Data Protection & Privacy Policy

Data Protection & Privacy Policy

Last updated May 19, 2025

BusWhere LLC is located at 2 Wisconsin Circle, Suite 700 Chevy Chase MD 20815, and is organized under the laws of the State of Wyoming.

This Data Protection Policy (hereinafter, “Policy”) applies to all activities of BusWhere LLC (hereinafter, “BusWhere” or “we”) with respect to the protection of personal data that BusWhere collects and processes in the course of its activities, including through its websites (BusWhere.com and any of its subdomains), mobile applications, and any other electronic interfaces with data subjects (hereinafter, “Websites”). For any questions regarding this Policy and the processing or use of your personal data by BusWhere, please contact us here: dataprivacy@buswhere.com.

The language of this Policy is intended to be gender-neutral.

General Principles

We at BusWhere believe that it is important to protect your data privacy. This Policy explains your rights regarding the personal data we collect, process and use in our ongoing activities, including via the Websites, as well as our use of safeguards to protect these rights. The Policy also applies to our use of cookies and tracking utilized in the Websites to distinguish you from other users, to improve your use of these interfaces, and to ensure that content in the Websites and other relevant interfaces is presented in the most effective manner for you.

Additional information about our use of cookies and tracking may be found in our Cookies Policy below.

The personal data collected and stored lawfully, fairly and transparently by BusWhere. In processing your data, we act in good faith, in a proportionate manner, and with the appropriate technical and organizational measures; and to mitigate the risks represented by the processing of the data.

Please be aware that the collection, processing and use of your personal data may, in the course of BusWhere’s ongoing activities, be carried out by external data processors or joint controllers on our behalf. Within the framework of our contracts with such external processors, we inform them of the requirement to duly comply with relevant legal data protection rules and legislation applicable to the services they provide to us, and make reasonable efforts to communicate any changes to them with respect to such rules and legislation.

We may revise this Policy from time to time, and such changes shall come into effect from the moment we notify you of such changes and/or updates, either through the Websites or in some other reasonable manner.

For data subjects of the European Union, your rights under the General Data Protection Regulation (GDPR), your rights are safeguarded by BusWhere in accordance with the principles detailed below; for California residents, your rights under the California Consumer Privacy Act (CCPA) are also safeguarded as described herein; and for residents of other states with applicable privacy laws, your rights are detailed in the State Privacy Rights section below. Any questions regarding privacy-related rights may be referred to us via the email address: dataprivacy@buswhere.com.

Data Subject Rights

General

The rights detailed below are subject to the applicable law that determines your status as a data subject in the jurisdiction in which you are located. Depending on the applicable law, you may have some or all of the following rights in respect of your personal data that we process. For any questions, please contact us at dataprivacy@buswhere.com.

Consent

For data subjects for which processing by explicit consent is relevant, we will only process personal data if you have consented to such processing, unless we are otherwise legally authorized or obliged to collect and further process personal data relating to you; and data will be processed solely based on your informed consent, used only for the purposes stated in the consent procedure (for example, in order to send BusWhere updates, newsletters, and the like), and within the scope outlined below.

Withdrawal of consent – You may revoke or withdraw your consent at any time by notifying us directly via the email address dataprivacy@buswhere.com.

Upon receipt of your request, and subject to applicable laws, we will delete your data unless we are legally obliged or authorized to retain it, including for ongoing legitimate business interests of BusWhere.

Withdrawal of your consent shall not have any influence over the legality of processing of your personal data carried out prior to said withdrawal.

Minimization of data processing

We process and store a minimum of your personal data, only as needed for providing BusWhere services to you.

The “right to be forgotten”

Subject to any relevant laws, including tax laws, you may also request the erasure of all or part of your personal data held by BusWhere. Upon receiving your request via the email address dataprivacy@buswhere.com, we will remove your personal data from all of our records, as soon as reasonably possible and when technically feasible, unless there is an overriding legal interest or other legal basis for the continuation of the data processing.

