One Car Challenge Program — Privacy Policy

Effective Date: June 9, 2026

Carma Technology Corporation, operating on behalf of the Los Angeles County Metropolitan Transportation Authority — Contract No. PS136596

Introduction

The Los Angeles County Metropolitan Transportation Authority ("LA Metro" "Metro" "us" "we" "our") and Carma Technology Corporation ("Carma"), operating the Program on Metro’s behalf, is committed to protecting your privacy. This Privacy Notice explains what LA Metro and Carma collects, uses, shares, and safeguards about your information when you apply to and participate in the One Car Challenge Program ("Program"), including through the GoCarma mobile application provided to selected participants.

Roles: Metro is the program sponsor and data controller. Carma is the program operator and data processor, processing personal information on Metro’s behalf under Contract No. PS136596. King’s College London ("KCL") is the academic research participant that receives de-identified and anonymized data. The University of California, Los Angeles ("UCLA") also participates as an academic research partner and likewise receives only de-identified and anonymized data.

BY SUBMITTING A PROGRAM APPLICATION OR USING THE GOCARMA APP IN CONNECTION WITH THE PROGRAM, YOU CONSENT TO THE COLLECTION, USE, AND SHARING OF YOUR INFORMATION AS SET FORTH IN THIS PRIVACY NOTICE. Please read this Privacy Notice carefully before submitting personal information to us.

This Privacy Notice applies to the One Car Challenge Program, including (a) the Program application and participant selection process and (b) active Program participation by selected individuals, including their use of the GoCarma mobile application and the submission of odometer readings and other Program survey data.

By applying to or participating in the Program, you consent to LA Metro’s and Carma’s collection, use, and sharing of information as described in this Privacy Notice, solely for purposes related to the operation, administration, and evaluation of the Program.

Metro and Carma do not sell personal information and do not use personal information for commercial advertising purposes. Metro and Carma may share personal information only as described in this Privacy Notice, including where disclosure is required by law, authorized by you, or necessary for Metro, Carma, or its service providers to perform functions on Metro’s behalf in connection with operating the Program.

We reserve the right to update this Privacy Notice at any time to reflect changes in the Program, legal compliance, or operational needs. If we make material changes to this Privacy Notice, we will provide notice through Metro channels and by email to enrolled participants.

Updates will be effective when the revised Privacy Notice is posted and will apply to your continued participation in the Program after the effective date listed above. Your continued participation after that date means the updated Privacy Notice applies.

LA Metro will handle your information in accordance with the Privacy Notice in effect at the time your information is collected, unless you authorize otherwise or applicable law permits or requires a different approach.

Information We Collect and Use

We collect information when you apply to the Program and, if you are selected to participate, when you use the GoCarma mobile application and submit information during active Program participation. We use this information to determine your eligibility, select participants, verify reduced driving, administer incentives, and evaluate the Program, comply with laws, and for other purposes described in this Privacy Notice.

Information collected during the Program application:

Your name and contact information (email address and phone number);

Your home address and ZIP code;

Household composition (number of household members and licensed drivers);

Vehicle license plate numbers for the vehicles in your household;

Vehicle identification details for the vehicles in your household (such as make, model, and vehicle identification number (VIN) or VIN-adjacent identifiers);

Basic eligibility responses (e.g., age range, household income range, licensed-driver confirmation, employment status); and

Limited technical data collected automatically during form submission (IP address, browser type, device type, operating system, date/time of submission).

We use license plate numbers to verify vehicle ownership through the California Department of Motor Vehicles (DMV) or a licensed DMV data access provider, solely to confirm your eligibility.

Information collected if you are selected and enroll in active Program participation (via the GoCarma mobile application):

Odometer readings — submitted by you, verified through photographs you provide, or obtained through your vehicle's vehicle telematics system where you choose to connect an eligible vehicle — at Program start (baseline), at periodic checkpoints during the Program, and at Program end. Odometer data is the sole verification method for Program compliance. The Program does not collect, track, or infer any travel behavior, trip routes, or travel mode.

Odometer readings obtained through your vehicle's vehicle telematics system, where you choose to connect an eligible vehicle, used solely to capture odometer mileage at required Program checkpoints. Vehicle telematics data is used only to obtain odometer values and is not used to collect, track, or infer travel behavior.

Device and application information necessary to operate the GoCarma application (such as device type, operating system, app version, and diagnostic information).

Telework declarations and responses to periodic Program surveys.

Demographic information you choose to provide in Program surveys, which may include race or ethnicity, disability status, household income, and similar characteristics, collected on a voluntary basis for equity-research and Program-evaluation purposes. Certain of this information, together with financial account information, is treated as “sensitive personal information” under California law (see “Sensitive Personal Information” below).

