Metropolitan Transportation Commission Clipper^® Program Privacy Policy

The effective date of this Privacy Policy is November 16, 2011
Last updated June 29, 2022

Overview

The Metropolitan Transportation Commission (MTC) is committed to ensuring Clipper^® customer privacy and security. Specifically: (1) MTC will not provide personally identifiable information (“PII”) from Clipper^® accounts to any third party without express customer consent, except as described in the Privacy Policy; (2) PII from Clipper^® accounts will never be provided to advertisers for their use; (3) MTC will not sell PII; and (4) MTC will maintain a secure environment for customer PII.

This Privacy Policy is intended to provide an understanding of how MTC handles PII collected by the Clipper^® Fare Payment System (FPS) program. Among other things, this policy explains the types of information collected from Clipper^® customers; the categories of third parties with whom MTC may share this information; and the process by which Clipper^® customers are notified about material changes to this Policy.

MTC engages contractors to operate and maintain the Clipper^® FPS program, including conducting Customer Service Center (CSC) activities, on behalf of MTC. These contractors are collectively referred to as the “Clipper^® Contractors.” Clipper^®’s Terms and Conditions (https://www.clippercard.com/ClipperWeb/agreement.do) notify customers that by enrolling in the Clipper^® program and/or using the system, the customer is allowing MTC, the Clipper^® Contractors, and other third parties referenced herein, to process personal information according to the provisions set forth in the Clipper^® Cardholder License Agreement and this Privacy Policy.

Definitions

The following definitions apply:

Personally Identifiable Information (PII):

PII identifies or describes a person or can be directly linked to a specific individual. Examples of PII include but are not limited to, a person’s name, date of birth, mailing address, business name, alternate contact information (if given), email address, Clipper ^® card serial number, telephone number, bank account information, credit card number, security code and expiration date, answers to security question (such as mother’s maiden name, city of birth, and best friend’s name), photograph and Travel Pattern Data.

Aggregate Data or Aggregate Information:

Aggregate Data or Aggregate Information: Aggregate Data or Aggregate Information is statistical information that is derived from collective data that relates to a group or category of persons from which PII has been removed. Aggregate Data reflects the characteristics of a large group of anonymous people. MTC may use Aggregate Data for any agency purpose and make it available to third parties. For example, MTC may provide Aggregate Data to others for generating statistical reports for the purpose of managing and evaluating Clipper ^® program operations.

Anonymous Data or Anonymous Information:

Anonymous Data or Anonymous Information is disaggregated data from which all PII has been removed, that does not identify or describe a person and that cannot be directly linked to a specific individual. MTC may use Anonymous Data for any of its statutorily-authorized purposes and may make Anonymous Data available to third parties.

Travel Pattern Data:

Travel Pattern Data is information concerning an individual Clipper ^® user’s trip start and end points, routes used, and date(s) and time(s) traveled. A Clipper ^® user’s trip start and end points, routes used, and date(s) and time(s) traveled do not constitute Travel Pattern Data if such information (1) is dissociated from any specific individual to create Anonymous Data; or (2) is combined with other data to create Aggregate Data.

Clipper ^® Mobile App:

The Clipper ^® Mobile App provides users with the ability to manage their Clipper ^® accounts and plan transit trips. The Clipper ^® Mobile App is available free of charge at the Apple App Store and the Google Play Store. Use of the Clipper ^® Mobile App is subject to the Clipper ^® Mobile Application License Agreement found at https://www.clippercard.com/ClipperWeb/mobile-application-agreement.html.

Digital Wallets:

Digital Wallets are provided by Apple and Google (Digital Wallet Providers). Digital Wallets allow users to store credit or debit card information in their mobile devices and enable the use of a mobile (virtual) Clipper ^® Card. Payment methods available in Digital Wallets may also be used to add value to a physical (plastic) Clipper ^® Card. Digital Wallets are subject neither to the Clipper ^® Mobile Application License Agreement nor this Privacy Policy. Digital Wallets are governed by the separate terms of use and privacy policies listed here: https://www.clippercard.com/ClipperWeb/mobile-application-agreement.html.

Clipper ^® START ^(SM):

Clipper ^® START ^(SM) is a pilot program that provides transit fare discounts on single rides on the Participating Transit Agencies listed here: https://www.clipperstartcard.comopens in new window .

