Effective Date: January 3, 2020
I. INTRODUCTION
II. OVERVIEW
III. DATA COLLECTION AND USES
IV. CHOICE AND TRANSPARENCY
V. UPDATES TO THIS NOTICE
When you use any of the products or services offered by Curb Mobility, LLC or its subsidiaries (collectively, “CML”), including our payment systems, our ride booking platform, our apps (including the Curb® mobile app) (“Apps”), our driver solutions, our dispatch systems, our websites (“Sites”) and/or our other channels that enable users to connect to our systems to use or obtain services (collectively, the “Platform” and, such services, “Services”), we may collect the types of personal information and data described below. This privacy notice describes how we use that information and data, with whom we share it and the choices available to users of our Platform and Services regarding our use of that information and data. In addition, we describe the measures we take to protect the security of the information and how users can contact us about our privacy practices.
A. Scope
This notice applies to users of the Platform or the Services anywhere in the world.
This notice specifically applies to:
Payers and Payees: individuals who attempt to or actually make or receive a payment via or payment systems, including our payment terminals and/or Apps, whether such payments are made using a credit card, an account on the Platform (an “Account”) or through other means.
Passengers: individuals who request or receive transportation, including those who receive transportation requested by another individual.
Drivers: individuals who provide transportation, whether individually or through a third party transportation company (e.g., a taxi dispatch association or radio network).
This notice also governs CML’s other collections of personal data in connection with the Services. For example, we may collect the contact information of individuals who use accounts on the Platform established by business, corporate or government agency users of our Platform.
All those subject to this notice are referred to herein as “users”.
In addition, please note the following:
For California users: Information regarding CML’s privacy practices related to the California Consumer Privacy Act (CCPA) is available here.
For passengers without a CML account: The personal data of passengers who take trips arranged via our Platform (including our Apps) by the holder of an Account (such as a corporation, government agency or healthcare provider) is processed in accordance with our contract with the holder of that account, the terms of which contract supersede and take precedence over any conflicting terms of this notice. Such processing may include sharing of passenger location data and usage of Platform or the Services with the Account holder. Please contact the Account holder for more information.
Our data practices are subject to applicable laws in the places in which we operate. This means that we engage in the practices described in this notice in a particular country or region only if permitted under the laws of those places. Please contact us at support@gocurb.com with any questions regarding our practices in a particular country or region.
Curb Mobility, LLC (11-11 34th Avenue, Long Island City, NY 11106, USA) is the data controller for the personal data collected in connection with use of the Platform or Services in the United States and Canada.
CML Mobility Limited (Gloucester House, 10 Camberwell New Road, London SE5 0TA, United Kingdom) is the data controller for the personal data collected in connection with use of the Platform or Services in the European Economic Area and the United Kingdom.
We process personal data inside and outside of the United States. The personal data of users outside the United States is transferred to the United States or other places on the basis of mechanisms approved under applicable laws, such as the Standard Contractual Clauses.
Questions, comments or complaints about CML’s data practices can be submitted to support@gocurb.com.
CML collects:
- Data provided by users to CML, such as during account creation and/or when making a payment or requesting transportation;
- Data created during use of the Platform or Services, such as payment information, location, App usage and/or device data; and
- Data from other sources, such as third parties that use CML APIs and/or provide analysis of collected data.
The following data is collected by or on behalf of CML:
1. Data provided by users, which includes:
User profile: We collect data when users create or update their Accounts. This may include their name, email, phone number, username and password, address, profile picture, payment or banking information (including related payment verification information), government identification documents (including driver’s license numbers and images), birthdate, signature and/or photo. This may also include vehicle or insurance information of drivers and user settings. We may use information (including photos) submitted by users to verify their identities or Account usage, such as, for example, cross-referencing public databases and/or using facial recognition technologies. For more information, please see the section titled “How we use personal data.”
