Umo Privacy Policy

Last updated September 22, 2026.

UMO^® is a registered trademark of Cubic Corporation in the United States.

This Privacy Policy applies to UMO^®, a service of Cubic Transportation Systems, Inc. (“Umo”) including its wholly owned subsidiary, Delerrok Inc., and all associated brands including UMO^®, TouchPass^® and ScanRide^™. This Privacy Policy does not cover services or websites, including but not limited to umomobility.com, offered by Cubic Transportation Systems, Inc. outside of Umo since those services are covered by one or more separate privacy policies.

As used herein, “you”, “your” or “User” refers to individual persons who use Umo’s services either alone or in conjunction with Umo’s agency transit partners and transit operators (“Transit Partners”) and/or 3^rd parties integrated with our services (“Service Providers”).

Your privacy is important to us. This Privacy Policy explains how we collect, track, process, share, use, and protect your Personal Information when you (i) access our online properties including our websites (“Online Sites”), (ii) download and use our mobile phone applications (“Mobile Apps”), (iii) use any 3^rd party services from our Service Providers contained within or adjacent to our Online Sites or Mobile Apps, such as accessing our online help, planning a trip, and using next stop alerts (“3^rd Party Features”), (iv) use any services or features in conjunction with a Transit Partner such as purchasing fare product, redeeming a benefit code, or paying for Transit Partner services using a dynamic or static QR code, ScanRide™, Umo Card, or third-party contactless card, including supported contactless bank cards (“Transit Features”). For ease of reference, collectively the Online Sites, Mobile Apps, 3^rd Party Features and Transit Features are referred to herein as the “Services.”

Personal Information means information that identifies or is capable of being associated with you. As you review this Privacy Policy, here are a few general principles to keep in mind:

• Cubic is a U.S. Company. Cubic endeavors to keep Personal Information in the country of origin; however, there will be instances where this is not the case. If you visit or use our Services, your Personal Information may be transferred or processed in the United States.
• If you have a Umo account and choose to use it with one of our Transit Partners, we will use and share any information that we collect from or about you in accordance with this Privacy Policy with those Transit Partners in support of your use of our Transit Features and you will be subject to their privacy policies and terms and conditions relevant to your engagement with them and the services they provide.
• By accessing or using our Services you are accepting the practices, terms, and conditions stated in this Privacy Policy. If you disagree with any term provided herein, you may not access or use the Services and should immediately stop using the Services.
• The Services may contain links to mobile applications and/or websites operated and maintained by third parties, including by Service Providers and Transit Partners. We have no control over Service Provider, Transit Partner, or third-party privacy policies which may be different from our Privacy Policy. You access such linked websites and services at your own risk. We encourage you to review the privacy policy of any such linked website you visit to understand how they collect, store, and use your Personal Information.
• If you use your Umo^® Card or third-party contactless card, including supported bank cards, with our Services and/or use your bank card to purchase fare product or for fare payment in conjunction with Transit Features, you will be doing so with one of our Transit Partners and will be subject to their privacy policy. Note that use of Umo^® Cards and supported bank cards often requires interaction and sharing of Personal Information with Service Providers in order to support Transit Features you use.

Umo reserves the right to change this Privacy Policy at any time. In the event of any substantial change of this Policy, we will provide you with notice by posting notice of the change on the Online Sites or Mobile Apps.

Data Collection

As described below, we may ask for and collect Personal Information about you when you provide it to us and automatically when you use the Services where we believe it is reasonably required for ordinary business purposes.

This information may include:

For account registration, security, and identification purposes:

• First Name
• Last Name
• Email Address
• Phone Number
• Umo^® Card Number

Only if required by a Transit Partner for certain discounted fare types or to comply with laws which vary by state and/or province, including where we are required to obtain parental consent:

• Birthdate

For features, including trip planning and use of ScanRide:

• Location information (Lat/Long, including precise location, if available)

For Transit Features, including purchasing fare product or fare payment on a Transit Partner vehicle:

• Bank card information
• full name,
• your bank card number,
• expiration date,
• card security code or CVV
• billing address

