This Policy applies to MP Operator, LLC, the holding company of Autopistas Metropolitanas de Puerto Rico, LLC and Puerto Rico Tollroads, LLC, and the private operator of Autopistas de Puerto Rico, LLC, collectively referred to as «the Companies» or «Company Affiliates».

This Privacy Policy (the «Policy») describes the privacy practices associated with:

(i) the Companies’ websites and mobile applications;

(ii) the Companies’ social media pages and advertisements;

(iii) communications or interactions with the Companies for customer service purposes; and

(iv) engagement with the Companies’ advertisements on the Internet and in digital media.

For purposes of this Policy, the term «User» refers to any individual who uses, accesses, or visits the Companies’ websites (the «Websites»), social media pages or advertisements, or mobile applications, as well as any individual who contacts or interacts with the Company for customer service purposes. The Companies may collect information in other transactions or interactions that are not subject to this Privacy Policy and/or are subject to other privacy policies, agreements or notices which could substitute, complement or modify this Privacy Policy.

What type of information do the Companies collect?

As described in more detail below (see How the Companies collect information?), the Companies may collect one or more of the following types of personal information from their users that may be used (by itself or together with any other information) to identify a specific individual:

• First and last name,
• Mailing address (including zip code),
• Email address,
• Telephone numbers,
• Voice recordings (for example, when contacting customer service),
• Location information, and
• Other information that enables the physical or electronic identification of a natural person.

As further described hereunder, the Companies also collect information that does not by itself identify a specific individual. The Companies gather certain information relating to the Internet or other electronic network activity information, including Browse history, search history, information regarding users’ interaction with the Company’s Website, mobile apps, or advertisements, and information regarding users’ browser, device, and operating system, access times, referring websites/webpages and domain names. The Companies also collect information about motor vehicles voluntarily provided by users (such as license plate numbers, make, model, among other information).

How the Companies collect information?

As described in this Policy, the Companies collect information voluntarily provided by users upon interacting with the Websites and/or any application or platform provided by the Companies for the benefit of users, and/or provided by third parties pursuant to their respective privacy and data use policies, as well as through user interaction through the Companies’ social media pages.

The following describes the information the Companies collect and how such information is collected:

Information which may identify the user:

• If the Companies allows the creation of accounts or registration on its websites and mobile apps, it will collect personal identification information (such as, name, e-mail address, phone number, postal address, physical address).
• The Companies collect information entered by users into online forms on the Companies’ Websites or mobile apps, and/ or when a user contacts the Companies with questions regarding its services, offers, promotions, and/or affiliates.
• When a user voluntarily completes a customer survey or provides feedback on any of the Company’s message boards, chats or via email.
• Users can also provide the Companies with other optional information, such as pictures, social network profiles, questionnaire responses, general business information, and other personal, biographical, or demographic info.
• During contact with Customer Services, the Companies collect information from users when they contact customer services, including without limitation the recording of any customer call for the purposes of training and quality control. This can include name, contact information and any other information provided by users.

Information that generally does not identify the user:

• For users that register an account with the Companies, our server logs also automatically collect user information such as users’ IP addresses, pages that user’s access within the Websites, browser type and language, and the date and time of visits, which helps the Companies track use of the Website and understand trends.
• The Companies collect certain non-personally identifiable information automatically. The technologies the Companies uses to assist with this information collection include cookies, web beacons, tags and scripts and software development kits (or SDKs). We use these technologies on our digital properties, including our websites and mobile apps, as well as in our e-mail communications and newsletters, all of which are governed by this Privacy Policy.
• When a user visits, accesses, or interacts with, the Companies’ Websites, mobile apps, e-mail communications and newsletters, the Companies’ servers automatically log information about the device persons are using, including unique identifiers. If the browser used by that user doesn’t accept cookies or similar technologies, said user may not have access to certain parts of the Companies’ Websites. The items the Companies log include IP address, Cookie identifiers, operating system and browser (e.g., type, version, and configuration), browser language, device identifiers (such as MAC address), advertising identifiers. The Companies may combine this data with other information it collects about their users.
• The Companies collect certain internet and network activity on its Websites and mobile apps, such as the URLs of any pages people visit on such sites and apps, the URL of the website from which a user came to the Companies’ Websites, how long said user spent on a page, access times and other details about the said use or visit of the Companies’ Websites or mobile apps.
• The Companies’ mobile apps collect real-time information about the location of users’ devices.

