purpose for which we have collected it and, if applicable, as long as permitted or required by legal, regulatory or industry retention requirements.

6. California Consumer Privacy Rights

Subject to exceptions and limitations, the CCPA provides California residents with the following rights, which apply only when we act as a “business” or “controller,” rather than a “service provider” or “processor.”

Right to Know / Access

You may have the right to know what personal information we have collected about you, including the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, “selling,” or “sharing” personal information or processing for “targeted advertising,” the categories of third parties to whom we disclose personal information, the categories of personal information disclosed to third parties, and the specific pieces of personal information we have collected about you in a usable format.

Right to Request Deletion

You have the right to request that we delete personal information we collected from you.

Right to Correct Inaccurate Information

You have the right to request that we correct inaccurate personal information that we hold about you.

Right to Opt Out of Sales and Sharing.

You have the right to opt out of our processing of your personal information for “targeted advertising” and of any “sale” or “sharing” of your personal information.

Right to Request Removal of Content

California residents under the age of 18 may make requests to remove content.

Shine the Light Requests

You may request information regarding our disclosure of certain personal information to third parties for their own direct marketing purposes, as permitted by California’s “Shine the Light” law.

We do not offer a separate right to limit our use or disclosure of sensitive personal information because we only use Sensitive Personal Information for purposes permitted by the CCPA (such as to provide the services, prevent fraud, and comply with law).

7. Exercising Your Privacy Rights

You may exercise the rights described above (other than the right to opt out of sales and sharing) by submitting a verifiable consumer request to us. You can do this by:

• Visiting our data subject rights (DSR) center, or
• Emailing us at privacy@passportinc.com with the subject line “California Privacy Request.”

If you are an authorized agent submitting a request on behalf of a consumer, we may ask you to provide documentation showing your authority to act on the consumer’s behalf.

To protect consumers’ privacy and security, we require a verifiable consumer request (except for requests to opt out of sales and sharing) so we can reasonably confirm your identity and properly understand and respond to your request. Please note that the CCPA includes certain limitations and exceptions to these rights, which may mean we deny or limit our response to some requests.

Our Commitment Not to Discriminate

Consistent with the CCPA, we will not discriminate against you for exercising any of your CCPA rights.

Privacy Rights in Your State of Residence

The laws of your state of residence may give you specific rights regarding how we collect, use, and disclose your personal information.

The categories of personal information we collect, and their sources, are described in What We Collect and How We Use It section in our Privacy Policy.

We disclose personal information to the categories of recipients as described in “Disclosure of Personal Information” section in California Notice above and How We Share Personal Information section in our Privacy Policy. In many cases, the practices described in California Notice also apply to residents of other U.S. states.

We do not use automated decision-making to evaluate or predict personal characteristics in a way that produces legal or similarly significant effects. As a result, we do not offer a separate right to control such automated decision-making or profiling.

Depending on your state of residence, and subject to legal limitations and exceptions, you may be able to exercise some or all of the following rights:

• Right to Know. To confirm whether we process personal information about you and, where applicable, to receive certain details about that processing.
• Right to Access and Portability. To access the personal information we have collected about you and, where required by law, receive it in a portable and, where technically feasible, readily usable format that allows you to transmit it to another entity.
• Right to Correction. To correct inaccuracies in your personal information, taking into account the nature of the information and the purposes for which we process it.
• Right to Control Sensitive Personal Information. To exercise control over our collection and processing of certain sensitive personal information (if any).
• Right to Opt Out of Targeted Advertising. To opt out of processing for targeted advertising where we engage in it as defined by applicable state law. We do not use personal information for targeted advertising in connection with our Services.
• Right to Opt Out of Sales / Sharing. To opt out of the sale of personal information (and, where applicable, sharing for cross-context behavioral advertising) as defined by law. We do not sell personal information to data brokers. To the extent certain website-only analytics or conversion-related disclosures are deemed a “sale” or “sharing” under California law, you may opt out via our “Your Privacy Choices” page.
• Right to Deletion. To request that we delete personal information we maintain about you, subject to applicable exceptions.
• Right to Withdraw Consent. Where our processing is based on your consent, to withdraw that consent.

Some states also provide a right not to receive discriminatory or retaliatory treatment for exercising these rights.

To exercise any of the rights described above, please use the our data subject rights (DSR) center or email us at privacy@passportinc.com with the subject line “Privacy Request.” We may request additional information to verify your identity and, where applicable, your authority to make the request.

Your state of residence may also give you the right to appeal our decision regarding your request. If this right applies, we will include information about how to submit an appeal in our response. You may also contact your state’s attorney general or a similar supervisory authority in your jurisdiction to raise a concern or complaint about our handling of your personal information or your request.