Background check and identity verification: We may collect background check and identity verification information for drivers who establish an account with us directly. This may include information such as driver history or criminal record (where permitted or required by applicable law) and right to work. This information may be collected by an authorized vendor on CML’s behalf.
User content: We collect the information users submit when they contact CML, including for customer support. This may include feedback, photographs or other recordings collected by users, as well recordings of telephone calls or other communications between users and CML.
2. Data created during use of our Platform or Services, which includes:
Location data: We collect precise or approximate location data from a user’s mobile device if enabled by the user to do so. For drivers, CML collects this data either from CML equipment installed in the vehicles or when the Curb® driver App is running in the foreground (app open and on-screen) or background (app open but not on-screen) of their mobile devices. For passengers, CML collects this data when the passenger is engaged in a trip and the Curb® passenger App is running in the foreground or the background. For payers and payees, CML collects this data from the CML equipment or Apps through which payments are made. Passengers may use certain Apps without enabling CML to collect location data from their mobile devices; however, this may affect some functionality available in such Apps. For example, a user who has not enabled location data collection in the Curb® passenger App will have to manually enter his or her pickup address when making a transportation request. In addition, the location data collected from a CML or driver device during a trip or a payment may be linked to the user’s account, even if the user has not enabled location data to be collected from his, her or its device, including for purposes of receipt generation, customer support, fraud detection, insurance and/or litigation.
Transaction and Payment information: We collect transaction information (including payment information) related to the use of our Platform or Services, including the type of Services requested or provided, request details, trip information, date and time the Service was provided, amount charged, distance traveled and payment method.
Usage data: We collect data about how users interact with our Platform and Services. This includes data such as access dates and times, App or Site features or pages viewed, App or Site crashes and other system activity, type of browser and third-party sites or services used before interacting with our Platform and Services. In addition, if you visit our Sites, we may collect certain information by automated means, such as cookies and web beacons. The information collected in this manner includes IP address, browser characteristics, device characteristics, operating system, language preferences, referring URLs, information on actions taken on the Sites and dates and times of Site visits. A “cookie” is a text file that websites send to a visitor’s computer or other Internet-connected device to uniquely identify the visitor’s browser or to store information or settings in the browser. A “web beacon,” also known as an Internet tag, pixel tag or clear GIF, links web pages to web servers and their cookies and may be used to transmit information collected through cookies back to a web server. Through these automated collection methods, we may obtain “clickstream data,” which is a log of content on which a visitor clicks while browsing a website. As a visitor clicks through our website, a record of the action may be collected and stored. Certain data elements collected through automated means, such as your browser information, may be linked with other information otherwise obtained about you to let us know, for example, whether you have opened an email we sent to you. Your browser may tell you how to be notified when you receive certain types of cookies or how to restrict or disable certain types of cookies. Please note, however, that without cookies you may not be able to use all of the features of our Sites.
Device data: We may collect data about the devices used to access our Platform or Services, including the hardware models, device IP addresses, operating systems and versions, software, preferred languages, unique device identifiers, advertising identifiers, serial numbers, device motion data and mobile network data.
Communications data: We may enable users to communicate with each other and/or CML through our Apps, Sites, email, text message, telephone and/or other means. For example, we enable drivers and passengers to call, text or send other files to each other (generally without disclosing their telephone numbers to each other). To provide this service, CML receives some data regarding the calls, texts or other communications, including the date and time of the communications and the content of the communications. CML may also use this data for customer support services (including to resolve disputes between users), for safety and security purposes (including fraud prevention), to improve our products and services and/or for analytics.
3. Data from other sources, which includes:
- User feedback, such as ratings, feedback, complaints or compliments.
- Users participating in our referral programs. For example, when a user refers another person, we receive the referred person’s personal data from that user.
- Account holders who request services for or on behalf of other users, or who enable such users to request or receive services through their accounts. This includes holders of Curb for Business Accounts.
- Users or others providing information in connection with claims or disputes.