Please understand that in the event of deletion of personal data upon your request, BusWhere may not be able to further provide services via the Websites, in whole or in part.

In requesting data deletion, you irrevocably agree and waive any claim against BusWhere’s inability to provide said services, or any interruption or malfunction resulting therefrom.

Note that your request for deletion may also be rejected by BusWhere due to a lack of sufficient relevant information provided by you.

The “right to data correction”

You may also request the correction of all or part of your personal data held by BusWhere. Upon receiving your request via the email address dataprivacy@buswhere.com, we will correct your personal data as soon as reasonably possible and when technically feasible, unless there is an overriding legal interest or other legal basis for refraining from the requested correction.

In requesting data correction, you irrevocably agree and waive any claim against BusWhere’s inability to provide said services, or any interruption or malfunction resulting therefrom.

Note that your request for correction may also be rejected by BusWhere for lack of sufficient and/or relevant information provided by you.

Transparency and portability of personal data

You are entitled to ask BusWhere for information about the type of personal data about you that we process. You may also be entitled to obtain it in a commonly-used and machine-readable form, subject to technical feasibility and lawfulness considerations. Please forward your request via the email address dataprivacy@buswhere.com.

Automated decision-making on the basis of your personal data

Although such situations will be rare, we may make decisions concerning our business relationship with you based on automated processing activities without human intervention. We commit to giving you the opportunity to obtain human intervention in such a decision, express your point of view, and obtain an explanation of the decision. Please send your request regarding automated decision-making via dataprivacy@buswhere.com.

Personal data relating to children and minors

When we collect or process personal data relating to children and minors, we take all of the required steps to safeguard it under applicable data protection regulations. Note that any data subject requests from minors must be accompanied by valid consent of a parent or legal guardian and his/her identification. Please forward any requests in this respect via the email address dataprivacy@buswhere.com.

Other sensitive personal data

BusWhere makes every effort to collect, process and retain sensitive personal data strictly in accordance with its ongoing business needs. We take all of the required steps to limit the processing of such data and to safeguard it under applicable regulations.

In the implementation of these data protection rights, BusWhere is committed to providing a timely and transparent response to your requests. For any questions regarding these rights, please contact us via dataprivacy@buswhere.com.

For our Data Subjects in the EU

We value your data subject rights under GDPR and therefore appointed GDPR-Rep.eu as representative according to Art 27 GDPR and provide you with an easy way to submit us privacy related request like a requests to access or erase your personal data. If you want to make use of your data subject rights, please visit: https://gdpr-rep.eu/q/11134541

Contact GDPR-Rep.eu:

GDPR-Rep.eu
Maetzler Rechtsanwalts GmbH & Co KG Attorneys at Law
c/o BusWhere LLC Schellinggasse 3/10,
1010 Vienna, Austria

Please add the following subject to all correspondence: GDPR-REP ID: 11134541

Legal Bases for Processing Personal Data

We process your personal data on the following legal bases:

Contractual Necessity

We process your personal data to perform our contractual obligations to you, including:

Providing the BusWhere services to you
Creating and maintaining accounts
Processing and managing subscriptions
Communicating with you about service updates or changes
Providing customer support related to our services

Legitimate Interests

We process your personal data based on our legitimate interests, which include:

Ensuring the security and integrity of our services
Preventing fraud and unauthorized access
Improving and enhancing our services
Conducting data analytics to better understand service usage
Internal administrative purposes
Managing our business operations

When we rely on legitimate interests, we perform a balancing test to ensure our interests do not override your fundamental rights and freedoms. You have the right to object to processing based on legitimate interests.

Legal Obligation

We process your personal data to comply with legal obligations, including:

Responding to legal requests from authorities
Tax and financial reporting requirements
Compliance with applicable laws and regulations
Maintaining records as required by law

Consent

Where required by law, we will only process your personal data with your consent. You may withdraw your consent at any time by contacting us at dataprivacy@buswhere.com. This may result in a cessation of services where the request is not compatible with the provision of services.

