Privacy Policy

Revised March 15, 2019

Thank you for visiting the Metropolitan Transportation Authority’s (“MTA”, “us” or “we”) OMNY Website. Cubic Transportation Systems, Inc. (“Cubic”) maintains this OMNY Website on behalf of the MTA. The OMNY Website is designed to provide customers (“you” or “user”) with access to OMNY information and the ability to maintain your registered OMNY Account. This Privacy Policy describes the MTA’s privacy practices regarding the collection, use, and disclosure of your Personal Information when you use the OMNY fare payment system (“OMNY”), the OMNY Website and OMNY Customer Service (collectively, “OMNY Products”). The OMNY Terms of Service provides that by using OMNY and/or registering for an OMNY Account, a customer allows the MTA, its affiliates and subsidiaries, and certain third parties access to your Personal Information in accordance with the provisions of the Terms of Service and this Privacy Policy. The MTA is committed to protecting your privacy when you use OMNY Products, and when we communicate with you, such as through our newsletters and alerts.

  1. PERSONAL INFORMATION WE COLLECT

    For purposes of this Privacy Policy, "Personal Information" means any information concerning a natural person that can be linked to that person. Examples of Personal Information include name, email address, mailing address, phone number, username (if applicable) and password to register for an OMNY Account and access, if applicable, other password-protected areas of the OMNY Website, credit or debit card number, and device ID if you access the OMNY Website on a smart phone, tablet or other smart device. Some OMNY Products require you to provide personal information, such as your name and contact information, while others automatically collect information from your device, such as browser information.

    Information you give us

    Personal Information you may provide through the OMNY Products includes:

    • Contact information. We may collect your contact details (such as your name, e-mail, and phone number) upon request, and when you provide it to us through the OMNY Website, an OMNY Customer Service representative or otherwise.
    • Account information. You can register for an OMNY Account by (i) submitting your e-mail address and (ii) creating a (a) password; (b) personal identification number (“PIN”), that will be used to access account management features via OMNY Customer Service; and (c) answers to security questions that will support the setting of a password or PIN ((i) and (ii) collectively, “Account Information”). If you register for an OMNY Account, we collect the Account Information you provide to create and administer your OMNY Account. This Account Information may be collected by electronic submission online, through the OMNY Website, or via OMNY Customer Service. If you register for an OMNY Account, your transaction and travel history can be tracked through your OMNY Account, and you can access this information for a period of up to 90 days by logging into your OMNY Account. By way of clarification, if you have a registered OMNY Account, each tap you make at an OMNY reader with a Payment Method that is registered to that Account can be linked to your OMNY Account.
    • Payment information. We collect your credit card or other payment card information when you (i) tap your contactless card or digital wallet or wearable (individually and collectively, “Payment Method(s)”) at an OMNY reader; (ii) register a credit or debit card as a Payment Method in your OMNY Account; or (iii) purchase a fare product (e.g., a monthly pass) through the OMNY Website or other sales channels. Such information may include the credit or debit card primary account number and expiration date, both for the cards you tap at an OMNY reader as well as any card provisioned to a digital wallet. Additionally, we may collect the country of card issuance, the card brand (e.g., Visa, MasterCard), and/or the card type (e.g., credit, debit, pre-paid, contactless, transit benefit, etc.). For any transaction, the method by which OMNY authenticates your Payment Method varies, but may include, without limitation, your PIN, billing ZIP code or full billing address to support cardholder verification.
    • User-generated content. We may collect content or other information that you may provide or create when you interact with the OMNY Website.
    • Correspondence. We may collect information about you that you provide when you request information from us or otherwise correspond with us.
    • Other information. We may collect other information about you that is not specifically listed here and will use it in accordance with this Privacy Policy.

    Information collected automatically when you use OMNY Products

    The MTA automatically collects certain information about your use of the OMNY Website, such as the IP address and domain name of your Internet service provider, the type of browser and operating system used, the date and time of your visit, the webpages you visit, services accessed, and the referring Internet site, if any. Additionally, if you use a mobile device to access the OMNY Website, we may collect information about your mobile device including your device ID and IP address of your mobile device. The MTA also monitors user traffic and patterns or usage of the OMNY Website by employing standard industry technologies such as cookies, log files, web beacons, and unique identifiers to identify your computer or mobile device.

    Cookies and Web Beacons

    The OMNY Website uses cookies, web beacons and other similar standard industry technologies to help us understand how you visit and use the OMNY Website.

