Together School App Privacy Policy
Last Updated: January 27, 2026
Global Privacy Notice
As a provider of school transportation management solutions, the privacy and security of individuals about whom we process personal data is important to us. This Global Privacy Notice (“Notice”) explains how we manage and protect your personal data when you use our mobile application (“App”) or web-based services.
Our App is designed for use by schools, bus staff, and parents/guardians. We collect minimal personal data – primarily student names and stop locations provided by schools, bus location data for tracking, and optional information provided by parents such as child photos and absence notifications.
For most personal data we process, we act on behalf of schools and as directed by them. We recommend that you also review your school’s privacy notice.
This Notice tells you who we are, what data we collect, and what we do with it.
Who Are We?
Educe Mobile Ltd, trading as Together School (“Together School”, “we”, “us”), is a UK-registered company providing mobile and web-based school transportation management solutions for international schools worldwide.
Founded in 2015, we serve schools across Europe, Middle East (including the UAE), Africa (including Kenya, South Africa, and Zambia), and India. Our services help schools manage bus routes, enable real-time tracking for parents, and streamline transportation operations.
Company Details:
Educe Mobile Ltd
Company Registration: England and Wales
Contact: privacy@togetherschool.com
What Data Do We Collect?
We collect minimal personal data necessary to provide our school transportation services. The data we process falls into the following categories:
Data Provided by Schools
Schools provide us with the following information to set up transportation services:
• Student names
• Bus stop locations (pickup and drop-off points)
• Route assignments
We do not collect student dates of birth, contact details, or other personal information directly through the App.
Data Provided by Parents/Guardians
Parents and guardians may optionally provide the following through the App:
• A photo of their child (to help bus staff identify students)
• Absence notifications (including the date and reason for absence)
This information is provided voluntarily by parents to facilitate safe and efficient transportation services.
Location Data (Bus Staff Devices)
We collect real-time location data from mobile devices used by bus staff during transportation operations. This data is used to:
• Enable parents to track the location of their child’s school bus
• Provide estimated arrival times
• Support route optimization and safety monitoring
Location tracking occurs only during active transportation periods and is associated with the bus/route, not with individual staff members’ personal movements.
Device and Technical Information
When you use our mobile App, we may collect:
• Push notification tokens (if you enable notifications for bus arrival alerts)
• Basic device information for App functionality and troubleshooting
Notification Data
When schools or administrators send notifications through our platform, we collect:
• Delivery status (whether the notification was received by your device)
• Read status (whether the notification was opened)
• Response data (where applicable, a simple Yes/No response to the notification)
This information helps schools confirm that important communications have been received and allows them to follow up when necessary.
How and Why Do We Use Your Data?
The purposes for which we use data about you, with corresponding legal basis for processing, are set out below:
| Purpose | Legal Basis |
| Displaying student names and stop locations for transportation management | Performance of contract with school; Legitimate interest in child safety |
| Real-time bus location tracking (bus staff device) | Performance of contract; Legitimate interest in providing safe transportation |
| Storing child photos (uploaded by parents) | Parental consent; Legitimate interest in child safety and identification |
| Recording absence notifications from parents | Parental consent; Performance of contract |
| Push notifications for bus arrival alerts | User consent |
| Tracking notification delivery, read status, and responses | Legitimate interest in ensuring important communications are received |
| Service improvement and troubleshooting | Legitimate interest in improving services |
Who Do We Share Your Data With?
We share data only as necessary to provide our services:
Your School
As your school’s service provider, we share relevant transportation data with school administrators. Schools can view student lists, route assignments, absence notifications, and bus tracking information.
Third-Party Service Providers
We use the following types of service providers who may process data on our behalf:
• Cloud hosting providers (for secure data storage)
• Mapping services (Google Maps) for route display and tracking
All third-party providers are contractually bound to protect your data and use it only for the purposes we specify.
We Do Not Sell Your Data
We do not sell, rent, or trade personal data to third parties for marketing or any other purposes.