Usage Information

In addition to the Personal Information described above, we may automatically collect certain information about your use of our Services in order to ensure access to certain 3^rd Party Features and Transit Features, to ensure that they are usable and perform well, and so that the integrity of the Services are maintained. This information may include the following:

• A unique device identifier to aid in combatting fraud on the platform
• Your device IP address which is necessary in the normal course of interacting with the platform though it may be masked by your computer or mobile device
• Your device operating system type and version, browser type and version, screen resolution, and other device settings used to provide a suitable user experience to you when using the Services
• The site you come from or the site you visit next depending on your device, browser, and privacy settings
• A cookie needed for system performance purposes when accessing the Passenger Portal
• Your activities and interaction with the Services, including analytical information from your mobile device, used for support and service improvement purposes.

If you use Transit Features, the following information will also be collected in the ordinary course of business:

• A Umo account is required to use Transit Features and so we will collect either your existing Umo card number, if converting from one to using our Mobile Apps, or registering it in our Online Sites, a phone number if you opt to use that for your account setup, or an email address and password, which may be optional in some cases. We may share this information with Transit Partners and Service Providers in order to provide these Services to you. If using a phone number or email address, we may ask you to verify what you have submitted to aid in ensuring recovery of your account should it become necessary for you or a Transit Partner to assist you with this.
• We may send text messages to your phone number (if provided) to aid in secure multi-factor authentication to your Umo account when registered from the Mobile App and in cases where your account phone number is being changed. We send emails, if you have opted in to this functionality, to send you alerts when your stored value balance is low, a pass is expiring or running out of rides, if/when your profile information has changed, in the event of a regular or autoload purchase, and other alerts, but only if you have opted in to this convenient functionality and provided us an email address.
• We send push notifications to aid with relevant Mobile App functionality, for instance, where the functionality is available, to call your attention back to the Mobile App if you are in the middle of a journey and have requested to be notified when you should get off the vehicle at your particular stop (e.g., “next stop alerts”) or silently to update the balance in your Mobile App after you have paid your fare with a dynamic QR code.
• If you have provided us access to your device’s location, we may use this for providing our trip planning functionality in conjunction with Service Providers and Transit Partners so that we know where you are when you select your destination and can provide you with relevant trip options. It is your choice to provide access to your device’s location for your convenience, and this is optional. Our Mobile Apps also support manual selection of origin and destination points on a map without the use of the device’s location for trip planning but those points selected will be passed to our Service Providers to provide you with relevant trip options. Note that not all Transit Partners choose to provide you access to our trip planning functionality.
• If you use our ScanRide functionality to scan a QR code with our Mobile Apps to pay your fare, and you have provided us access to your device’s location, we may use your device’s location in order to determine what transit stop you boarded at and share this with your Transit Partner as well as to help minimize fraud.
• If you choose to buy fare product (passes and/or stored value) through our Services, we collect and then share bank card information including your full name, card number, expiration date, card security code, and billing address with Service Providers but only those necessary to effect the purchase transaction (e.g., a third-party payment provider who processes your payment and transmits funds to the merchant account of our Transit Partner) and with the Transit Partner itself given your purchase transaction with them, but only the card brand and last four digits of your card number. Where any of this information is stored, we use PCI certified solutions including our Cubic Payment Application (“CPA”) or PCI certified Service Providers who we are contracted with either directly or through our Transit Partners.
• When you purchase fare product or make fare payments using the Services and/or in conjunction with Transit Partners and Service Providers, that activity creates transactions which are kept while there is business use for this data, and where retention is required per applicable law, which may be owned by either Umo or by any of our Transit Partners or Service Providers. In some cases, this transaction data is combined with Transit Partner vehicle location data that will show approximately where a transaction occurred to aid in reporting and Transit Partner capacity planning.

Umo does not send marketing email communications to those that use our Services and limits communication to where a particular Transit Feature requires it or where you have opted in to communication such as an email alert. Because your account information is shared with any Transit Partners you choose to work with, any communication with you via email, phone or other means is under their terms of use and privacy policy which govern your relationship with them and which differ from our policies.

Additional Sources of Information 

Our Services may also use cookies, pixel tags or other technologies to collect and store other information about your visit to, or use of, said Services, though we go through great lengths to avoid this whenever possible.

