OMNY Privacy Policy

The Metropolitan Transportation Authority and our affiliates and subsidiaries (collectively, the "MTA", "we", "us" or "our") respects your privacy. This privacy policy and agreement (the "OMNY Privacy Policy") describes the MTA's privacy practices regarding our collection, use, and treatment of information that you may provide when you use the OMNY services and technology (collectively, the "OMNY Services"), which includes: (i) the OMNY website (the "Website"); (ii) the OMNY mobile application (the "OMNY App"); (iii) the OMNY fare payment services, including the OMNY fare payment readers (the "OMNY Fare Payment System"); and (iv) the OMNY customer support services ("OMNY Customer Service").

This OMNY Privacy Policy applies to anyone using our OMNY Services ("you" and "your"), including casual visitors to our Website who do not create an OMNY Account, users who create an OMNY Account, guest users of the OMNY App, and anyone else accessing our OMNY Services.

1. Your Consent. Please read this OMNY Privacy Policy carefully. By accessing or otherwise using our OMNY Services, you acknowledge and agree that you have read this OMNY Privacy Policy and agree to be legally bound by it. We may also confirm your agreement to be bound by this OMNY Privacy Policy by asking you to click an "I accept" or similar button when you access or use certain OMNY Services. If you do not agree with the terms of this OMNY Privacy Policy then do not access or use our OMNY Services.
2. Types of Information We Collect. We collect a few categories of information via our OMNY Services:
   1. Personal Information. We use the term "Personal Information" to mean any information that identifies you as an individual, and any other information that we associate with it. Personal Information you may provide to us through your access or use of the OMNY Services includes:
      • Your name, age, photograph, email address, date of birth, and password;
      • Your other contact information, including mailing address (including postal code and country of residence), and phone number;
      • Payment information and identity verification information, such as credit card or other payment card information, and the last four digits of your Social Security number;
      • Any disabilities that may qualify you for a special program;
      • Any special program account number and/or card ID issued to you by the MTA, and other information relating to your participation in a special program;
      • Other identifying information that you elect to provide to the MTA through the OMNY digital assistant on the Website; and
      • Geolocation information.
   2. Online Activity Information. We also collect technical and device-related information through certain OMNY Services, and third party analytics tools that we use (collectively, the "Online Activity Information"). Examples of Online Activity Information includes:
      • Device identifiers, such as cookies;
      • Device information, such as hardware and software settings;
      • IP addresses and log information, such as your device's name, the type and version of your web browser, and referrer addresses that can function to identify a user device;
      • Tracking information that we, or a third party, may collect.

      If any of your Online Activity Information is associated with Personal Information, then we will treat such associated Online Activity Information as Personal Information. Otherwise, we treat Online Activity Information as Anonymous Information.