Information that the Companies may collect through third parties:

• The Companies may also receive information indirectly from the following sources: i. Privately Owned Databases. Marketing, data analysis and social media-owned databases provide the Companies access to a range of information — like public data, survey data and more. ii. Social Media Platforms and Other Third-Party Services. If the Companies allow users to link their social media or other third-party accounts to the Companies’ Websites or mobile apps, by linking the services, the users authorize the Companies to collect, store and use any information they may share with the Companies. Users can disconnect their registration on the Companies’ Websites or mobile apps (if any) registration from third-party accounts at any time.
• The Companies also receive information from users when they interact with the Companies’ pages or on social media hosted groups, accounts, or posts. This includes aggregate data on the Companies’ followers (e.g., age, gender and location), engagement data (e.g., “likes,” comments, shares, reposts and clicks), awareness data (e.g., number of impressions and reach) and individual users’ public profiles.
• The Companies may generate new information from other data it collects using its own- or third-party algorithms, including using automated means to generate information about user likely preferences or other characteristics.
• The Companies also receive information from users when they interact with third-party service providers in connection with services requested or contacted through the Companies’ mobile apps.
• The Companies receive information from Google Analytics and ads networks.

Cookies

• The Companies use cookies and similar technologies on their websites that users agree to when they use said Websites and, in the case of some cookies, for legitimate interests of delivering and optimizing the Companies’ services (where the cookie delivers essential functionality).
• Cookies are text files placed on a computer to collect standard Internet log information and visitor behavior information. When someone visits the Companies’ Websites, the Companies may collect information automatically through cookies or similar technology. For further information, visit allaboutcookies.org.
• The Companies use cookies and similar technologies for several reasons:
  
  • To gather metrics about users’ experience.
  • To make the Companies’ services easier to use.
  • For security reasons.
  • The Companies use cookies to authenticate registered users’ identity and confirm whether registered users are currently logged into the Companies.
  • To provide personalized content.
  • The Companies store user preferences, default language, device and browser information, profile information which includes the level of usage of service and the webpages on the Websites visited, so the Companies can identify users across devices and personalize the content users see.
  • To improve its services.
  • To advertise.

What types of cookies do the Companies use?

There are several different types of cookies the Companies’ Website use:

• Functionality—The Companies use these cookies so that we recognize users on its websites and remember their previously selected preferences. These could include what language they prefer and location they are in. First party and third-party cookies are used.
• Advertising—The Companies use these cookies to collect information about the visit of users to the Websites, the content viewed, the links followed and information about browser, device, and IP address. The Companies sometimes share some limited aspects of this data with third parties for advertising purposes. The Companies may also share online data collected through cookies with their advertising partners. This means that when a user visits another website, said user may be shown advertising based on Browse patterns on the Websites.

How will the Companies use the information collected?

The Companies use each of the categories of information described above in connection maintenance, operations, safety of the Toll Roads (comprised of PR-5, PR-22, PR-52, PR-20, PR-53 and PR-66) and its Websites, mobile apps, and for the business and commercial purposes described hereunder. The activities below can involve outside service providers to whom the Companies disclose information of the users for these purposes.

