PRONTO Privacy Policy

Privacy Policy for Protection of Personally Identifiable Information

The PRONTO fare system is an account-based solution used by transit passengers to obtain regional transportation services.   When a transit passenger uses a PRONTO fare media, certain forms of Personally Identifiable Information may be collected.  This Privacy Policy describes what types of Personally Identifiable Information are collected and how San Diego Metropolitan Transit System ("MTS") manages and stores Personally Identifiable Information to ensure your privacy. 

1. Personally, Identifiable Information - What Types are Collected

Personally, Identifiable Information means any information that identifies or describes a person, including but not limited to, travel pattern data, address, telephone number, email address or credit card number.

For un-registered PRONTO accounts, the only Personally Identifiable Information collected is boarding information, which includes the bus route or trolley boarded, which trolley station or bus stop you boarded at and the time at which you boarded a bus or trolley.

For registered PRONTO accounts, MTS does request that certain Personally Identifiable Information be provided to set up your account.  Collection of Personally Identifiable Information occurs when you provide your account information through either the MTS website (https://www.sdmts.com), PRONTO website or PRONTO Mobile Ticketing application (https://www.ridepronto.com ), PRONTO Institutional Portal, and the PRONTO Service Center.

The following is a description of what Personally Identifiable Information that may be collected:

2. Use of Information

MTS uses Personally Identifiable Information to more efficiently administer your registered PRONTO account functions.  MTS also collects Aggregated Travel Information through your use of the PRONTO account.   Aggregated Travel Information includes sale transactions, validation information and information on the type of subscriber, such as a rider using a Senior, Disabled, Medicare or Youth discount pass.  MTS uses this information in a format that does not identify any individual PRONTO account subscriber.  Personally Identifiable Information such as your name, address and billing information are removed before it is used for Aggregated Travel Information.  MTS does share Aggregated Travel Information with San Diego Association of Governments ("SANDAG") and North County Transit District ("NCTD") for data analysis purposes.

MTS will not use your Personally Identifiable Information collected from registered PRONTO accounts to send you emails or mail marketing advertisements for any other MTS service or product.  However, MTS reserves the right to continue to email or mail important notices concerning use of your registered PRONTO account and this Privacy Policy.

3. Third Party Access to Personally Identifiable Information

MTS only provides access of Personally Identifiable Information to the below described parties and entities:

• MTS Internal Departments:   Access to Personally Identifiable Information is limited only to certain approved personnel and only for certain approved purposes necessary to administer your account.  MTS controls access by providing only certain employees with the necessary log in credentials.  The PRONTO Support Center, operations staff and MTS management have access to your Personally Identifiable Information as required to perform account functions and to investigate customer complaints.  In addition, MTS Code Compliance Security Officers also has access but it is restricted to only a subscriber’s name, date of birth, recent sale transactions and recent fare validation information to investigate transit fare violations.   
• Law Enforcement Purposes:  Per state law, MTS must make Personally Identifiable Information available to a law enforcement agency pursuant to a search warrant or to a Peace Officer without a search warrant if there is good cause to believe the delay of obtaining a search warrant would cause an adverse result in an investigation.

4. Personally Identifiable Information – Where it is Stored

Safeguarding and protection of Personally Identifiable Information is a high priority for MTS.  Personally Identifiable Information is only held in the back-office components that are within a protected datacenter. All access to the system is controlled through access control and all components are within a dedicated fare collection network with no direct internet access. Connections to the system require encryption. Access to the system requires Two-Factor Authentication.

5. Storage Period

State law requires that MTS only store Personally Identifiable Information from a registered PRONTO account with credit card information to the extent it is necessary to perform account functions such as billing, account settlement or enforcement activities.  All other stored Personally Identifiable Information that is not necessary to perform account functions, such as a credit card number that has expired, will be discarded within 4 years and 6 months from the date of expiration.  In addition, any personal account information connected to an expired PRONTO account will be discarded within 4 years and 6 months from the date the PRONTO account has expired.  

6. Cookies

Cookies are small data elements that a Web site can use to facilitate the user’s ongoing access, such as by remembering names and passwords until the session has ended.  Cookies may be saved by your internet browser when you use the https://www.ridepronto.com or https://www.sdmts.com website.  You may be able to set parameters on your computer that allow you to accept cookies or to have your browser notify you each time a cookie is offered.  You may also set your internet browser to reject cookies.  MTS does not collect or retain your Personally Identifiable Information through the use of cookies.

7. Security

Please do not send highly sensitive information, such as a credit card number, over email.  MTS cannot guarantee that incoming email before received by MTS will not be intercepted.  Despite the protections established within this Privacy Policy, if any unauthorized access to or use of Personally Identifiable Information occurs, MTS will notify you of a breach in security of the system following discovery in one or more of the following ways: email, mail, posting of the breach on https://www.sdmts.com, https://www.ridepronto.com, or by notifying the media. 

8. Changes to a registered PRONTO Account

You may review and request changes to your Personally Identifiable Information through either the https://www.ridepronto.com website or calling the PRONTO Support Center. 

9. Children's Privacy Policy

The Children's Online Privacy Protection Act ("COPPA") imposes certain requirements on operators of websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age. 

If MTS has actual knowledge that we have collected Personally Identifiable Information online from children under the age of 13, MTS will make all reasonable efforts to obtain parental or legal guardian consent before any further use of the Personally Identifiable Information occurs.  When MTS obtains parental or legal guardian consent, MTS will maintain reasonable procedures to protect the confidentiality, security and integrity of the Personally Identifiable Information collected from children under the age of 13.

When MTS does not obtain parental or legal guardian consent to use Personally Identifiable Information for children under the age of 13, MTS will no longer maintain the Personally Identifiable Information in any retrievable form.

10. Effective Date

 The Effective Date of this Privacy Policy is October 28, 2021.   

11. Changes to Privacy Policy

MTS will endeavor to make all appropriate revisions to this Privacy Policy as changes to MTS’s collection and management of Personally Identifiable Information occur.   When material changes occur to the Privacy Policy, MTS will notify you in one or more of the following ways: updating the Privacy Policy posted on https://www.ridepronto.com Web site; updating the Privacy Policy posted on https://www.sdmts.com Web site, sending rider alerts on Twitter or Facebook; posting fliers on buses and trolleys; posting fliers on information boards at Trolley Stations; and/or posting fliers at the main lobby of MTS Offices. 

12. History of Changes to Privacy Policy