- CML business partners through which users create or access their Account, such as third party apps or websites that use CML’s APIs or whose APIs CML uses.
- Vendors who help us verify users’ identity, background information or eligibility to work, or the authenticity of a user’s request for Services, whether for regulatory, safety or security purposes.
- Insurance, vehicle or financial services providers for drivers.
- Transportation companies such as dispatch associations, radio networks or for-hire-vehicle rental fleets (for drivers who use our services through an account associated with such a company).
- Publicly available sources.
- Marketing service providers.
CML may combine the data collected from these sources with other data in its possession.
CML collects and uses data to enable reliable and convenient transportation, delivery, and other products and services. We also use the data we collect:
- To enhance the safety and security of our users, Platform and Services, including fraud prevention
- For customer support and/or dispute resolution
- For research and development
- To enable communications with, between or among users
- To send marketing and non-marketing communications to users
- In connection with legal or administrative proceedings
CML does not sell or share user personal data with third parties for their direct marketing, except with users’ consent.
CML uses the data it collects for purposes including:
1. Providing Services and features.
CML uses the data we collect to provide, personalize, maintain, and improve our Platform and Services.
This includes using the data to:
- Create and update users’ accounts.
- Verify drivers’ identity, background history and/or eligibility to provide transportation.
- Verify the probability of a user’s Service request being authentic.
- Enable transportation and other Services.
- Offer, process or facilitate payments for Services.
- Track and share the progress of trips arranged via the Platform.
- Enable features that allow users to share information with other people, such as share ETA and location with their contacts.
- Perform internal operations necessary to provide our services, including to troubleshoot software bugs and operational problems; to conduct data analysis, testing, and research; and to monitor and analyze usage and activity trends.
2. Safety and security.
We use personal data to help maintain the safety, security and integrity of our Platform, Services and users. This includes:
- Screening passengers and drivers before enabling their use of our Services and at subsequent intervals, including through reviews of background checks, where permitted by law, to help prevent use of our Services by unsafe persons.
- In certain regions, using information derived from driver’s photos submitted to CML for safety and security purposes. This includes prompting drivers establishing an account on the Curb® driver App to share a selfie before enabling such driver to receive trip requests.
- Using device, location, profile, usage and other data to prevent, detect, and combat fraud or unsafe activities.
- Using user ratings and feedback to encourage compliance with our performance expectations and as grounds for de-prioritizing drivers with low ratings or who otherwise fail to meet such expectations.
3. Customer support.
CML uses the information we collect (including recordings of customer support calls with notice to and the consent of the user) to provide customer support, including to:
- Direct questions to the appropriate customer support person
- Investigate and address user concerns
- Monitor and improve our customer support responses and processes
4. Research and development.
We may use the data we collect for testing, research, analysis, product development and machine learning to improve the user experience. This helps us to improve and enhance the safety and security of our Platform and Services, improve our ability to prevent the use of our Platform or Services for illegal or improper purposes and develop new features and products.
5. Enabling communications between users.
For example, a driver may message or call a passenger to confirm a pickup location or a passenger may contact a driver to retrieve a lost item.
6. Marketing.
CML may use the data we collect to market our Services to our users. This includes sending users communications about CML services, features, promotions, sweepstakes, studies, surveys, news, updates and events.
We may also send communications to our users about products and services offered by CML partners. For example, if a user has used a certain payment card to pay for Services, we may send that user a communication regarding an offer or promotion provided by that payment card network (e.g., Mastercard, American Express, etc.). Although we may send users communications about CML partners’ products and services, we do not sell users’ personal data to, or share it with, such partners or others for purposes of their own direct marketing or advertising, except with users’ consent.
We may use the data we collect to personalize the marketing communications (including advertisements) that we send, including based on user location, past use of CML’s services and user preferences and settings.
7. Non-marketing communications.
CML may use the data we collect to generate and provide users with receipts; inform them of changes to our Terms of Use, services, or policies; or send other communications that aren’t for the purpose of marketing the services or products of CML or its partners.