• To provide services and information for users (including, but not limited to, information about the Toll Roads, roadside assistance, among others).
• We use location information to provide services or coordinate the provision of services requested by users in or through the Companies’ mobile apps. We collect this information for purposes of enhancing or facilitating our services.
• To help users to use and navigate the Companies’ Websites, mobile apps, Toll Roads or other services.
• To analyze data on users’ usage behaviors when they use the Companies’ Websites, or mobile apps.
• For auditing and verifying that the Companies’ internal processes work as intended and comply with legal, regulatory and contractual requirements.
• For fraud and security monitoring: to detect and prevent cyberattacks or unauthorized robot activities.
• For customer satisfaction, and to assess or users’ satisfaction with the Websites, mobile apps, the Companies’ services (for example, roadside assistance), and the Toll Roads.
• The Companies may aggregate or de-identify information so that they can no longer identify a particular user, as defined under applicable laws. The Companies can use and disclose this aggregated or de-identified information for any purpose, unless an applicable law says otherwise.
• For improving the Companies’ Websites, mobile apps, services or Toll Roads.
• For legal purposes related to the use of the Companies’ services, Website, mobile apps, or the Toll Roads.
• To communicate with users and provide notices and updates regarding our services, Websites, mobile apps, Toll Roads, toll fees, among others.
• The Companies’ legal obligations under applicable laws and regulations.
• To resolve disputes, troubleshoot problems and enforce the agreements with users, including this, Policy.
• Estimate our audience size and usage patterns.
• Store information about users’ preferences, allowing the Companies to customize our websites and mobile apps according to the users’ individual interests.
• Speed up the searches performed by users.
• Recognize users when using the Websites or mobile apps.
• The Companies or third-party data and advertising platforms use or combine multiple technologies, such as cookies, page tags, mobile identifiers and IP addresses to infer users’ common identities across different services and multiple devices such as tablets, browsers, and mobile phones. The Companies do so, for instance, to tailor ads to users, to enable the Companies to determine the success of advertising campaigns and to improve upon them. These third-party data and advertising platforms may sometimes use data that the Companies provide to them in order to improve their technologies and their ability to match common devices to users. The Companies may also use this to measure the performance of e-mail messaging and to learn how to improve e-mail deliverability and open rates.
• The above data and techniques are used for personalized marketing, analytics, and related purposes. The Companies may also use this data to personalize online marketing campaigns to be relevant to users.

To Whom Do the Companies Disclose the Information Collected?

The Companies reserve the right to disclose or share the information they collect from users in the circumstances described below.

• The Company Affiliates may access the information collected from users for the purposes listed here.
• The Companies may share information collected from users with service providers, contractors, or agents necessary to carry out certain tasks or perform certain services, including: fulfilling requests for services or information from users, maintaining technology and related infrastructure of its Websites, mobile apps or the Toll Roads; web hosting; offering customer service; presenting surveys; ad servers; ad networks; distributing e-mails; list processing and analytics; managing and analyzing research. When performing these tasks or services, service providers often have access to the information collected from users. The Companies sometimes allow them to use aggregated or de-identified information for other purposes, in accordance with applicable laws. Said third parties will only use any information collected from users under this Policy for services exclusive to the Companies.
• The following provides more information about the circumstances in which the Companies knowingly discloses user information to third parties that are not affiliates or service providers to the Companies:
  
  • When the Companies are legally required to disclose the information to government agencies, including but not limited to the Puerto Rico Highways and Transportation Authority, and other agencies in connection with the operation of the Toll Roads, vehicle registration, or emergency services.
  • When the Companies are required to disclose or preserve the information to comply with any court order, law, or legal process, including to respond to any government or regulatory request.
  • In the event of a reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of the Companies’ business, assets or membership units (including in connection with any bankruptcy or similar proceedings), the Companies would have a legitimate interest in disclosing or transferring the information collected from users to a third-party – such as an acquiring entity and its advisers.
  • The Companies can share or disclose information they collect from users with their business partners to offer you certain products, services, or promotions.
  • Third parties to market their products or services to users that have not opted out of these disclosures.
  • To fulfill the purpose for which users provide it.
  • For any other purpose disclosed by the Companies when users provide the information.
  • To enforce the Companies’ rights arising from any contracts entered into between the users and the Companies, including any applicable Terms and Conditions, and/or any End User License Agreement, and for billing and collection purposes.
  • If the Companies believe disclosure is necessary or appropriate to protect the rights, property, or safety of the Companies, the Toll Roads, its customers or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction.
  • The Companies can disclose aggregated information about users, and information that does not identify any individual or device, without restriction.
• The Companies can also preserve or disclose the information collected if they believe it would be necessary to:
  
  • Comply with the law or with legal process.
  • Protect against misuse or unauthorized use of the Companies’ Websites, mobile apps, services or Toll Roads.
  • Protect the safety or property of the Companies’ personnel, users, Toll Roads, or the public.
  • Cooperate with government authorities.

How Do the Companies Keep Information Secure?