   3. Anonymous Information. In addition to Personal Information, we may also collect (i) information that does not identify you or your devices, and (ii) de-identified Personal Information that no longer identifies you (collectively, "Anonymous Information"). Information that meets either of these criteria might include, for example, demographic information and statistical information (e.g., page views and hit counts). We use Anonymous Information for our operations and, since Anonymous Information does not include Personal Information, we do not treat it as such.
3. How We Collect this Information. We collect the above information through the following means and technologies:
   • Registration; Linked Accounts. When you register in order to create an account with us (an "OMNY Account"), you must provide us with certain Personal Information in order to create an OMNY Account. We will use this information to set up your OMNY Account, authenticate your sign-on information, and to manage other functionalities relating to your account. As further explained below, you may also link an OMNY contactless fare payment card, a credit card or other payment card (each, an "OMNY Payment Method") with your OMNY Account.
   • Participation in Special Programs. When you apply to participate in certain programs available through the MTA, we will collect certain Personal Information in order to determine your eligibility. For example, if you would like to participate in the MTA's Reduced Fare Program, then we will collect Personal Information about you, including your name, age, address, contact information, and any qualifying disabilities that may qualify you for participation in the Reduced Fare Program.
   • Payment Information. We collect your credit card, other payment card information, or banking information when you purchase a fare product through our OMNY Services, register an OMNY Payment Method in your OMNY Account, or otherwise use an OMNY Payment Method to access our OMNY Services (for example, by tapping a credit card or phone at a reader). Such information may include the credit or debit card primary account number and expiration date, and bank account number and routing number. Additionally, we may collect the card brand (e.g., Visa, MasterCard), and/or the card type (e.g., credit, debit, pre-paid, contactless, transit benefit, etc.). For any transaction, the method by which the OMNY Services authenticate your OMNY Payment Method varies, but may include, for example, your PIN, billing ZIP code, or full billing address. Note that your financial institution may provide us with updated financial information in order to complete contemplated transactions.
   • Questionnaires and Surveys. We may invite you and/or allow you to participate in surveys and questionnaires, which we may post or otherwise provide to you from time to time. You are free to choose whether you participate in a survey or questionnaire. We may ask that, in addition to providing your responses, you also provide Personal Information. In these instances, we may use any information that you provide to us for the purposes for which you submit the information. We may also add your Personal Information to your customer profile. Survey and questionnaire information may be used for the purposes of monitoring, improving the OMNY Services, or publicly posting your responses to surveys or questionnaires.
   • User Content. As further set out below, we may give you the ability through the OMNY Services to engage with us and others in public exchanges or to publicly display information via the OMNY Services, such as comments and feedback about the OMNY Services (collectively, "User Content"). The OMNY Terms of Service provides additional details about your rights and obligations related to User Content. We are not responsible for Personal Information you decide to include in User Content. If you include any Personal Information relating to others in your User Content, then you represent that you have full permission and authority to do so.
     • User Content Provided to Us for Internal Use. We may provide you with the ability to submit User Content to us (either directly or through a third party service) for our internal operations. For example, we may ask you to provide us with additional feedback when you submit responses to our surveys. If you provide us with such User Content, then we will protect it in accordance with this OMNY Privacy Policy, and we will inform you when asking for information that it is only for our internal purposes.
     • User Content Provided to Us for Public Consumption. We may give you the ability, for example, through the Website, OMNY App, or a third party social media platform, to engage with us and others in public exchanges by providing User Content, which may include opportunities for you to provide comments, reviews, recommendations, and other input. Please understand that, if you include Personal Information in such User Content, then others will be able to read, collect, republish, and otherwise freely use the information. We are not responsible for Personal Information that you decide to include in such User Content, and we will not take down, remove, or edit User Content, except as required by applicable law.
   • Correspondence. We may collect information about you that you provide when you request information from us or otherwise correspond with us including, for example, when using the Contact Us feature on our Website.
   • Device Configuration. We may collect certain information in order to determine whether your computer/device is supported by our systems. This information may include your operating system and browser, the presence of any software that our Website or OMNY App may require to operate with your computer/device, or other third party software on your computer/device.
   • IP Addresses; Logs. We may automatically receive and record information in our server logs from your browser, including your IP address (the Internet address of your computer), your computer's name, the type and version of your web browser, referrer addresses, and other generally accepted log information. We may also record page views (hit counts) and other general statistical and tracking information, which will be aggregated with that of other users in order to understand how our Website is being used, and for security and monitoring purposes.
   • Location Information. Certain OMNY Services, such as the Website and OMNY App, may request your current location, which, if selected, could determine your geographic location. We will only collect and process such information if you have consented and opted-in to this feature. You may also always opt out or withdraw your permission by changing your permissions or settings on your browser or on the OMNY App.
   • Cookies. Cookies are small data files that are sent to your browser from our web servers, and are stored on your computer or mobile device's hard drive, to enable the OMNY Website to recognize users who have previously visited it and retain certain information such as customer preferences and navigation history in order to help us understand how the OMNY Website is being used, and to improve your browsing experience. For example, we use Google Analytics cookies, which are described here. You can prevent the use of Google Analytics relating to your use of the OMNY Services by downloading and installing a browser plugin available here.
   • Web Beacons. The Website also uses web beacons, which are small image files with unique identifiers used alone or in conjunction with cookies, to determine ads your browser is shown, which ads you click and other actions you take on the Internet. We use beacons to help us better provide relevant products, services, and information to you, and to help us effectively measure advertising effectiveness, if applicable. A third party is required to protect the privacy of the information it receives using web beacons or cookies and is not allowed to use the information it receives for any purpose beyond what is necessary to assist the MTA.
   • Other Information. If we collect other information about you using a method that is not specifically listed here, then we will use it in accordance with this OMNY Privacy Policy.
   • Contact Information. We may collect your contact details (such as your name, email address, mailing address (including postal code), and phone number) upon request and when you provide it to us through the OMNY Services, including the Website, OMNY App, to an OMNY Customer Service representative, or the OMNY digital assistant on the Website.
4. How We Use Collected Information. We use information that we collect or process, including Personal Information, Online Activity Information, and Anonymous Information, as permitted under applicable law and consistent with this OMNY Privacy Policy and the OMNY Terms of Service. More specifically, we use the information we collect for the following purposes:
   • to provide, maintain, and improve the OMNY Services or other MTA services, including internal administration, auditing, operation, and troubleshooting;
   • to process your transactions made via our OMNY Services, including the OMNY Fare Payment System readers, and to resolve inquiries you submit when you contact OMNY Customer Service or the OMNY digital assistant on the Website;
   • to resolve payment issues;
   • to communicate with you about the OMNY Services, including by sending you announcements, updates, security alerts, and support and administrative messages;
   • to perform analytics, quality control, market research, and to determine the effectiveness of our OMNY Services, promotional campaigns, to improve our current products, OMNY Services, and develop new products and services;
   • to create Anonymous Information;
   • to allow you to post User Content;
   • to understand your needs and interests, and personalize your experience with the OMNY Services;
   • to share the information with third parties strictly as permitted pursuant to Section 6 (Disclosure of Your Information) of this OMNY Privacy Policy; and
   • to respond to your requests, questions, and feedback related to the OMNY Services, if applicable.