Regional Transit Connection Discount ID Card:

The Regional Transit Connection (RTC) Discount ID Card is a Clipper® Card available to persons with qualifying disabilities under which the cardholder may receive discount fares on fixed-route, rail and ferry systems throughout the San Francisco Bay Area. MTC became responsible for verifying eligibility for RTC Discount Card applicants on July 1, 2022. This Privacy Policy applies to PII collected in connection with RTC Discount Card applications on or after this date. Information about eligibility and participating agencies is listed at https://511.org/transit/rtc-cardopens in new window .

Clipper ^® Websites:

Include clippercard.com, m.clippercard.com, and clipperstartcard.com

Collection of Personally Identifiable Information

A Clipper^® card may either be registered or unregistered and may be physical (plastic) or mobile (virtual) via a Digital Wallet. MTC, through the CSC, collects PII in order to register Clipper^® cards with the Clipper^® FPS. Examples of PII include a Clipper^® cardholder's name, address, telephone number, email address, bank account information, credit card number, security code and expiration date, Clipper^® card serial number, answers to security question (such as mother’s maiden name, city of birth, and best friend’s name), photograph or other information that personally identifies a Clipper^® cardholder. MTC obtains this PII from applications and other forms submitted by Clipper^® cardholders to the CSC by telephone, mail, facsimile transmission or by electronic submission through the Clipper^® website or the Clipper^® Mobile App and from the Clipper^® Participating Transit Agencies listed below who receive applications for RTC Discount ID Cards and manage institutional programs such as “AC Transit EasyPass” and “VTA Smart Pass.” Travel Pattern Data and purchase history, including fare-product purchased, date and time of purchase, the value of the purchase and, for in person sales, the location of the purchase, are collected as a byproduct of the use of the Clipper^® card in the Clipper FPS. If users of the Clipper^® Mobile App choose to save a point of interest as a favorite in the app’s trip planner, the name, address, latitude, and longitude of the point of interest are collected in MTC’s Clipper^® Contractor’s back-office system and linked to the user’s email address. In addition, if a Clipper^® cardholder participates in a bike share program that uses the Clipper^® card serial number as an identifier for membership, MTC may obtain such serial number along with bike trip records, including origin and destination stations and times traveled, from the bike-share program operator.

For those customers participating in the Clipper^® START^(SM) Pilot Program, additional PII is collected to determine eligibility. Such PII is incorporated in the documentation requested to prove identity (such as photo of driver license, state-issued ID, passport, or permanent resident card) and income (such as photo of CalFresh/EBT card, Medi-Cal card, or tax documents). The CSC obtains this documentation from information submitted by customers through the Clipper^® START^(SM) website and in paper form submitted by mail or facsimile transmission to the contractor performing the eligibility review.

Additional PII, such as date of birth, is also collected to determine eligibility for Clipper® Youth and Senior Discount Cards. Such PII is incorporated in the application and supporting documentation requested to prove eligibility (birth certificate or passport, state-issued ID card or driver’s license, permanent resident card (“Green Card”), matricula consular/consular ID card, San Francisco City ID card, student ID card, military ID or dependent card, or medical benefit card). Applicants for a Clipper® Youth or Senior Discount card submit applications with copies of supporting documents to MTC’s CSC contractor via mail, email, facsimile, at an in-person customer service location, or via the Clipper® Mobile App.

Additional PII is also collected to determine eligibility for RTC Discount ID Cards. Such PII is incorporated in the application(s) and supporting documentation requested to prove eligibility (Veteran’s letter, Medicare Card, DMV Placard Registration Receipt, or disability card from another transit agency) and includes Veteran’s Administration Claim number, Medicare number, DMV Placard number, category of disability, sex, and date of birth. Applicants submit applications with copies of supporting documents to the Clipper® Participating Transit Agencies which forward them to MTC’s verifier contractor to determine eligibility. In some circumstances, PII may also be provided by applicants or their doctors (or other eligible professionals certified by the state Medical License Board) directly to MTC’s verifier contractor.