The Companies use reasonable physical, managerial, and technical safeguards to prevent loss, misuse, and unauthorized access, disclosure, destruction and alteration of the information that it collects. Please be aware, however, that no data security measures can be guaranteed to be completely effective. Consequently, the Companies cannot ensure or warrant the security of collected data or other information. In particular, the Companies cannot guarantee that collected data or other information will not be disclosed, altered, or accessed in accidental circumstances or by unauthorized or unlawful acts of others.

How Long Do the Companies Keep This Information For?

The Companies retain the information they collect from user as long as it has an ongoing legitimate business need to do so and as permitted by applicable laws.

International Transfers

The Companies operate their technology from servers located in the Commonwealth of Puerto Rico and/or elsewhere in the United States and the information collected is processed solely in the Commonwealth of Puerto Rico and/or the United States. Laws governing the collection and use of data in the European Union, Switzerland or United States may not be equivalent to those in the country where a user of the Companies’ Websites or mobile apps resides, but the Companies will at all times protect user’s data in accordance with this Privacy Policy.

The Companies may share user information with our affiliates and other third parties described above who are based in countries outside of their country of residence. While some countries may not have data protection laws that are equivalent to those of the country in which users reside, the Companies will take all reasonable measures to protect their information in accordance with this Privacy Policy and all applicable legal requirements. If any of the recipients is in a country without the adequate legal protection or safeguards for personal data, the Companies will make reasonable efforts, so the recipient adopts the principles described in this Privacy Policy.

Privacy policies of Third Parties

The Companies’ Websites and mobile apps may contain links to other Websites. When users click on a link to another Website, they should read their privacy policy. Except as otherwise discussed in this Privacy Policy, this document only addresses the use and disclosure of information the Companies collect from Users. Other sites accessible through the Companies’ Websites or mobile apps have their own privacy policies and data collection, use and disclosure practices. Please consult each site’s privacy policy. The Companies are not responsible for the content, policies or practices of third parties.

Additionally, other companies which place advertising on the Companies’ Websites or mobile apps may collect information about user when they view or click on their advertising through the use of cookies. The Companies cannot control this collection of information. Users should contact these advertisers directly if they have any questions about their use of the information that they collect.

What Are the Options and Choices of users?

The Companies provides a variety of ways for users to control the personal information it holds about them, including choices about how the Companies use that information.

A. In General

i. Communications Preferences

The choices described below are limited to the e-mail address, phone or device used by each user.

• e-mail: Users can unsubscribe from commercial e-mails and e-mail newsletters them by following the instructions near the bottom of the e-mail. Users can also e-mail the Companies at privacy@metropistas.com.
• Push Notifications: Users can opt out any time by adjusting their device settings, or uninstalling the Companies’ mobile apps.
• Text Messages: Users can opt out of text alerts any time by replying “STOP,” or any alternative keyword shared by the Companies. Companies complete any opt-out request as quickly as it can. This opt-out request won’t prohibit the Companies from sending important nonmarketing notices.

ii. Browser and Platform Controls

• Location Information: Users can choose whether or not to allow the Companies’ mobile apps to collect and use real-time information about device’s location through the device’s privacy settings. If the user blocks the use of location information some parts of the mobile apps may then be inaccessible or not function properly. Should you wish to opt out of the collection of this information, please adjust the settings of your device so that information about your physical location is not sent to us or third parties. If this option is chosen services may not be requested from the Companies through the mobile app.
• Cookie Controls: Most web browsers are set to accept cookies by default. Users can go to their browser settings to learn how to delete or reject cookies. If users choose to delete or reject cookies, this could affect certain features or services of the Companies’ Websites. When users choose to delete cookies, settings and preferences controlled by those cookies, including advertising preferences, may be deleted and may need to be recreated.
• Mail Web Beacons: Most e-mail clients have settings which allow them to prevent the automatic downloading of images, including web beacons, which prevents the automatic connection to the web servers that host those images.
• Do Not Track: Some browsers include a “Do Not Track” (DNT) setting that can send a signal to the websites you visit indicating you do not wish to be tracked. There is not a common understanding of how to interpret the DNT signal; therefore, Companies’ Websites do not respond to browser DNT signals. Instead, users can use the range of other tools to control data collection and use, including the cookie controls and advertising controls described above.
• Mobile Advertising ID Controls: iOS and Android operating systems provide options to limit tracking and/or reset the advertising IDs.

iii. Users access to and control of information

Users may correct and modify the information they have provided to the Companies by sending an email to privacy@metropistas.com. A user may also send the Companies an email at privacy@metropistas.com to request access to, correct or delete any personal information that she/he has provided to Companies under the terms of this Privacy Policy. The Companies cannot delete users’ personal information except by also deleting the user account. The Companies may not accommodate a request to change information if the Companies believe the change would violate any law or legal requirement or cause the information to be incorrect.

