Lyft Privacy Policy - Local Information and Rights

1. CALIFORNIA
2. CANADA
3. ADDITIONAL STATES (INCLUDING COLORADO, CONNECTICUT, DELAWARE, IOWA, MARYLAND, MINNESOTA, MONTANA, NEBRASKA, NEW HAMPSHIRE, NEW JERSEY, OREGON, TENNESSEE, TEXAS, UTAH, VIRGINIA)

CALIFORNIA

Categories of Personal Information Collected and Disclosed. The following chart details which categories of personal information we may have collected from and about California residents in the past 12 months and the categories of recipients to whom we have disclosed each category of information for a business or commercial purpose. The second column in the chart lists by category the type of information described in section 2 of our Privacy Policy, as required by California law. You may also find a list of the sources from which we collect personal information in section 2 of our Privacy Policy and additional details regarding our disclosures of personal information are included in section 4 of our Privacy Policy.

(1) “Other Lyft users” includes, for example: Riders (if you are a Driver), Drivers (if you are a Rider), and other Riders (if you are a Rider taking a shared ride), and people who refer you to Lyft

(2) “Other third parties” includes, for example: a third party who requests or pays for your ride, parties to whom you request to share or link accounts, other parties with whom you intentionally interact (e.g., to obtain a vehicle service), and parties to whom you direct us to share information

Categories of Personal Information Sold or Shared and Categories of Third Parties to Whom it was Sold or Shared. We may have sold or shared the following categories of personal information with third parties for the purpose of cross-context behavioral advertising or analytics in the preceding 12 months:

• Identifiers;
• Commercial information;
• Internet or other electronic network activity information;
• Geolocation information; and
• Inferences.

We may have sold or shared each of the categories of personal information listed above with the following categories of third parties for the purpose of cross-context behavioral advertising or analytics:

• Advertising publishers that place advertisements on our behalf, such as Google or Meta;
• Advertising partners that place advertisements on the Lyft Platform on behalf of other advertisers; and
• Parties that provide statistical and analytic information regarding the effectiveness of our marketing and advertising.

Children’s Data. Lyft is not directed to children, and we don’t knowingly collect personal information from children under the age of 16; accordingly we don’t knowingly share personal information of children under the age of 16 for cross-context behavioral advertising nor do we sell that information. If we find out that a child under 16 has given us personal information, we will take steps to delete that information. If you believe that a child under the age of 16 has given us personal information, please contact us at our Help Center.

Sensitive Personal Information. Lyft does not process sensitive personal information other than to provide the Lyft Platform (including maintaining safety and security and performing research and analysis) and as permitted by California law. To the extent that we use or disclose sensitive personal information as defined by California law, we limit our use or disclosure of this information for permitted business purposes. Lyft does not sell or share sensitive personal information for the purpose of cross-context behavioral advertising.

Deidentified Information. As mentioned in our Privacy Policy, personal information does not include information that is deidentified. When we receive or use deidentified information, we maintain it in deidentified form and do not attempt to reidentify the information.

Retention of Personal Information. We retain your information for as long as necessary to provide you and our other users the Lyft Platform. This means we keep your profile information for as long as you maintain an account. We retain transactional information such as rides and payments for at least seven years to ensure we can perform legitimate business functions, such as accounting for tax obligations. We also retain your information as necessary to comply with our legal obligations, resolve disputes and enforce our terms and policies.

Your California Rights Regarding Your Personal Information. California law provides California residents with certain rights, including those listed below. To exercise these rights see the “Exercising Your California Privacy Rights” section below or visit our privacy homepage. For metrics regarding rights requests, see here.

Right to Know. You have the right to know what personal information we have collected about you, including:

• The categories of personal information we have collected about you;
• The categories of sources from which the personal information is collected;
• The business or commercial purpose for collecting or sharing your personal information;
• The categories of third parties to whom we have disclosed your personal information; and
• The specific pieces of personal information we have collected about you.

Right to Delete. You have the right to request that we delete the personal information we have collected from you (and direct our service providers to do the same).

Right to Correct. You have the right to request that we correct inaccurate personal information.

Right to Opt Out of Sharing and Sale. You have the right to opt out of the sharing and sale of your personal information.

Other Rights. You can request certain information about our disclosure of personal information to third parties for their own direct marketing purposes during the preceding calendar year. This request is free and may be made once a year.

Exercising Your California Privacy Rights. To exercise any other privacy rights listed above, please contact us using one of the following methods:

Website: You may visit our privacy homepage to authenticate your account (where necessary) and exercise rights via our website. If you would like to access your personal information or delete your Lyft account, please visit us here.