How MTC uses Personally Identifiable Information

MTC uses the PII provided in order to process enrollments, manage accounts, promote Clipper^® program improvements, perform data analysis to inform MTC initiatives, respond to questions, send customer emails about Clipper^® program updates, provide information regarding significant changes to this Privacy Policy, and otherwise communicate with Clipper^® customers, but only after satisfying any applicable requirements of law, such as requirements to seek customer consent to receive certain types of communications.

PII is only utilized as described in this Privacy Policy.

Third Parties with Whom MTC May Share Personally Identifiable Information

MTC may share PII with the Alameda-Contra Costa Transit District (AC Transit), Golden Gate Transit, Caltrain, BART, the City and County of San Francisco, acting by and through its SFMTA, the San Mateo County Transit District (SamTrans), the Santa Clara Valley Transportation Authority (VTA), the San Francisco Bay Area Water Emergency Transportation Authority (WETA); Central Contra Costa Transit Authority; the City of Fairfield, as the operator of Fairfield and Suisun Transit; City of Petaluma; Eastern Contra Costa Transit Authority; Livermore/Amador Valley Transit Authority; Marin County Transit District; Napa Valley Transportation Authority; Solano County Transit; Sonoma County Transit; Vacaville City Coach; Western Contra Costa Transit Authority; the City of Santa Rosa, the City of Union City, and the Sonoma-Marin Area Rail Transit District (collectively referred to herein, together with any other transit operators who may begin collecting fares through the Clipper^® FPS, as Clipper^® Participating Transit Agencies) for the purpose of operating and managing the Clipper^® FPS. In addition, MTC and the Clipper^® Participating Transit Agencies may disclose PII to the Clipper^® Contractors or their other contractors, but only for the purpose of operating and maintaining the Clipper^® FPS, such as managing patron accounts, storing information, operating the Clipper^® Mobile App, determining eligibility for Clipper^® START(SM), Clipper® Youth and Senior Discount Cards, and RTC Discount ID Cards, and revenue collection. These contractors are provided only with the PII they need to deliver the service. MTC requires its service providers to maintain the confidentiality of the PII and to use it only as necessary to carry out their duties under the Clipper^® Program. Further, MTC or its contractors may share PII with law enforcement agencies, as required by law. In addition, MTC’s Clipper^® System Integrator Contractor shares PII with a subcontractor to enable credit card processing services. MTC’s Clipper^® System Integrator Contractor also provides Clipper^® card serial numbers to the Digital Wallet Providers for assignment to mobile (virtual) cards.

Besides these entities, PII will not be disclosed to any other third party without express customer consent, except as required to comply with laws or legal processes served on MTC or the Clipper^® Contractors.

Retention of Personally Identifiable Information

MTC, through the Clipper^® Contractors, shall only store the PII of a Clipper^® customer that is necessary to perform account functions such as billing, account settlement, or enforcement activities. All other information shall be discarded no more than four years and six months after fare payment has been made, except as required to comply with laws or legal processes. All PII shall be discarded no later than four years and six months after the account is closed or terminated, except as required to comply with laws or legal processes. For Clipper^® START^(SM) enrollees, proof of identity and proof of income documentation is discarded no later than 120 days after approval, denial, or issuance of final notice of incomplete applications. Paper copies of applications and supporting materials shall be discarded after entry into the Clipper^® START^(SM) database. For Clipper® Youth and Senior Discount Card applicants, application materials submitted are discarded no later than 30 days after verification of eligibility. For RTC Discount Card applicants, application materials are discarded no later than 90 days after verification of eligibility.

Security of Clipper^® Personally Identifiable Information

MTC is committed to the security of customer PII. PII provided by Clipper^® customers is stored on computing systems and services that are located in secure, controlled facilities. Computing systems and services are designed with software, hardware and physical security measures in place to prevent unauthorized access.

Access to PII is controlled through the following administrative, technical, and physical security measures. By contract, third parties, including cloud service providers, with whom MTC shares or stores PII are also required to implement adequate security measures to maintain the confidentiality of such information.

Administrative:

• Access to PII is limited only to certain operations and technical employees for limited, approved purposes based on their specific work responsibilities.
• Privacy and security training is required for employees with access to PII, upon hire. In addition, regular periodic refresher training is required for those employees.

