VERRA MOBILITY PRIVACY NOTICE

Verra Mobility Corporation (referred to as “Verra Mobility”, “we“, “us“, and/or “our“) takes its data protection and privacy responsibilities seriously. This notice explains how we collect and use personal information during our business activities in our capacity of data controller for the purposes of applicable data protection legislation.

We have separate privacy notices for our products and services

The Verra Mobility entity responsible for your personal information will be the Verra Mobility company that originally collects information from or about you. This may also be explained in separate notices made available when your personal information is first collected by that Verra Mobility entity, for example where you or the business you work for engages us to provide a service.

You’ll find more privacy notices when you use our other websites. This Notice supplements – but doesn’t override – them.

You can find out more about Verra Mobility by contacting us using the information in the “Contact Us” section below.

When we collect information

We collect information about you if: (i) you use our website; (ii) use our services; (iii) or contact us by post, telephone or email.

We also process personal information on behalf of our customers when we provide our services to them. When we do this, we act as a “processor” under relevant data protection laws, whilst our customer (or potentially a third party) will be the relevant “controller”. If you have concerns or questions about our processing of your personal information in the context of Verra Mobility’s services, you should contact us using the information in the “Contact Us” section below. Please note that if you contact us directly, we may need to disclose your request to the relevant customer.

The types of personal information we collect

Depending on the purpose for which we use your data, we may collect and use certain personal information that is disclosed to us including:

Your name and contact details;
Your marketing preferences;
Any other personal information you provide in correspondence with us, for example where this is relevant to a complaint or query.

Through your use of our websites, we will also collect information – such as IP address and browser generated information (browser type, operating system), as well as information about your browsing session. We do not use this information to identify you as an individual, but to tailor or enhance your browsing experience, or in aggregate with data of other users for statistical purposes. Please see our cookies policy for further information about the cookies we use.

How we use your information and what is the legal basis for our use of your information

Your personal information will be used for the purposes listed in the table below. We will only collect, use and share your personal information where we are satisfied that we have an appropriate legal basis to do this. We have also described the legal basis which we rely on, in the table. The legal basis we rely upon will impact which rights you have in relation to your personal information (see the section below for more details):

How we use your information

What is the legal basis for our use of your information

To deliver our services.

Where there is a contract in place between you and us, this processing is necessary to perform the contract between you and us.

Where there is no contract in place, or where there is a contract, but this is between us and your employer (for example), this processing is necessary for our legitimate interests.

We consider that we have a legitimate interest in providing our customers with products and services which they have requested, as this is central to our business.

To conduct business with you.

Where there is a contract in place between you and us, this processing is necessary to perform the contract between you and us.

Where there is no contract in place, or where there is a contract, but this is between us and your employer (for example), this processing is necessary for our legitimate interests.

We consider that we have a legitimate interest in conducting business with our customers, as this is central to our business, helping us to preserve our business operations and grow our business

To correspond with you in relation to our services.

Where there is a contract in place between you and us, this processing is necessary to perform the contract between you and us.

Where there is no contract in place, or where there is a contract, but this is between us and your employer (for example), this processing is necessary for our legitimate interests.

We consider that we have a legitimate interest in conducting business with our customers, as this is central to our business, helping us to preserve our business operations and grow our business

To provide Customer Services, including responding to any queries we have received from you.

This processing is necessary for our legitimate interests.

We consider that we have a legitimate interest in ensuring that all our customers receive the best possible experience, helping us to preserve our business operations and grow our business. Understanding our customers’ needs is a vital part of ensuring a great customer experience.

To monitor your use of our websites to make improvements to the site and the user experience.

This processing is necessary for our legitimate interests.

We consider that we have a legitimate interest in ensuring that we are continually improving our services to preserve our business operations and grow our business and ensuring that you are provided with information of relevance to you.

However, where this activity is carried out using cookies which are not strictly necessary (see our cookie policy for further information) we will, where required by law, obtain your consent to such processing. Where such consent has been obtained, we will rely on this as our basis for processing.

To market to you about our products and services, and otherwise to identify goods and services which we believe may be of interest to you.

This processing is necessary for our legitimate interests.

We consider that we have a legitimate interest in ensuring that our customers are kept up to date with information about our products and services, as this helps us to preserve our business operations and grow our business. This could include: receiving and replying to your email, contacting you about your account and our services or service-related issues, fulfilling subscription requests, tracking traffic patterns to make our websites and apps easier to use, planning business activities based on aggregate data analysis, ensuring the security of our websites and apps, customizing your website or app experience, or other administrative, technical or organizational activities for which we have a legitimate interest.

