Thank you for visiting the CityBase website ("Website"). CityBase, Inc. ("CityBase", "We", "Us", "Our") provides the Website, which is accessible to You on behalf of the CityBase client (the "Client"). CityBase values the privacy of its Website visitors. We only collect the minimum amount of information necessary to serve Our customers ("You", "Your").

The following Website Privacy Policy ("Privacy Policy" or "Policy") governs Our collection, use, and sharing of information You provide to Us through Your access and use of the Website and Services, including additional products, promotions and applications that may be made available to You through the Website or Services. All capital terms used but not defined shall have the meaning set forth in the Terms, which can be reviewed at pay.indy.gov/terms_of_use.

Please review this Privacy Policy carefully. By using or providing information to Us, You acknowledge that this Privacy Policy will apply to the operation of the Website and Our provision of the Services.

What Information We Collect

The information which We may collect generally falls into the following two categories:

• Personally Identifiable Information; and
• Non-Personally Identifiable Information.

Personally Identifiable Information ("PII" or "Personal Information")

Personally Identifiable Information, or "PII," is information that enables Us to identify You as an individual separate from other individuals or users of Our Website. The PII We may collect when You use certain Services through the Website may include:

• first and last name
• mailing address
• phone number
• e-mail address
• payment card information, including, among other things, the number,expiration date, PAN and CVV for the payment card
• banking information, such as ABA Routing and Account numbers, andDDA number
• user IDs and passwords
• public postings

We request PII when You:

• perform an online service transaction, such as paying a bill; or
• enter information in a voluntary online form, such as surveys; or
• create a profile and register an account and/or enroll as a Customer or user of our Services; or
• correspond with Us.

Non-Personally Identifiable Information ("NPII")

Non-Personally Identifiable Information, or "NPII," refers to technical information that does not, by itself, identify You as a specific individual from a group. The Non-Personally Identifiable Information We collect when You visit the Website may include,cookies, the Uniform Resource Locator (URL1) of the web pages visited on the Website or Our Internet Protocol (IP2) address. This Privacy Policy provides more information about how We use cookies and other NPII collection technology below.

Why We Collect Your Information

We will use Your Personally Identifiable Information to provide Our products andServices that Your Personally Identifiable Information was shared with Us to fulfill. Wemay use Your Personally Identifiable Information for the following purposes:

• to provide users Our products, information or Services,
• to provide all visitors a smooth, efficient, and personalized Website
experience,
• to provide customer service,
• improve Our Website and Services,
• to develop new products or services,
• maintain the security of the Service and Our network,
• as required or permitted by law,
• security,
• effectuate a change in ownership if the Website is sold in whole or in part,in which case, the new owner may have access to Your Personally Identifiable Information pursuant to the terms of this Privacy Policy, and
• marketing Our Website, Services and other products and services offered by CityBase (unless You choose to opt out).

How We Use Your Information

We gather and use information in a number of ways, including the following:

Web Page Visits: We collect certain information when You visit the Website. We collect this information to help run the Website more efficiently, to gather broad demographic information, and to monitor the level of activity on the Website.

Services: We collect PII when You request or use Services, such as paying a bill or parking ticket. We collect this information to process Your request, to obtain payment when applicable, to communicate with You about the status of Your request, and to take steps to improve Website functionality and create a personalized user experience.

Online surveys: We collect PII from customers who volunteer to complete surveys. We use this information to improve the Website and Services.Newsletters and e-mails: We collect PII when You ask to receive newsletters,e-mails, and other information. We use this information to provide You with the information You request.Newsletters and e-mails:

We collect PII when You ask to receive newsletters, e-mails, and other information. We use this information to provide You with the information You request.

Contact information: If You contact us, We may keep a record of Your correspondence or comments, including PII, in a file specific to You. We use this information to help Us provide better service in the event You contact us again.

Aggregate/De-Identified Data. We may aggregate and/or de-identify any information collected through the Website and Services so that such information can no longer be linked to You or Your device ("Aggregate/De-Identified Information"). We may use Aggregate/De-Identified Information for any purpose, including without limitation for research and marketing purposes, and may also share such data with any third parties, including advertisers, promotional partners, and sponsors. Aggregate/De-Identified Information is NPII.

Geoloation. We and our service providers, such as Google Analytics, may gather and use Your location information to provide the Services and use Your location information to improve the Service.

How We Share Your Information

CityBase will not rent, sell or give away any PII entered provided to Us to third parties for that third party's marketing or mailing list purposes, unless You provide Your consent.