Why BusWhere Uses Your Personal Data

BusWhere uses your personal data to provide the services requested by you and to process your requests and inquiries. Your personal data is also used for the cookies and tracking utilized in the Websites to distinguish you from other users, to improve your use of these interfaces, and to ensure that content in the Websites and other relevant interfaces is presented in the most effective manner for you.

Additional information about our use of cookies and tracking may be found in our Cookies Policy below.

The Types of Personal Data We Collect and How We Use It, Including Third-Party Use

The personal data collected and used by BusWhere is limited to the data necessary for us to provide you with services we supply in the course of our ongoing business activities, while operating under the relevant data protection and other regulatory obligations for each data subject and for combatting fraud.

Specific Categories of Personal Data

For End Users, we collect:

First and last name
Email address
Phone number
Physical address
Account credentials

For riders who are tracked as riders but are not themselves End Users, we do not collect personal data directly. Instead, the responsible End User selects an arbitrary descriptor (which could include part or all of the rider’s name) for their riders determined by that End User or the organization responsible for the account.

Access to your data, including physical access, is limited to only those employees of BusWhere and third parties who have contracted with us and who utilize it exclusively for the purposes outlined below.

There may be exceptional circumstances in which we process sensitive personal information in order to carry out our activities. In such a case, we will only use this information for these purposes and will delete it when the purpose for which the information was collected or processed is terminated, unless there is a legal obligation not to delete this information.

Automatic Processing of Usage Data

There may be circumstances in which automatic processing of your personal data may occur. As is true of most organizations operating websites, we gather certain information automatically and store it in log files. This information includes but is not limited to IP addresses, type of browser, Internet service provider, referring and exit pages, operating systems, a date/time stamp and clickstream data. We may use this information to analyze trends, to administer the Websites, to track users’ movements through them and to gather information about our user base as a whole. We may link this automatically-collected data to personal data for legitimate purposes, such as to detect and prevent fraudulent activity; and for other legally-authorized purposes.

Third-Parties

When you receive services from BusWhere through the Websites and other electronic interfaces, you may also be directed to third-party processors.

When we use such third-party processors, we rely on the third-party service provider to process personal data to provide certain services; and we contractually require them to comply with the data protection and other laws and regulations applicable to their processing services.

Please check the respective service provider’s relevant data protection terms and compliance with applicable laws prior to usage of any such processor’s services. The same applies to any links to and from websites of third-party networks, advertisers and affiliates.

Such third-party websites are governed solely by such third parties’ data protection policies: you are advised to be careful and check any such third party’s privacy policies and compliance with laws, prior to supplying them with any of your personal data.

In order to provide some of the BusWhere services, we may share some of the data we collect from you with third parties such as vendors and other service providers who are engaged by us or are working with us. This data may also be shared with these parties for analytics purposes, which may require the reproduction and display of your information in an aggregated and anonymized manner that will not in any way identify you personally.

For more information about opting out of having your web browsing information used for behavioral advertising purposes, please visit www.aboutads.info/choices if you are in the United States and if you are in the EU, please visit www.youronlinechoices.eu/. In other locations, please be in direct touch with us at: dataprivacy@buswhere.com.

BusWhere may also disclose your data to a third party if we are required to do so by applicable law, court order or governmental regulation; or if such disclosure is otherwise authorized and necessary in support of any criminal or legal investigation or proceeding in accordance with applicable laws and regulations.

Data Retention Periods

We retain personal data for as long as your account is active or as needed to provide you with our services. We maintain the following data retention practices:

Active account data is retained throughout the duration of your relationship with BusWhere
Upon account deletion or termination, we will delete or anonymize your personal data within a reasonable timeframe, typically within 90 days
Certain information may be retained in backup systems for a limited period
Information required for legal purposes (such as transaction records, tax documents, etc.) may be retained for longer periods as required by applicable laws

You can request the deletion of your account and associated personal data at any time by contacting us at dataprivacy@buswhere.com. Upon receiving your request, we will process it according to the procedure outlined in the “Privacy Rights Request Process” section below.