However, where we are required by law to obtain your consent before sending you such information, we will rely upon such consent as our basis for processing.

In any case, if you tell us that you do not wish to receive such communications from us, we will respect your wishes. If you would prefer not to receive marketing-related communications from us, we provide unsubscribe options which will allow you to opt-out of such communications.

To monitor, maintain and improve our IT environment, including security of our systems, and the applications that our customers use and that we use to manage our services.

This processing is necessary for our legitimate interests.

For our employee training purposes.

This processing is necessary for our legitimate interests.

To enable us to comply with any legal or regulatory requirements.

Our use of your personal information is necessary to comply with a relevant legal or regulatory obligation that we have.

Who we share your information with and transferring information globally

We share your information with (i) third parties who help manage our business and deliver services, including IT service providers who help manage our IT and back office systems; (ii) with other members of the Verra Mobility Group; (iii) with our regulators and law enforcement organizations; and (iv) If, in the future, we sell or transfer some or all of our business or assets to a third party, we may disclose information to a potential or actual third party purchaser of our business or assets.

Accordingly, your personal information may be transferred and stored in countries that are subject to different standards of data protection. We will take appropriate steps ensure that transfers of personal information are in accordance with applicable law and carefully managed to protect your privacy rights and interests.

Storing your personal information

We will store your personal information for as long as is reasonably necessary for the purposes for which it was collected, as explained in this notice. In some circumstances we may store your personal information for longer periods of time, for instance where we are required to do so in accordance with legal, regulatory, tax, accounting requirements.

Your rights

You have certain rights in relation to our use of your personal information, including the right to request access to, rectify or remove personal information we process; restrict or object to the processing of your personal information, transfer your personal information; and withdraw your consent to the processing of your personal information (where processing is based upon your consent). If you have any questions or comments about how we handle your personal information or wish to exercise any of the rights described above, please communicate via the “Contact Us” section below.

You have a right to lodge a complaint with your local supervisory authority if you have concerns about how we are processing your personal information. We ask that you please attempt to resolve any issues with us first, although you have a right to contact your supervisory authority at any time.

System Security Requirements

Use of Verra Mobility systems is subject to VM Consolidated operating rules and security controls, including data security, user ids, and password requirements. VM Consolidated will report to customers, as soon as possible any data security breach involving the personal information of the customer and will cooperate with the customer in taking actions to limit the effect of, and investigating the scope of, any security breach. Encryption and strong access control mechanisms are used to protect customer data both at rest and in transit in line with our policies and standards. The system requirements necessary for VM Consolidated to achieve its principal commitments and operational objectives include the following: Management demonstrates a commitment to integrity and ethical values. Management also establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives. Logical access to programs, data, and computer resources relevant to Verra Mobility systems is restricted to authorized and appropriate users and such users are restricted to performing authorized and appropriate actions. Changes to application programs and related data management systems are authorized, tested, documented, approved, and implemented to result in the complete and timely processing of transactions relevant to Verra Mobility systems. Network infrastructure is configured as authorized to (1) support the effective functioning of application controls to result in complete and timely processing of Verra Mobility systems ; (2) protect data relevant to Verra Mobility systems from unauthorized changes; and (3) support Verra Mobility systems. Application and system monitoring relevant to Verra Mobility systems are authorized and executed in a complete and timely manner and deviations, problems, and errors that may affect Verra Mobility systems are identified, tracked, recorded, and resolved in a complete and timely manner. Security incidents that are identified are documented, investigated and resolved, and users are notified as necessary.

Your State Privacy Rights

Certain state privacy laws require that we provide such state residents specific information about how we use their personal information.

Categories of Personal Information that We Collect, Disclose, and Sell

Below please find the categories of personal information about state residents that we collect, sell, and/or disclose to third parties or service providers for a business purpose.

