1. Introduction

OnRoute Transport Group Ltd ('OnRoute', 'we', 'us', or 'our') is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect personal information in connection with our website (www.onroutegroup.co.uk), our transport services, and our wider business operations.

We are registered as a data controller with the Information Commissioner's Office (ICO) under registration number ZC107178. This policy is written in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you have any questions about this policy or how we handle your data, please contact us at admin@onroutegroup.co.uk.

2. Who This Policy Applies To

This Privacy Policy applies to personal data collected from or about:

• Visitors to our website (www.onroutegroup.co.uk)
• Customers, parents, and carers who contact us or use our transport services
• Job applicants who apply for roles with OnRoute Transport Group
• Employed and self-employed drivers who work with or for OnRoute
• Local authority representatives, school staff, and council contacts we work with

Our website and services are directed at adults. We do not knowingly collect personal data directly from children. Where OnRoute transports children, all data processing relating to those children is conducted through parents, carers, schools, or local authority partners — not directly with the children themselves.

3. What Personal Data We Collect

3.1 Website Visitors and Hosting

As part of our hosting, security, and infrastructure services, our hosting provider may automatically collect certain technical data when you visit our website. This may include:

• Your IP address and approximate geographic location
• Browser type, version, and operating system
• Pages visited on our website and time spent on each page
• Referring website or search engine
• Date and time of your visit

3.2 Contact and Enquiry Form

When you submit an enquiry through our website contact form, we collect:

• Your full name
• Your email address
• Your telephone number (if provided)
• The content of your message or enquiry

3.3 Online Booking and Quote Requests

When you submit a booking or transport quote request through our website, we collect:

• Your name and contact details (email and telephone number)
• Details of the transport service required, including route, dates, and passenger requirements
• Where relevant to service delivery, information about the passenger(s), which may include a child's name and any specific transport or care needs
• Any additional information you choose to provide in support of your request

3.4 Customers, Parents, and Carers

In the course of providing transport services, we may collect and process:

• Full name, address, email address, and telephone number
• Details of transport requirements including pickup and drop-off locations and times
• Information relevant to passenger welfare and safeguarding
• Payment and invoicing information where applicable

3.5 Job Applicants

When you apply for a position with OnRoute, we collect:

• Full name, address, email address, and telephone number
• CV, employment history, and qualifications
• Right to work in the UK documentation and driving licence details
• References from previous employers
• Enhanced DBS (Disclosure and Barring Service) check information

3.6 Drivers (Employed and Self-Employed)

For drivers engaged by or operating within the OnRoute network, we collect and maintain:

• Full name, home address, and contact details
• PHV licence details, issuing authority, and expiry date
• Enhanced DBS certificate details and renewal date
• Vehicle details, MOT, and insurance documentation (self-employed drivers)
• Journey records, booking logs, and walkaround check logs
• In-vehicle CCTV footage (retained for a maximum of 28 days unless required)

4. How We Use Your Personal Data

We process personal data only where we have a lawful basis to do so under UK GDPR. The lawful bases we rely on are:

• Contract: processing is necessary to perform a contract with you
• Legal obligation: processing is necessary to comply with a legal obligation
• Legitimate interests: processing is necessary for our legitimate business interests
• Consent: where you have given clear, specific, and freely given consent

5. Marketing Communications

Where you have consented to receive marketing communications from us, we may contact you by email with information about our services, updates, and relevant offers. You may withdraw your consent at any time by emailing us at admin@onroutegroup.co.uk.

6. Third Parties We Share Your Data With

We do not sell your personal data to any third party. We may share your data with:

• Local Authorities and Councils: In connection with transport services provided under contract.
• Schools: Operational data to support safeguarding and route coordination.
• Third-Party IT Providers: Software providers that support our operational systems.
• DBS Umbrella Body: For the purpose of conducting required background checks.
• Legal Authorities: Where we are required or permitted to do so by law.

7. How Long We Keep Your Data

We retain personal data only for as long as necessary. Standard retention periods include:

• Website enquiry data: 12 months
• Booking and transport records: 6 years
• Driver compliance records: 6 years from end of engagement
• In-vehicle CCTV footage: Up to 28 days
• Employee and payroll records: 6 years from end of employment

8. Your Rights Under UK GDPR

You have the following rights in relation to the personal data we hold about you:

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure ('right to be forgotten')
• Right to restrict or object to processing
• Right to withdraw consent at any time

To exercise any of these rights, please contact us at admin@onroutegroup.co.uk.

9. Contact and Complaints

If you have any questions or wish to lodge a complaint, please contact us first. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk.