Effective Date: April 12, 2021
This policy describes how Monterey-Salinas Transit will handle an individual’s private information.
Scope and Exceptions:
The policy aims to provide clear information for users and/or customers, to provide clear direction to Monterey-Salinas Transit employees, and to keep Monterey-Salinas Transit compliant with all applicable local, state, federal, and international data privacy regulations.
The policy includes both a section specifically around website policies and more general information about maintaining appropriate controls around privacy that apply to both the website and any applications MST may build and endorse.
Monterey-Salinas Transit works hard not to collect information that is not explicitly needed and avoids integrating tools that collect data in unsolicited ways.
Scope and Exceptions:
During the course of online interactions with MST’s website (mst.org), it is customary to collect information that a web browser provides including:
Additionally, as an individual browses the Site, MST collects information about the individual web pages that is viewed, what websites or search terms referred the individual to the Site, and information about how the user interacts with the Site.
MST collects Device Information using the following technologies:
- “Cookies” are data files that are placed on the device or computer and often include an anonymous unique identifier. For more information about cookies, and how to disable cookies, visit allaboutcookies.org.
- “Log files” track actions occurring on the Site, and collect data including the users IP address, browser type, Internet service provider, referring/exit pages, and date/time stamps.
- “Web beacons,” “tag,” and “pixels” are electronic files used to record information about how users browse the Site.
Additionally, when users purchase services or attempt to purchase services through the site, MST collects certain information, including name, billing address, shipping address, payment information (including credit card numbers), email address, and phone number. MST refers to this information as “Order Information.”
SHARING and TRANFERRING INDIVIDUAL’S INFORMATION
In no case does MST sell or rent Personal Data to marketers or unaffiliated third parties. MST shares your Personal Data with trusted entities, as outlined below.
Scope and Exceptions:
MST shares Personal Data internally to provide their Services and for internal administration purposes.
MST shares Personal Data with a limited number of their service providers. MST has service providers that provide services on their behalf, such as website hosting, data analysis, information technology and related infrastructure, customer service, email delivery, and auditing services. These service providers may need to access Personal Data to perform their services. MST authorizes such service providers to use or disclose the Personal Data only as necessary to perform services on MST’s behalf or to comply with legal requirements. MST requires such service providers to contractually commit to protect the security and confidentiality of Personal Data they process on MST’s behalf. MST’s service providers are predominantly located in the United States of America.
MST will share an individual’s Personal Information with third parties to help MST use your Personal Information, as described above. For example, MST may use Google Analytics to help MST understand how MST’s customers use the Site– individuals can read more about how Google uses their Personal Information here. Individuals can also opt-out of Google Analytics here.
Finally, MST may also share an individual’s Personal Information to comply with applicable laws and regulations, to respond to a subpoena, search warrant or other lawful request for information MST receives, or to otherwise protect MST’s rights.
DO NOT TRACK
Please note that MST does not alter their Site’s data collection and use practices when MST sees a Do Not Track signal from an individual’s browser.
USE BY MINORS
The Site is not intended for use by individuals under the age of thirteen (13), and MST requests that they not provide Personal Data through the Site.
Individuals have choices regarding MST’s use and disclosure of an individual’s Personal Data:
Scope and Exceptions:
Process for exercising data protection rights. In order to exercise an individual’s data protection rights, an individual may contact Monterey-Salinas Transit as described in the Contact Us section below. MST takes each request seriously. MST will comply with an individual’s request to the extent required by applicable law. MST will not be able to respond to a request if MST no longer holds an individual’s Personal Data. If an individual feels that they have not received a satisfactory response from MST, they may consult with the data protection authority in their country.
For an individual’s protection, MST may need to verify an individual’s identity before responding to their request, such as verifying that the email address from which they sent the request matches the email address that MST has on file. If MST no longer needs to process Personal Data about an individual in order to provide MST Services or MST Sites, MST will not maintain, acquire or process additional information in order to identify an individual for the purpose of responding to their request.
If an individual is a European resident, MST notes that they are processing and individual’s information in order to fulfill contracts MST might have with an individual (for example if an individual subscribes to service through the Site), or otherwise to pursue MST’s legitimate business interests listed above. Additionally, please note that an individual’s information will be transferred outside of Europe, including to Canada and the United States.
1. Opting out of receiving electronic communications from MST. If an individual no longer wants to receive marketing-related emails from MST, they may opt-out via the unsubscribe link included in such emails. MST will try to comply with an individual’s request(s) as soon as reasonably practicable. Please note that if an individual opts-out of receiving marketing-related emails from MST, MST may still send important administrative messages that are required to provide an individual with MST’s Services.
2. How an individual can see or change their account Personal Data. If an individual would like to review, correct, or update Personal Data that they have previously disclosed to MST, they may do so by signing in to their account or by contacting MST.
3. Individual’s data protection rights. Depending on an individual’s location and subject to applicable law, they may have the following rights with regard to the Personal Data MST controls about an individual:
3.1 The right to request confirmation of whether Monterey-Salinas Transit processes Personal Data relating to an individual, and if so, to request a copy of that Personal Data;
3.2 The right to request Monterey-Salinas Transit rectifies or updates an individual’s Personal Data that is inaccurate, incomplete or outdated; the right to request that Monterey-Salinas Transit erase an individual’s Personal Data in certain circumstances provided by law;
3.3 The right to request that Monterey-Salinas Transit restrict the use of an individual’s Personal Data in certain circumstances, such as while Monterey-Salinas Transit considers another request that an individual may have submitted (including a request that Monterey-Salinas Transit make an update to an individual’s Personal Data);
3.4 The right to request that MST exports to another company, where technically feasible, an individual’s Personal Data that MST holds in order to provide services to an individual. Where the processing of an individual’s Personal Data is based on an individual’s previously given consent, an individual has the right to withdraw their consent at any time. Individuals may also have the right to object to the processing of their Personal Data on grounds relating to their particular situation.
HANDLING PRIVATE DATA
Private data including PII (personally identifiable information; for example, name and email) must be handled in accordance with MST’s Data Classification Policy. At a minimum, any such data must be encrypted at rest and in transit. It must also have appropriate authorization and auditing so that MST is sure that the people accessing the data have the right to do so and that any access is trackable.
Attn: Customer Service
19 Upper Ragsdale Drive, Suite 200
Monterey, CA 93940
Phone: 1-888-MST-BUS1 (888) 678-2871) / TTY/TDD 831-393-8111 / 711 Relay
April 12, 2021