CityBase may share Your information in the following ways:

Affiliates and Subsidiaries.

We may share information We collect with Our affiliates and subsidiaries under common ownership and control to deliver the Website and Services to You and enhance the Website and Services, and provide Your customer experience.

Our Service Providers.

We provide access to or share Your information with select third parties who perform services on Our behalf. They have access to perform these services but are prohibited from using Your information for other purposes. They provide a variety of services to us, including banking and payment processing, billing, sales, marketing, product content and features, advertising, analytics, research, customer service, data storage, security, auditing, fraud prevention, and legal services.

Third Parties You Authorize

CityBase will send information about You to other companies, agencies, or people that You choose to interact with through use of the Services, such as the credit card networks, including Visa, Mastercard, Discover, and American Express. This Privacy Policy does not apply to collection, storage, or other processing of Your information by such third party.

Client

CityBase may send information about You to Client to provide the Services. For example, We may have to share information with the Client for the purposes of processing Your payment of a ticket. This Privacy Policy does not apply to collection, storage, or other processing of Your information by Client.

Otherwise Required by Law.

CityBase will access, retain and disclose PII about You as required to do so bylaw, rule, regulation, subpoena, court order or legal process.

Accessing and Changing Your Information

CityBase seeks to ensure that Your information and preferences are accurate and complete. If You have created an account to access the Website, You can change Your account information by visiting the Website.

Use of Cookies On the Website

A "cookie" is a small data file transferred by a Website to Your device's hard drive. You are sent cookies when You browse the Website, make online payments, respond to online surveys, request information, etc. Accepting CityBase's cookies does not give us access to Your Personally Identifiable Information. However, We can use the cookies to identify information about Your computer or devices, such as Your computer type, web browser type, and the operating system in use. The information collected permits Us to analyze traffic patterns on Our Website. This can enable Us over time to provide You with a better experience on the Website by improving the content and making it easier to use.

Most web browsers automatically accept cookies, but You can usually refuse cookies, or selectively accept certain cookies, by adjusting the preferences in Your web browser. If You turn off cookies, though, there may be some features of the Website that will not be available to You and some pages may not display properly.

Do Not Track Signals and Online Tracking

Except for Our use of Google Analytics, which automatically collects information such as Your IP address, to support the Website, We do not collect information about Your online activities over time, across third party websites, or on other third party applications.

The Website does acknowledge and honor any "Do Not Track" signals sent from Your web browser. Therefore, if You have such signals turned on, the Website, includingGoogle Analytics, will not collect information about Your browsing session while still enabling You to use the Website.

Protecting Your Information

We have implemented commercially available and reasonable organizational, technical, and administrative measures designed to secure Your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure. Such technologies include the use of SSL/TSL connections to encrypt the collection and transfer of payment information through a trusted third party. CityBase contracts with trusted third parties to securely collect and transmit any payment card or banking information You enter. CityBase does not store such payment information.

Unfortunately, the transmission of information via the Internet is never completely secure. Although We do our best to protect Your personal information, We cannot guarantee the security of Your personal information transmitted through the Website or as part of the Services. Any transmission of PII is at Your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Website.

General Information

Links to Other Websites

The Website may contain links to many local government agencies and other public sector resources. In a few cases, with their permission, We may provide links to private company websites, such as Google Maps. Any access or use of a third party website is subject to the posted terms and conditions and privacy policy on such third party sites. We suggest that You carefully review the privacy policies of each third party site You visit. CityBase is not responsible or liable for any content or actions taken on such third party sites.

California Shine the Light and Online Privacy Protection Act Compliance

California Civil Code Section § 1798.83 requires companies to provide users who are California residents with information regarding how their Personally Identifiable Information is shared for marketing purposes, if applicable. We will not distribute YourPII to third parties for the purposes of marketing or advertising third party products to You without obtaining Your consent in advance.

Children’s Online Privacy Protection Act Compliance

We do not intentionally collect information from any individual under 13 years of age. Our Website, products and services are all directed to people who are at least 18 years of age or older.

United States Use Only

The Website is intended to serve U.S. residents only. Personal information submitted toUs may be maintained or accessed in servers or files in the United States of America, which the European Union has not deemed to provide "adequate" privacy protection. If you do not consent to having Your information processed and stored in the United States of America, please do not provide it to Us. We contend that the General Data Protection Regulation (EU) 2016/679 does not apply to Our processing of Personally Identifiable Information and that it is not within the jurisdiction of the EU. All processing of PII is governed by the applicable laws of the United States of America.

