Privacy Policy

1. Introduction

Welcome to LetsGo, a school transportation platform operated by LetsRide Private Limited ("Company," "we," "our," or "us"), a company incorporated under the laws of India with its registered office at Flat No. G6, Plot No. 321-322, Kanaka Durga Apts, Mallampet, Hyderabad – 500090, Telangana, India.

LetsGo provides safe, reliable, and affordable daily commute services for school students by connecting parents, students, drivers, and school administrators through a mobile application. The platform facilitates route management, real-time vehicle tracking, trip scheduling, and communication between all stakeholders.

This Privacy Policy ("Policy") describes how we collect, use, store, share, and protect the personal data you provide to us or that we collect when you access or use the LetsGo mobile application, website, and associated services (collectively, "Services"). It also describes your rights with respect to your personal data and how you can exercise those rights.

This Policy applies to all users of the LetsGo platform, including parents, students (where applicable), drivers, and school administrators.

2. Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings assigned below:

• "Application" or "App" – The LetsGo mobile application available on Android (Google Play Store) and iOS (Apple App Store).
• "Personal Data" – Any information that relates to an identified or identifiable natural person, as defined under the Digital Personal Data Protection Act, 2023 (India) and the General Data Protection Regulation (GDPR).
• "Data Principal" – The individual to whom the Personal Data relates (referred to as "you" or "user" throughout this Policy). Under the DPDP Act, 2023, a parent or legal guardian acts as Data Principal on behalf of a minor.
• "Data Fiduciary" – The Company, which determines the purpose and means of processing Personal Data.
• "Data Processor" – Any third party that processes Personal Data on behalf of the Company under a contractual arrangement.
• "Student Data" – Any Personal Data relating to a student enrolled in a school and registered on the LetsGo platform.
• "Driver" – A transport service provider (auto-rickshaw or cab driver) registered and onboarded on the LetsGo platform.
• "School Administrator" – An authorised representative of a school institution who manages transport operations via the LetsGo platform.
• "Processing" – Any operation or set of operations performed on Personal Data, whether by automated means or otherwise, including collection, storage, use, disclosure, or deletion.
• "Consent" – A freely given, specific, informed, and unambiguous affirmative action by the Data Principal signifying agreement to the processing of their Personal Data for a specified purpose.
• "DPDP Act" – The Digital Personal Data Protection Act, 2023 (India).
• "GDPR" – General Data Protection Regulation (EU) 2016/679.
• "Services" – All products, features, and services offered by LetsGo through the App, website, or any other channel.

3. Information We Collect

We collect the following categories of information depending on your user type and the specific Services you use.

3.1 Information from Parents

• Full name, email address, mobile number
• Residential address and locality
• Parent/guardian identity verification details (as required)
• Child's (student's) information provided at registration
• Communication records within the App (messages, support tickets)
• Payment-related metadata (transaction identifiers, payment status — no card or bank details are stored by us)
• Feedback, ratings, and app interactions

3.2 Information from Students

• Full name, date of birth, gender
• School name, class/grade, and section
• Pickup and drop-off location (home address or designated stop)
• Profile photograph (optional, uploaded by parent/guardian)
• Attendance and trip history

3.3 Information from Drivers

• Full name, date of birth, gender, photograph
• Mobile number and email address
• Residential address
• Government-issued identity proof (Aadhaar, PAN, Driving Licence)
• Driving licence number, type, validity, and issuing authority
• Vehicle registration number, type (auto/cab), model, colour, fitness certificate, and insurance details
• Route assignments and trip history
• Real-time GPS location during active trips
• Bank account or UPI details for payment settlement
• Emergency contact information

3.4 Information from School Administrators

• Administrator's name, official designation, email, and mobile number
• School name, affiliation board, registration number, and address
• Authorised signatory details
• Student roster information (uploaded or entered for transport management)

3.5 Location Data

• Real-time GPS coordinates of vehicles during active trips
• Home address/pickup location coordinates of students
• Historical trip route data

3.6 Device Data

• Device type, model, operating system and version
• Mobile network information and IP address
• Unique device identifiers (Android ID, IDFA)
• App version, crash reports, and performance logs
• Push notification tokens

3.7 Communication Data

• In-app messages between parents, drivers, and administrators
• Masked call records (where call masking is used through VoIP services)
• Support communications and query history

3.8 Usage and Behavioural Data

• Pages, features, and screens accessed within the App
• Session duration and frequency of access
• App navigation patterns and interaction logs

4. How We Collect Information

We collect Personal Data through the following means:

4.1 Directly from You

• Registration: When you create an account on LetsGo, you provide us your name, contact details, and role-specific information.
• Profile Management: When you update your profile, add student details, or modify settings.
• Service Usage: When you book, track, or complete a trip.
• Document Upload: Drivers upload identity and vehicle documents during onboarding.
• Support Requests: When you contact our support team via in-app chat, email, or phone.
• Feedback: When you submit ratings, reviews, or responses to surveys.