8. Legal proceedings and requirements.
We may use the personal data we collect to investigate or address claims or disputes relating to use of the Platform or Services, or as otherwise allowed by applicable law, or as requested by regulators, government entities and official inquiries.
9. Automated decision-making.
We use personal data to make automated decisions relating to use of our services. This includes:
- Matching available vehicles to users requesting ground transportation. Users can be matched based on availability, proximity and other factors.
- Deactivating users who are identified as having engaged in fraud or activities that may otherwise harm CML, its users and/or others.
- Using user location information, and communications between passengers and drivers, to identify no-show or cancellation fees payable or induced through fraud. For example, if we determine by using such information that a driver is delaying a passenger pickup in order to induce a cancellation, we will not charge the passenger a no-show or cancellation fee and may instead charge the driver a no-show or cancellation fee.
CML and its partners use cookies and other identification technologies on our Apps, Sites, emails, and online ads for purposes described in this notice.
Cookies are small text files that are stored on browsers or devices by websites, apps, online media, and advertisements. CML uses cookies and similar technologies for purposes such as:
- Authenticating users
- Remembering user preferences and settings
- Determining the popularity of content
- Delivering and measuring the effectiveness of advertising campaigns
- Analyzing App and Site traffic and trends, and generally understanding the online behaviors and interests of people who interact with our Platform or Services
We may also allow others to provide audience measurement and analytics services for us, to serve advertisements on our behalf across the Internet and to track and report on the performance of those advertisements. These entities may use cookies, web beacons, SDKs and other technologies to identify the devices used by visitors to our Sites, as well as when they visit other online sites and services.
Some of CML’s Services require that we share data with other users or at a user’s request. We may also share data with our affiliates, subsidiaries and partners, for legal reasons or in connection with claims or disputes.
CML may share the data we collect:
1. With other users
This includes sharing:
- Passengers’ name and pickup and/or dropoff location with drivers.
- Passengers’ name with other passengers in a shared ride. Passengers in shared rides may also see the dropoff location of the other passengers.
- We may share diver information and data with passengers and/or Account holders, including name and photo; vehicle make, model, color, license plate, and vehicle photo; location (before and during trip); and contact information (depending upon applicable laws). We also provide passengers with receipts containing information such as a breakdown of amounts charged, vehicle license plate and/or registration number, driver name and/or license number, driver and/or vehicle photo, route map, and such other information required on invoices in the country or region where the trip was performed.
2. At the user’s request
This includes sharing data with:
- Other people at the user’s request. For example, we share a user’s ETA and location with a friend when requested by that user, or a user’s trip information when they split a fare with a friend.
- CML business partners. For example, if a user requests a service through a partnership or promotional offering made by a third party, CML may share certain data with those third parties. This may include, for example, other services, platforms, apps or websites that integrate with our APIs; vehicle suppliers or services; those with an API or service with which we integrate; or restaurant partners or other CML business partners and their users in connection with promotions, contests, or specialized services.
3. With the general public
Questions or comments from users submitted through public forums such as CML blogs and CML social media pages may be viewable by the public, including any personal data included in the questions or comments submitted by a user.
4. With the CML Account holder
If a user requests Services using an Account held by another party or payment for which Services will be charged to an Account held by another party, we may share the request and/or trip information, including real-time location data, with the Account holder. This occurs, for example, when:
- A passenger uses their employer’s Curb for Business account (or a sub-account thereof) to arrange or pay for a trip via the Platform;
- A driver uses an Account held by or associated with a third party transportation company (e.g., a dispatch association, radio network or for-hire vehicle rental company); or
- A passenger takes a trip arranged by a third party under that third party’s Account.
5. With CML subsidiaries and affiliates
We share data with our subsidiaries and affiliates to help us provide our services or conduct data processing on our behalf. For example, CML processes and stores data in the United States on behalf of its international subsidiaries and affiliates.