Changes to this Privacy Policy

If there are changes to this Privacy Policy, We will post those changes on our Website in a revised Privacy Policy. Each posted Privacy Policy will include a date of last revision. It is Your responsibility to periodically review this Privacy Policy and You are bound by any changes to this Privacy Policy

Contact Us

If You have any questions or concerns about the Website's use of Your information or about this Privacy Policy, please send an e-mail to info@thecitybase.com and note"Privacy" in the subject line.

Additional Privacy Rights

Nevada Privacy Rights

Nevada law (SB 220), permits customers in Nevada to opt-out of the sale of certain kinds of personal information. A sale under Nevada law is the transfer of this personal information to third parties for monetary consideration so these third parties can then re-sell or license the sold information. We do not sell Your Personal Information to third parties as defined in Nevada law. If You are a Nevada resident and wish to opt-out of the sale of Your personal information should we change our practices in the future, You must send a request by email to: info@thecitybase.com.

California Consumer Privacy Act

This Privacy Policy for California residents supplements the information contained above in our general privacy policy and applies solely to visitors, users and others who reside in the State of California. Any inconsistent terms in any other sections of the Privacy Policy will be superseded by this Section for California residents. To the extent applicable, these rights and obligations will also apply to residents of Virginia, Nevada and Colorado even though there may be a reference to the CCPA.

We will not sell your personal information

We will not sell Your personal information to others.

Your Rights Under the CCPA

Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), California residents are granted the following rights:

• To know what personal information is being collected about them;
• To know whether their personal information is sold or disclosed and to whom;
• To say no to the sale of their personal information;
• To access their personal information;
• To have their personal information deleted; and
• To have the right to equal service and price, even if they exercise their privacy rights under this law.

When receiving a request, We will verify that the individual making the request is the resident to whom the personal information subject to the request pertains. California residents may exercise their rights themselves or may use an authorized agent to make requests to disclose certain information about the processing of their personal information or to delete personal information on their behalf. If You use an authorized agent to submit a request, We may require that You provide Us additional information demonstrating that the agent is acting on Your behalf.

Categories of Personal Information We Collect

We collect information as set forth above and also information that identified You, Your household or Your device or is reasonably capable of being connected with or linked to You, Your household or Your device. "Personal information" does not include public information available from government records, de-identified or aggregated information.

How We Use Your Information

See above for how We use Your information. Except as otherwise stated in this Privacy Policy, We will not collect additional categories of Personal Information or use the Personal Information We collected for materially different, unrelated, or incompatible purposes without providing You notice.

Requests to Know

You have the right to request that We disclose certain information to You about Our collection and use of Your PII over the prior twelve (12) months. Once We receive and confirm Your verifiable consumer request, We will disclose to You:

• Right to Know and Access. You may submit a verifiable request for information regarding the: (1) categories of Personal Information collected or disclosed by Us; (2) purposes for which categories of Personal Information are collected by Us; (3) categories of sources from which We collect Personal Information; and (4) specific pieces of PII We have collected about You during the past twelve months.
• Data and Collection Minimization. The use of Personal Information must be for the stated purposes when collected.
• Right to Access Information Related to Automated Decision Making. You may request information related to the logic involved in any automated processing of Your Personal Information, to the extent applicable, and the expected outcomes.
• Right to Correct Information. You may request that We update or correct inaccurate Personal Information about You.
• Right to Non-Discrimination. You have the right not to be discriminated against based upon Your exercise of Your privacy rights. See below for more information.
• Right to Limit Use or Disclosure of Sensitive Personal Information("SPI"). You may limit the use and disclosure of Your SPI to the minimum necessary for the purchase and delivery of the goods and services We offer.
• Right to Opt-Out of Automated Decision Making Technology. You may request Your removal from having automated decision-making applied to Your Personal Information.
• Right to Delete. Subject to certain exceptions, You have the option to delete Personal Information about You that We have collected from You. See below for more information.
• Verification. Requests for access to or deletion of Personal Information are subject to Our ability to reasonably verify Your identity in light of the information requested and pursuant to relevant CCPA requirements, limitations, and regulations.
• Right to Equal Service and Price. You have the right not to receive discriminatory treatment for the exercise of Your CCPA privacy rights.
• Storage. We cannot retain Your Personal Information or SPI for a longer period than is reasonably necessary to fulfill the purpose for which We collected Your Personal Information or SPI.
• Purpose. The business or commercial purpose for collecting Your Personal Information.
• Personal Information Collected. The specific pieces of Personal Information We have collected about You
• Disclosure. If We sold or disclosed your Personal Information for a business purpose, We will provide two separate lists disclosing:
• In the case of a sale, the categories of Personal Information sold about You and the categories of third parties to whom the Personal Information was sold, by category of Personal Information for each category of third parties; and
• In the case of disclosure for a business purpose, the categories of Personal Information that were sold or disclosed for a business purpose and if Personal Information has not been sold or disclosed for a business purpose, that We did not do so.

