The Regional Municipality of Waterloo who owns and operates Grand River Transit (“GRT”, “we”, “us”, or “our”) is committed to protecting the privacy of any personal information you (“you”, “user” or “your”) provide to us.    

The Municipal Act, 2001, S.O. 2001, c.25, as amended, authorizes GRT to collect personal information for operating the EasyGO Fare Card Program. Any personal information you provide is collected, used and disclosed in accordance with the Municipal Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. M.56, as amended (“MFIPPA”).

This “EasyGO Fare Card Privacy Statement” (“Privacy Statement”) is designed to inform you of GRT’s privacy practices and describes how we collect, use, protect and disclose your Personal Information as it relates to the EasyGO Fare Card Program. This Privacy Statement applies to the Services provided by GRT under the EasyGO Fare Card Program, including but not limited to EasyGO Fare Cards, Fare Products, and the Sites  to which we link this Privacy Statement, and GRT customer services with respect to the EasyGO Fare Card Program.

This Privacy Statement does not apply to the information you provide to any person other than GRT. For example, it does not apply to any retailer that sells GRT products, or to information you provide to any third party such as an employer to whom GRT sells EasyGO Fare Cards and Fare Products. This Privacy Statement does not apply to other smart cards provided by third parties that may be used to pay for GRT services, e.g. student cards loaded with a U-Pass. All such third parties are responsible for their own collection, use, and disclosure of personal information.

Capitalized terms used in this Privacy Policy but not defined herein shall have the meaning given to them in the EasyGO Fare Card Program Terms and Conditions.

1.0 Information stored on the EasyGO Fare Card

Your EasyGO Fare Card stores the following information:

  • Card serial number
  • Card type
  • Expiry date
  • Language preference
  • The Fare Products loaded onto the Card, including passes and Stored Value balance
  • The last 10 transactions using the Card, including fare payment/validation, reloads, and the device where the Card was used.
  • Special purpose flags associated with your Card such as eligibility for MobilityPLUS, transit support person and Connect-to-GO programs

If you obtain a Concession Card or a Personalized  Card, or if you choose to register your Card, your Card will be linked to your Account containing your Personal Information.

2.0 Personal Information

“Personal Information” means information about an identifiable individual. You can choose to limit the Personal Information you provide by obtaining a full fare adult EasyGO Fare Card and using it without registering the Card, and adding Fare Products to your Card online without creating an Account by using the one-time purchase option. In such cases, your credit card information will only be used to complete your transaction, and will not be stored in GRT’s systems. You can also add Fare Products to your Card without providing credit card information by loading your Card in person at a designated Customer Service Centre, by loading your Card in person at a EasyGo Fare Card vending machine and by paying cash.

Concession Cards and Personalized Cards, which can be loaded with discounted Fare Products, must be registered.

If you wish to register your Card, or if you are eligible and wish to obtain a Concession Card or Personalized Card, we will require some information so we can provide you with assistance and Services.

When you register a My EasyGO Account or Card, the minimum information that is needed is:

  • Name
  • Address
  • Phone number

Certain card types may permit, or require, you to provide additional information, such as:

  • Date of birth
  • Confirmation of eligibility for fare products
  • For Personalized cards, we will also take your photo, which will be linked to your profile, and placed on your card.

In order to create a My EasyGO Account, you will be prompted to create a username, password, security question and response. If you wish to set up an Autoload or Autorenewal through your My EasyGO Account, you will need to provide credit card information. You can also choose to have a credit card on file for future purchases so you don’t have to enter it every time.

3.0 Information collected through use of the EasyGO Fare Card

GRT may also collect information through your use of the EasyGO Fare Card. When you present an EasyGO Fare Card to a GRT card reader device, either for fare payment or to check the Card’s status, we collect information including:

  • The date and time the Card was used
  • The ID of the reader device
  • Information about the transit vehicle and route number
  • The nature of the transaction (e.g. payment or checking Card information)
  • Amount/type of Fare Product
  • Any transfer

4.0 Information collected when you use the EasyGO Fare Card Program, Services, or Sites    

We may use aggregated information (information that is not Personal Information or linked to Personal Information) from you and others to improve the EasyGO Fare Card Program, Services, and our Site content and effectiveness, user experience and/or for internal or external analytical and reporting purposes. This analytical information is not used to personally identify you.

