Privacy Statement

Our Commitment to You

Kansas City Southern (“KCS”), acting through its U.S.- and Mexico-based affiliates and subsidiaries¹, is firmly committed to protecting the privacy and personal information of individuals who visit our website, use our services, apply for/obtain a job with us, or collaborate as business partners with us. This Privacy Statement, which is accessible from every page on our site, describes the types of personal information that is collected, our use of that information, and our data security practices. Personal information collected by KCS is used for internal business purposes only; KCS does not sell or lease any individual’s personal information for compensation. Further, KCS does not divulge personal information to any party other than KCS’s affiliates and subsidiaries, service providers, and other third parties except as necessary to help run our business.

Public Website Traffic Information

General Disclosures

In general, you can visit KCS’s website on the Internet (www.kcsouthern.com) without telling us who you are or revealing any personally identifiable information about yourself. KCS may automatically process and use some technical data such as cookies, web beacons, tracking pixels, and/or Internet Protocol (IP) addresses to collect information regarding use of our site; however, this processing only identifies a company name and will not be used to identify an individual.

For certain pages on our site, our web servers also may collect visitors’ domain names, geo-locations (city and country), device information, gender, age, language, and email addresses. We collect this information to improve and personalize our site’s content and functionality as well as to better understand how and where site visitors are using our content and applications. This information is compiled to measure the number of visits, average time spent on the site, pages viewed, and similar non-individualized and non-identifying information. KCS then uses this information to improve user experience. Users may change their options through their computer setup and/or browser by refusing to accept cookies and/or web beacons, or by indicating whether or not to accept cookies and/or web beacons. Our site does not treat browsers with a “Do Not Track” signal differently from those without one.

Google Analytics

Our website (www.kcsouthern.com) uses Google Analytics, a web analysis service of Google, Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA, www.google.com (“Google Analytics” or “Google”). Google Analytics employs cookies that are stored to your computer in order to facilitate an analysis of your use of the site. The information generated by these cookies, such as time, place, and frequency of your visits to our site, including your IP address, is transmitted to Google’s location in the US and stored there.

In using Google Analytics, our website employs the extension “anonymizeIp.” In doing so, Google abbreviates and thereby anonymizes your IP address before transferring it from EU/EEA member states. Google uses this information to analyze your use of our site, to compile reports for us on internet activity, and to provide other services relating to our website.

Google may also transfer this information to third parties where required to do so by law or where such third parties process this data on Google’s behalf. Google states that it will never associate your IP address with other data held by Google. You can prevent cookies from being installed by adjusting the settings on your browser software accordingly as noted elsewhere in this Privacy Statement. You should be aware, however, that by doing so you may not be able to make full use of all the functions of our website.

Google Analytics also offers a deactivation add-on for most current browsers that provides you with more control over what data Google can collect on the websites you access. The add-on tells the JavaScript (ga.js) used by Google Analytics not to transmit any information about website visits to Google Analytics. However, the browser deactivation add-on offered by Google Analytics does not prevent information from being transmitted to us or to other web analysis services we may engage.

Google Analytics also uses electronic images known as web beacons (sometimes called single pixel gifs) that are used along with cookies to compile aggregated statistics to analyze how our site is used.

You can find additional information on how to install the browser add-on referenced above at the following link: https://tools.google.com/dlpage/gaoptout?hl=en. For the cases in which personal data is transferred to the US, Google has self-certified pursuant to the EU-US Privacy Shield (https://www.privacyshield.gov/EU-US-Framework).

Collection of Personal Information

In addition to the website traffic information described above, limited personal information about you may be requested and collected for business-related purposes as you use our website and other online tools and secured applications. This personal information is necessary for KCS to process employment applications, provide requested services, respond to information requests, and validate authorization to grant access to specific account information. This section of the Privacy Statement explains in further detail what, how, and why personal information is collected.

What Is Collected

The types of information, including personal information, that KCS may collect include but are not limited to the following:

• Basic identification information such as names and surnames, prefixes, gender, place and date of birth, social security number, nationality/ethnicity, marital status, citizenship status, veteran status, disability status, and limited medical information obtained for employment-related purposes.
  • If you are an employee, such basic identification information may also be collected directly from you on your dependents and/or beneficiaries for the purposes of offering or providing employee benefits. 
• Work Information including position, work address, institutional phone and email, work history, and educational history.
• Biometric Information including fingerprints, hand scans, or other unique biological information.
• Contact Information including official identity documents, telephone number, email address, and mailing address.
• Financial Information including banking or credit information and, for legally-required wage-withholding purposes, outstanding garnishments and child-support orders.
• Device Information such as device type, operating system, location, and time of access information.
• Marketing Information such as business contact information and other analytics.
• Account Registration Information such as names/usernames, addresses, phone numbers, and other business contact information.
• Transaction Information such as transaction and customer numbers, shipping information, rates, contracts, and payment information.

