Privacy Policy

1. Introduction

• Aircity Operating System (HK) Ltd ("MTC", "we", "us", or "our") is committed to protecting your privacy.
• This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our websites, mobile application and services.
• By using MTC services, you consent to the data practices described in this policy.
• If you do not agree with the terms of this Privacy Policy, please do not use our services.

2. Information We Collect

• Personal Information: Name, email address, phone number, date of birth, and profile photo.
• Identity Documents: Hong Kong Identity Card (HKID) or passport, and valid driving license for verification purposes.
• Payment Information: Credit/debit card details, wallet balance, and transaction history.
• Location Data: Real-time GPS location during trips for navigation, safety, and service provision.
• Motion and Floor Data: on iPhone, if you allow Motion & Fitness, step and activity summaries around trip start and your phone's altitude when you detect your parking floor.
• Device Information: Device type, operating system, unique device identifiers, and push notification tokens.
• Usage Data: App interactions, booking history, trip details, and preferences.
• Communications: Records of customer support interactions via WhatsApp or other channels.

3. How We Use Your Information

• Service Provision: To process bookings, facilitate vehicle access, and provide navigation assistance.
• Identity Verification: To verify your identity and driving eligibility through KYC processes.
• Payment Processing: To process payments, manage your wallet, and handle refunds or disputes.
• Safety & Security: To monitor trips for safety, detect fraud, and respond to emergencies.
• Communications: To send booking confirmations, trip updates, and important service notifications.
• Service Improvement: To analyze usage patterns and improve our app and vehicle fleet.
• Legal Compliance: To comply with legal obligations, including traffic authority inquiries and law enforcement requests.

4. Data Sharing & Disclosure

• We do not sell your personal information to third parties.
• Advertising and Analytics Partners: We share information with Google and Meta as described in section 10 (Cookies, Analytics & Advertising).
• Payment Processors: We share payment information with secure third-party payment providers (e.g., Stripe) to process transactions.
• Identity Verification: We may use third-party services to verify your identity documents.
• Legal Requirements: We may disclose information to comply with laws, regulations, legal processes, or government requests.
• Traffic Authorities: We may share trip data with traffic authorities in response to traffic violation inquiries.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred.
• With Your Consent: We may share information for other purposes with your explicit consent.

5. Data Storage & Security

• Your data is stored on secure servers with industry-standard encryption.
• We use SSL/TLS encryption for all data transmitted between your device and our servers.
• Payment card details are tokenized and stored by our PCI-DSS compliant payment processor.
• We implement access controls to limit employee access to personal data on a need-to-know basis.
• Despite our security measures, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

6. Data Retention

• Account Information: Retained for the duration of your account and up to 7 years after closure for legal and tax purposes.
• Trip History: Retained for 7 years to comply with traffic authority requirements and dispute resolution.
• Payment Records: Retained for 7 years in accordance with financial regulations.
• Identity Documents: Retained for the duration of your account; deleted within 30 days of account closure.
• Location Data: Trip location data is retained for 90 days; aggregated anonymous data may be retained longer for analytics.
• Motion and floor data is retained for 90 days; anonymous per-car-park floor heights may be kept longer.

7. Your Rights

• Access: You may request a copy of the personal data we hold about you.
• Correction: You may request correction of inaccurate or incomplete personal data.
• Deletion: You may request deletion of your personal data, subject to legal retention requirements.
• Data Portability: You may request your data in a structured, machine-readable format.
• Withdraw Consent: You may withdraw consent for optional data processing at any time.
• Advertising Choices: You may turn off analytics and advertising cookies by selecting "Only essential" in our website's cookie notice, and ask us to stop sharing your hashed contact details with advertising partners.
• To exercise these rights, please contact us via WhatsApp. We will respond within 30 days.

8. Location Tracking

• Location tracking is essential for our service and is active only during trips.
• We use location data to: unlock vehicles, provide navigation, calculate fares based on distance, ensure vehicle security, and respond to emergencies.
• You may disable location services on your device, but this will prevent you from using our service.
• Location data is not shared with third parties except as required by law.

9. Push Notifications

• We send push notifications for booking updates, trip status, payment confirmations, and important service alerts.
• You may disable push notifications in your device settings, but you may miss important trip information.
• Marketing notifications are optional and can be disabled in the app settings.

10. Cookies, Analytics & Advertising

• Our websites (masstransit.hk and stations.masstransit.hk) and app use cookies and similar technologies. Some are essential to run the site; others measure how the site is used and how our advertising performs.
• Analytics: We use Google Analytics to understand which pages people visit, on what kind of device and from roughly where. This helps us improve the site.
• Advertising: We use Google Ads and the Meta Pixel to measure our ads and to show our ads to people who have visited our site. These services may set their own cookies and receive your device and browsing information.
• Ad Click Details: When you arrive from an ad, we record the ad's click identifier so we can tell which ads lead to sign-ups and bookings.
• Matching Ads to Bookings: When you sign up or book, we may send Google and Meta that event together with the click identifier and your email address and phone number in hashed (encrypted, one-way) form. They use this only to match the event to an ad and report results to us.
• Customer Lists: We may share hashed email addresses and phone numbers of customers with Google and Meta so that we do not show ads for new customers to people who already use MTC.
• Your Choices: On masstransit.hk, select "Only essential" in the cookie notice to turn off analytics and advertising cookies. You can also clear cookies in your browser, adjust ad settings in your Google and Meta accounts, or contact us to opt out of customer-list sharing.
• Visitors from the European Economic Area, the United Kingdom and Switzerland: analytics and advertising cookies stay off unless you select "Accept all" in the cookie notice.
• Google and Meta process this information under their own privacy policies.

11. Children's Privacy

• Our services are not intended for individuals under 18 years of age.
• We do not knowingly collect personal information from children under 18.
• If we discover that we have collected information from a child under 18, we will delete it promptly.

12. International Data Transfers

• Your data may be processed and stored on servers located outside of Hong Kong.
• We ensure appropriate safeguards are in place for any international data transfers.
• By using our services, you consent to the transfer of your data to locations outside Hong Kong.

13. Policy Updates

• We may update this Privacy Policy from time to time.
• Material changes will be notified via the app or email.
• Continued use of our services after changes constitutes acceptance of the updated policy.
• We encourage you to review this policy periodically.

14. Contact Us

For privacy-related inquiries or to exercise your data rights, please contact us:

• WhatsApp: +852 9089 0874
• Email: info@masstransit.hk
• Aircity Operating System (HK) Ltd
• Hong Kong SAR