When you visit a GRT EasyGO fare card Site, our servers automatically record and store information that your computer browser sends to it. This server log information may include but is not limited to:

  • IP address and domain name associated with your Internet connection
  • Type of browser, browser language and the operating system of your computer
  • The date and time of your visits
  • The website you viewed prior to coming to the Site
  • The pages viewed on the Site, how much time was spent on them, and any search terms used, as well as other navigation information

When you visit the Site, we may place one or more cookies on your device that may uniquely identify your browser. Cookies are small files that are placed on your device's hard drive.  Cookies are used by the Site to recognize repeat users, make it more convenient to use the Site and compile data that may help us improve our Site. While many browsers are initially set up to accept cookies, you can change your browser settings so that you refuse all cookies or receive a notice when a cookie is sent. However, if you disable cookies, some Site features and Services may not function properly. We may also use graphic tags, internet tags or similar web beacon type functions that allow us to count number of users who visit a page or access particular cookies.  We may also use web beacons in HTML formatted email messages that we send to determine which email messages were opened.

The information collected automatically by the Site  is not linked to your Personal Information unless you seek certain Services that require you to submit Personal Information (as described in section 2.0, for example, if you choose to register) and choose to provide the information via the Site.

5.0 How your Personal Information is used

GRT collects Personal Information as described in this Privacy Statement to provide the Services  requested by you and to operate the EasyGO Fare Card Program and Sites. For example, we use Personal Information to:

  • Verify your identity and that you are eligible for GRT Fare Products you request
  • Register your Card (for Concession Cards and Personalized Cards)
  • Charge you for Services you request including fare payment, card loading and re-loading,
  • Inform you of information related to your account (e.g. changes, purchases, expiries)
  • Help prevent error and fraud
  • Operate and improve the EasyGO Fare Card program and Fare Products
  • Communicate with you regarding products and Services that may be of interest to you
  • To respond to your questions or inquiries,
  • To provide you with customer service,
  • Comply with legal and regulatory requirements
  • To conduct other purposes which are disclosed to you and to which you consent, or which are permitted under applicable laws and regulations.

Without limiting the generality of the foregoing, when a Registered Card holder provides us with contact information such as an email address or phone number, they expressly authorize GRT to contact them from time to time by email or phone. GRT may contact you in this manner for the purpose of managing your My EasyGO Account and providing you with Services related to your EasyGO Fare Card, including confirmation of reloads and verification of Accounts.

When you use your Card, information related to that use (such as boarding data) is associated with the Card’s serial number. If you have registered your Card, this information can be associated with your Personal Information. This allows you to access your recent transaction history. You can access your 10 most recent transactions by visiting customer service at a designated Customer Service Centre, or by checking your Card history at a Fare Vending Machine. You can also access your previous 100 transactions online if you have created a My EasyGO Account. If you do not think your transaction history is correct, please contact us at 519-585-7555.

GRT  may use anonymized and aggregated boarding data for study to better understand, plan and help forecast ridership, transit service and related topics.

6.0 How your Personal Information may be shared

GRT uses and may share your Personal Information only for purposes for which it was collected, or for a purpose consistent with such purposes. GRT will only collect, use or disclose your Personal Information in accordance with MFIPPA.

GRT may disclose your Personal Information to third parties without further notice or consent where: (i) GRT has received your prior consent to such disclosure, including for the purposes set out in this Privacy Statement; (ii) disclosure to a third party is necessary in order to provide Services to you; (iii) it is required or permitted by law, regulation, court order or other legal requirement; (iv) disclosure to a third party is necessary to help detect, prevent or otherwise address fraud, security or technical issues; (v) the disclosure is to protect our rights, privacy ,safety or property; (vii) the disclosure is to identify, contact or bring legal action against someone who may be violating the Terms, and/or ;(viii) the disclosure is to conduct investigations of possible breaches of law. GRT may be legally obligated to share your information with law enforcement in some circumstances.

Information regarding the acquisition and use of fare payment media may be disclosed in aggregate form if the data does not contain any Personal Information.

7.0 How your Personal Information is stored

Our Sites may be hosted by a third-party service provider  and your  Personal Information collected for the EasyGO Fare Card Program is stored by a third party host with data centres located in the United States. Personal information may be accessible under the US Patriot Act or other United States laws under a lawful order made in the United States.

GRT has the right to refuse or approve changes in the location of data storage. If the location of data storage changes, we will update this Privacy Statement.

If you choose a direct payment gateway to complete your purchase, then our payment service  collects and stores your credit card data. Your credit card data is encrypted through the Payment Card Industry Data Security Standard (“PCI-DSS”).  GRT does not receive your complete payment information such as your full credit card number when you make a purchase on the Site.  Payment information is handled by our third party service providers.

8.0 How long GRT keeps your Personal Information

GRT retains the information associated with your EasyGO Fare Card for as long as needed to provide you with the Services associated with the Card. GRT keeps a record of your 100 most recent EasyGO Fare  Card transactions. This includes trip transactions (time, date, route and fare paid) and revalue transactions (adding Fare Products to your Card). If you have created a My EasyGO Account, you can access your last 100 transactions online.

If you decide to unregister your Card, your personal information is retained for two years, then securely deleted, according to the Regional Municipality of Waterloo’s Corporate Information and Disposal Schedule, 2014, By-law  No. 93-076 as amended.