Data Breach Notification Procedures

In the event of a data breach that may affect your personal data, we will:

Investigate the incident promptly to determine the nature and scope of the breach
Take immediate steps to contain the breach and mitigate potential harm
Notify affected individuals without undue delay, and, where feasible, no later than 72 hours after becoming aware of the breach
Provide information on:
- The nature of the personal data breach
- The categories and approximate number of personal data records concerned
- The likely consequences of the personal data breach
- The measures taken or proposed to address the breach
- Recommended steps affected individuals should take to protect themselves
Notify relevant supervisory authorities as required by applicable law
Document all facts relating to the data breach, its effects, and remedial action taken

If you become aware of a potential security breach or have security concerns regarding your data, please contact us immediately at dataprivacy@buswhere.com.

Privacy Rights Request Process

To exercise your privacy rights, please follow these steps:

Submit a Request: Contact us through dataprivacy@buswhere.com with the subject line “Privacy Rights Request” or through other designated channels provided on our website.
Verification Process: We will verify your identity before processing your request to ensure the security of your information. This may include:
- Confirming the email address associated with your account
- Requesting additional information to verify your identity
- For authorized agents acting on your behalf, providing written permission from the individual
Request Processing:
- We will acknowledge receipt of your request within 10 business days
- We will respond to your request within 45 calendar days
- If necessary, we may extend the response period by an additional 45 days, in which case we will notify you of the extension
Response Format: We will provide our response in a readily usable format, typically by email or through your account interface.
Appeal Process: If you are not satisfied with our response, you may appeal the decision by contacting dataprivacy@buswhere.com with the subject line “Privacy Rights Appeal.”

We may deny requests that:

Cannot be verified
Are excessive, repetitive, or manifestly unfounded
Require disproportionate technical effort
Risk the privacy of others
Are limited by legal obligations or exceptions provided by applicable laws

There is no charge for making a privacy rights request unless your requests are excessive, repetitive, or manifestly unfounded.

State Privacy Rights

California Privacy Rights

Under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), California residents have specific rights regarding their personal information:

Right to Know what personal information is collected, used, shared, or sold
Right to Delete personal information held by businesses
Right to Opt-Out of the sale or sharing of personal information
Right to Non-Discrimination for exercising their CCPA rights
Right to Correct inaccurate personal information
Right to Limit use and disclosure of sensitive personal information

To exercise these rights, please submit a request through dataprivacy@buswhere.com or call (202) 888-5920.

Virginia Privacy Rights

Under the Virginia Consumer Data Protection Act (VCDPA), Virginia residents have the following rights:

Right to Access personal data
Right to Correct inaccuracies in personal data
Right to Delete personal data
Right to Data Portability
Right to Opt-Out of targeted advertising, the sale of personal data, and profiling for significant decisions

To exercise these rights, please submit a request through dataprivacy@buswhere.com.

Colorado Privacy Rights

Under the Colorado Privacy Act (CPA), Colorado residents have the following rights:

Right to Access personal data
Right to Correct inaccuracies in personal data
Right to Delete personal data
Right to Data Portability
Right to Opt-Out of targeted advertising, sale of personal data, and profiling for significant decisions

To exercise these rights, please submit a request through dataprivacy@buswhere.com.

Connecticut Privacy Rights

Under the Connecticut Data Privacy Act (CTDPA), Connecticut residents have the following rights:

Right to Access personal data
Right to Correct inaccuracies in personal data
Right to Delete personal data
Right to Data Portability
Right to Opt-Out of targeted advertising, sale of personal data, and profiling for significant decisions

To exercise these rights, please submit a request through dataprivacy@buswhere.com.

Utah Privacy Rights

Under the Utah Consumer Privacy Act (UCPA), Utah residents have the following rights:

Right to Access personal data
Right to Delete personal data that the consumer provided to the controller
Right to Data Portability
Right to Opt-Out of the sale of personal data and targeted advertising

To exercise these rights, please submit a request through dataprivacy@buswhere.com.

