Overview

The Bay Area Toll Authority (BATA) is committed to ensuring FasTrak® customer privacy and security. Specifically: (1) BATA will not provide personally identifiable information (“PII”) from FasTrak® accounts to any third party without express customer consent, except as described in the Privacy Policy; (2) Data from FasTrak® accounts will never be provided to advertisers for their use; and (3) BATA will maintain a secure environment for customer personal information.

This Privacy Policy is intended to provide an understanding of how BATA handles PII collected by the FasTrak® program. Among other things, this policy explains the types of information collected from FasTrak® customers; the third parties with whom BATA may share this information; and the process by which FasTrak® customers are notified about material changes to this Policy.

BATA’s contractor, ACS State and Local Solutions, (“ACS”) operates the FasTrak® Customer Service Center (“CSC”) on behalf of BATA. BATA oversees ACS. FasTrak® Terms and Conditions notify customers that by enrolling in the FasTrak® program and using the system, the customer is allowing BATA, its contractor, ACS, and other third parties referenced herein, to process personal information according to the provisions set forth in those documents and this Privacy Policy.

Definitons

The following definitions apply:

Personally Identifiable Information (PII): PII identifies or describes a person or can be directly linked to a specific individual. Examples of PII include but are not limited to, a person’s name, mailing address, business name, alternate contact information (if given), e-mail address, fax numbers, toll tag number, FasTrak® account number, license plate, telephone number, e-mail address, credit card number, security code and expiration date, and Travel Pattern Data.

Travel Pattern Data: A customer’s toll tag number is collected as he or she drives through a toll booth to record the transaction. The tag number in conjunction with the toll booth location constitutes a customer’s Travel Pattern Data.

Aggregate Data or Aggregate Information: Aggregate data or information is statistical information that is derived from collective data that relates to a group or category of persons from which PII has been removed. Aggregate data reflects the characteristics of a large group of anonymous people. BATA may use aggregate data and provide aggregate data to others to generate statistical reports for the purpose of managing the FasTrak® program operations.

Collection of Personally Identifiable Information

BATA collects PII, including name, business name, mailing address(es), e-mail address, telephone number, fax number, signature, license plate number and state of registration, vehicle make, model, year, and color, and credit card number, expiration date, and security code during the FasTrak® account registration process. After registration and a FasTrak® toll tag has been assigned to a customer vehicle, the tag number and Travel Pattern Data is collected as a customer drives through a toll booth to record the transaction.

How BATA uses Personally Identifiable Information

BATA uses the PII provided in order to effectively and efficiently process enrollments, manage accounts, respond to questions, send customer e-mails about FasTrak® program updates, provide information regarding significant changes to this Privacy Policy, and otherwise communicate with FasTrak® customers.

BATA may also obtain information about a FasTrak® customer from other sources, such as the California Department of Motor Vehicles (DMV), to pursue unpaid amounts due.

PII is only utilized as described in this Privacy Policy.

Third Parties with Whom BATA May Share Personally Identifiable Information

BATA may share PII with the Golden Gate Bridge Highway and Transportation District and other toll agencies within the state of California for the purpose of managing FasTrak® operations.

In addition, BATA hires third party service providers for the purpose of operating the FasTrak® Program, such as managing your account and collecting revenues due. ACS is one such service provider. These contractors are provided only with the PII they need to deliver the service. BATA requires the service providers to maintain the confidentiality of the information and to use it only as necessary to carry out their duties under the FasTrak® Program.

Besides these entities, PII will not be disclosed to any other third party without express customer consent, except as required to comply with laws or legal processes served on BATA.

Retention of Personally Identifiable Information

BATA, through its contractor, ACS, shall only store the PII of a FasTrak® customer that is necessary to perform account functions such as billing, account settlement, or enforcement activities. All other information shall be discarded no more than four years and six months after the closure date of the billing cycle and the bill has been paid, including resolution of all toll violations, if applicable. BATA, through ACS, will discard all account information, including PII no later than four years and six months after the date an account is closed or terminated and all outstanding amounts due are paid, including resolution of all toll violations, if applicable.

