Privacy Policy

SIMPLAA UK LTD
Company Registered in England and Wales
Office 8, Sigma Business Centre, 7 Havelock Place, Harrow, England, HA1 1LJ
ICO Registration Number: ZB896174

Last Updated: May 2026

1. Introduction

Simplaa UK Ltd ("Simplaa", "we", "us", or "our") is committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains how we collect, use, store, share and protect your personal data when you use our services.

Our services include council-contracted student and SEN transport, private hire rides, airport transfers, an operational dispatch platform for drivers and staff, and the Simplaa mobile application ("the App") available on iOS and Android.

2. Data Protection Officer

If you have questions about how we handle your personal data please contact us:

Email: support@simplaa.com
Address: Office 8, Sigma Business Centre, 7 Havelock Place, Harrow, England, HA1 1LJ

3. What Personal Data We Collect

Drivers and Escorts (Personnel)

• Full name, date of birth and photograph
• Address, postcode, email and phone number
• National Insurance number
• Driving licence details and compliance documentation (DBS certificates, first aid certificates, safeguarding certificates, PCO licences)
• Vehicle details including registration, make, model, colour, insurance, MOT and PH licence
• Bank account and payment information (account name, sort code, account number)
• Emergency contact name and phone number
• Availability, route assignments and attendance records
• Proof of identity documents (passport, driving licence, biometric residence permit)

Mobile App Data

When you use the Simplaa mobile App, we additionally collect:

• GPS location data — While you are on shift, the App collects your precise GPS location (latitude, longitude, heading, speed and accuracy) every 30 seconds and transmits it to our servers. This data is used by dispatch to coordinate crew positions on a live tracker. Location tracking only occurs while the "Start Shift" toggle is active and stops automatically when your shift ends or you manually end your shift. The App requests both foreground and background location permission to maintain tracking while the App is not in the foreground.
• Device tokens — We collect Firebase Cloud Messaging (FCM) device tokens to deliver push notifications about shift updates, chat messages, incoming calls, cover offers and schedule changes.
• Camera and photo library — If you grant permission, the App accesses your camera or photo library to capture or upload profile photos and compliance documents (DBS certificates, driving licences, vehicle documents). Photos are uploaded to our secure cloud storage.
• Microphone — If you grant permission, the App accesses your microphone for in-app voice calls between crew and the dispatch office via our VoIP service.
• Phone state (Android only) — The App may access phone state information to manage incoming and outgoing VoIP calls.

Customers

• Name
• Address, email and phone number
• Pickup and drop-off details
• Payment information
• Booking communications

Service Users (Students and Children)

• Name and date of birth
• School information
• Pickup and drop locations
• Route assignment details
• Attendance records
• Special requirements such as wheelchair accessibility or medical needs

4. How We Collect Your Data

• Directly from you when you register, create an account, or book a service
• Through the Simplaa mobile App when you grant device permissions
• From local authorities for contracted transport services
• From third-party operators involved in service delivery
• Automatically through cookies and website usage
• Through messaging platforms such as WhatsApp or SMS

5. How We Use Your Data

• Providing transport services and managing bookings
• Managing driver onboarding and compliance
• Processing payments and financial records
• Real-time crew location tracking for dispatch coordination while personnel are on shift
• Facilitating in-app voice calls between crew and office staff
• Sending push notifications for operational updates, chat messages and incoming calls
• Safeguarding children and vulnerable individuals
• Communicating schedules and operational updates
• Improving our platform and services
• Complying with legal and regulatory obligations

Legal Basis for Processing

We process your personal data on the following legal bases under UK GDPR:

• Contract — Processing necessary for the performance of your engagement as personnel or your booking as a customer (Article 6(1)(b))
• Legal obligation — Processing necessary to comply with employment, tax, safeguarding and transport regulations (Article 6(1)(c))
• Legitimate interests — Processing necessary for operational dispatch, crew safety and service improvement, where your interests do not override ours (Article 6(1)(f))
• Consent — Where you have given explicit consent, such as accepting the data processing notice in the App (Article 6(1)(a)). You may withdraw consent at any time.