4.2 Automatically

• Location Services: GPS data is collected from driver devices during active trips (and from parent devices when location sharing is enabled).
• Device Sensors and Diagnostics: App performance data, crash logs, and device identifiers are collected automatically.
• Cookies and Analytics SDKs: Usage behaviour is collected through cookies and analytics tools (see Section 15).

4.3 From Third Parties

• Schools: School administrators may provide us with student roster data for route configuration.
• Payment Gateways: We receive payment confirmation and transaction metadata from our payment processing partners.
• Government/Regulatory Sources: Driver verification data may be cross-referenced with government databases (e.g., Sarathi/Vahan) for licence and vehicle validation.

5. Purpose of Data Collection

We process your Personal Data only for specific, legitimate, and lawful purposes as described below:

6. Legal Basis for Processing

We process your Personal Data under one or more of the following lawful bases, as applicable under the DPDP Act, 2023 and GDPR:

• Consent: Where you have provided explicit, informed, and voluntary consent for processing, including consent obtained through the App's onboarding flow. Parents provide consent on behalf of minor children.
• Performance of Contract: Processing is necessary for the performance of the service agreement between you and LetsGo (e.g., transport service delivery, driver onboarding).
• Legitimate Interests: Processing is necessary for the legitimate interests of LetsGo or a third party — such as fraud prevention, safety monitoring, and platform improvement — provided that such interests do not override the rights of the Data Principal.
• Legal Obligation: Processing is required to comply with applicable laws, regulations, court orders, or instructions from government authorities.
• Vital Interests: Processing may be necessary to protect the vital interests of a student or another person in emergency or safety-critical situations.

7. Location Tracking Policy

7.1 What We Track

LetsGo collects real-time GPS location data from driver devices when a trip is active. Parents may view the live location of the vehicle assigned to their child through the App.

7.2 When We Track

• Drivers: Location is tracked continuously during active duty hours (from trip start to trip end). Background location access is requested with explicit driver consent during onboarding.
• Parents: Approximate location may be collected to identify the nearest available drivers or school zone — only with explicit opt-in consent.
• Students: Students are not independently tracked. Their location context is inferred from the assigned driver's vehicle location.

7.3 Purpose of Location Tracking

• Real-time safety monitoring for parents and schools
• Route optimisation and deviatio alerts
• ETA calculation and notifications
• Dispute resolution and safety incident investigation

7.4 Location Data Retention

Trip-specific location logs are retained for 90 days from the date of the trip. After this period, location data is permanently deleted unless retention is required for an ongoing legal proceeding or safety investigation.

7.5 Opt-Out

Drivers who disable location permissions will be unable to perform active trips on the platform. Parents may disable optional location features through device settings, though this may limit certain platform features.

8. Children's Privacy Policy

8.1 Age of Users

Student users of LetsGo are typically minors (under 18 years of age). Students do not directly register on the platform. All student information is registered and managed by a parent, legal guardian, or authorised school administrator.

8.2 Parental Consent

Prior to registering a student, parents or legal guardians must:

• Create their own verified account on the platform
• Provide verifiable consent for processing their child's Personal Data
• Confirm they have the legal authority to act on behalf of the child

We rely on the parent/guardian's account as the gating mechanism for student data entry. We do not independently solicit data from children under 13 years of age.

8.3 Minimisation of Student Data

We collect only the minimum student data necessary for safe transport service delivery:

• Name, school, class — for identification and route allocation
• Pickup and drop location — for route planning
• Trip history — for attendance and parent visibility

8.4 Access to Student Data

Student data is accessible only to:

• The registered parent/guardian of that student
• The assigned driver (name and pickup point only)
• Authorised school administrators of the student's school
• LetsGo's internal safety and operations teams (on a need-to-know basis)

8.5 Compliance

We comply with the obligations relating to children's data under the DPDP Act, 2023 (Section 9), and the Children's Online Privacy Protection Rules applicable to our platform. We do not subject children's data to behavioural tracking, targeted advertising, or profiling.