Categories of personal information	Do we collect?	Do we disclose to a 3rd Party for a legitimate business purpose?	Do we sell?
NAME, CONTACT INFORMATION AND IDENTIFIERS: Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol (IP) address, email address, account name, or other similar identifiers.	YES	NO	NO
CUSTOMER RECORDS: Paper and electronic customer records containing personal information, such as name, address, telephone number, bank account number, credit card number, debit card number, or any other financial information,	YES	NO	NO
PROTECTED CLASSIFICATIONS: Characteristics of protected classifications under California or federal law such as race, color, sex, age, religion, national origin, disability, citizenship status, and genetic information.	NO	NO	NO
PURCHASE HISTORY AND TENDENCIES: Commercial information, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	NO	NO	NO
BIOMETRIC INFORMATION: Physiological, biological, or behavioral characteristics that can be used alone or in combination with each other to establish individual identity, including DNA, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.	NO	NO	NO
USAGE DATA: Internet or other electronic network activity information, including, but not limited to, and information regarding a resident’s interaction with websites and mobile applications.	YES	NO	NO
GEOLOCATION DATA: Geographic location information about a particular individual or device	YES	NO	NO
AUDIO/VISUAL: Audio, electronic, visual, thermal, olfactory, or similar information.	NO	NO	NO
EMPLOYMENT HISTORY: Professional or employment-related information.	NO	NO	NO
EDUCATION INFORMATION: Information that is not publicly available personally identifiable information as defined in the federal Family Educational Rights and Privacy Act (20 U.S.C. section 1232g, 34 C.F.R. Part 99).	NO	NO	NO
PROFILES AND INFERENCES: Inferences drawn from any of the information identified above to create a profile about a resident reflecting the resident’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	NO	NO	NO

California Consumer Rights under the California Consumer Protection Act (“CCPA”) and California Privacy Rights Act (“CPRA”):

California law gives consumers the right to make the following data subject requests:

Access. You have the right to know what personal information the business has collected about you. While our California Privacy Policy details the personal information we collect about all California consumers, you have the right to make a request to know and get access to information that is specific to you, should we have any.
Correction. You may request that we correct inaccurate information we maintain about you, subject to some exceptions and, if necessary, independent verification.
Non-Discrimination. You have the right not to be discriminated against if you exercise any of the rights conferred by the CPRA. Please note that a legitimate denial of a request for information, deletion, or to opt out is not discriminatory, nor is charging a fee for excessive or repetitive consumer requests as permitted by the CPRA.
Deletion. You have the right to request that we delete personal information we have collected from you, subject to certain exception. For example, we will not delete any personal information required to provide our services to you or that we must maintain to comply with our legal obligations. We will notify you following submission of your request if this is the case.
Limitation. In some instances, you have the right to limit our use or disclosure of Sensitive Personal Information.

Opt-Out of the Sale/Sharing of Your Personal Information. If we have sold or shared personal information about you, you have the right to opt out of the sale or sharing of that personal information. To exercise your opt-out rights, please visit our Do Not Sell My Personal Information form.

Personal Information of Minors. Our Website and other business offerings, including our Services, are not intended for children or minors under the age of 18+ years old.

Additional California Privacy Rights. California Civil Code Section § 1798.83 permits users of our web site that are California residents to request certain information regarding our disclosure of personal information to other parties for their direct marketing purposes. To make such a request, please send an email to privacy@verramobility.com with the subject ‘Shine the Light Request.

You can submit a data subject request by:

Filling out Verra Mobility’s Request Form
Calling us at +1 480-596-4566;
Emailing us at privacy@verramobility.com; or
Writing us at VRRM, Attn: Privacy Office, 1150 North Alma School Road, Mesa AZ 85201

After we receive your request, to ensure the security of the information we store and consumers’ privacy, we will verify that you are appropriately affiliated with the subject of the request, either as the consumer or as an authorized agent or guardian of the consumer. We may ask you to provide a few pieces of information to confirm your identity in our records. You may designate an authorized agent to exercise your rights under the CCPA on your behalf. You must provide the authorized agent written permission to exercise your rights under the CPRA on your behalf and we may deny a request from an agent on your behalf if we cannot verify that they have been authorized by you to act on your behalf. Even if you use an authorized agent to exercise your rights under the CCPA on your behalf, pursuant to the CCPA we may still require that you verify your own identity directly to us. This provision does not apply if you have provided a power of attorney under the California Probate Code.

The CCPA and CPRA prohibit discrimination against California consumers for exercising their rights under the CCPA and CPRA. We do not discriminate against California consumers when they exercise their CCPA and CPRA rights.

Commonwealth of Virginia Consumer Rights under the Virginia Consumer Data Protection Act (VCDPA) and other applicable Virginia laws:

To confirm whether we are processing your personal information.
To access your personal information and obtain a copy of it (where the processing is carried out by automated means).
To correct inaccuracies in your personal information.
To delete the personal information, we have collected from or about you.
To opt out of the processing of your personal information for purposes of targeted advertising.
To opt out of the sale of your personal information.
To opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

Exercising Your Privacy Rights. You may make a request at any time to exercise your privacy rights listed above by contacting us as indicated in this Privacy Notice. We will respond to your request within 45 days of receipt (if properly submitted). If we need more time to process and respond to your request, we will notify you of that fact along with the reason for the delay. In all cases we will complete your request within 90 days from the date of our receipt of your properly submitted request. If we decline to act regarding your request, we will inform you of our decision and the reason for it, along with instructions on how you may appeal our decision.