Technical:

• Clipper^® contractor network perimeters are protected with firewalls.
• Electronic storage of PII is encrypted.
• Electronic connections to and from the Clipper^® Websites are encrypted.
• Vulnerability and penetration tests are conducted on the Clipper^® system.
• Employees' use of Clipper^®, Clipper^® START^(SM) and the RTC Clipper^® access customer databases is monitored. For customer databases stored in cloud based services and systems, employees’ use is logged and maintained.

Physical:

• Physical access to MTC and Clipper^® Contractor servers is restricted to authorized technical personnel.
• Data center access to approved technical personnel is restricted via secure authentication, and other security protocols.

In addition to MTC’s policies and procedures implementing PII security, the Clipper^® customer must also do such things as safeguard passwords, PINs, and other authentication information that may be used to access a Clipper^® account. Clipper^® customers should not disclose authentication information to any third party and should notify MTC of any unauthorized use of their passwords. MTC cannot secure PII that is released by Clipper^® customers or PII that customers request MTC to release. In addition, there is a risk that unauthorized third parties may engage in illegal activity by such things as hacking into MTC's security system or the security system of a Clipper^® Contractor or by intercepting transmissions of personal information over the Internet. MTC is not responsible for any data obtained in an unauthorized manner, and MTC is the only entity that may authorize obtaining data from the Clipper^® FPS.

Please note that with the exception of processing an application for Clipper^® START^(SM), a Clipper^® Youth or Senior Discount Card, or an RTC Discount ID Card, unless the Clipper^® customer initiates an inquiry, the Clipper^® Contractors will never ask Clipper^® customers to provide or confirm any information in connection with Clipper^® such as credit card numbers, Clipper^® card serial numbers, or other PII. If a customer ever has any doubt about the authenticity of an email regarding Clipper^®, the customer should open a new web browser, type in https://www.clippercard.com/ClipperWeb/index.do, log into the customer’s Clipper^® account, and then perform the requested activity. If a customer ever has any doubt about the authenticity of an email, text , or phone message regarding Clipper^® START^(SM) , the customer should open a new web browser, type in https://www.clipperstartcard.com/s/login, log into the customer’s Clipper^® START^(SM) account, and then perform the requested activity. The Clipper^® START^(SM) Pilot Program uses a passwordless login process for account access and will email or send a text message with a verification code. As an alternative, the customer may call 855-614-9149 for assistance.

In connection with a Clipper® START(SM) , Clipper Youth or Senior Discount Card, or RTC Discount ID Card application, a Clipper® Contractor may contact an individual using PII provided in the application if the application is denied or is incomplete. If incomplete, the contractor will attempt to assist the individual in completing the application.

Account access and controls

Creating an account with Clipper^® is in the customer’s discretion. The required account information consists of PII such as name, business name, mailing address(es), email address, telephone number, bank account number, and credit card number, expiration date and security code. MTC may request other optional information, such as alternate contact information, but, in such instances, clearly indicates that such information is optional.

Customers can review and update personal account information at any time. Customers are also able to modify, add, or delete any optional account information by signing into their Clipper^® account on clippercard.com, m.clippercard.com, or the Clipper^® Mobile App and editing the account profile. Deletion of some account information, such as a customer’s primary funding source may require contacting the CSC by telephone. PII can also be reviewed and edited online as discussed below under “Updating Personally Identifiable Information.” Clipper^® customers can close their account at any time by submitting a completed Clipper^® Cancellation Form (available at clippercard.com).

Creating an account with Clipper^® START^(SM) is required to apply for the pilot program and is separate from creating an account with Clipper^®. The required Clipper^® START^(SM) account information consists of PII such as name, mailing address(es), email address, telephone number, and information incorporated in proof of identity and income documentation. MTC will also request demographic information (e.g. gender, ethnicity) and survey information but, in such instances, an applicant can choose not to answer. Clipper^® START^(SM) enrollees can review and update personal account information, while the account is active. PII can also be reviewed and edited online or by telephone as discussed below under “Updating Personally Identifiable Information.” Clipper START customers can close their account at any time by contacting the Clipper^® START^(SM) Customer Service Center.