9. Data Sharing and Disclosure

We do not sell, rent, or trade your Personal Data to any third party. We share your data only under the following limited circumstances:

9.1 Within the Platform (Operating Necessity)

• A parent may see the assigned driver's name, photo, vehicle number, and live location.
• A driver may see the names and pickup/drop locations of students on their assigned route.
• A school administrator may access details of students enrolled under their institution.

9.2 Service Providers and Data Processors

We engage third-party vendors and service providers who process data on our behalf and under our instructions, bound by data processing agreements, including:

• Cloud hosting and infrastructure providers
• Payment gateway and financial services providers
• SMS and push notification service providers
• Analytics and crash reporting tools
• Customer support software providers
• Background verification agencies (for drivers)

9.3 Legal and Regulatory Disclosure

We may disclose your Personal Data to law enforcement agencies, courts, regulatory authorities, or government bodies when:

• Required by applicable law, court order, or legal process
• Required to protect the safety of a student or any person
• Required to enforce our Terms of Service or other agreements
• Required to detect, prevent, or address fraud, security, or technical issues

9.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets, your Personal Data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy. You will be notified of any such material change.

9.5 With Your Consent

We may share your data with any other third party where you have provided explicit, informed consent.

10. Data Storage and Retention

10.1 Storage Location

All Personal Data of Indian residents is stored within the territory of India on servers operated or contracted by LetsGo, in compliance with the DPDP Act, 2023. Data may only be transferred internationally under the conditions set forth in Section 16 of this Policy.

10.2 Retention Schedule

10.3 Post-Retention Deletion

Upon expiry of the applicable retention period, Personal Data is permanently and securely deleted or anonymised so that the data can no longer be linked to an identifiable individual. Anonymised or aggregated data may be retained indefinitely for analytical purposes.

11. Data Security Measures

We implement appropriate technical, organisational, and physical security measures to protect your Personal Data from unauthorised access, disclosure, alteration, loss, or destruction.

11.1 Technical Safeguards

• TLS/SSL encryption for all data in transit
• AES-256 encryption for data at rest
• Multi-factor authentication (MFA) for administrator and driver accounts
• Role-based access controls (RBAC) for internal staff
• Secure coding practices; regular code reviews and vulnerability assessments
• Web Application Firewall (WAF) and intrusion detection systems
• Regular penetration testing by qualified security professionals

11.2 Organisational Controls

• Data access limited to authorised personnel on a need-to-know basis
• Employee training on data privacy and security policies
• Non-Disclosure Agreements (NDAs) with all staff and contractors
• Data processing agreements with all third-party processors

11.3 Limitations

While we employ industry-standard security measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee the absolute security of your data, and you share information with us at your own risk. We encourage you to use strong passwords and protect your account credentials.

12. User Rights and Choices

Subject to applicable laws, including the DPDP Act, 2023 and GDPR, you have the following rights with respect to your Personal Data:

• Right of Access: You may request a copy of the Personal Data we hold about you.
• Right to Correction: You may request correction of inaccurate or incomplete Personal Data.
• Right to Erasure / Right to Be Forgotten: You may request deletion of your Personal Data, subject to applicable legal and contractual retention obligations.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time. Withdrawal of consent shall not affect the lawfulness of processing carried out prior to withdrawal.
• Right to Data Portability: Where technically feasible, you may request your data in a structured, machine-readable format.
• Right to Grievance Redressal: You have the right to file a complaint with our Grievance Officer (see Section 23) or with the Data Protection Board of India, once constituted.
• Right to Nominate: Under the DPDP Act, you may nominate another individual to exercise your rights in the event of death or incapacity.

12.1 How to Exercise Your Rights

You may exercise the above rights by:

• Using the self-service tools available in the App (Account Settings → Privacy)
• Submitting a written request to our Grievance Officer at the contact details provided in Section 23

We will respond to verified requests within 30 days of receipt, as required under the DPDP Act. Where the request is complex or we receive a high volume of requests, we may extend this period by an additional 30 days with notice to you.