Other State Privacy Rights

As additional states enact privacy legislation, we will honor the rights of residents in those states in accordance with applicable laws. If you reside in a state with specific privacy legislation not explicitly mentioned above, please contact us at dataprivacy@buswhere.com to inquire about your rights.

Other Uses of Your Personal Data

In addition to the uses identified elsewhere in this Policy, we may use the personal data we collect for the following purposes, to:

Share promotional and information content about the use of BusWhere with you in accordance with your communication preferences;
Send information to you regarding changes to our terms of use, this Policy, other policies, or other legal agreements;
Meet legal requirements.

BusWhere’s Protection of Your Personal Data

We are taking all reasonable, industry-standard technical and organizational measures to protect your personal data against loss, alteration, theft or access by unauthorized third parties. We will not sell, share, transfer or use the data we collect from you for purposes other than those purposes stated expressly in this Policy.

The above notwithstanding, BusWhere will not be liable or responsible in any way, including financially, for any damage or loss resulting from the improper use or any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, your personal data.

Cookies Policy

IMPORTANT NOTE: Use of the BusWhere Websites by you indicates your acceptance of this Cookies Policy.

This Cookies Policy applies to all activities of BusWhere with respect to the cookies that we collect and store in the course of our activities, including through the Websites and any other electronic interfaces with data subjects that we operate.

What’s a cookie? A cookie is a small file sent from a website, which is then stored by your web browser. The information in the cookie can be used to recognize your last session with BusWhere. Cookies cannot install malicious software such as viruses on your device, and they do not store any of your personal data or account information.

Why do we use cookies? We use cookies to save and maintain BusWhere users’ settings and selected preferences during browsing sessions, for saving repeating users’ preferences for future use (e.g. geographical location, accessibility and language selections and preferences), and for statistical analysis of the performance of websites and apps, trend analysis, and monitoring and identifying errors.

Where do cookies come from? Cookies originate from two types of sources: 1st-party and 3rd-party. This classification refers to the internet domain that is placing the cookie. 3rd-party cookies are cookies that are set by a domain other than that of the site being visited by the user. If a user visits a website and another entity sets a cookie through that site this would be a 3rd-party cookie. 1st-party cookies are those set by a website that is being visited by the user at the time.

Opting in – When you first visit the websites and apps, you will be informed that by continuing to use our website, you acknowledge our use of cookies for enhancing your browsing experience. You can also control the use of cookies at the individual browser level, and instructions for managing cookie usage can be found for the following browsers, at:

Google Chrome
Internet Explorer
Firefox
Safari
Safari Mobile
Opera

If you disable cookies through your browser, you may still use the Websites, but your ability to use some features may be limited or unavailable. Many browsers allow a private mode to be activated through which the cookies are always erased after the visit, and you hereby irrevocably and unconditionally waive any claim or demand in this regard. If you wish to opt out of interest-based advertising, click http://preferences-mgr.truste.com/. If you are located in the European Union click http://www.youronlinechoices.eu/.

Do Not Track/Privacy Mode is a function that allows users to opt out from being tracked by websites for any purpose, including the use of analytics services, advertising networks and social platforms. If you have enabled the “do not track” function in your browser, you will not be tracked. This is in addition to your opting-out of data aggregation and analysis for Website statistics.

Categories of cookies we use – BusWhere places a high priority on the security and confidentiality of the information stored in the persistent cookies we use. The categories we use are as follows:

Performance cookies – These cookies allow publishers to track your behavior as a site visitor, measure site performance, and improve your user experience.
Functionality cookies – There are different types of cookies in this category, and they are used to customize the site for your personal use using the options you specify, such as your language preference.
Targeting cookies – These cookies help you track relevant ads for you. They help record your use of these ads, including limits on how often you view them.

Any questions? For any questions about the use of cookies by BusWhere, or the rest of our Data Protection and Privacy Policy, please be in touch with us via the email address dataprivacy@buswhere.com. Please include your name and mailing or email address. We may require that you provide additional information to verify your identity before allowing you to exercise certain rights that are outlined above.