Aggregate Data

MTC may also combine the PII provided by Clipper^® customers in a non-identifiable format with other information to create Aggregate Data that may be disclosed to third parties. Aggregate Data is used by MTC to manage, evaluate and improve the Clipper^® program, to inform other MTC initiatives and for the marketing of Clipper^®. Aggregate Data does not contain any information that could be used to contact or identify individual Clipper^® customers or their accounts. For example, MTC may inform third parties regarding the number of Clipper^® accounts within a particular zip code. MTC requires third parties with whom Aggregate Data is shared to agree that they will not attempt to make information personally identifiable, such as by combining it with other databases.

Anonymous Data

MTC may also remove all PII from data developed as a byproduct of the use of the Clipper^® FPS to create Anonymous Data that may be disclosed to third parties. MTC may use Anonymous Data for any of its statutorily-authorized purposes and may make Anonymous Data available to third parties. Anonymous Data does not contain any information that could be used to track, contact or identify individual Clipper^® customers or their accounts. For example, MTC may share a dataset that includes information such as where and approximately when a sample of anonymous Clipper^® users traveled on certain days in a given month. MTC requires third parties with whom Anonymous Data is shared to agree that they will not attempt to make information personally identifiable, such as by combining it with other databases or reverse engineering the data.

Accessing Clipper^® Websites and the Clipper^® Mobile App Via Mobile Devices

When the customer accesses clippercard.com or clipperstartcard.com using a mobile device, location information, IP address, and other information may be collected by the mobile device’s platform provider, operating system provider, and/or the customer’s data carrier. Before a customer accesses clippercard.com or clipperstartcard.com using a mobile device, he or she should review the terms of use and privacy policies of the customer’s platform provider, operating system provider, and data carrier to determine how they collect, use, and/or retain PII. MTC is not responsible for the terms of use or privacy policies of the platform providers, operating system providers, or data carriers, or the use of PII, by such entities.

When the customer uses the Clipper^® Mobile App, location information and other information may be collected by the mobile device’s platform provider, operating system provider, and/or the customer’s data carrier. Before a customer downloads and uses the Clipper^® Mobile App, he or she should review the terms of use and privacy policies of the customer’s platform provider, operating system provider, and data carrier to determine how they collect, use, and/or retain PII. MTC is not responsible for the terms of use or privacy policies of the platform providers, operating system providers, or data carriers, or the use of PII, by such entities.

Website Usage Metrics

The Clipper^® Websites use a third-party traffic measurement service called Google Analytics to gather and compute website usage metrics. Google Analytics collects customers’ Internet Protocol (IP) addresses and the pages the users are visiting. MTC and its contractors use this information for such things as analyzing results of Clipper^® marketing campaigns and making recommendations for website improvements, and may include such information as Aggregate Data in operational reports and presentations. Google Analytics may set a cookie that will enable it to function properly. To find out more about Google Analytics’ privacy principles, visit the Google Analytics Privacy and Security Page at https://support.google.com/analytics/answer/6004245?hl=en.

Clipper^® Mobile App Usage Analysis

MTC uses Firebase, a Google product, and Google Analytics to analyze how the Clipper^® Mobile App is being used. Firebase and Google Analytics are used by MTC and its contractors to examine and analyze app behavior, app performance, and mobile device technology with the goal of providing feedback for future enhancements and improvements. No cookies are set by Google Analytics or Firebase and information provided by them is anonymous. To find out more about Firebase’s privacy information, visit the Privacy and Security in Firebase page at https://firebase.google.com/support/privacy opens in new window . More information about how Google manages personal information for its products and services is available at https://policies.google.com/privacyopens in new window .

Cookies

The Clipper^® Websites store “cookies” on the computer systems of users of the websites. Cookies are small data elements that a website can store on a user’s system.

The cookies used by the Clipper^® Websites facilitate customer’s use of the websites (e.g. maintain login status until the session has ended). When using the Clipper^® Websites, the customer is required to accept a cookie for the session during which the customer is logged in to his or her account. Customers may change their browser security settings to accept or reject cookies.

Once a patron leaves a Clipper^® website, the Privacy Policy of other websites visited or linked-to from the Clipper^® website should also be reviewed to understand how these external sites utilize cookies and how the information that is collected through the use of cookies on these websites is utilized.

