KidKommute Privacy Policy
Last updated: March 3, 2026
KidKommute ("we", "our", "us") is a school transportation management platform operated by KidKommute (Pty) Ltd, registration number: [Registration Number], based in South Africa. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information in compliance with the Protection of Personal Information Act 4 of 2013 (POPIA) of South Africa. We are committed to protecting your privacy and ensuring the security of your personal information.
Account Information: Full name, email address, phone number, and encrypted password when you create an account.
Child Information: Child's name, date of birth, school, grade, pickup and drop-off addresses, and medical information (allergies, medical conditions, emergency contacts, medications) voluntarily provided by parents/guardians.
Operator Documents: Driver's license, ID document, vehicle registration details, Professional Driving Permit (PDP), insurance documentation, proof of residence, and vehicle inspection certificates.
Real-time GPS Location: Precise location data from operators' devices only during active school transport trips.
Payment Records: Subscription payment information processed through Apple In-App Purchase (IAP) for iOS users and PayFast for Android users.
Device Information: Device type, operating system, unique device identifiers, push notification tokens, IP address, and app usage analytics collected via Google Firebase.
Camera and Photo Library: Profile photos, compliance document images, and digital signatures captured or uploaded for verification purposes.
We use your personal information for the following purposes:
• To provide real-time GPS tracking of school transport vehicles to parents/guardians;
• To send push notifications for pickup, drop-off, and emergency alerts;
• To verify operator credentials and vehicle documentation for safety compliance;
• To manage transport contracts between parents and operators;
• To process subscription payments through Apple IAP and PayFast;
• To facilitate secure in-app communication between parents and operators;
• To respond to emergency situations with panic alert functionality;
• To generate transport reports, attendance records, and invoices;
• To maintain child medical information for emergency situations;
• To improve our services and develop new features.
We process your personal information based on the following lawful grounds under POPIA:
• Consent: For medical information and location tracking, we obtain explicit consent from parents/guardians;
• Contractual Necessity: To provide the services you have requested (transport tracking, notifications, etc.);
• Legal Obligation: To comply with South African transport regulations and safety requirements;
• Legitimate Interests: To ensure child safety, prevent fraud, and improve our services;
• Vital Interests: To protect the life and safety of children in emergency situations.
We share personal information only as necessary and with appropriate safeguards:
• Parents see Operator Location: Real-time GPS location of operators is shared only with parents of children assigned to that specific route during active trips;
• Operators see Assigned Children's Details: Operators can view names, pickup/drop-off locations, and medical information only for children assigned to their route;
• Payment Processors: Payment information is processed through Apple IAP (iOS) and PayFast (Android) - we do not store credit card details;
• Data Storage: All data is stored securely on Google Firebase with appropriate access controls;
• Emergency Services: Location and child information may be shared with emergency services if a panic alert is activated;
• Legal Requirements: We may disclose information when required by South African law or legal proceedings.
KidKommute is designed to protect children's privacy:
• We only collect information about children from their parents or legal guardians;
• Children's information is accessible only to authorized parents/guardians and assigned operators;
• We do not knowingly collect information directly from children under 18;
• Parents/guardians can review, update, or delete their children's information at any time;
• Medical information is stored securely and used only for emergency situations.
We implement robust security measures to protect your personal information:
• SSL/TLS Encryption: All data transmission is encrypted using HTTPS/TLS protocols;
• Encrypted Passwords: User passwords are hashed and salted using industry-standard algorithms;
• Firebase Security Rules: Role-based access controls and security rules on Google Firebase;
• Access Controls: Strict role-based permissions within the application;
• Regular Security Audits: Periodic security assessments and vulnerability testing;
• Employee Training: All staff are trained on POPIA compliance and data protection.
We retain personal information only as long as necessary:
• Active accounts: Retained while account is active and for 12 months after deactivation;
• Trip and location data: Retained for 6 months for reporting and dispute resolution;
• Financial records: Retained for 5 years as required by South African tax law;
• Operator documents: Retained for 2 years after contract termination;
• Medical information: Retained while child is using the service and deleted upon account closure;
• All data is securely deleted or anonymized after retention periods expire.
As a data subject under POPIA, you have the following rights:
• Right of Access: Request a copy of the personal information we hold about you;
• Right to Correction: Request correction of inaccurate or incomplete information;
• Right to Deletion: Request deletion of your personal information (subject to legal requirements);
• Right to Object: Object to the processing of your personal information;
• Right to Restrict Processing: Request restriction of processing in certain circumstances;
• Right to Data Portability: Receive your personal information in a structured, commonly used format;
• Right to Withdraw Consent: Withdraw consent for processing where consent was the legal basis.
The KidKommute app requests access to:
• Camera: To capture profile photos, compliance documents, and digital signatures for verification;
• Photo Library: To upload existing photos of documents or profile pictures;
• Usage: Photos are used solely for account verification and safety purposes;
• Storage: All photos are stored securely on Firebase with restricted access;
• Permissions: You can deny camera/photo access, but this may limit certain app features.
Location services are essential for KidKommute's functionality:
• Operators: Location is tracked only during active transport trips (pickup to drop-off);
• Parents: Can view operator location only during their child's active trips;
• Background Location: Operators grant permission for background location access to ensure continuous tracking;
• Precise Location: Used for accurate real-time tracking and emergency response;
• Location Sharing: Operator location is shared only with parents of children on the current route;
• Location History: Trip routes are stored for 6 months for reporting purposes.
We send push notifications for:
• Child pickup and drop-off status changes;
• Emergency panic alerts and crash detection notifications;
• Chat messages between parents and operators;
• Subscription and payment reminders;
• Substitute operator assignments and route changes;
• Service updates and important announcements.
You can manage notification preferences in your device settings or within the app.
KidKommute uses the following third-party services:
• Google Firebase: Authentication, real-time database, cloud functions, push notifications, and analytics;
• Google Maps: Route navigation, location display, and geocoding services;
• Apple In-App Purchase: Subscription processing for iOS users;
• PayFast: Payment processing for Android users;
• Expo Application Services: App distribution and updates.
Each service provider has its own privacy policy and data processing agreements.
If you are not satisfied with how we handle your personal information, you may lodge a complaint with:
Information Regulator of South Africa
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
P.O Box 31533, Braamfontein, Johannesburg, 2017
Complaints email: complaints.IR@justice.gov.za
General enquiries: inforeg@justice.gov.za
Website: https://inforegulator.org.za
For privacy-related inquiries or to exercise your POPIA rights:
KidKommute (Pty) Ltd
Information Officer: Teboho Mosala
Email: support@kidkommute.co.za
Phone: +27 10 825 3961
Address: B3 Carlswald Business Park, 1 Seventh Road, Carlswald, Midrand, 1682, South Africa
Response Time: We will respond to all privacy inquiries within 7 business days.
We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will notify you of material changes through the app or by email. The "Last updated" date at the top indicates when this policy was last revised. Your continued use of KidKommute after changes constitutes acceptance of the updated policy.