How It is Collected

For the purposes described in this Privacy Notice, the information described above (including personal information) is collected when:

• You provide this information to KCS directly (including verbally, electronically, and/or in writing);
• You contract for any service from us, whether by the exchange of physical or electronic documents or remotely through any existing communication system;
• You enter your information to register or obtain a username for MyKCS applications or use online services via our internet portal or through our Salesforce or MCS applications;
• We receive your information from a third party; and/or
• We obtain your publicly available information from other sources as permitted by law (e.g., telephone or professional directories).

Why It Is Collected

The collected information described above, including that which is personal information, will or may be used to:

• Respond to inquiries for information about our company;
• Prepare estimates for services;
• Provide requested/contracted services;
• Evaluate and improve the quality of our services, including by performing analysis, research, and development;
• Inform you/your business of changes or new services that are related to the services that have been contracted/acquired;
• Comply with contractual obligations;
• Comply with federal, state, and local laws, including transport and customs regulations;
• Grant access to certain KCS premises for fulfillment of services;
• Follow up on, update, and confirm contracted services;
• Ensure care, custody, and protection of customers’ freight;
• Extend invitations to attend company events or participate in company surveys;
• Handle insurance matters;
• Process claims related to the provision of our contracted services;
• Issue, send, and deliver billing invoices/payments;
• Satisfy financial and credit purposes or obligations;
• Maintain contact information for communications, notices, and notifications;
• Make our website more intuitive and easy to use;
• Protect the security and effective functioning of our website and information resources;
• Screen and select applicants for employment; and/or
• Accomplish purposes or obligations pertaining to employment with the company (for example, benefits administration and payroll).

By providing information directly to KCS, whether personal information or otherwise, you are representing that such information is true and accurate and are also consenting to such information being used for the purposes outlined in this Privacy Statement, as applicable. It shall be your responsibility to communicate to KCS any significant changes to such information, with “significant” being understood as any change to the information that would impede the correct contact, source, location, or subject of that information from being identified or hinder KCS’s use of the information for the business purpose(s) for which it was provided. By providing your personal information to KCS you are consenting to our use of such information for the business purpose for which it was provided, unless and until you object to the processing of such information pursuant and subject to the terms of this Privacy Statement.

Data Security

KCS has adopted the National Institute of Standards and Technology’s (NIST) Cybersecurity Framework and other NIST standards and guidelines to fulfill our obligation of security to our customers, employees, and applicable laws and regulations. To prevent unauthorized access, maintain data accuracy, and ensure the correct use of information, KCS has implemented and/or contracted for appropriate physical, technical, and administrative controls to safeguard and secure the information (including personal information) that is collected through our website, online tools/applications, and other methods. This includes security measures to protect against the loss, misuse, and alteration of the personal information under our control. However, it should be noted and acknowledged that no security measures are always effective. KCS therefore does not guarantee the performance or adequacy of any such security measures. Individuals who provide their personal information to KCS do so accepting that we do not have any control over and will be not be responsible for the links to other pages, portals, etc., of third parties not associated with KCS that may appear on www.kcsouthern.com. The inclusion of any third-party link does not imply our endorsement of the external site company, its website, or the products and services it promotes or sells. We are not responsible or liable for the independent privacy policies of these third-party sites. You should consult the privacy policies at these sites to determine how your information may be used and whether these third-party sites are or may be tracking your personal information across sites/services and over time.

Your Access to/Control over Your Personal Information

Under certain applicable privacy and data protection laws, and subject to certain limitations, you may be able to access and/or have some control over your own personal information that is maintained by KCS. As a company, we are committed to protecting your data privacy and have provided the following information about your potential rights under applicable law and, if available, how to exercise your rights:

Disclosure of Personal Information We Collect About You

• You may have the right to know:
  • The categories of personal information we have collected about you, if any;
  • The categories of sources from which such personal information is collected;
  • Our business or commercial purpose for collecting personal information, if any;
  • The categories of third parties with whom we share personal information, if any (again, KCS does not sell anyone’s personal information); and
  • The specific pieces of personal information we have collected about you.
• Please note that we are not required to:
  • Retain any personal information about you that was collected for a single one-time transaction if, in the ordinary course of business, that information about you is not retained;
  • Re-identify or otherwise link any data that, in the ordinary course of business, is not maintained in a manner that would be considered personal information;
  • Provide the personal information to you more than twice in a 12-month period; or
  • Otherwise respond to your request for disclosure and/or deletion of your personal information when not obligated to do so under applicable law.