Disclosure of User Information for Third-Party Advertising and Marketing. If a user does not want the Companies to share her/his personal information with unaffiliated or non-agent, third parties for advertising and marketing purposes, she/he can opt-out by informing us of your preference when you sign up for a Metropistas account or modifying your promotional preferences online. To stop receiving phone, mail, SMS, and/or email marketing communications from us, you may text “STOP” to a text message from us or click “unsubscribe” at the bottom of an email from us.

Promotion by the Companies. If a user does not want the Companies to use her/his information to promote its own or third parties’ products or services, she/he can opt-out by unsubscribed option at emails. Users of the Companies’ mobile apps can also always opt-out by logging into the mobile app and adjusting her/his user preferences in the account profile by checking or unchecking the relevant boxes or by sending an email to privacy@metropistas.com stating her/his request.

Users located at other jurisdictions may have certain rights under the applicable data protections laws. For example, users located in the European Union may have the following rights:

• The right to access the information that the Company maintains about them, to request deletion of their data, update their data, object to processing of their personal information, ask the Company to restrict processing of their personal information or request portability of their personal information and correct or amend that information if it is inaccurate or has been processed in violation of privacy laws, to the extent allowed by law, including the General Data Protection Regulation (GDPR); and certain rights related to automated decision-making (i.e. where no humans are involved) and profiling (i.e. where certain personal data is processed to evaluate an individual).
• If the Company has collected and processed personal information from users located at the European Union with their consent, then said users can withdraw their consent at any time. Withdrawing their consent will not affect the lawfulness of any processing the Company conducted prior to their withdrawal, nor will it affect processing of personal information conducted in reliance on lawful processing grounds other than consent.

A user that would like to exercise any of the above choices, may contact the Company via privacy@metropistas.com or by calling the Company at 787.705.8699. In their request, users must be specific. State the information they want changed, whether they’d like their information suppressed from the Companies databases or whether there are limitations they’d like the Companies to put on how the Companies use their personal information. Please use the e-mail address linked to that personal information—Companies only completes requests on the information linked to the user e-mail address. To verify user identity, the Companies will e-mail the e-mail address provide by the user, and which matches Companies’ records, and wait for the user response. In some instances, the Companies may also ask for additional information. This is how the Companies verifies the user identity before complying.

User rights and Companies’ responses will vary based on the user’s state or country of residency. A user may be located in a jurisdiction where the Companies is not obligated, or is unable, to fulfill a request. In such a case, the user’s request may not be fulfilled.

Notwithstanding the above choices, the Companies might need to keep certain information for recordkeeping purposes, or to complete a transaction the user began prior to requesting a change or deletion. In some cases, a user request doesn’t ensure complete removal of the content or information.

Children

The Companies’ Websites and mobile apps are directed to a general audience and are not directed to children. The Companies do not knowingly or intentionally solicit or collect on or through the Companies’ Website, mobile apps or online any personal information from children under the age of 13 (or under the age of 16 in the case of user located at the European Union), except as otherwise permitted by law or regulation. If the Companies obtains actual knowledge that it has collected personal information about a child under the age of 13 (or under the age of 16 in the case of user located at the European Union), that information will be immediately deleted from its records and databases.

Changes to the Privacy Policy

The Companies reserve the right to change this Privacy Policy at any time. Such changes, modifications, additions or deletions shall be effective immediately upon notice thereof, which may be given by means included, but not limited to issuing an email to the email address listed by registered users or posting the revised Privacy Policy on the Companies’ Websites. This Privacy Policy was last updated on April 22, 2025.

How to contact the Companies

If a user has any questions about the Companies’ Privacy Policy, the information that the Company has collected, stored or hold on such user, please do not hesitate to contact Company at:

• Email: privacy@metropistas.com
• Phone: 787.705.8699
• Mailing Address: PO Box 12004, San Juan PR 00922