Privacy Policy

This Privacy Policy explains how Yellow Bus ("we", "us", "our", "the platform") collects, uses, stores, and protects personal data when you use our school bus tracking service, whether through this website, our dashboard, or our Driver and Parent mobile apps.

We process personal data in accordance with Kenya's Data Protection Act, No. 24 of 2019 ("the Data Protection Act"). See our Data Protection Act statement for a link to the full text of the Act and an overview of how it applies to this platform.

Information we collect

What we collect depends on your role on the platform:

• Parents: your name, phone number, email, home address, payment/wallet information for bus fare or subscription billing, and your children's names, school, photos (used for driver identification at pickup/drop-off), and designated-guardian details for anyone else authorised to collect your child.
• Children: name, school, photo, and journey data — real-time bus location while your child's trip is active, check-in/check-out timestamps, and attendance/absence records. We do not knowingly collect more information about a child than is needed to run the school transport service safely.
• Drivers: your name, phone number, photo, driving/compliance documents, and GPS location while a trip is active.
• Van owners: your name, contact details, vehicle information, and compliance documents (e.g. insurance, inspection certificates).
• School administrators: your name, email, phone number, and login credentials.
• Device and usage data: basic technical information (device type, app version, IP address) needed to operate and secure the service.

Why we collect it

We use this information to:

• Provide live bus tracking, arrival estimates, and check-in/check-out confirmations to parents and schools
• Verify a child's identity at pickup and drop-off, including via a designated guardian's photo/badge where enabled
• Notify parents and drivers of trip status, delays, and safety incidents
• Process fare payments and manage wallet balances or subscription billing
• Verify driver and van owner compliance documentation
• Maintain the security and proper functioning of the platform
• Meet our own legal, safety, and record-keeping obligations

We do not sell personal data, and we do not use children's data for advertising or marketing.

Who we share it with

Location, journey, and check-in/check-out data for a child is visible to that child's own parent/guardian and to the driver and school operating that route — never to other parents or unrelated schools. We share data with third-party service providers only where necessary to operate the platform (for example, SMS gateways to deliver verification codes and alerts, payment gateways to process fares and subscriptions, and mapping providers to render live tracking). These providers are only given the data needed to perform their specific function.

We may disclose personal data where required by Kenyan law or a valid order from a competent authority.

Your rights under the Data Protection Act

As a data subject, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request erasure of your data, subject to any legal or safety record-keeping obligations we must still meet
• Object to certain processing of your data
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe your rights have been infringed

Parents and van owners using our mobile apps can request a copy of their data or submit an account/data deletion request directly from the app's Settings → Privacy section. School administrators or other users can exercise these rights by contacting their school, who can reach us using the contact details published on this platform.

Children's data

This platform is built to help schools and parents keep children safe during school transport, which necessarily involves processing children's personal data (including location and photos). This processing is carried out on the basis of the school's and parent's legitimate interest in child safety and the contractual relationship between the school and the parent, and we apply extra care to this data: it is only ever shown to the child's own parent/guardian and the driver/school operating their route, and photos are only used for pickup/drop-off identification.

Data retention

We retain personal data only for as long as needed for the purposes described in this policy, or as required by law. Operational and safety logs (such as trip and check-in records) are retained for a limited period to support safety review and dispute resolution, after which they are periodically deleted or anonymised.

Data security

We apply reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, including access controls, encrypted transmission of sensitive data, and restricting data visibility to only the people who need it (a parent's own children, a driver's own route, a school's own users).

Cookies

Our web dashboard uses only the cookies necessary to keep you securely logged in. We do not use advertising or third-party tracking cookies.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to the platform or to applicable law. We will post the updated policy here with a revised effective date.

Contact us

If you have questions about this Privacy Policy or how your data is handled, please contact your school administrator, or reach us using the contact details published on this platform's website.