6. Special Category Data

We may process sensitive data including DBS checks and health information where necessary for safeguarding or operational purposes, in accordance with UK data protection laws.

7. Who We Share Your Data With

• Local authorities and councils
• Drivers and escorts providing transport services
• Third-party transport operators
• Payment processors and banks

Technology Service Providers

We use the following third-party service providers to operate our platform and App:

We also share data with:

• Professional advisers
• Regulators and law enforcement where required

We do not sell your personal data.

8. International Data Transfers

Some of our technology service providers (including Google and Twilio) may process data in the United States or other countries outside the UK. Where personal data is transferred outside the UK, appropriate safeguards such as standard contractual clauses or adequacy decisions will be used to protect the data.

9. Data Retention

• Personnel compliance documents — duration of engagement plus 6 years
• Financial records — 7 years
• Customer booking data — 3 years
• Communications (chat, email, WhatsApp) — 12 months
• GPS location data (crew positions) — 90 days
• Location trail history — 90 days
• Website analytics data — up to 2 years
• Account deletion requests — processed after 30-day grace period; deletion confirmation records retained for 12 months

10. Cookies

Our website uses cookies to improve functionality and analyse usage.

• Strictly necessary cookies
• Performance and analytics cookies
• Preference and functionality cookies

You can manage cookies through your browser settings.

11. Your Rights

Under UK GDPR you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Restrict processing
• Request data portability
• Object to processing
• Withdraw consent where applicable

To exercise these rights please contact support@simplaa.com.

Account Deletion

You can request deletion of your account directly from the App by navigating to your Account settings and selecting "Delete account". Upon requesting deletion:

1. Your account enters a 30-day grace period during which you can cancel the request by signing back in.
2. After 30 days, your personal data (name, contact details, National Insurance number, bank details, date of birth, emergency contacts, location history and uploaded documents) is permanently deleted or anonymised.
3. A confirmation email is sent when the deletion is complete.
4. Anonymised records may be retained where required for legal, tax or regulatory compliance.

You may also request deletion by emailing support@simplaa.com.

12. Children's Data

We process children's data only where necessary for council-contracted school transport services. This data is provided by local authorities and handled in accordance with safeguarding and data protection regulations.

The Simplaa mobile App is not intended for use by children under 18. Account registration requires users to be at least 18 years old.

13. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• Encryption of data in transit (TLS/HTTPS)
• Firebase App Check to verify genuine app requests
• Access controls and role-based permissions
• Secure cloud storage for uploaded documents
• Security monitoring and incident response procedures

14. Messaging Communications

We may use WhatsApp, SMS or in-app messaging to communicate operational updates such as route assignments, shift cover and schedule updates.

In-app push notifications are used to deliver time-sensitive information including incoming voice calls, chat messages, cover offers and schedule changes. You can manage notification permissions in your device settings.

15. Mobile App Permissions

The Simplaa App requests the following device permissions. All permissions are optional and requested at the point of use:

You can revoke any permission at any time through your device settings. Revoking location permission will prevent shift tracking. Revoking microphone permission will prevent voice calls.

16. Changes to This Policy

We may update this Privacy Policy periodically. Any updates will be reflected by the updated date at the top of the policy. If we make material changes that affect how we process your personal data, we will notify you through the App or by email.

17. Complaints

If you are not satisfied with how we handle your personal data you may contact the Information Commissioner's Office (ICO).

ICO Website: https://ico.org.uk
Telephone: 0303 123 1113

18. Contact Us

SIMPLAA UK LTD
Office 8, Sigma Business Centre, 7 Havelock Place, Harrow, England, HA1 1LJ
Email: support@simplaa.com
ICO Registration Number: ZB896174