   In addition to the uses specifically identified above, there may be instances where you request information and OMNY Services from us that are not described in this OMNY Privacy Policy. We may, in our discretion, use information that you submit to us in order to provide such information and OMNY Services. Moreover, if we collect any Personal Information from you that is not described in this OMNY Privacy Policy, then we ask for your consent before collecting, using, or sharing such Personal Information.

5. Other Essential Uses of Information. We may also use information that we collect or process as we believe necessary for certain essential purposes, including:
   • to comply with applicable law and legal processes;
   • to respond to requests from public and government authorities;
   • to detect, prevent, or investigate potential security incidents, fraud, harmful, unauthorized, unethical, or illegal activity;
   • to provide important safety notices or otherwise notify you of emergency situations;
   • to enforce the OMNY Terms of Service and this OMNY Privacy Policy;
   • to protect our operations;
   • to protect the rights, privacy, safety or property, and security of you, us, and others; and
   • to provide the OMNY Services.
6. Disclosure of Your Information. We will not sell Personal Information collected from the OMNY Services to third parties. We will also not disclose your Personal Information to third parties without your express consent, except in the following limited circumstances:
   • Our Affiliates. We may share your Personal Information among our affiliates and subsidiaries for purposes consistent with this OMNY Privacy Policy.
   • MTA Vendors and Transit Partners. We may share your Personal Information with our third party vendors and transportation partners as needed for them to provide us with services, to assist us with providing the OMNY Services, or to support our business activities (such as website analytics, email delivery, payment processing, IT providers, technical support, and legal and other professional advice). We will only provide these third parties with the Personal Information necessary for them to perform their required functions, and we do not allow them to use your Personal Information for any other purpose. We require these third parties to agree to privacy practices at least as stringent as those set out in this OMNY Privacy Policy as well as any additional privacy or security measures agreed to in our contracts with them. For example, Cubic Transportation Systems, Inc. maintains and operates the Website, OMNY App, and various portions of the OMNY Fare Payment System on our behalf.
   • Compliance, Fraud Prevention, and Safety. We may share your Personal Information for the compliance, fraud prevention, and safety purposes described in this OMNY Privacy Policy.

   • Legal Obligation. We may be required to share your Personal Information pursuant to a court order or other legal or regulatory obligation or process. In addition, the MTA is a public benefit corporation and, as such, the disclosure of your Personal Information is subject to certain laws, including but not limited to the New York State Internet Security and Privacy Act, New York State Freedom of Information Law, and the New York State Personal Privacy Protection Law, unless the information is exempted by law. You should not provide Personal Information if you are concerned about disclosure of your information under these laws.