Use of Data

We use the information we collect in a number of ways, such as:

• Processing of account applications and transactions.
• Identity verification for account access and other security purposes.
• Internal reporting and analytics to optimize user experience and Services performance.
• Accounting recording, auditing, and other internal function requirements.
• User preferences management.
• Support of our Transit Partners in the use of our Services.
• Compliance of enforcing applicable legal requirements, relevant industry standards, contractual obligations, and our policies.
• Prevention of fraud and enhancement of the security of your account or our Services.
• On an aggregate or anonymous basis (such that it does not include any Personal Information) for various business purposes, where permissible under applicable laws and regulations.
• For any other purposes that we may specifically disclose at the time you provide or we collect your Personal Information.

Banners

You may see banners when you use our Services made available from our Transit Partners but these are not traditional advertisements. As a part of the Transit Features made available to our Transit Partners, they have the ability to configure text and banners on the home screen of the Mobile Apps when their specific transit agency is selected. These may change from time to time and are used to provide information to Users of the Mobile App and are fully controlled by each Transit Partner.

Disclosure of Information

We do not sell your Personal Information. We do not disclose your Personal Information to third parties for direct marketing purposes. We share your Personal Information with our Transit Partners and Services Providers in order to provide you the Umo Services.

The Services allow you to use the services offered by our Transit Partners. When you use the services of Transit Partners in conjunction with Umo Services, we may share relevant Personal Information with them as necessary for them to perform their services on your behalf. The Personal Information we share with Transit Partners through our Services will be subject to their applicable privacy policies.

We sometimes use Service Providers to perform certain services for us, e.g., to provide certain services on our behalf, such as payment processing for fare product purchases or fare payment, hosting and maintenance, data storage and management services, production and fulfillment services, and other relevant business purposes. We provide our Service Providers with the Personal Information when reasonably necessary for them to perform these services on our behalf. Each third-party partner must agree

(a) to implement and maintain reasonable security procedures and practices appropriate to the nature of the Personal Information involved in order to protect your Personal Information from unauthorized access, destruction, use, modification, or disclosure and,

(b) not to retain, use, or disclose the Personal Information for any purpose other than for the specific purpose of performing the services for us, or as otherwise permitted by law.

We may also share your Personal Information with third parties or affiliates in connection with a corporate transaction, such as a sale, consolidation or merger of the Cubic businesses and with other third parties to comply with legal requirements such as the demands of applicable subpoenas and court orders; to verify or enforce our terms of use, our other rights, or other applicable policies; to address fraud, security or technical issues; to respond to an emergency; or otherwise to protect the rights, property or security of our customers or third parties. 

Security

The security of your Personal Information is important to us. We use standard security procedures and practices appropriate to the nature of the information we collect in an effort to protect the Personal Information from unauthorized access, destruction, use, modification, or disclosure. We also require our Service Providers to implement and maintain reasonable security procedures and practices appropriate to the nature of the information we share with them. No data transmission over the Internet or any wireless network can be guaranteed to be 100% secure. So, while we strive to protect Personal Information, we cannot and do not guarantee or warrant the security of any information you transmit to or from the Services, and you do so at your own risk.

Children's Privacy Statement

Protecting children’s privacy is important to us. For that reason, no part of our Services or Mobile Apps are targeted to attract anyone under the age of 13. Users from ages 13 to 15, and in some jurisdictions where required, from ages 13 to 17, must represent and warrant that they are using the Services under the supervision of a parent or guardian and we, or our Transit Partners, may ask your parent or guardian to provide prior written consent for you to use the Services or may revoke your access to use the Service if we learn that such consent which was previously given, has been revoked. Transit Partners may have separate policies with respect to the use of their services by children and you should refer to their policies in that respect.

While we may collect Personal Information of children under the age of 13 who wish to use the Umo Services, we do not solicit this Personal Information from the child directly. We will seek, or cause our Transit Partners to seek, parental consent for any Personal Information provided for children under the age of 16, and in some jurisdictions where required, for children under the age of 18. We also comply with the Children’s Online Privacy Protection Act (COPPA), and if you believe we have Personal Information regarding a child under the age of 16 that you have not authorized, you may contact us at the contact information at the end of this Privacy Policy to request that we delete it.