    Cookies are small data files that are sent to your browser from our web servers, and are stored on your computer or mobile device’s hard drive, to enable the OMNY Website to recognize users who have previously visited it and retain certain information such as customer preferences and navigation history in order to help us understand how the OMNY Website is being used, and to improve your browsing experience. Cookies used in connection with the OMNY Website do not retrieve any other data from your hard drive, nor do they capture your e-mail address or any additional Personal Information. Most browsers let you remove or reject cookies. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. The use of cookies is required to log in to your OMNY Account, so please note that if you set your browser to disable cookies, your experience with the OMNY Website will not be optimal, and some of the features of the Website may not function.

    The OMNY Website also uses web beacons, which are small image files with unique identifiers used alone or in conjunction with cookies, to determine ads your browser is shown, which ads you click and other actions you take on the Internet. We use beacons to help us better provide relevant products, services and information to you, and to help us effectively measure advertising effectiveness, if applicable. A third party is required to protect the privacy of the information it receives using web beacons or cookies and is not allowed to use the information it receives for any purpose beyond what is necessary to assist the MTA. We do not sell, trade, or otherwise distribute information about you gathered through the web beacons or pixels with any third parties.

    The OMNY Website contains third party analytics cookies and web beacons, such as Google Analytics. The information generated by Google Analytics about your use of the OMNY Website (including your IP address) will be transmitted to and stored by Google on servers in the United States. Google will use this information for the purpose of evaluating your use of the OMNY Website, compiling reports on the OMNY Website activity for operators of the OMNY Website and providing other services relating to the OMNY Website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. Google will not associate your IP address with any other data held by Google. Your IP address is recorded, but immediately pseudonymized meaning that only a rough localization is possible. You can find out more information about Google Analytics cookies here. You can prevent the use of Google Analytics relating to your use of the OMNY Website by downloading and installing a browser plugin available here.

    Location Information

    The OMNY Website may allow your browser to request your current location, which, if selected, could determine your geographic location. We will only collect and process such information if you have consented and opted-in to this feature. You may also always opt out or withdraw your permission by changing your permissions or settings on your browser.

  2. HOW WE USE YOUR PERSONAL INFORMATION

    By providing Personal Information to us when you create or update your OMNY Account, or use other OMNY Products and related services, you are expressly agreeing to our use and processing of your Personal Information as described in this Privacy Policy.

    To operate the OMNY Website

    We use your Personal Information:

    • to provide, maintain and improve the OMNY Website and the services we offer through OMNY Products;
    • to communicate with you about OMNY Products, including by sending you announcements, updates, security alerts, and support and administrative messages;
    • to understand your needs and interests, and personalize your experience with OMNY Products; and
    • to respond to your requests, questions and feedback related to OMNY Products, if applicable.

    To process your transactions.

    The MTA uses your payment card information to process your transactions made at OMNY readers and resolve inquiries you submit when you contact us via the OMNY Website or through OMNY Customer Service. We may use your transaction history to resolve issues with your credit or debit card charges in OMNY or for your other inquiries, however, this does not constitute use or disclosure of your Personal Information.

    To communicate with you

    If you register for an OMNY Account, request information from us, place an order online, or participate in our surveys, promotions, or events, we may send you MTA communications as permitted by law. Please be aware that you cannot opt out of initial communications regarding registering your account and account notifications, such as password changes.

    To comply with law

    The MTA uses your Personal Information as we believe necessary or appropriate to comply with applicable laws, lawful requests, and legal processes, such as to respond to subpoenas or requests from government authorities.

    With your consent

    If you use OMNY Products, we will ask for your consent before collecting, using or sharing your Personal Information in any way not covered by this Privacy Policy.

    To create anonymous data for analytics

    We may create anonymized data from your Personal Information and the Personal Information we collect from others. We make Personal Information into anonymized data by excluding information that makes the data personally identifiable to you, and the MTA may use that anonymized data for our lawful business purposes such as to improve OMNY Products and planning for OMNY or MTA service improvements. Anonymous data does not contain any information that could be used to identify or contact individual customers or their OMNY Accounts

    For compliance, fraud prevention, and safety

    We use your Personal Information as we believe necessary or appropriate to (i) enforce the terms and conditions that govern the OMNY Products, including this Privacy Policy; (ii) protect our rights, privacy, safety or property, and/or that of you or others; and (iii) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity.

  3. DISCLOSURE OF YOUR PERSONAL INFORMATION

    The MTA will only disclose Personal Information we collect if you consent to the disclosure of such Personal Information or under the circumstances described below. The MTA will not sell the information collected from OMNY Products to third parties for commercial marketing purposes.