6. With CML service providers and business partners
CML provides data to vendors, consultants, marketing partners, research firms and other service providers or business partners. These include:
- Payment processors and facilitators
- Background check and identity verification providers (drivers and delivery partners only)
- Cloud storage providers
- Marketing partners and marketing platform providers, including social media advertising services
- Data analytics providers
- Research partners, including those performing surveys or research projects in partnership with CML or on CML’s behalf
- Vendors that assist CML to enhance the safety and security of its Platform, including its Apps
- Consultants, lawyers, accountants and other professional service providers
- Transportation company partners (e.g., dispatch associations, radio networks or for-hire vehicle rental companies)
- Insurance and financing partners
7. For legal reasons or in the event of a dispute
CML may share users’ personal data if we believe it’s required by applicable law, regulation, operating license or agreement, legal or administrative process or governmental request, or where the disclosure is otherwise appropriate due to safety, fraud or similar concerns. This includes sharing personal data with law enforcement officials, public health officials, other government authorities, airports (if required by the airport authorities as a condition of providing Services on airport property) or other third parties as necessary to enforce our Terms of Service, user agreements or other policies; to protect CML’s rights or property or the rights, safety, or property of others; or in the event of a claim or dispute relating to the use of our Platform or Services. If you use another person’s credit card, we may be required by law to share your personal data, including trip or order information, with the owner of that credit card.
This also includes sharing personal data with others in connection with, or during negotiations of, any merger, sale of company assets, consolidation or restructuring, financing, or acquisition of all or a portion of our business by or into another company.
8. With consent
CML may share a user’s personal data other than as described in this notice if we notify the user and they consent to the sharing.
CML retains user profile, transaction and other personal data for as long as a user maintains their Account.
CML may retain certain user data after receiving an Account deletion request if necessary, such as to comply with legal requirements.
For drivers, CML may also retain vehicle and background check information (to the extent permitted by law) for as long as they maintain their Account.
Passengers may request deletion of their account at any time via email to support@gocurb.com. Following such requests, CML deletes the data that it is not required to retain for purposes of regulatory, tax, insurance, litigation, document retention or other legal or compliance requirements. While it retains such data, it may also use it for purposes of safety, security, fraud prevention and detection, and research and development. In certain circumstances, CML may be unable to delete a user’s Account, such as if there’s an outstanding credit or payment on the account or an unresolved claim or dispute. Upon resolution of the issue preventing deletion, CML will delete the Account as described above.
CML may also retain certain information if necessary for purposes of safety, security, and fraud prevention. For example, if CML deactivates an Account because of unsafe behavior or security incidents, CML may retain certain information about that Account to prevent that user from opening a new Account in the future.
We only collect and use personal data where we have lawful grounds to do so. These include processing user personal data to provide requested Services, for purposes of CML’s legitimate interests or those of other parties, to fulfill our legal obligations, or based on consent.
We collect and use personal data only where we have one or more lawful grounds for doing so. Such grounds may vary depending on where our users are located, but generally include processing personal data:
1. To provide requested Services
In order to provide our Services, we must collect and use certain personal data. This includes:
- User profile data, which we use to establish and maintain Accounts; verify user identity; communicate with users about their Services, requests and Accounts; and enable users to make payments or receive earnings
- Background information, which is used to verify an applicant’s eligibility to be provide transportation
- Location data, which we use to facilitate and track trips and assist with navigation
- Usage data, which is necessary to maintain, optimize and enhance the Services, including to determine incentives, connect passengers and drivers and calculate costs of trips
- Transaction and payment information
- Information relating to customer support
2. For purposes of the legitimate interests of CML or other parties
This includes using personal data to maintain and enhance our users’ safety and security. For example, we use personal data to prevent use of our Services by users who have engaged in inappropriate or dangerous behavior, such as by retaining data of banned users to prevent their use of the Platform or Services.