Email webform: You may write to us to exercise rights.

To opt out of the sharing and sale of personal information, you may also visit here. Alternatively, where available you can use certain preference signals to exercise your opt-out right automatically with all businesses that you interact with online, including Lyft. If you enable a browser-based opt-out preference signal that complies with California law, such as the Global Privacy Control (GPC), upon receipt or detection, we will treat the signal as a valid request to opt out of the sharing of personal information linked to that browser and any consumer profile we have associated with that browser. Please note that if you use different browsers or browser profiles, you will have to enable the signal on each one that you use.

To respond to some requests, we may need to verify your request either by asking you to log in and authenticate your account or otherwise verify your identity by providing information about yourself or your account. Authorized agents can make a request on your behalf if you have given them legal power of attorney or we are provided proof of signed permission, verification of your identity, and, in some cases, confirmation that you provided the agent permission to submit the request.

• With respect to a request to know, request to delete, or request to correct, we will process a request from an authorized agent submitted on your behalf if you have given them legal power of attorney or we are provided proof of signed permission, verification of your identity, and, in some cases, confirmation that you provided the agent permission to submit the request.
• With respect to a sharing or selling opt out request, we may request confirmation that you provided the agent permission to submit the request before processing it.

CANADA

Your Canada Rights Regarding Your Personal Information. Federal and provincial Canadian laws provide individuals with some or all of the rights listed below. To exercise these rights see the “Exercising Your Canada Privacy Rights” section below or visit our privacy homepage.

Right to Know. You have the right to know we have processed your personal information and to request access to the personal information we have collected about you.

Right to Correct. You have the right to request that we correct inaccurate personal information.

Right to Delete. In some circumstances, you have the right to request that we delete the personal information we have collected about you.

Right to Opt Out. Depending on the location from which you are using our services, you have the right to opt in or out of targeted advertising (as defined under applicable law) and the use of cookies and similar technologies for non-essential purposes like targeted advertising.

Withdraw Consent. You have the right to withdraw your consent to our collection, use or disclosure of your personal information at any time, subject to contractual and legal restrictions and reasonable notice.

Exercising Your Canada Privacy Rights. Lyft has designated a Data Privacy Officer (DPO) who is accountable for ensuring Lyft’s compliance with its Privacy Policy and applicable laws. The Lyft DPO may delegate their obligations to others from time to time. To contact the Lyft DPO, or to exercise privacy rights under Canada law, please contact us using one of the following methods:

Website: You may visit our privacy homepage to authenticate and exercise rights via our website. If you would like to access your personal information or delete your Lyft account, please visit us here.

Email webform: You may write to us to exercise rights.

To opt out of targeted advertising or cookies you may also visit here.

To appeal our decision regarding a request related to these rights, you may write to us.

Authorized agents can make a request on your behalf if you have given them legal power of attorney or we are provided proof of signed permission, verification of your identity, and, in some cases, confirmation that you provided the agent permission to submit the request.

Transfer of Data. In providing you with the Lyft services, Lyft or its service providers may process, store, or communicate your personal data outside of your province of residence or outside of Canada.

Children. Lyft is not directed to children, and we don’t knowingly collect personal information from children under the age of 16. If we find out that a child under 16 has given us personal information, we will take steps to delete that information. If you believe that a child under the age of 16 has given us personal information, please contact us at our Help Center.

Vos droits à l’égard de vos renseignements personnels au Canada. Les lois provinciales et fédérales canadiennes confèrent aux particuliers une partie ou la totalité des droits énumérés ci-après. Pour exercer ces droits, veuillez consulter la section « Exercice de vos droits à la protection des renseignements personnels au Canada » ci-après ou visiter notre page d’accueil sur le respect de la vie privée.

Droit de savoir. Vous avez le droit de savoir que nous avons traité vos renseignements personnels et de demander l’accès aux renseignements personnels que nous avons recueillis à votre sujet.

Droit de corriger. Vous avez le droit de nous demander de corriger des renseignements personnels inexacts.

Droit de supprimer. Dans certaines circonstances, vous avez le droit de nous demander de supprimer les renseignements personnels que nous avons recueillis à votre sujet.

Droit de refus. Selon l’endroit à partir duquel vous utilisez nos services, vous avez le droit d’accepter ou de refuser la publicité ciblée (au sens des lois applicables) et l’utilisation de témoins et de technologies similaires à des fins non essentielles comme la publicité ciblée.

Révocation du consentement. Vous avez le droit de révoquer votre consentement à la collecte, à l’utilisation ou à la communication de vos renseignements personnels à tout moment, sous réserve de restrictions contractuelles et légales et d’un préavis raisonnable.