    The MTA may disclose Personal Information without your consent:

    • With MTA affiliates. We may share your information among the MTA affiliates and subsidiaries for purposes consistent with this Privacy Policy. The MTA affiliates and subsidiaries are: MTA Metro-North Railroad, MTA Long Island Rail Road, MTA Bus Company, MTA Bridges and Tunnels, MTA Capital Construction Company, and MTA New York City Transit and its subsidiaries.
    • To provide OMNY services and Products. We may share your Personal Information with third party service providers and transportation partners as needed for them to provide us with services that help us provide the OMNY Products or support our business activities (such as website analytics, email delivery, payment processing, IT providers, technical support, and legal and other professional advice). These third parties have limited access to your information only to perform certain tasks on our behalf and as directed by the MTA. We typically require these third parties to follow this Privacy Policy as well as any additional privacy or security measures agreed to in our contracts with them.
    • For compliance, fraud prevention, and safety. We may share your Personal Information for the compliance, fraud prevention and safety purposes described in Section 2 (For Compliance, Fraud Prevention and Safety Purposes) above.
    • When required by law. We may be required to share your information pursuant to a court order or other legal or regulatory obligation or process. In addition, the MTA is a public benefit corporation and, as such, the disclosure of your Personal Information is subject to certain laws, including but not limited to the New York State Internet Security and Privacy Act, New York State Freedom of Information Law, and the New York State Personal Privacy Protection Law, unless the information is exempted by law. You should not provide personal information if you are concerned about disclosure of your information under these laws.
  4. RETENTION OF YOUR PERSONAL INFORMATION

    The MTA will only store Personal Information that is necessary to maintain OMNY Accounts, to perform account functions such as billing, account settlement or enforcement activities, or as otherwise permitted by this Privacy Policy. The information collected through the OMNY Website is retained by us in accordance with the applicable records retention and disposition requirements of New York or federal law.

  5. CONFIDENTIALITY AND SECURITY OF YOUR PERSONAL INFORMATION

    The MTA is strongly committed to protecting your Personal Information from unauthorized access, use or disclosure. As the entity that maintains the OMNY Website, Cubic employs a number of organizational, technical and physical safeguards designed to protect the Personal Information we collect, and Cubic periodically reviews its processes and systems to verify compliance with industry best practices to ensure the highest level of security. By way of example and not limitation, payment card information is stored within OMNY Products in a non-identifiable way so that it has no extrinsic or exploitable meaning or value. However, security risk is inherent in all internet and information technologies, and we cannot guarantee the security of your Personal Information.

    As an additional security measure, should you register for an OMNY Account, we require the use of a valid email address and password to help protect your Personal Information. This allows the MTA to verify who you are and prevent unauthorized access. You are responsible for maintaining the confidentiality of your password, account and access to your computer.

  6. THIRD PARTY PLATFORMS

    The OMNY Website may integrate with third party platforms, such as Facebook and Google. If you sign in through a third party platform, you authorize the MTA to collect, store, and use any information that you agreed the third party platform would provide to the MTA, such as your name, profile picture, unique identifier, and email address. When you use a third party platform through the OMNY Website, the third party may also have access to information about you and your use of the OMNY Website. PLEASE REVIEW THESE THIRD PARTIES’ PRIVACY NOTICES CAREFULLY, AS THE MTA DOES NOT CONTROL AND CANNOT BE RESPONSIBLE FOR THESE PROVIDERS' PRIVACY OR INFORMATION SECURITY PRACTICES. 

  7. THIRD PARTY SITES AND SERVICE PROVIDERS

    In order to provide users with certain information, the OMNY Website may provide links to websites and applications of various public and private entities. This Privacy Policy only applies to the OMNY Website and does not apply to any third party websites or mobile applications linked from the OMNY Website. Some of these third party websites or applications may use MTA licensed symbols including, but not limited to, the OMNY name and logo, and/or MTA public transit data provided free as a public service by the MTA and its affiliates and subsidiaries, however all third party websites and applications follow their own privacy practices. YOU SHOULD REVIEW THE PRIVACY POLICY OF ANY THIRD PARTY WEBSITE OR MOBILE APPLICATION THAT YOU ACCESS THROUGH A LINK FROM THE OMNY WEBSITE. THE MTA DOES NOT IN ANY WAY GUARANTEE, APPROVE OR ENDORSE THE INFORMATION, SERVICES OR PRODUCTS AVAILABLE ON LINKED THIRD PARTY WEBSITES OR APPLICATIONS.