Security of FasTrak® Personally Identifiable Information

BATA is committed to the security of your PII. BATA, together with its CSC Contractor, ACS, stores the PII provided by FasTrak® customers on computer servers that are located in secure, controlled facilities. Servers are designed with software, hardware and physical security measures in place to prevent unauthorized access.

Access to PII is controlled through the following administrative, technical, and physical security measures. By contract, third parties with whom BATA shares PII are also required to implement adequate security measures to maintain the confidentiality of such information.

Administrative:

• Access to PII is limited only to certain operations and technical employees for limited, approved purposes based on their specific work responsibilities.



• Privacy and security training is required for employees with access to PII, upon hire. In addition, regular periodic refresher training is required for those employees.

Technical:

• FasTrak® network perimeters are protected with firewalls.



• FasTrak® databases are implemented to ensure PII is segregated from Aggregate Information.



• Storage of PII is encrypted.



• Electronic connections to and from the FasTrak® website is encrypted.



• Internal and external audits of perimeter and software code security are conducted.



• Employees' use of FasTrak® customer databases is monitored and records of access to PII are maintained.



• Electronic communications containing PII are transmitted via encrypted channels.

Physical:

• Physical access to Internal BATA servers is restricted to authorized technical personnel.



• Data center access to approved technical personnel is restricted via photo / passcode authentication, and other security protocols.

In addition to BATA’s policies and procedures implementing PII security, the FasTrak® customer must also do such things as safeguard passwords, PINs, and other authentication information that may be used to access a FasTrak® account. FasTrak® customers should not disclose authentication information to any third party and should notify BATA of any unauthorized use of their passwords. BATA cannot secure PII that is released by FasTrak® customers or PII that customers request BATA to release. In addition, there is a risk that unauthorized third parties may engage in illegal activity by such things as hacking into BATA’s security system or by intercepting transmissions of personal information over the Internet.

Account access and controls

Creating an account with FasTrak® is in the customer’s discretion. The required account information consists of personal information such as name, business name, mailing address(es), e-mail address, telephone number, fax number, signature, license plate number and state of registration, vehicle make, model, year and color, and credit card number, expiration date and security code. BATA may request other optional information, such as alternate contact information, but, in such instances, clearly indicates that such information is optional.

Customers can review and update personal account information at any time. Customers are also able to modify, add, or delete any optional account information by signing into their FasTrak® account and editing the account profile. PII can also be reviewed and edited online as discussed below under “Updating Personally Identifiable Information.” FasTrak customers can close their account at any time by submitting a completed Account Closure Form. All account information will be deleted no later than 4 years and 6 months after the account is closed or terminated and all outstanding amounts due are paid, including resolution of all toll violations, if applicable.

Other Uses of Toll Tag Data

The Metropolitan Transportation Commission (MTC) / 511.org operates a traffic data collection system based on FasTrak® toll tags to provide better information about the transportation network to Bay Area travelers, transportation managers, and transportation planners through the 511 Driving Times (SM) service. Encryption software is used to mask each toll tag identification number to ensure that toll tag information is treated anonymously in the traffic data collection process. No FasTrak® customer PII is shared by BATA, or its third-party contractors, with MTC for 511 Driving Times (SM). Further, a customer has the option not to have his or her transponder read by the data collection system by placing the transponder in the mylar bag that comes with the transponder. For more information on the 511 Driving Times (SM) service, please refer to www.511.org.

Aggregate Data

BATA may also combine the PII provided by FasTrak® customers in a non-identifiable format with other information to create Aggregate Data that may be disclosed to third parties. Aggregate data is used by BATA to improve the FasTrak® program and for the marketing of FasTrak®. Aggregate data does not contain any information that could be used to contact or identify individual FasTrak customers or their accounts. For example, BATA may inform third parties regarding the number of FasTrak accounts within a particular zip code. BATA requires third parties with whom Aggregate Information is shared to agree that they will not attempt to make information personally identifiable, such as by combining it with other databases.

Cookies

The FasTrak® website (www.bayareafastrak.org) stores “cookies” on the computer systems of users of the website. Cookies are small data elements that a website can store on a user’s system. The cookies used by the FasTrak® web site facilitate customer’s use of the web site (e.g. remember login names and passwords until the session has ended). The FasTrak® web site does not require that users of the website accept these cookies. Also, the FasTrak® web site does not store “third party” cookies on the computer systems of users of the website.