Legal Requirements
We may share data where required by law, regulation, or legal process, or where necessary to protect the safety of users.
International Data Transfers
As we serve schools globally across Europe, Middle East, Africa, India, and the Americas, and use cloud infrastructure, your data may be transferred internationally. We ensure appropriate safeguards are in place for such transfers:
• For transfers from the EU/EEA: We rely on European Commission adequacy decisions or Standard Contractual Clauses (SCCs)
• For transfers from the UK: We comply with UK GDPR requirements and use UK-approved transfer mechanisms
• For transfers from India: We comply with cross-border transfer requirements under the DPDPA 2023
• For transfers from the UAE: We comply with UAE data transfer requirements and ensure adequate protection levels
• For transfers from South Africa: We comply with POPIA requirements for cross-border transfers
• For transfers from Kenya: We ensure compliance with the Data Protection Act cross-border provisions
• For transfers from Zambia: We comply with the Data Protection Act requirements for international transfers
Our primary cloud infrastructure is hosted in the EU (Ireland), with regional hosting options available for schools in the Middle East and Africa to minimize data transfer distances and comply with local requirements.
How Do We Protect Your Data?
We implement appropriate technical and organisational measures to protect personal data from unauthorised disclosure, use, alteration, or destruction:
Application Security
Traffic encryption (TLS/SSL), strong password hashing, protection against common vulnerabilities (XSS, SQL injection, CSRF).
Network Security
Firewalls, intrusion detection systems, and DDoS protection.
Organisational Security
Access controls, audit logs, confidentiality agreements, and staff training.
Data Minimisation
We only collect and retain data necessary for the purposes described in this Notice.
How Long Do We Keep Your Data?
We retain personal data only for as long as necessary:
• Student names and route assignments: Retained while the school’s contract is active, deleted within 90 days of contract termination
• Child photos: Retained until deleted by parent or end of school contract
• Absence records: Retained for the current academic year
• Bus location data: Real-time only; historical tracking data retained for up to 30 days for operational purposes
• Notification records (delivery, read status, responses): Retained for the current academic year
When a school terminates their contract, we will delete all personal data within 90 days unless legal retention requirements apply.
What Are Your Rights?
Depending on your location, you may have the following rights regarding your personal data:
• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your data in certain circumstances
• Restriction: Request that we limit how we use your data
• Portability: Request a copy of your data in a structured, machine-readable format
• Objection: Object to our processing of your data in certain circumstances
• Withdraw Consent: Where processing is based on consent, you may withdraw it at any time
• Opt-out of Marketing: Unsubscribe from marketing communications at any time
To exercise these rights, contact us at privacy@togetherschool.com. As we process most data on behalf of your school, we may direct your request to your school for handling.
Children’s Privacy
Our services are designed for use by schools, and we process student data solely as directed by schools. We do not knowingly collect personal data directly from children under 16 without parental consent or school authorization.
Schools are responsible for obtaining appropriate consents from parents/guardians for the processing of student data through our services. If you believe we have inadvertently collected data from a child without appropriate authorization, please contact us immediately.
Location Data
Our App collects location data in the following specific circumstances:
Bus Staff App – Background Location
The bus staff version of our App collects location data from the device carried on the school bus. This enables real-time bus tracking for parents and school administrators. Key points:
• Location is tracked only during active transportation periods
• The location represents the bus position, not personal movements of individual staff
• Bus staff consent to location tracking as part of their role
• Location data is used solely for transportation safety and providing arrival estimates to parents
Parent App – No Location Collection
The parent version of our App does not collect or track the location of parents’ devices. Parents can view the bus location but their own location is not collected.
App Permissions
Our App requests the following permissions:
Bus Staff App:
• Location (including background): Required for real-time bus tracking functionality
• Notifications: To receive route and schedule alerts
Parent App:
• Notifications: To receive bus arrival alerts and transportation updates
• Camera/Photo Library (optional): Only if you choose to upload a photo of your child
• Storage (optional): To cache data for faster loading
Location permission is not required or requested for the parent App.
