Exercising Your California Access, Deletion, And Do Not Sell Rights

As a California Resident you may request that we disclose what personal information Union Pacific collects, uses, and discloses about you (the “Right to Know”), you may have the right to ask us to delete the personal information we collect about you (“Right to Delete”), you may have the right to ask us to correct inaccurate personal information we have collected about you (“Right to Correct”), and you may request that we limit use and disclosure of your sensitive personal information to that necessary for limited business purposes specified in the CCPA (“Right to Limit Use and Disclosure of Sensitive Personal Information”). These rights may be subject to certain exceptions as set forth in the CCPA. For example, we may deny a Right to Delete request when Union Pacific is required to retain your personal information to comply with our own legal obligations. When exercising your CCPA rights, Union Pacific will notify you of any exceptions or other reasons that require us to deny all or part of your request, unless prohibited from doing so by law. 

Union Pacific does not sell your personal information. However, as a California resident you may still make an opt-out request that Union Pacific not sell or share your personal information with third parties using the process described below. 

If your verifiable Request to Know includes a request to receive a copy of the specific pieces of personal information that we have collected about you in the last 12 months (or a specific subset of your information), we will seek to organize the personal information associated with you in file formats and categories that are easy to understand. We will contact you when the information is available to you.

How to Submit a Privacy Request

To exercise your individual rights set forth in this Privacy Policy, you can email Union Pacific at Privacy-Requests@up.com, call this toll-free number: 1-866-251-9185, or complete this intake form. 

Right to Know requests may be made up to two (2) times in a 12-month period. We will not charge a fee to process or respond to a verifiable  request. However, we have the right to charge for or decline any unfounded, excessive, or repetitive requests, in such cases we will inform you of our decision and, if applicable, provide you with a cost estimate before completing your request. 

Making a Request to Opt-Out of Sales or Sharing of Personal Information With Third Parties

Although we do not currently sell, as that term has been defined by applicable law, your personal information, if you would like to opt-out of any potential sale of your personal information, or would like to opt-out of sharing your with third parties (which does not include our permissible service providers or contractors), you can do so by submitting a request at  Privacy-Requests@up.com  or calling our toll-free number 1-866-251-9185.

We do not target users younger than age 18 and, therefore, do not knowingly collect or sell personal information of minors younger than 16 years of age without affirmative authorization

We do not target users younger than age 18 and, therefore, do not knowingly collect or sell personal information of minors younger than 16 years of age without affirmative authorization.

Verifying Requests

After submitting a request, we will take steps to verify your identity in order for us to properly respond and/or confirm that it is not a fraudulent request. In order to verify your identity, we will request, at a minimum, that you provide your name, email address, phone number, address, and relationship to UP, so that we can seek to match this information with the information existing in our systems. When providing us this information, you represent and affirm that all information provided is true and accurate. If we are unable to verify that the consumer submitting the request is the same individual about whom we have collected personal information, we may contact you for more information, or we may not be able to meet your request.

Only you, or someone legally authorized to act on your behalf, may make a verifiable request related to your personal information. You may designate an authorized agent to request any of the above rights on your behalf. You may make such a designation by providing the agent with written permission, signed by you, to act on your behalf.  Your agent may contact us as set forth in this Policy to make a request on your behalf.  Even if you choose to use an agent, as permitted by law, we may require verification of the agent’s authorization to act on your behalf, require you to confirm you have authorized the agent to act on your behalf, or require you to verify your own identity.

Response Timing

When you make a request to exercise your rights, we will typically provide our response within 45 days. We will notify you within that time period and provide an explanation if we need additional time (up to 90 days) to process your request. When you opt-out from the sale or sharing of your personal information with third parties, we will honor your request as soon as feasible, but no later than 15 days from the date we receive your request.

Additional Notice for Consumers in Connecticut, Colorado, Utah, and Virginia

This part of our Privacy Statement applies to consumers who reside in the states of Connecticut, Colorado, Utah and Virginia.

• Privacy Rights. Under applicable law, you may have the following rights, in each case under the conditions and to the extent set out in applicable law:

• Right of Access: A right to confirm whether UP is processing personal information about you, and to request to access such personal information (including, if applicable, in a portable and readily usable format).

• Right of Correction: A right to correct inaccuracies in certain personal information UP may hold about you; and

• Right of Deletion: A right to request that UP delete personal information concerning you. Please note that if you have requested a service that requires the use of your personal information, we may not be able to provide that service if you choose to delete your personal information.

If any of the above rights are available to you under applicable law, you can submit a request to exercise your rights by emailing UP at Privacy-Requests@up.com.

If your rights request is denied, applicable law may give you a right to lodge an appeal with us.  The response to your rights request will inform you of any appeal rights you may have, and tell you how you can exercise them.  

Notice for Consumers of Texas. 