Once you leave the FasTrak® website, the privacy policy of other web sites you visit or link to from the FasTrak® web site should also be reviewed to understand how these external sites utilize cookies and how the information that is collected through the use of cookies on these websites is utilized.

BATA does not knowingly engage in business with any company or vendor that uses Spyware or Malware. BATA does not market detailed information collected from web sessions that can be directly tied to personal information. Further, BATA does not provide FasTrak® customers with downloadable software that collects or utilizes any PII.

Externally-Linked Websites

The FasTrak® website contains links to third-party websites operated by entities that are affiliated with FasTrak®. These web links may be referenced within content, or placed beside the names or logos of the other entities. BATA does not disclose PII to these third-party websites.

WARNING: Once you enter external websites (whether through a service or content link), BATA is not responsible for the privacy practices of those other websites. Please review all privacy policies of external websites you may link to through our website, before providing any information to such other websites.

Updating Personally Identifiable Information

PII can be reviewed and edited online at http://www.bayareafastrak.org/dynamic/accounts/index.shtml. The FasTrak® website uses functions that have the ability to collect and store self-reported data. These functions enable FasTrak® customers to revise, update or review information that has been previously submitted by going back to the applicable function, logging-in and making the desired changes. In addition to this method, customers may update their PII by electronically submitting a Comment Form found under the “Contact Us” Bar of the FasTrak® website to the FasTrak® Customer Service Center or by telephoning the FasTrak® Customer Service Center at (877) BAY-TOLL or 1-877-229-8655.

Complaints or problems regarding updating personal information should be submitted via the Comment Form. The FasTrak® Customer Service Center will either resolve the issue or forward the complaint to an appropriate BATA staff member for a response or resolution. BATA strives to answer all queries within 48 business hours, but it may not always be feasible to do so.

If an adequate resolution is not received, please contact BATA's Privacy Officer at:

Bay Area Toll Authority
Attn: Privacy Officer
101 8th Street, Oakland, CA 94607
Or e-mail: privacyofficer@mtc.ca.gov
Or call: 510-817-5700

Changes to this Privacy Policy

Material Changes – BATA will inform FasTrak® customers if material changes are made to the FasTrak® Program Privacy Policy, in particular, changes that expand the permissible uses or disclosures of PII allowed by the prior version of the Privacy Policy. If BATA makes material changes to the FasTrak® Privacy Policy, BATA will notify FasTrak customers by means of posting a conspicuous notice on the FasTrak® website that material changes have been made.

Immaterial Changes - BATA may also make non-substantive changes to the Privacy Policy, such as those that do not affect the permissible uses or disclosures of PII. In these instances, BATA may not post a special notice on the FasTrak® website.

If BATA decides to make any change to the FasTrak® Privacy Policy, material or immaterial, BATA will post the revised policy on the FasTrak® website, along with the date of any amendment.

BATA reserves the right to modify this Privacy Policy at any time, so the policy needs to be reviewed frequently by FasTrak® customers.

When BATA revises the Privacy Policy, the "last updated" date at the top of the Privacy Policy will reflect the date of the last change. We encourage FasTrak® customers to review this Privacy Policy periodically to stay informed about how BATA protects the security of PII collected for the FasTrak® program is protected. Continued use of the FasTrak® Program constitutes the customer’s agreement to this Privacy Policy and any updates.

E-mails Sent to BATA

This Privacy Policy only applies to FasTrak® PII that you send to the FasTrak® Customer Service Center. This Privacy Policy does not apply to other web-based content or personal information that is transmitted directly to BATA. Please do not send PII in an email directly to BATA, if you want to keep content or data private.

Contact information

BATA welcomes your comments on the FasTrak® Privacy Policy. Also, if there are questions about this statement, please contact the BATA Privacy Officer at the address, e-mail or phone number listed above.

History of Changes to Privacy Policy

March 3, 2004		Privacy Policy Established
July 28, 2004		Revisions to Privacy Policy
May 25, 2005		Revisions to Privacy Policy
September 24, 2008		Revisions to Privacy Policy
December 15, 2010		Revisions to Privacy Policy
January 06, 2011		Revisions to Privacy Policy