This also includes purposes such as combating fraud; improving our services, direct marketing, research, and development; and enforcing our Terms of Service.
In addition, it includes using personal data to the extent necessary for the interests of other people or the general public, such as in connection with legal or insurance claims, and to protect the rights and safety of others.
3. To fulfill CML’s legal obligations
For example, CML is subject to laws and regulations in many cities and countries that require it to collect and retain data about our users’ trips, and to provide copies of such data to the government or other authorities. We collect and use personal data to comply with such laws.
CML may also share data with law enforcement regarding criminal acts or threats to public safety, or requests by third parties pursuant to legal processes.
4. With consent
CML may collect and use personal data based on the user’s consent. For example, we may collect personal data through voluntary surveys. Responses to such surveys are collected on the basis of consent and will be deleted once no longer necessary for the purposes collected.
A user who has provided consent to a collection or use of their personal data can revoke it at any time. However, the user will not be able to use any Service that requires collection or use of that personal data.
CML enables users to access and control the data that CML collects, including through:
- In-app settings
- Device permissions
- Marketing opt-outs
CML also enables users to request access to or copies of their data, changes or updates to their Accounts, deletion of their Accounts, or that CML restrict its processing of user personal data.
A. Privacy settings
CML provides users with trip status notifications and updates related to activity on their account. These notifications are a necessary part of using the CML app and cannot be disabled. However, users may choose the method by which they receive these notifications through the Settings > Profile > Push Notifications menu in the CML app. Disabling push notifications may limit your ability to use our Services.
A passenger can adjust his or her location-sharing preferences in the settings menus of his or her mobile device. The Curb® mobile App uses passengers’ device location services to make it easier to arrange a trip whenever they need one. Location data helps improve our services, including pickups, navigation and customer support. Disabling our Apps’ access to your device’s location services may limit your ability to use our Services.
B. Device permissions
Most mobile device platforms (iOS, Android, etc.) have defined certain types of device data that apps cannot access without the device owner’s permission, and these platforms have different methods for how that permission can be obtained. iOS devices notify users the first time the CML app requests permission to access certain types of data and gives users the option to grant or refuse permission. Android devices notify users of the permissions that the CML app seeks before their first use of the app, and use of the app constitutes a grant of such permission.
D. Marketing opt-outs
Users may opt out of receiving marketing and promotional communications from CML by following the unsubscribe instructions in those communications. We may still send non-promotional communications to users who have opted out of marketing and promotional communications, such as receipts for rides or information about their Account.
E. User data requests
CML provides users with a variety of ways to learn about, control, and submit questions and comments about CML’s handling of their data. To make a request, please send an email to support@gocurb.com.
Accessing data: Users can ask for an explanation of the data we collect from them and how we use it.
Receiving data: Users can ask for a copy of data that CML collects from them with their consent or as necessary to provide our services.
Changing or updating data: Users can edit the name, phone number, email address, payment method and photo associated with their account through the Settings menu in CML’s Apps or Sites. They may also ask that CML change or update their data, including if they believe such data is inaccurate or incomplete.
Deleting data: Users may request deletion of their account at any time by submitting such request to support@gocurb.com.
Objections, restrictions, and complaints: Users may request that we stop using all or some of their personal data, or that we limit our use of their data. CML may continue to process data after such objection or request to the extent required or permitted by law.
In addition, depending on their location, users may have the right to file a complaint relating to CML’s handling of their personal data with the data protection authority in their country. For example, users in the United Kingdom may submit such requests to the Information Commissioner’s Office.
We may occasionally update this notice. Use of our Platform or Services after an update constitutes consent to the updated notice to the extent permitted by law.
If we make significant changes to this notice, we will notify users in advance of the changes through the CML Apps or Sites or through other means, such as email. We encourage users to periodically review this notice for the latest information on our privacy practices. After such notice, use of our services will be understood as consent to the updates to the extent permitted by law.