Sale of Personal Information. Virginia residents acting within their individual capacity may opt out of the sale of their personal information. ‘Selling’ means we exchange your personal information to third parties in exchange for money. Based on this definition, we Do NOT sell your personal information to third parties.

You can submit a data subject request by:

Filling out Verra Mobility’s Request Form
Calling us at +1 480-596-4566;
Emailing us at privacy@verramobility.com; or
Writing us at VRRM, Attn: Privacy Office, 1150 North Alma School Road, Mesa AZ 85201

Colorado Consumer Rights under the Colorado Privacy Act (CPA) and other applicable Colorado laws:

To confirm whether we are processing your personal information.
To access your personal information and obtain a copy of it.
To correct inaccuracies in your personal information.
To delete the personal information, we have collected from or about you.
To opt out of the processing of your personal information for purposes of targeted advertising.
To opt out of the sale of your personal information.
To opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

Exercising Your Privacy Rights. You may also make a request at any time to exercise your privacy rights listed above by contacting us as indicated in this Privacy Notice. We will respond to your request within 45 days of receipt (if properly submitted). If we need more time to process and respond to your request, we will notify you of that fact along with the reason for the delay. In all cases we will complete your request within 90 days from the date of our receipt of your properly submitted request. If we decline to act regarding your request, we will inform you of our decision and the reason for it, along with instructions on how you may appeal our decision.

Sale of Personal Information. Colorado residents acting within their individual capacity may opt out of the sale of their personal information. ‘Selling’ means we exchange your personal information to third parties in exchange for money or something else of value. Based on this definition, we Do NOT sell your personal information to third parties.

You can submit a data subject request by:

Filling out Verra Mobility’s Request Form
Calling us at +1 480-596-4566;
Emailing us at privacy@verramobility.com; or
Writing us at VRRM, Attn: Privacy Office, 1150 North Alma School Road, Mesa AZ 85201

Connecticut Consumer rights under the Connecticut Data Protection Act (CTDPA) and other Connecticut laws:

To confirm whether we are processing your personal information.
To access your personal information and obtain a copy of it.
To correct inaccuracies in your personal information.
To delete the personal information, we have collected from or about you.
To opt out of the processing of your personal information for purposes of targeted advertising.
To opt out of the sale of your personal information.
To opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. You can submit an opt out request.

Sale of Personal Information. Connecticut residents acting within their individual capacity may opt out of the sale of their personal information. ‘Selling’ means we exchange your personal information to third parties in exchange for money or something else of value. Based on this definition, we Do NOT sell your personal information to third parties.

You can submit a data subject request by:

Filling out Verra Mobility’s Request Form
Calling us at +1 480-596-4566;
Emailing us at privacy@verramobility.com; or
Writing us at VRRM, Attn: Privacy Office, 1150 North Alma School Road, Mesa AZ 85201

Utah Consumer rights under the Utah Consumer Privacy Act (UCPA) and other applicable Utah laws:

To confirm whether we are processing your personal information.
To access your personal information and obtain a copy of information you previously provided to us.
To delete the personal information, we have collected from or about you.
To opt out of the processing of your personal information for purposes of targeted advertising.
To opt out of the sale of your personal information.

Exercising Your Privacy Rights. You may make a request at any time to exercise your privacy rights listed above as indicated in this Privacy Notice. We will respond to your request withing 45 days of receipt (if properly submitted). If we need more time to process and respond to your request, we will notify you of that fact along with the reason for the delay. In all cases we will complete your request within 90 days from the date of our receipt of your properly submitted request. If we decline to act regarding your request, we will inform you of our decision and the reason for it, along with instructions on how you may appeal our decision.

Sale of Personal Information. Utah residents acting within their individual capacity may opt out of the sale of their personal information. ‘Selling’ means we exchange your personal information to third parties in exchange for money. Based on this definition, we Do NOT sell your personal information to third parties.

You can submit a data subject request by:

Filling out Verra Mobility’s Request Form
Calling us at +1 480-596-4566;
Emailing us at privacy@verramobility.com; or
Writing us at VRRM, Attn: Privacy Office, 1150 North Alma School Road, Mesa AZ 85201

CONTACT US:

The primary point of contact for all issues arising from this privacy notice is:

Email: privacy@verramobility.com

Phone: 1-480-596-4566

Postal Address:

Verra Mobility

Privacy Department

1150 Alma School Road

Mesa, AZ 85201