Compliance and fraud-prevention records, including the results of compliance checks, records of suspected or confirmed non-compliance, and fraud-prevention flags, which become part of your participant record.

Incentive transaction records, including incentives earned, redemptions, and payment-method details necessary to deliver electronic incentives, including the financial account information (such as your existing bank account or debit card details) you provide so that incentive payments can be disbursed to you through our payment processor. Where the incentives you receive meet applicable tax-reporting thresholds, we may also collect your Social Security number or other taxpayer identification number as necessary to issue any required tax forms.

Communications with Carma customer support, including messages and support requests.

Location Data

The GoCarma application does not collect real-time location data from your device, track your routes, or infer travel behavior. Your home address, which you provide during the Program application, may be mapped by longitude and latitude to verify that it falls within the Los Angeles County service area — this is a one-time boundary check, not ongoing location tracking. The GoCarma application does not use Bluetooth or any other proximity-detection technology.

The GoCarma application does not request or require device location or Bluetooth permissions. Disabling location services or Bluetooth on your device does not affect your ability to submit odometer readings or earn Program incentives.

Your Choices Regarding Your Personal Information

You may choose what information you provide when completing the Program application or participating in the Program. In some cases, certain information is necessary to determine your eligibility, verify reduced driving, or administer incentives. If you choose not to provide required information, you may not be able to participate in the Program or earn incentives.

Metro and Carma uses information only as needed to operate and evaluate the Program and to meet legal and operational requirements.

Metro Use of Tracking Technologies

Metro and Carma services may use tracking and similar technologies to support core functionality, security, analytics, and service improvement. Metro and Carma may use them to enable application functionality and features, remember user preferences, maintain sessions, and understand how services are used to improve accessibility, reliability, and performance, and diagnose technical issues and maintain system integrity. They do not typically contain information that directly identifies you unless you choose to provide such information through a Metro or Program service.

How We Use Your Information

LA Metro and Carma directly, and through its Program vendors or service providers, uses information only for purposes related to the operation, administration, and evaluation of the Program. We collect and use information in a manner that is reasonably necessary to determine eligibility, select participants, verify reduced driving, administer incentives, conduct academic research, and meet funding-agency reporting obligations, and meet legal and regulatory obligations.

Depending on the services you use, LA Metro may use information to:

Determine eligibility for the Program and select participants

Communicate with applicants and participants about application status, Program enrollment, incentive milestones, and Program updates

Verify reduced driving activity through odometer readings only, and calculate incentive earnings

Support customer service, dispute resolution, and account assistance

Improve the reliability, accessibility, and performance of the Program and the GoCarma application

Maintain the security and integrity of the application platform and GoCarma application

Conduct academic research and Program evaluation using de-identified data, including research conducted by King’s College London under the research agreement described in the "Research and King’s College London" section below

Comply with applicable laws, regulations, and public safety requirements

Third Party Vendors

For function of the Program application platform and the GoCarma application, we may need to share this information with a member of our vendors or service providers with your consent or as you direct; to manage the Program application platform and administer the Program; for cloud storage hosting, database and server co-location services, data and cyber security services, fraud detection and prevention services, application platform and GoCarma analytics tools including session replay records for usability and functionality monitoring and analysis, services for measuring attribution and the efficacy of our publication and marketing efforts, sending notices and communications, e-mail distribution and monitoring services, vehicle ownership verification through the California DMV or a licensed data access provider, incentive payment processors, and our business, legal and financial advisors. These service providers may receive or otherwise have access to our users’ information, depending on each of their particular roles and purposes in facilitating and enhancing our services and business, and may only use it for such purposes.

Specific third parties currently engaged for the Program include:

LA Metro — program sponsor and data controller; receives registration data and aggregated/de-identified Program reporting.

King’s College London — academic research partner; receives de-identified Program data only, for non-commercial academic research and Program evaluation under research ethics approval ref LRS/RGO-25/26-56106.

University of California, Los Angeles (UCLA) — academic research partner; receives de-identified Program data only, for non-commercial academic research and Program evaluation.

California DMV (or a licensed data access provider) — receives license plate numbers for vehicle ownership verification.

Typeform — hosts the Program application form.

Incentive payment processors (including Stripe, which provides payout services) — process electronic incentive payments to selected participants.