We are not required to (i) retain Your Personal Information if collected for a single one-time transaction if, in the ordinary course of business, that information would not be retained and (ii) re-identify or otherwise link any data that, in the ordinary course of business, is not maintained in a way that would be considered personal information.

Requests to Delete

You have the right to request that We delete any of Your Personal Information that We collected from You and retained, subject to certain exceptions. Once We receive and confirm Your verifiable consumer request, We will delete (and direct our service providers to delete) Your Personal Information from Our records, unless an exception applies, which We will disclose to You.

We are not required to grant Your deletion request if retaining the Personal Information is necessary for Us or Our service providers to:

• Complete the transaction for which the Personal Information was collected, fulfill the terms of a written warranty or product recall, provide a good or service requested by You, or reasonably anticipated within the context of Our ongoing business relationship with You, or otherwise perform a contract between Us and You.
• Detect security incidents, protect against malicious, deceptive, fraudulent or illegal activity; or prosecute those responsible for that activity.
• Debug to identify and repair errors that impact existing intended functionality.
• Exercise free speech, ensure the right of another consumer to exercise that consumer’s right of free speech, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act.
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest when the deletion of the public information is likely to render impossible or seriously impair the achievement of such research, if the consumer has provided informed consent.
• For solely internal uses that are reasonably aligned with Your expectations based on Your relationship with Us.
• Comply with a legal obligation.
• Internally make otherwise lawful uses of Your Personal Information that are compatible with the context in which You provided Your Personal Information.

How to Submit a Request to Know or a Request to Delete

To request this information, please submit a verifiable consumer request to Us by:

• Emailing us at info@thecitybase.com and submit Your request in the body of the email with the subject heading: "[INSERT STATE OF RESIDENCY]Consumer Request," for example, "Virginia Consumer Request."

Only You, or someone legally authorized to act on Your behalf, may make a verifiable consumer request related to Your Personal Information. We are not required to provide You with Personal Information more than twice in a 12-month period.

We will not be able to respond to Your request or provide You with Personal Information if We cannot verify Your identity or authority to make the request and confirm the Personal Information relates to You.

We will try to respond to Your request within forty-five (45) days of receipt of Your written request. If We require more time (up to 90 days), We will inform You of the extension period in writing. We will deliver Our written response by mail or electronically, at Your option. Any disclosures We provide will only cover the 12-month period preceding the verifiable consumer request's receipt. The response We provide will also explain the reasons We cannot comply with a request, if applicable. For data portability requests, We will select a format to provide your Personal Information that is readily useable and should allow You to transmit the information from one entity to another entity without hindrance, specifically by electronic mail communication.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If We determine that the request warrants a fee, We will tell You why We made that decision and provide You with a cost estimate before completing Your request.

Opt-Out Request

Once You make an opt-out request, We will wait at least twelve (12) months before asking You to reauthorize personal information sharing with third parties. However, You may change Your mind and opt back into personal information sharing with third parties at any time by emailing us at: info@thecitybase.com.

We will only use Personal Information provided in an opt-out request to review and comply with the request. We will act upon Your opt-out request within fifteen(15) days of receipt.

Non-Discrimination

We will not discriminate against You for exercising any of Your CCPA rights. Unless permitted by the CCPA, We will not:

• Deny You goods or services, except to the extent that the provision of Services requires the disclosure of Personal Information that You have decided not to disclose or allow Us to use for the purpose of a loan.
• Charge You different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide You a different level or quality of goods or services.
• Suggest that You may receive a different price or rate for goods or services or a different level or quality of goods or services.

However, We may offer You certain financial incentives permitted by the CCPA that can result in different prices, rates, or quality levels. Any CCPA-permitted financial incentive We offer will reasonably relate to Your personal information's value and contain written terms that describe the program's material aspects. Participation in a financial incentive program requires Your prior opt in consent, which You may revoke at any time.