MTC does not knowingly engage in business with any company or vendor that uses Spyware or Malware. MTC does not market detailed information collected from web sessions that can be directly tied to personal information. Further, MTC does not provide Clipperv customers with downloadable software that collects or utilizes any PII.

Third-Party Websites and Applications

The Clipper^® Websites may contain links to third-party websites operated by entities that are affiliated with Clipper^®. These web links may be referenced within content, or placed beside the names or logos of the other entities. In addition, third-party websites may exist that reference one or more of the Clipper^® websites. MTC does not disclose PII to these third-party websites.

WARNING: Once a patron enters external websites (whether through a service or content link or directly through a third-party website), MTC is not responsible for the privacy practices of those other websites. Please review all privacy policies of external websites you may visit from links on the Clipper^® websites before using or providing any information to such other websites.

In addition, MTC is not responsible for third-party applications, including Digital Wallets, that access or make use of the Clipper^® Websites, the Clipper^® Mobile App, or any features thereof (“Apps”). Before a Clipper^® customer downloads or accesses Apps, he or she should review the terms of use and privacy policies of the Apps to determine how they collect, use, and/or retain PII. MTC is not responsible for the terms of use or privacy policies of Apps, or the use of PII by such Apps.

Updating Personally Identifiable Information

Certain PII can be reviewed and edited online at https://www.clippercard.com and at https://www.clipperstartcard.com/s/login. The Clipper^® Websites use functions that have the ability to collect and store self-reported data. These functions enable customers to revise, update or review information that has been previously submitted by going back to the applicable function, logging-in and making the desired changes. In addition to this method, customers may update their PII by logging into the Clipper^® Mobile App, or by telephoning the Clipper^® Customer Service Center at 877-878-8883 or the Clipper^® START^(SM) Customer Service Center at 855-614-9149. Customers of the RTC Discount card program may review or update their PII, as submitted in their applications, by contacting MTC at rtcinfo@bayareametro.gov or telephoning 415-778-6622

Complaints or problems regarding updating personal information should be submitted via the applicable website or by email or telephone. The Clipper^® or Clipper^® START^(SM) Customer Service Center will either resolve the issue or forward the complaint to an appropriate MTC staff member or Participating Transit Agency for a response or resolution. MTC strives to answer all queries within 48 business hours, but it may not always be feasible to do so.

If an adequate resolution is not received, please contact MTC's Privacy Officer at:
Metropolitan Transportation Commission
Attn: Privacy Officer
375 Beale Street, Suite 800
San Francisco, CA 94105
Or email: privacyofficer@bayareametro.gov
Or call: 415.778.6700

Changes to this Privacy Policy

Material Changes - MTC will inform Clipper^® customers if material changes are made to the Clipper^® Program Privacy Policy, in particular, changes that expand the permissible uses or disclosures of PII allowed by the prior version of the Privacy Policy. If MTC makes material changes to the Clipper^® Privacy Policy, MTC will notify Clipper^® customers by means of posting a conspicuous notice on the Clipper^® Websites that material changes have been made.

Immaterial Changes - MTC may also make non-substantive changes to the Privacy Policy, such as those that do not affect the permissible uses or disclosures of PII. In these instances, MTC may not post a special notice on the Clipper^® Websites.

If MTC decides to make any change to the Clipper^® Privacy Policy, material or immaterial, MTC will post the revised policy on the Clipper^® Websites, along with the date of any amendment.

MTC reserves the right to modify this Privacy Policy at any time, so the policy needs to be reviewed frequently by Clipper^® customers.

When MTC revises the Privacy Policy, the "last updated" date at the top of the Privacy Policy will reflect the date of the last change. We encourage Clipper^® customers to review this Privacy Policy periodically to stay informed about how MTC protects the security of PII collected for the Clipper^® Program. Continued use of the Clipper^® Program constitutes the customer's agreement to this Privacy Policy and any updates.

Emails Sent to MTC

This Privacy Policy does not apply to the content of emails transmitted directly to MTC. Please do not send PII in an email directly to MTC in order to keep content or data private.

Contact information

MTC welcomes comments on the Clipper^® Privacy Policy. Also, if there are questions about this statement, please contact the MTC Privacy Officer at the address, email or phone number listed above.

History of Changes to Privacy Policy

See FAQs about Clipper's^® Privacy Policy.