7. Retention of Personal Information. The MTA will only store Personal Information that is necessary to maintain OMNY Accounts, to perform account functions such as billing, account settlement or enforcement activities, to provide the OMNY Services, or as otherwise permitted by this OMNY Privacy Policy. The information collected through the OMNY Services is retained by us in accordance with the applicable records retention and disposition requirements of New York or federal law.
8. How We Safeguard the Information We Collect. The MTA is committed to protecting your Personal Information from unauthorized access, use or disclosure. We have implemented physical, technical, and administrative security measures and controls designed to prevent unauthorized access to, or disclosure of, Personal Information that you provide to us. Additionally, we require our third party providers to implement security measures and to otherwise handle Personal Information consistent with this OMNY Privacy Policy and applicable law. Our security measures and other safeguards are intended to deter and prevent hackers and others from unauthorized access to information that you provide to us. However, due to the nature of internet communications and information technology, we cannot provide, and expressly disclaim, assurance that the information you provide us will remain free from loss, misuse, or alteration by third parties who, despite our efforts, obtain unauthorized access.
9. Disclaimer. By using the OMNY Services, you acknowledge and agree that there is a risk that unauthorized third parties may engage in illegal activity, such as hacking or intercepting transmissions of Personal Information. You agree that the MTA is not responsible for any data or Personal Information obtained: (i) in an unauthorized manner; (ii) by a third party as a result of your negligence or misuse of the OMNY Services; or (iii) as a result of your disclosure of Personal Information to third parties. The information provided in this OMNY Privacy Policy should not be construed as giving business, legal, or other advice, or warranting as fail proof, the security of information provided through the OMNY Services.
10. OMNY Account Registration and Controls; Opting Out. Registering for an OMNY Account is optional. If you opt to register for an OMNY Account, you will need to provide account information to us, as described herein. An OMNY Account may be closed at any time by contacting OMNY Customer Service at (877) 789-OMNY (6669) or https://www.omny.info/Contact.
    1. Modifying or Updating Personal Information. A customer who has registered for an OMNY Account can modify Personal Information at any time, or add account information online at https://www.omny.info by logging into their OMNY Account, by contacting OMNY Customer Service, or by using the OMNY digital assistant on the Website.
    2. Choosing Not to Share Your Personal Information. You may choose not to send us an email, register online for an OMNY Account, or otherwise communicate with us via certain OMNY Services, such as the App or Website. While your choice not to participate in these activities or transactions may limit your ability to receive specific OMNY Services, it will not prevent you from receiving all the OMNY Services.
    3. Opting Out. If we choose to send to you, or you have elected to receive, bulletins, updates, questionnaires, surveys, or other marketing-related materials, we will provide you with the ability to decline – or "opt out" – of receiving such communications. Instructions for opting-out will be provided if and when we determine to send you such a communication. For example, if you no longer wish to receive promotional email messages from us, then you can opt out by either (i) following the "unsubscribe" instructions located near the bottom of each email message, or (ii) contacting us as provided in Section 16 (How to Contact Us) below. Please understand that we may still communicate with you in connection with administrative notices concerning any transactions, operation of the OMNY Services and legal notices.
11. Personal Information of Children; Compliance with COPPA. The MTA does not knowingly collect Personal Information from children under the age of 13 years online, in compliance with the Children's Online Privacy Protection Act ("COPPA") and the Federal Trade Commission's rule interpreting COPPA (16 CFR § 312). The online OMNY Services offerings are not directed at children, and as such, Personal Information submitted in an email or through an online transaction will be treated as though it was submitted by an adult, and may, unless exempted by federal or state law, be subject to public access. Please contact us if you believe we have collected Personal Information from a child under 13 years using online methods. If we learn that a child under 13 years of age has provided us with Personal Information, we will delete this information from our databases.
12. Third Party Resources. Certain of our OMNY Services, including our Website, may link to other websites, mobile apps, social media platforms, and other online services (collectively, the "Third Party Resources"). We have no control over such third parties and are not responsible for the content, availability, or security of such Third Party Resources and so please read their privacy policies carefully. The inclusion of a link from our OMNY Services to any Third Party Resource does not necessarily imply endorsement of such third party's products, services, or other offerings, and is provided for your convenience only. If you decide to access or use any such Third Party Resource via our OMNY Services, you do so subject to such third party's terms and conditions. By way of clarification, any personal information that you provide to a third party via a Third Party Resource is subject to the privacy policy of the applicable third party and not this OMNY Privacy Policy.
13. Applicability to the OMNY Services. This OMNY Privacy Policy applies only to the OMNY Services described in this OMNY Privacy Policy. This OMNY Privacy Policy does not apply to MTA.info, other non-OMNY MTA mobile applications such as MYmta or MTA Subway Time, or other non-OMNY MTA products or services. This OMNY Privacy Policy does not apply to the content of emails and other correspondence not provided through the means made available via the OMNY Services, including emails and other correspondence transmitted directly to the MTA, its affiliates or subsidiaries, or to Cubic Transportation Systems, Inc.
14. Changes to this OMNY Privacy Policy. We may update this OMNY Privacy Policy from time to time. If we make changes to this OMNY Privacy Policy, then we will post them on the Website and indicate the Effective Date. Your continued use of the OMNY Services constitutes your agreement with this OMNY Privacy Policy and any updates to it.
15. Relationship to Other Agreements. This OMNY Privacy Policy must be read together with the OMNY Terms of Service, and the OMNY Terms of Service are incorporated herein. If the OMNY Terms of Service conflicts with this OMNY Privacy Policy, then this OMNY Privacy Policy shall control.
16. How to Contact Us. If you have any questions about OMNY, the OMNY Services, or this OMNY Privacy Policy, please contact OMNY Customer Service using one of the following methods: (i) via the Contact Us form on our Website, (ii) by calling (877) 789-OMNY (6669) or 511, or (iii) by using the OMNY digital assistant on the Website. Questions or comments regarding the MTA, its affiliates and subsidiaries generally, Freedom of Information Law Requests or any other non-OMNY inquiries must be submitted as directed on MTA.info.
17. Effective Date. The effective date of this OMNY Privacy Policy is June 7, 2022.