Statistical Data

To monitor utilization of the Program application platform and GoCarma application and improve its quality, we may compile statistical information through analytics services. This might include collecting and analyzing the number of visitors to the platform, patterns of traffic flowing through the platform, and information regarding your clicks, and your referral URL to reflect data collected in the platform. The analytics services may transfer this information to third parties in case of a legal obligation or if a third-party processes data on behalf of that service. We may use this information to generate aggregate statistics about visitors to our platform. Please check your web browser if you want to learn what information your browser sends or how to change your settings.

Geolocation Data

The GoCarma application does not collect real-time geolocation data, GPS signals, or motion-sensor data from your device to verify Program compliance or infer travel behavior. Your home address — collected during the Program application — may be mapped by longitude and latitude to confirm that it falls within the Los Angeles County service area boundary. This is a one-time eligibility check performed on your address, not continuous or passive location tracking. The GoCarma application does not use Bluetooth or any other proximity-detection technology.

Research and King’s College London

The One Car Challenge is conducted in collaboration with King’s College London ("KCL"), the Program’s academic research partner, under research ethics approval ref: LRS/RGO-25/26-56106. KCL contributes to Program design, evaluation, and publication of research findings on vehicle-reduction behavior and related transportation policy outcomes.

De-identified Program data — with your name, contact details, home address, license plate numbers, and other direct identifiers removed — may be shared with KCL for non-commercial academic research and Program evaluation. KCL does not receive direct identifiers. Research findings will be published using fully anonymized, aggregated data only.

De-identified Program data shared with KCL is retained by KCL for up to seven (7) years following the conclusion of the applicable Program cohort, in accordance with the research ethics approval and to support longitudinal analysis of Program outcomes. After the seven-year retention period, KCL’s identifiable-by-association working records are deleted; fully anonymized, aggregated data may be retained indefinitely by KCL for publication and reproducibility purposes.

The sharing of de-identified data with KCL is conducted for non-commercial academic research and does not constitute a "sale" of personal information under the California Consumer Privacy Act, as no monetary or other valuable consideration is exchanged.

How Long We Keep Your Information

We retain personal information only for as long as is reasonably necessary to operate, administer, and evaluate the Program and to meet legal, regulatory, and public-safety requirements. Specific retention periods are as follows:

Applicants who are NOT selected: Registration data is retained for up to twelve (12) months to support potential future Program phases and will be deleted no later than December 31 of the calendar year following application. You may request earlier deletion at any time by contacting team+privacy@gocarma.com.

Selected participants — registration and household information: Retained for the duration of the Program plus seven (7) years following Program conclusion, to support audit and research evaluation.

Selected participants — vehicle and odometer data: Retained for the duration of the Program plus seven (7) years.

Selected participants — telework declarations and survey responses: Retained for the duration of the Program plus seven (7) years.

Selected participants — incentive transaction records: Retained for the duration of the Program plus seven (7) years for tax-reporting and audit purposes.

Customer support communications: Retained for the duration of the Program plus three (3) years.

De-identified research data shared with King’s College London: Retained by KCL for up to seven (7) years following the conclusion of the applicable Program cohort (see "Research and King’s College London" above).

Fully anonymized, aggregated data: May be retained indefinitely, as it can no longer be linked to you.

Communications and Notifications

Metro and Carma may communicate with you by email and, where you have provided a mobile number and consented, by text message (SMS) about your application, selection status, Program enrollment, incentive milestones, and Program updates. You may manage email preferences by replying to communications you receive from us, or by contacting team+privacy@gocarma.com. You may opt out of text messages by replying STOP to any message.

Safeguarding of Information

LA Metro and Carma uses reasonable administrative, technical, and physical safeguards required by law for a public agency and consistent with industry standards (including SOC 2 Type II, PCI-DSS, and ISO 27001) to protect personal information from unauthorized access, use, or disclosure. Personal information is encrypted in transit and at rest, is stored in data centers located in the United States, and is subject to role-based access controls and audit logging.

These safeguards may include access controls, security monitoring, encryption where appropriate, vendor security requirements, and procedures designed to protect the confidentiality and integrity of information. Metro reviews and updates its security practices as needed to address evolving risks and operational requirements.

While Metro takes steps to protect personal information, no system can be guaranteed to be completely secure. Information is handled in accordance with applicable laws, regulations, and Metro’s information security and record retention policies.

Sensitive Personal Information

Some of the information we collect is considered "sensitive personal information" under California law. For the Program, this includes your financial account information (such as a bank account or debit card used to receive incentives) and any racial or ethnic origin or similar demographic information you choose to provide in Program surveys. We collect and use sensitive personal information only as reasonably necessary to operate, administer, and evaluate the Program (including disbursing incentives and conducting equity research), to comply with law, and for the other purposes described in this Privacy Notice. We do not use or disclose sensitive personal information to infer characteristics about you, and we do not sell it or share it for cross-context behavioral advertising. You may request that we limit our use of sensitive personal information as described in "Your Privacy Rights" below, subject to the limitations noted there.