This Texas notice uses certain terms that have the meaning given to them in the Texas Data Privacy and Security Act Notice of 2023.

What Are the Categories of Personal Information Collected?

We may collect or receive (and may have collected or received during the 12-month period prior to the Last Updated date of this Texas Notice) the categories of personal information listed below. Not all categories will be collected or received for every individual.

• Identifiers: Personal identifiers, such as name, telephone number, physical address, email address, national identification numbers, driver’s license numbers, and signatures.
• Device Information and Online Activity: Device and online identifiers, keystroke patterns indicative of human or bot website/app usage, mobile and web network activity and related information (such as Mac address, IP address, cookie IDs, browser activity, and other information associated with your browsing history), and social media information.
• Commercial Information: Purchase and transaction history information (such as products or services you have purchased, rented, or returned), health and safety-related information, product testimonials, travel and vacation information, and competition entries.
• Communications: Communication details (such as the content of emails, text messages, or other communications), call logs, and calendar information where Walmart is a party to the exchange.
• Demographic Information: Demographic information, such as age (including information about children under the age of 13 with respect to certain purchases and services [e.g., tobacco purchases]), gender, citizenship, ethnicity, date of birth, family or marital status, household income, education, professional and employment information, family health, number of children, number of cars owned, and software or virtual assets owned.

• Financial Information: Financial information, such as credit or debit card numbers, financial account numbers, and claims information.
• Biometric Information: Biometric information, such as voice prints, imagery of the iris or retina, face geometry, and palm prints or fingerprints.
• Geolocation: Location information, such as geolocation information.
• Sensory Information: Audio, visual information, and other sensory information such as photographs and audio and video recordings.
• Background Information: Background and criminal information, such as background checks and criminal convictions.
• Inferences: Individual preferences and characteristics, such as inferences related to shopping patterns and behaviors, intelligence, and aptitudes.
• Sensitive Personal Information: Personal data that reveals an individual’s racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexuality or citizenship or immigration status; genetic or biometric data that is processed for the purpose of uniquely identifying an individual; personal data collected from a known child; and precise geolocation. 

What Are the Purposes for Collecting Personal Information?

We may use your personal information for the purposes described in the How We Use Personal Information section above and as provided below:

• Performing services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytics services, providing storage, or providing similar services.
• Providing advertising and marketing services.
• To conduct auditing and monitoring of transactions and engagement, including auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance.
• Short-term, transient use, such as non-personalized advertising shown as part of your current interaction with us.
• Helping to ensure security and integrity and prevent fraud.
• Undertaking activities to verify or maintain the quality or safety of our services or devices and to improve, upgrade, or enhance them.
• Debugging to identify and repair errors.
• To conduct business analysis, such as analytics, projections, identifying areas for operational improvement.
• To conduct research and development, including undertaking internal research for technological development and demonstration.
• To fulfill our legal function or obligations.

We use sensitive personal information for each of the purposes described above and to make inferences about consumers, which we may use to promote certain products or services. Walmart does not process sensitive personal information without consent.

To the extent we process deidentified information, we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.

Sharing of Personal Information

We may share personal information with third parties for various purposes as described above in the Disclosure to Third Parties section. 

How Can You Exercise Your Texas Privacy Rights?

If you are a Texas resident, you can make certain requests regarding your personal information, and we will fulfill each request to the extent required by law. If we are unable to comply with your request in whole or in part, we will notify you with reasons for the denial. 

Texas residents can exercise the following rights by Privacy-Requests@up.com or calling our toll-free number 1-866-251-9185:

• Request to Access My Personal Information
• Correct My Personal Information
• Delete My Personal Information

• Opt Out of the Processing of My Personal Information for Purposes of Targeted Advertising
• Opt Out of the Sale of My Personal Information

Non-Discrimination for the Exercise of a Consumer’s Privacy Rights

Union Pacific will not discriminate against you for exercising your Privacy rights, including in terms of the price or services that we offer.

Questions

If you have any questions or concerns about Union Pacific’s Privacy Policy that are not requests, Union Pacific will attempt to answer any questions and you may contact us by email at Privacy-Requests@up.com  or mail us at:

Chief Privacy Officer
Union Pacific Railroad
1400 Douglas Street, MS 1580
Omaha, Nebraska  68179

Disability Accessibility

If you are a user with a disability, or an individual assisting a user with a disability, and have difficulty accessing or navigating our digital channels – including this Privacy Policy – please contact us at Privacy-Requests@up.com and we would be happy to assist.

Updates to this Privacy Policy

We may occasionally update this notice. We will temporarily post a notification to our customers and our public-facing websites when this privacy policy has material revisions. We also encourage users to periodically review this policy for the latest information on our privacy practices. After such notice, use of our services by users in countries outside the European Union will be understood as consent to the updates to the permitted by law.

Last Updated: July 1, 2023