California Residents

California residents have additional rights as set forth in the Privacy Notice for California Residents appended hereto.

Nevada Residents

If you are a Nevada resident, you have the right to request certain information from us regarding the collection and sale of your Personal Information (as defined in Nevada Revised Statutes 603A.320) during your use of the Services or when you otherwise interact with us online. If you have sought or acquired, by purchase or lease, any goods or services for personal, family, or household purposes from the Services, you may ask us to disclose whether we have sold (for monetary consideration) certain information about you (including your first and last name, physical address, email address, telephone number, social security number, an identifier that allows you to be contacted either physically or online, or other contact information that allows us to identify you personally). 

As a Nevada resident, you may also request to opt out of us sharing such information about you but please realize that because we provide no direct Services to end users that are not in conjunction with sharing personal information with Transit Partners, and because we do not sell or share information about you for marketing or promotional purposes, this sharing is required in order to use the Services. While we are happy to honor opt-out requests, it does mean that we will need to close your account to prevent further use of the Services. To make this inquiry, please submit a request in writing to umo.privacy@cubic.com with “Nevada Privacy Rights” in the subject line. You must include your full name, email address, and attest that you are a Nevada resident by providing a Nevada postal address in your request. Please state whether you are requesting information and/or opting out. You must complete a separate request for each Umo account. 

We will process your request within 60 days, or we will let you know if we need additional time. We may require additional information to verify your identity before we can respond. 

California / Delaware Do Not Track Disclosures

Do Not Track (“DNT”) is a web browser setting that requests that a web application disable its tracking of an individual user. When you choose to turn on the DNT setting in your mobile device, you prevent your mobile device from allowing the Mobile App to send a special signal to websites, analytics companies, ad networks, plug in providers, and other web services you encounter while browsing to stop tracking your activity. Various third parties are developing or have developed signals or other mechanisms for the expression of consumer choice regarding the collection of information about an individual consumer’s online activities over time and across third-party websites or online services (e.g., mobile device and browser do not track signals), but there is no universally agreed upon standard for what a company should do when it detects a DNT signal. Currently, we do not monitor or take any action with respect to these signals or other mechanisms. You can learn more about Do Not Track here https://allaboutdnt.com/ .

Processing in The United States

Please be aware that your Personal Information may be transferred to and maintained on servers or databases located outside your state, province, or country. If you are located outside of the United States, please be advised that we or our Service Providers may process and store information in the United States. The laws in the United States may not be as protective of your privacy as those in your location. By using our Services, you agree that the collection, use, transfer and disclosure of your Personal Information and communications will be governed by the applicable laws in the United States. Some of our Services do keep Personal Information data resident in their country of origin outside of the United States, which we endeavor to do whenever possible but cannot guarantee.

Additional Rights Applicable to Canada Residents

Residents of Canada have the following additional rights regarding the collection and use of Personal Information under Canada’s Personal Information Protection & Electronic Documents Act, Alberta residents under Alberta’s Personal Information Protection Act, British Columbia residents under British Columbia's Personal Information Protection Act and Québec residents under Québec's Act respecting the protection of personal information in the private sector (collectively “Canada’s Privacy Laws”)

• To obtain access to the Personal Information that we hold about you. If you wish to validate or access your data, you may do so by logging in to your account or contacting us at umo.privacy@cubic.com. We may require you to confirm your identity and your residency in order to obtain the information. A copy of your data will be sent to you via email within 30 business days upon receipt of request.
• To correct information. If you believe that your Personal Information that we possess is, or has become, incorrect or is incomplete, you may request to review, revise, correct, or update any of the Personal Information we may have about you free of charge. If any Personal Information is inaccurate or incomplete, you may log in to your Umo account to correct or update such data or send us your request to do so at umo.privacy@cubic.com. You can only request information that is about you personally and not your access levels or other system-generated data. If for some reason such requested changes cannot be made in our system, an explanation email will be sent to you to explain why your request cannot be honored within 30 days from the date we receive your request.
• To withdraw consent. Where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before withdrawal.