How to Contact Us
If you have any questions about this Notice or wish to exercise your rights, please contact:
Data Protection Contact
Email: privacy@togetherschool.com
Address: Educe Mobile Ltd, United Kingdom
If you are not satisfied with our response, you have the right to lodge a complaint with a supervisory authority. For UK residents, this is the Information Commissioner’s Office (ICO):
Website: www.ico.org.uk
Telephone: +44 0303 123 1113
Changes to This Notice
We may update this Notice from time to time. We will notify you of significant changes through the App or by email. We encourage you to review this Notice periodically.
Additional Rights for California Residents
If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights regarding your personal information:
• Right to Know: What personal information we collect, use, and disclose
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Of the sale of personal information (we do not sell personal information)
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights
To exercise these rights, contact us at privacy@togetherschool.com.
US Education Privacy Compliance
For schools in the United States, we comply with applicable student privacy laws including:
FERPA (Family Educational Rights and Privacy Act)
We act as a “school official” under FERPA and process student education records solely as directed by schools for legitimate educational purposes.
COPPA (Children’s Online Privacy Protection Act)
We rely on schools to obtain verifiable parental consent for the collection of personal information from children under 13, consistent with COPPA’s exception for school-authorized educational purposes.
Regional Data Protection Compliance
We operate globally and comply with applicable data protection laws in each jurisdiction where we provide services:
India – Digital Personal Data Protection Act 2023 (DPDPA)
For users in India, we comply with the Digital Personal Data Protection Act 2023:
• We process personal data only for lawful purposes with valid consent or other lawful grounds
• We provide notice of data collection in clear, plain language
• You have the right to access, correct, and erase your personal data
• You have the right to nominate another person to exercise your rights in the event of your death or incapacity
• You may lodge grievances with our Grievance Officer or the Data Protection Board of India
• For children under 18, we rely on verifiable parental consent obtained through schools
Grievance Officer (India):
Email: grievance@togetherschool.com
United Arab Emirates – Federal Decree-Law No. 45 of 2021
For users in the UAE, we comply with the UAE Personal Data Protection Law:
• We process personal data only with consent or other legitimate legal basis
• We implement appropriate security measures to protect personal data
• You have the right to access, rectify, restrict processing, and request erasure of your data
• You have the right to object to automated decision-making
• Cross-border transfers are conducted in compliance with UAE data protection requirements
• We do not process sensitive personal data (religious beliefs, health data, biometrics) except as strictly necessary and with appropriate safeguards
South Africa – Protection of Personal Information Act (POPIA)
For users in South Africa, we comply with POPIA:
• We process personal information lawfully and in a reasonable manner that does not infringe your privacy
• We collect personal information for specific, explicitly defined, and lawful purposes
• You have the right to request access to and correction of your personal information
• You have the right to request deletion of your personal information
• You have the right to object to processing of your personal information
• You have the right to lodge a complaint with the Information Regulator
Information Regulator (South Africa):
Website: www.justice.gov.za/inforeg
Email: inforeg@justice.gov.za
Kenya – Data Protection Act 2019
For users in Kenya, we comply with the Kenya Data Protection Act:
• We process personal data fairly, lawfully, and in a transparent manner
• We collect personal data for explicit, specified, and legitimate purposes
• You have the right to be informed of the use of your personal data
• You have the right to access, rectify, and delete your personal data
• You have the right to object to processing and to data portability
• You have the right to lodge a complaint with the Office of the Data Protection Commissioner
Office of the Data Protection Commissioner (Kenya):
Website: www.odpc.go.ke
Zambia – Data Protection Act 2021
For users in Zambia, we comply with the Zambia Data Protection Act:
• We process personal data lawfully, fairly, and transparently
• We ensure personal data is accurate and kept up to date
• You have the right to access your personal data held by us
• You have the right to rectification of inaccurate personal data
• You have the right to erasure of your personal data in certain circumstances
• You have the right to lodge a complaint with the Data Protection Commissioner
• Cross-border transfers comply with Zambian data protection requirements