Exercice de vos droits à la protection des renseignements personnels au Canada. Lyft a désigné un responsable de la protection des renseignements personnels (un « RPRP ») chargé de s’assurer que Lyft respecte sa Politique de protection des renseignements personnels et les lois applicables. Le RPRP de Lyft peut déléguer ses obligations à d’autres à l’occasion. Pour communiquer avec le RPRP de Lyft ou exercer les droits à la protection de renseignements personnels en vertu des lois du Canada, veuillez communiquer avec nous de l’une des façons suivantes :

Site Web : Vous pouvez visiter notre page d’accueil sur le respect de la vie privée pour vous authentifier et exercer vos droits par l’intermédiaire de notre site Web. Pour accéder à vos renseignements personnels ou supprimer votre compte Lyft, veuillez visiter notre site Web en cliquant ici.

Formulaire Web par courriel : Vous pouvez nous écrire pour exercer vos droits.

Pour refuser la publicité ciblée ou désactiver les témoins, vous pouvez également cliquer ici.

Pour en appeler de notre décision concernant une demande relative à ces droits, vous pouvez nous écrire.

Les mandataires autorisés peuvent présenter une demande en votre nom si vous leur avez donné une procuration légale ou que nous avons reçu une preuve d’autorisation signée, une vérification de votre identité et, dans certains cas, une confirmation que vous avez donné aux mandataires l’autorisation de présenter la demande.

Transfert de données. En vous fournissant les services Lyft, Lyft ou ses fournisseurs de services peuvent traiter, stocker ou communiquer vos données personnelles à l’extérieur de votre province de résidence ou du Canada.

Enfants. Lyft ne s’adresse pas aux enfants, et elle ne recueille pas sciemment de renseignements personnels auprès d’enfants de moins de 16 ans. Si nous découvrons qu’un enfant de moins de 16 ans nous a transmis des renseignements personnels, nous prendrons des mesures pour supprimer ces renseignements. Si vous croyez qu’un enfant de moins de 16 ans nous a transmis des renseignements personnels, veuillez communiquer avec nous à notre Centre d’aide.

ADDITIONAL STATES (INCLUDING COLORADO, CONNECTICUT, DELAWARE, IOWA, MARYLAND, MINNESOTA, MONTANA, NEBRASKA, NEW HAMPSHIRE, NEW JERSEY, OREGON, TENNESSEE, TEXAS, UTAH, VIRGINIA)

Your Rights Regarding Your Personal Data. Laws in these states provide residents with certain rights, which may include those listed below. Ultimately each local law will dictate specifics regarding how the rights apply, and the rights will be available from the date that the relevant laws and regulations become effective. To exercise the rights listed below see the “Exercising Your Local Privacy Rights” section below or visit our privacy homepage.

Rights to Access and Data Portability. You have the right to request details regarding our processing and access to your personal data and to obtain your personal data in a portable format and you may have the right to obtain your personal data in a readily usable format, to the extent feasible. You may have the right to request a list of third parties with whom we share personal information here.

Right to Correct. You have the right to request that we correct inaccurate personal data.

Right to Delete. You may have the right to request that we delete the personal data we have collected about you.

Right to Opt Out. You may have the right to opt out of targeted advertising and the sale of your data (as defined under relevant and applicable law).

Exercising Your Local Privacy Rights. To request access to or deletion of your personal data, or to exercise any other privacy right listed above, please contact us using one of the following methods:

Website: You may visit our privacy homepage to authenticate your account (where necessary) and exercise rights via our website. If you would like to access your personal information or delete your Lyft account, please visit us here.

Email webform: You may write to us to exercise rights.

To opt out of targeted advertising and the sale of personal data, you may also visit here. Alternatively, where available you can use certain preference signals to exercise your opt out right automatically with all businesses that you interact with online, including Lyft. If you enable a browser-based opt out preference signal that complies with applicable local law, such as the Global Privacy Control (GPC), upon receipt or detection, we will treat the signal as a valid request to opt out of the sharing of personal information linked to that browser and any consumer profile we have associated with that browser. Please note that if you use different browsers or browser profiles, you will have to enable the signal on each one that you use.

You may have the right to appeal our decision regarding a request related to these rights. To do so, you may write to us.

To respond to some rights requests, we may need to verify your request either by asking you to log in and authenticate your account or otherwise verify your identity by providing information about yourself or your account. Under some applicable laws, authorized agents can make a request on your behalf under certain circumstances, such as if you have given them legal power of attorney or we are provided proof of signed permission, verification of your identity, and, in some cases, confirmation that you provided the agent permission to submit the request.