Please note that where our processing of your Personal Information relies on your consent and where you then withdraw that consent, we may not be able to provide all or some aspects of our Services to you and/or it may affect the provision of those Services. Where you have purchased fare product and it resides on your account, you will be referred to the applicable Transit Partner who provides transit services in your area so that they can service your request.

Please note that the above individual rights are not absolute, and we may be entitled to refuse requests where certain exceptions apply. If you have given your consent and you wish to withdraw it, please contact us by email using the contact details provided at the end of this document.If you would like to ask questions or provide comments regarding this Privacy Policy you may do so by sending us an e-mail at umo.privacy@cubic.com or by writing to us at Cubic Corporation, Attn: Customer Service – Privacy, 9233 Balboa Avenue, San Diego, CA 92123, United States.

Privacy Contact

If you would like to ask questions or provide comments regarding this Privacy Policy you may do so by sending us an e-mail at umo.privacy@cubic.com or by writing to us at Cubic Corporation, Attn: Customer Service – Privacy, 9233 Balboa Avenue, San Diego, CA 92123, United States.

California Privacy Rights

This Privacy Notice is for California Residents and applies solely to all visitors, users, and others who reside in the State of California (“Consumers”). We adopt this Notice to comply with the California Consumer Privacy Act of 2018 (“CCPA”). Any terms defined in the CCPA have the same meaning when used in this Section.

Umo collects certain types of Personal Information about you during your relationship with Umo as a user of or visitor to our Services. In particular, our Services have collected the following categories of Personal Information from its consumers within the last twelve (12) months. The categories and examples provided in the chart below are those defined in the CCPA. This does not mean that all examples of that category of Personal Information were in fact collected, but reflects our good faith belief to the best of our knowledge that some of that information may have been collected about consumers. We will update this disclosure from time to time as appropriate.

For purposes of the CCPA, Personal information does not include:

• Publicly available information from government records.
• Deidentified or aggregated consumer information.
• Information excluded from the CCPA’s scope, like:
• health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
• Personal Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994.

Under California law, if you are a resident of California, under certain circumstances, you have the right to request certain information that we collect about you, including:
(1) The categories of Personal Information we have collected from you;
(2) The categories of sources from which we collected the Personal Information;
(3) The business purpose we have for collecting or sharing that Personal Information;
(4) The categories of third parties with whom we share such Personal Information; and
(5) The specific pieces of Personal Information we have collected about you.

In addition, you may request that we provide you with:
(1) The categories of Personal Information that we sold about you, and the categories of third parties to whom the Personal Information was sold, by category or categories of Personal Information for each category of third parties to whom the information was sold;
(2) The categories of Personal Information that we have disclosed about you for a business purpose;
(3) The category or categories of consumers’ Personal Information that we have sold, or if we have not sold consumers’ Personal Information; and
(4) The category or categories of consumers’ Personal Information that we have disclosed for a business purpose, or if we have not disclosed that information for a business purpose.

Please note that if we collected information about you for a single one-time transaction and do not keep that information in the ordinary course of business, that information will not be retained for purposes of a request under this section. In addition, if we have de-identified or anonymized data about you, we are not required to re-identify or otherwise link your identity to that data if it is not otherwise maintained that way in our records.

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

However, we may offer you certain financial incentives permitted by the CCPA that can result in different prices, rates, or quality levels. Any CCPA-permitted financial incentive we offer will reasonably relate to your Personal Information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior opt in consent, which you may revoke at any time.

As a California resident, you also have the right, at any time, to tell us not to sell Personal Information – this is called the “right to opt-out” of the sale of Personal Information.

You may make a written request to us to request this information. We may require you to confirm your identity and your residency in order to obtain the information, and you are only entitled to make this request twice a year. You may email or write us with your request at the contact information below. Please include “California Privacy Rights” as the subject line. You must include your full name, email address, and attest to the fact that you are a California resident by including a California postal address in your request. We will respond to your request within 45 days or let you know if we need additional time.

Attention: Privacy Officer
umo.privacy@cubic.com
9233 Balboa Avenue, San Diego, CA 92123, United States

©2026, Cubic Corporation