13. Consent Policy

13.1 How We Obtain Consent

We obtain your consent through clear, plain-language notices presented at the following touchpoints:

• During App registration, before any data is collected
• When requesting access to sensitive device permissions (camera, contacts, location, microphone)
• When any material change is made to this Policy
• For children's data: from the parent/guardian during student profile creation

13.2 Consent by Minors

LetsGo does not obtain consent directly from students who are minors. All consent for processing student data is obtained from the parent or legal guardian, who assumes full responsibility for the accuracy of the information provided.

13.3 Conditional Use of Services

Certain permissions (such as GPS location for drivers) are essential to the functioning of the App. Refusal to grant these permissions will result in limited or no access to the relevant features. We clearly distinguish between mandatory and optional data processing at each consent request.

13.4 Withdrawal of Consent

You may withdraw previously given consent at any time by accessing "Privacy Settings" in your App account or by contacting our Grievance Officer. Please note that withdrawal may render certain Services inoperable. We will process withdrawal requests within the timelines set out in Section 12.1.

14. Third-Party Services

LetsGo integrates with certain third-party services to deliver its features. These third parties may independently collect data subject to their own privacy policies. We have listed the categories of third-party integrations below:

We require all third-party processors to enter into data processing agreements that impose equivalent or greater data protection obligations. However, LetsGo is not responsible for the independent data practices of third-party platforms that users access outside of the LetsGo App.

15. Cookies and Tracking Technologies

15.1 Mobile App

The LetsGo mobile application does not use browser cookies. However, we use the following tracking technologies within the App:

• Device Identifiers: Android Advertising ID (GAID) or Apple IDFA for session management and analytics.
• Analytics SDKs: We embed analytics libraries (e.g., Firebase Analytics) that collect anonymised usage data about feature interactions and app performance.
• Crash Reporting SDKs: These capture diagnostic data automatically when the App encounters an error.

15.2 Website

If you access our website, we use:

• Strictly Necessary Cookies: For session management and security. These cannot be disabled.
• Analytics Cookies: To understand website traffic and usage patterns. You may opt out via our Cookie Preference Centre.

15.3 Opt-Out

You may opt out of analytics tracking by:

• Disabling advertising identifiers in your device settings (iOS: Settings → Privacy → Tracking; Android: Settings → Google → Ads)
• Using the opt-out mechanism in our Cookie Preference Centre (for the website)

16. International Data Transfers

LetsGo's primary data storage is within India. Where data is processed outside India — for example, by third-party service providers whose infrastructure is located outside India — we ensure that:

• Such transfers are made only to countries or entities that provide an adequate level of data protection as recognised under applicable Indian law;
• Appropriate contractual safeguards (such as Standard Contractual Clauses or equivalent mechanisms) are in place;
• Such transfers are subject to the conditions and restrictions prescribed by the DPDP Act, 2023, and any rules or notifications issued by the Government of India thereunder.

We will update this section as regulations under the DPDP Act concerning cross-border data transfers are notified by the Government of India.

17. Policy for Drivers

Drivers are subject to additional data processing activities specific to their role on the LetsGo platform. By registering as a driver, you acknowledge and agree to the following:

17.1 Identity and Document Verification

Your identity documents (Aadhaar, PAN, Driving Licence), vehicle documents (Registration Certificate, Insurance, Fitness Certificate), and a recent photograph will be collected, stored, and verified through authorised background verification agencies and government databases. Submission of false or fraudulent documents will result in immediate account suspension and may lead to legal action.

17.2 Continuous GPS Tracking

During active trips, your device's GPS location is tracked in real time and is visible to parents of students on your assigned route. This is a mandatory requirement for transport safety and service delivery. Tampering with or disabling location services during an active trip constitutes a breach of your service agreement.

17.3 Performance and Conduct Monitoring

Trip data, ratings from parents, and completion records are used to evaluate your performance on the platform. This data may be used for route reassignment, disciplinary actions, or service termination decisions.

17.4 Payment Data

Your registered bank account or UPI ID will be used for payment settlements. This information is encrypted and shared only with our authorised payment partners. LetsGo does not store complete bank account credentials internally.

17.5 Data Retention Post-Deactivation

Following deactivation of your driver account, your identity documents and trip records will be retained for a minimum of 5 years to comply with applicable transport safety regulations and to respond to any post-service disputes or legal proceedings.

18. Policy for Schools

School administrators play a critical role in the LetsGo ecosystem. The following terms apply to schools and their authorised representatives:

18.1 Institutional Data

Schools provide institutional information (school name, registration number, address, principal's contact) and authorise administrators to manage student transport on the platform. Schools are responsible for the accuracy of the information provided and for maintaining up-to-date records.