If your Account becomes inactive, as described in the EasyGO Fare Card Terms , Section 15.0, your Personal Information is retained for two years from the time at which the Account is deemed to be inactive, then securely deleted, according to the Regional Municipality of Waterloo’s Corporate Information and Disposal Schedule, 2014, By-law No. 93-076 as amended.

9.0 Accessing your Personal Information

You may request access to your Personal Information, and may request that we correct it if you believe it is inaccurate. GRT will comply with the MFIPPA to provide you access to your Personal Information that we hold. However, there may be circumstances where we are unable to provide all such Personal Information to you. For example, we may not be able to provide you with information if it: (i) contains the information of other persons; (ii) is subject to legal privilege; (iii) contains confidential information proprietary to GRT or another person; (iv) relates to an investigation regarding a breach of any agreement with GRT’s EasyGO Fare Card or any of its affiliates or contravention of laws; or (v) cannot be disclosed for any other legal reason.

If you wish to access or correct your Personal Information, please notify GRT in writing at the address at the end of this Privacy Statement.

10.0 Protecting your information

GRT protects the Personal Information subject to this Privacy Statement using appropriate and necessary safeguards to help protect against loss, theft and unauthorized access, disclosure, copying, use or modification.

Do not share your passwords or security answer with anyone. Although we have taken measures to help protect the Personal Information we collect, no security measures can provide absolute protection. We cannot ensure or warrant the security of any information you provide to us.  Without limitation we also cannot guarantee the safety of any information you transfer using a network that is not secure.

11.0 Consent

When you voluntarily provide us with Personal Information in association with the Services provided by GRT under the EasyGO Fare Card Program, you consent to the terms of this Privacy Statement.

You may withdraw your consent by providing written notice to GRT, subject to any legal requirements that require our continued collection, use, disclosure or storage of your information. If you withdraw your consent, you may no longer be eligible to use or be provided with an EasyGO Fare Card or the Services.

12.0 Third Party Services

In general, the third party service providers used by us will only collect and disclose your information to the extent necessary to allow them to perform the services they provide to us. 

Some third party service providers performing services on our behalf may store, transfer and process personal information at facilities that are located outside of Canada in countries (including the United States) whose data protection laws differ from those of Canada.  If you elect to proceed with a transaction that involves a third party service provider then your Personal Information may be subject to request from governments, courts, or law enforcement in those jurisdictions according to the laws in those jurisdictions. Once you leave our Site or are redirected to a third party provider’s website or application, you are no longer governed by this Privacy Statement or our Terms. 

13.0 Links to other websites

The Service may contain links to websites that are independently owned and operated by other third party entities that are not associated or affiliated with us.  You agree that this Privacy Statement is only as stated herein, and that it does not apply to any third party site.   When you click on links on our Site, the links may direct you away from our Site. We are not responsible for the privacy practices or the content of any other linked website.  Other linked websites may collect and treat Personal Information differently and we encourage you to read and review the privacy policy for each website you visit.  If you elect to access another linked website, you do so at your own risk.

14.0 Age of consent

By using the Site and/or providing us with Personal Information, you represent and warrant that you are at least the age of majority in Ontario, or that you have the consent of your parent/legal guardian to this Privacy Statement, and that are you domiciled in Canada. 

15.0 Changes to Privacy Statement

GRT retains the right, in its sole and absolute discretion, to terminate or modify any of this Privacy Statement at any time, and without further notice or liability to Cardholders, Business Accounts, or any other person or entity.  If we do this, GRT will post any amended Privacy Statement on our Site. As permitted by applicable law, any amendment will become effective at the time we post the amended Privacy Statement on our Site with an indication at the bottom of this Privacy Statement the date this Privacy Statement was last revised or as otherwise stated in any notice we choose to provide to you.  It is your responsibility to check our Site periodically for changes.  Use of the GRT EasyGO Fare Card  Program, the Services or the Sites  after the effective date of any change will be deemed to be your acceptance of the change.

16.0 Questions or concerns

Please direct any questions or comments  regarding this Privacy Statement or if you would like to report a violation of this Privacy Statement to :

Director, Transit Services
Grand River Transit
250 Strasburg Road
Kitchener, ON N2E 3M6

Phone: 519-585-7555 / TTY (Deaf and Hard of Hearing): 519-575-4608

Email: grtinfo@regionofwaterloo.ca

You also have the right to contact the Information and Privacy Commissioner of Ontario if you think your privacy rights have been violated. The Commissioner can be reached at:

Information and Privacy Commissioner of Ontario

2 Bloor Street East, Suite 1400

Toronto, ON M4W 1A8

Phone:  419-326-3333 or 1-800-387-0073

Website:  www.ipc.on.ca

Effective Date of Privacy Statement:  May 15, 2018