  8. CUSTOMER OBLIGATIONS AND DISCLAIMER

    Users are responsible for safeguarding personal mobile devices, tablets, computers, emails, passwords and other authentication information that may be used to access the OMNY Website. You should not disclose authentication information to any third party and should notify OMNY Customer Service of any unauthorized use of your password or account or any other breach of security. By using the OMNY Website, you acknowledge and agree that there is a risk that unauthorized third parties may engage in illegal activity, such as hacking or intercepting transmissions of Personal Information. The MTA is not responsible for any data or Personal Information obtained (1) in an unauthorized manner, (2) by a third party as a result of a customer’s negligence or misuse of OMNY Products and equipment, or (3) as a result of your disclosure of Personal Information to third parties. If a customer’s Payment Method is lost, stolen or damaged, we are not responsible for any data or Personal Information that is obtained by a third party until the problem is reported by you to the MTA as further described in the OMNY Terms of Use.

  9. OMNY ACCOUNT REGISTRATION AND CONTROLS

    Registering for an OMNY Account is optional. If you opt to register for an OMNY Account, you will need to provide Account Information to us, as described in Section 1 (Personal Information We Collect) above. An OMNY Account may be closed at any time by contacting OMNY Customer Service at 511 or https://www.omny.info/Contact.

    Modifying or Updating Personal Information

    A customer who has registered for an OMNY Account can modify Personal Information at any time, or add or delete any Account Information both online at https://www.omny.info by logging into their OMNY Account, or by contacting OMNY Customer Service.

    Choosing not to share your personal information

    You may choose not to send us an email, register online for an OMNY Account, or otherwise communicate with us via the OMNY Website. While your choice not to participate in these activities or transactions may limit your ability to receive specific services or products through the OMNY Website, it will not prevent you from requesting services or products from the MTA and its affiliates and subsidiaries by other means and will usually not impact your ability to take advantage of other features of MTA websites.

  10. PERSONAL INFORMATION OF CHILDREN; COMPLIANCE WITH COPPA.

    The MTA does not knowingly collect Personal Information from children under the age of 13 years through the OMNY Products, in compliance with the Children’s Online Privacy Protection Act (“COPPA”) and the Federal Trade Commission’s rule interpreting COPPA (16 CFR § 312). The OMNY Products are not directed at children, and as such, Personal Information submitted in an email or through an online transaction will be treated as though it was submitted by an adult, and may, unless exempted by federal or state law, be subject to public access. Please contact us if you believe we have Personal Information related to a child under 13 years. If we learn that a child under 13 years of age has provided us with Personal Information, we will delete this information from our databases.

  11. NO WARRANTIES OR REPRESENTATIONS

    The information provided in this Privacy Policy should not be construed as giving business, legal, or other advice, or warranting as fail proof, the security of information provided through the OMNY Products.

  12. APPLICABILITY TO OMNY PRODUCTS ONLY

    This OMNY Privacy Policy applies only to OMNY Products. This Privacy Policy does not apply to MTA.info, MTA mobile applications such as MYmta or MTA Subway Time, or other MTA products or services. This Privacy Policy does not apply to the content of emails or other correspondence transmitted directly to MTA, its affiliates or subsidiaries, or directly to Cubic.

  13. CHANGES TO THIS PRIVACY POLICY

    Please note that this Privacy Policy may change from time to time. If we make changes to this Privacy Policy, we will post them on the OMNY Website and indicate the “last updated” date. Continued use of OMNY Products constitutes the customer’s agreement with this OMNY Privacy Policy and any updates.

  14. OMNY PRODUCTS PROVIDED IN THE MTA REGION ONLY

    The MTA provides local transportation services in New York City through Long Island, southeastern New York State and Connecticut (collectively, the “MTA Region”). The OMNY Products are intended for users in the MTA Region. You acknowledge and agree that any information you submit to us through the OMNY Products is processed within the United States and subject to the applicable laws of the United States.

  15. Contact Information

    Questions or comments regarding this Privacy Policy may be directed to OMNY Customer Service by either calling 511 or by submitting an inquiry to https://www.omny.info/Contact.

    Questions or comments regarding the MTA, its affiliates and subsidiaries generally, Freedom of Information Law Requests or any other non-OMNY inquiries must be submitted as directed by MTA.info.

The effective date of this OMNY Privacy Policy is March 15, 2019
Last updated: March 15, 2019