Disclosure of Personal Information Sold or Used for a Business Purpose

• In connection with any personal information that we disclose to a third party for a business purpose, you may have the right to know:
  • The categories of personal information about you that we disclosed, if any; and
  • The categories of third parties to whom any such personal information was disclosed.

Right to Deletion

• After submitting a verifiable request to KCS, and subject to certain exceptions set out below, you may have the right to have KCS:
  • Delete your personal information from our records, if any; and
  • Direct any service providers to delete your personal information from their records.

• Please note that KCS may not delete your information (including personal information) if it is necessary to:
  • Complete the transaction for which such information was collected, provide a service either requested by you or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between you and us;
  • Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for such activity;
  • Debug in order to identify and repair errors that impair existing intended functionality of software, applications, or other technology tools;
  • Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law;
  • Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when our deletion of the information is likely to render impossible or seriously impair the achievement of such research, provided we have obtained your informed consent;
  • Enable solely internal uses of such information that are reasonably aligned with your expectations based on your business relationship with us;
  • Comply with an existing legal obligation or applicable law; or
  • Otherwise use your personal information, internally, in a lawful manner that is compatible with the context in which you provided the information.

Protection Against Discrimination

• If and as provided under applicable privacy and data protection laws, you have the right to not be discriminated against by us because you exercised any of your rights. In such cases, KCS will not, based solely upon your decisions and elections regarding personal information:
  • Deny goods or services to you;
  • Charge different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties;
  • Provide a different level or quality of goods or services to you; or
  • Suggest that you will receive a different price or rate for goods or services or a different level or quality of goods or services.
• As noted in this Privacy Statement, your information (including personal information) may be required as necessary to provide a rate and perform transportation or other services.

How to Contact Us

For inquiries regarding this Privacy Statement, to request exercise of any of the potentially applicable rights outlined herein, to remove or change your contact information in our database, or to opt out of receiving future mailings or other communications from us (e.g., promotions, offers, or services), as well as for all other inquiries, please contact us at any time using one of the options below:

United States Residents: Via email to webmaster@kcsouthern.com, by conventional mail to The Kansas City Southern Railway Company, PO Box 219335, Kansas City, MO 64121-9335, or by calling toll-free (800)-243-8624.

United Mexican States Residents: Via email to datospersonales@kcsouthern.com.mx or by conventional mail sent to Montes Urales No. 625, Colonia Lomas de Chapultepec, Alcaldía Miguel Hidalgo, C.P. 11000, Ciudad de México, to the attention of “Department of Personal Information.”

Verifying Your Identity:

If you choose to contact us directly by email, mail, or phone to make either a personal-information disclosure or deletion request, you will need to provide us with:

• Enough information to identify you including:
  • Your full name,
  • Mailing address,
  • Email address,
  • Phone number, and
  • Contract, account, customer, or other matter reference number (if applicable).
• Proof of your identity (e.g., a copy of your driver's license or passport and a recent utility or credit card bill or KCS transaction information); and
• A description of what potentially applicable right that you wish to exercise (e.g., disclosure or deletion rights) and the personal information to which your request relates.

We are not obligated to make a data access or data portability disclosure if we cannot verify that the person making the request is the person about whom we collected information, or is someone authorized to act on such person's behalf.

Any personal information we collect from you to verify your identity in connection with your request will be used solely for the purposes of verification.

Timing of Our Response 

When you make a personal information disclosure or deletion request as set forth above, we will typically provide our response within 45 days. However, we will notify you within that time period and provide an explanation if we need additional time (up to 90 days) to process your request.

Data Transfer—Locally and Internationally

KCS’s website is controlled and operated by us from within the United States of America and the United Mexican States and is not intended to subject KCS to the laws or jurisdiction of any other state, country, or territory. By providing KCS with information (including personal information) for the business purposes outlined in this Privacy Statement, you are acknowledging that such information may potentially be transferred by KCS to businesses that may host, store, process, or access this information outside of your country of residence where data protection rules are different from those of your country. By submitting your personal information, you agree to this transfer, storing, and/or processing of your information. KCS takes steps that are reasonably necessary to ensure that your personal information is treated securely by us in accordance with this Privacy Statement as well as all applicable data protection laws. In certain circumstances, and notwithstanding the data-protection provisions that KCS has contracted for, courts, law enforcement agencies, regulatory agencies, and/or security authorities in those other countries may be entitled to access your personal information from these third-party companies, which you signify your understanding and acknowledgement of by submitting your personal information to KCS.