Automated Verification and Decision-Making

The Program uses automated processing to support eligibility verification and incentive administration. For example, odometer photographs may be read using automated character recognition, and odometer readings obtained through your vehicle telematics may be automatically retrieved and verified at Program checkpoints. These odometer readings are used to determine whether you have met Program requirements for a given period and the incentive amount you have earned. The Program does not use automated processing to infer travel mode or track travel behavior. If you believe an automated determination affecting your incentives is incorrect, you may contact Carma customer support or team+privacy@gocarma.com to request human review of the determination.

International Data Transfers

The Program is operated primarily in the United States, and Program personal information is stored in U.S.-based data centers. Some recipients and service providers may be located outside the United States. In particular, de-identified Program data is shared with King’s College London, which is located in the United Kingdom, and certain payment-processing functions may be performed by providers that operate internationally. Where information is transferred internationally, we take steps intended to ensure it remains protected consistent with this Privacy Notice and applicable law.

Your Privacy Rights

Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources from which it was collected, the business purposes for collection, and the categories of third parties with whom it has been shared.

Right to Delete: You may request that we delete the personal information we have collected about you, subject to certain exceptions (e.g., legal compliance, ongoing Program obligations, tax-reporting records, and de-identified data already transferred to research partners).

Right to Correct: You may request that we correct inaccurate personal information we maintain about you, subject to applicable legal limitations.

Right to Limit Use of Sensitive Personal Information: Because the Program collects sensitive personal information (including financial account information and, where you provide it, demographic information such as race or ethnicity), you may request that we limit our use and disclosure of that information to the purposes permitted under California law. Please note that financial account information is necessary to disburse Program incentives, so limiting its use may affect your ability to receive payments.

Right to Opt Out of Sale: We do not sell your personal information. We do not exchange your personal information for money or other valuable consideration, and the sharing of de-identified data with King’s College London for non-commercial academic research is not a sale of personal information. Right to Non-Discrimination: We will not discriminate against you for exercising any of your rights.

To exercise any of these rights, contact us at team+privacy@gocarma.com or write to the address in the "Contact Us" section below. We will verify your identity before processing your request and respond within 45 days as required by law. You may also use an authorized agent to submit a request on your behalf, in which case we may require proof of the agent’s authorization and verification of your identity. We will not discriminate or retaliate against you for exercising any of these rights.

Links to External Websites

Metro websites and applications may include links to external websites or services for your convenience, including services operated by Metro contractors, partner agencies, or other public or private entities. When you follow a link to an external site, you are leaving Metro’s digital environment and are subject to the privacy policies and practices of that site. Metro does not control and is not responsible for the content, privacy practices, or security of external websites. Metro provides links to external resources as a public service and does not share your personal information with those sites unless explicitly stated and authorized.

Legal, Public Safety, and Regulatory Disclosures

Metro and Carma may disclose personal information when required by law, court order, subpoena, or other lawful process, or when necessary to protect public safety, Program systems, or the rights and safety of Metro, Program applicants and participants, employees, or the public. Because LA Metro is a public agency, information it holds may also be subject to disclosure under the California Public Records Act. We will withhold or redact information where an exemption applies and disclosure is not required.

Aggregated and De-Identified Information

Metro and Carma may use and share aggregated or de-identified information for planning, research, reporting, and service improvement purposes, including academic research conducted by King’s College London under the research ethics approval referenced above. This information does not identify individual applicants or participants.

Information on Children

The Program is not directed at individuals under 18. Program eligibility requires a licensed driver, so applicants under 18 are excluded. We do not knowingly collect, use or disclose any personal information from children. If we learn that personal information of persons under 18 years-of-age has been collected through our Program platforms, we will take the appropriate steps.

Governing Law and Jurisdiction

This Privacy Notice is governed by the laws of the State of California, without regard to its conflict of laws principles. Any claims arising out of or relating to this Privacy Notice shall be subject to the jurisdiction of the state and federal courts located within the State of California, as applicable to a public agency.

If any provision of this Privacy Notice is determined to be invalid or unenforceable by a court of competent jurisdiction, the remaining provisions shall remain in full force and effect.

Contact Us

If you have any questions about this Notice or data use, please contact us at:

Email: team+privacy@gocarma.com

Mail:

Carma Technology Corporation

Attn: Privacy — One Car Challenge

600 Congress Avenue, Floor 14, Austin, Texas 78701