18.2 Student Roster Data

Schools may upload or enter student data for transport allocation purposes. By uploading this data, the school represents and warrants that it has obtained all necessary consents and permissions from parents/guardians and has the lawful authority to share such data with LetsGo.

18.3 Data Access and Control

School administrators may access only the data of students enrolled under their institution. Administrators must not share access credentials and must immediately notify LetsGo of any suspected unauthorised access.

18.4 School as Data Fiduciary

To the extent that a school determines the purpose and means of processing student data on its own platform (e.g., internal ERP systems), the school acts as an independent Data Fiduciary and is solely responsible for such processing. LetsGo acts as a Data Processor to schools only for the processing described in this Policy.

19. Account Deletion & Data Erasure

19.1 How to Delete Your Account

You may request account deletion at any time through one of the following methods:

• In-App: Navigate to Account Settings → Delete Account
• Email: Send a request to support@letsgoschool.co.in from your registered email address
• Grievance Officer: Submit a written request (see Section 23)

19.2 Erasure Process

Upon receipt of a verified deletion request:

• Your account will be deactivated immediately, preventing any further logins or active use.
• Personal Data will be permanently erased within 30 days, subject to applicable retention obligations.
• Certain data may be retained beyond this period where required by law, regulation, or for the resolution of pending disputes, as described in Section 10.2.

19.3 Effect of Deletion

• All ongoing service subscriptions will be terminated.
• Pending payments or refunds will be processed prior to deletion.
• Associated student profiles will be delinked and deactivated.
• You will not be able to recover your account or historical data after deletion is complete.

20. Breach Notification Policy

20.1 Internal Response

In the event of a confirmed Personal Data breach, LetsGo will:

• Immediately activate its Incident Response Plan
• Contain the breach and assess the nature, scope, and probable consequences
• Engage relevant technical, legal, and management teams

20.2 Regulatory Notification

In accordance with the DPDP Act, 2023, LetsGo will notify the Data Protection Board of India of a notifiable breach in the prescribed form and within the timeframes specified under applicable law, which may be updated by regulation.

20.3 User Notification

Where a breach is likely to result in high risk to the rights or interests of affected Data Principals, we will notify the affected users without undue delay, providing:

• Nature of the breach and categories of data affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach
• Contact details for further information and remediation guidance

21. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, applicable laws, or platform features. The following process applies to all updates:

• The updated Policy will be published in the App and on our website with a revised "Last Updated" date.
• For material changes (those that significantly affect your rights or how we process your data), we will provide prior notice through in-app notifications, email, or both, at least 30 days before the changes take effect.
• Your continued use of the Services after the effective date of the revised Policy constitutes acceptance of the updated terms.
• If you do not agree with any material change, you must stop using the Services and may delete your account as described in Section 19.

We recommend that you review this Policy periodically to stay informed about how we handle your data.

22. Contact Information

If you have questions, concerns, or requests relating to this Privacy Policy or our data practices, you may contact us through the following channels:

23. Grievance Officer Details (India Compliance)

In accordance with the Information Technology Act, 2000 (as amended), the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023, we have designated a Grievance Officer to address complaints and queries related to the processing of Personal Data.

Any Data Principal who believes their data has been processed in violation of this Policy or applicable law may lodge a complaint with the Grievance Officer. If the complaint is not resolved satisfactorily, the Data Principal may also approach the Data Protection Board of India (once constituted under the DPDP Act, 2023) for adjudication of the dispute.

24. Governing Law and Jurisdiction

This Privacy Policy and all matters relating to the collection, processing, storage, and disclosure of Personal Data by LetsGo shall be governed by, and construed in accordance with, the laws of the Republic of India, including but not limited to:

• The Digital Personal Data Protection Act, 2023
• The Information Technology Act, 2000 and the rules made thereunder
• The Consumer Protection Act, 2019
• Any other applicable central or state legislation

In the event of any dispute, claim, or controversy arising out of or in connection with this Policy or our data practices, the parties shall first attempt to resolve the matter through consultation and negotiation in good faith. If the dispute cannot be resolved informally, it shall be subject to the exclusive jurisdiction of the courts located at Hyderabad, Telangana, India.

Where international compliance obligations apply (e.g., where European residents use the Service), we additionally comply with the requirements of the General Data Protection Regulation (GDPR) to the extent applicable. Data subjects outside India may be entitled to additional rights under their local laws.