Special Provisions for Residents of United Mexican States

“ARCO Rights”: 

Pursuant and subject to the Ley Federal de Protección de Datos Personales en Posesión de Paticulares (Federal Law on the Protection of Personal Information in the Possession of Civil Parties), published in the Official Federal Gazette on July 5, 2010, as amended (“the Law”), you have certain “ARCO Rights” to:

• ACCESS – Access your Personal Information in our possession and know the details of the Treatment of your Personal Information;
• RECTIFY – Rectify your Personal Information in the event such information is inaccurate or incomplete;
• CANCEL – Have KCS cancel or delete your Personal Information when you believe this information is not necessary for any of the purposes laid out in this Privacy Statement or is being used for purposes for which you have not given your consent; and
• OBJECT – Object to the treatment of your Personal Information for specific purposes, which you are required to express clearly.

Mechanisms for Exercising ARCO Rights: 

The ARCO Rights described previously are exercised by presenting the respective request in writing and in Spanish, free of charge, as described in this Privacy Statement in the section How to Contact Us. We will respond within 20 (twenty) days of receiving your request to access, know, rectify, cancel, or object. This with the understanding that—under Article 3, section VII of the Law—the terms and times given in this Privacy Notice will be counted in business days. In addition, we hereby inform you that the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (Federal Institute for Transparency, Access to Information and the Protection of Personal Information) is responsible for protecting your ARCO rights and regulates and verifies compliance with the Law.

Transfer of Personal Information:

Your Personal Information will not be transferred to any third party without your consent, except in the cases provided by Article 37 of the Law, and except when the Personal Information is transferred to Kansas City Southern de México, S.A. de C.V., Nafta Rail, S.A. de C.V., Arrendadora KCSM, S. de R.L. de C.V., Vamos a Mexico, S.A. de C.V., Servicios Puerta México, S. de R.L. de C.V., Kansas City Southern, The Kansas City Southern Railway Company, The Texas Mexican Railway Company (Tex Mex), or any other subsidiary, affiliate, of member of Kansas City Southern. Your consent will be understood if you do not express your objection to your information being transferred.

Special Notifications for U.S. Residents

Protection of Children’s Privacy:  In compliance with the Children's Online Privacy Protection Act, 15 U.S.C., §§ 6501-06 and 16 C.F.R., §§ 312.1-312.12, this site does not intentionally or knowingly collect information from persons under 18 years of age. If we determine or are notified that we have collected such information, we will immediately purge such information. By using our site, you represent that you are 18 years of age or older.

Notice to California Residents:  If you are a California resident, California law may provide you with certain rights with respect to your personal information. To learn more about your California privacy rights, visit https://oag.ca.gov/privacy/privacy-laws. If you believe that any such rights identified by law or in this Privacy Statement are applicable to you, and you wish to exercise such rights, please submit a verifiable request as set forth above in How to Contact Us.

Changes To This Privacy Statement

We reserve the right to update this Privacy Statement from time to time as our business (including privacy and security practices) changes, or as required by law. Any changes to this Privacy Statement will be made available to the public by any or all of the following means: announcements placed at our establishments, via our website, by email sent to the most recent address we have for you, by publications in national newspapers, magazines, posters, audio recordings, or in person via our staff when you visit any of our facilities.

The effective date of this Privacy Statement is provided below, and we encourage you to visit our site periodically to stay informed about our privacy and security practices.

Effective Date

This Privacy Statement was last updated on July 19, 2021.

 

¹For U.S. residents: Kansas City Southern and its U.S.-based affiliates and subsidiaries, together with its Mexico-based affiliates and subsidiaries, are collectively referred to herein as “KCS,” “we,” or “us” and, are responsible, respectively, for the gathering, use, access, handling, transfer or transmission, release, or storage of your personal information as described in this Privacy Statement.

For United Mexican States residents: At the holding address of Montes Urales No. 625, Colonia Lomas de Chapultepec, Alcaldía Miguel Hidalgo, C.P. 11000, Ciudad de México, the following entities:

• Kansas City Southern de México, S.A. de C.V. (KCSM),

• Nafta Rail, S.A. de C.V. (NAFTA),

• Arrendadora KCSM, S. de R.L. de C.V. (AKCSM),

• Vamos a Mexico, S.A. de C.V. (VM), and/or

• Servicios Puerta México, S. de R.L. de C.V. (SPM),

together with Kansas City Southern and its U.S. affiliates and subsidiaries, are collectively referred to as “KCS,” “we,” or “us” and are responsible, respectively, for the “Treatment”—gathering, use, access, handling, transfer or transmission, release, or storage—of your “Personal Information,” as such terms are described in this Privacy Statement and/or defined in the Ley Federal de Protección de Datos Personales en Posesión de Particulares (Federal Law on the Protection of Personal Information in the Possession of Civil Parties), published in the Official Federal Gazette on July 5, 2010, as amended.