गोपनीयता नीति

BOBOK PRIVACY POLICY

Driver App, School App and school panel, and Website

Effective date: 7 October 2026. Version 2.0. Replaces the separate Driver, School and Website policies (version 1.0).

ABOUT THIS POLICY

This Privacy Policy is published by Bobok Private Limited ("BOBOK", "we"), CIN U82990DL2026PTC464503, registered office at 12, 4th Floor, Flat No. 400, A Ajit Singh House, Hauz Khas, New Delhi 110016.

It is issued under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). It covers three things:

• Part A: the BOBOK Driver App (Android and iOS), used by drivers engaged by a school.

• Part B: the BOBOK School App and the school web panel, used by schools and their staff.

• Part C: the website bobok.in and our business contacts.

Part A forms part of the BOBOK Driver Terms and Conditions, and Part B forms part of the BOBOK School Terms and Conditions. The BOBOK Parent App has its own privacy policy, available on this website.

BOBOK is a technology provider. Schools run their own transport: BOBOK does not operate vehicles, employ drivers or supervise children.

We do not sell personal data, and we do not use it for advertising.

Location in the Driver App

The BOBOK Driver App collects the phone's precise location to show the live position of the school vehicle to the school and to parents, and to send pickup alerts. This happens only while a trip is active, from the moment the driver taps Start trip until the trip ends, and it continues when the app is in the background, is closed, or the screen is off.

No location is collected when no trip is active. The School App does not collect the device's location. Full details are in Part A.

PART A: BOBOK DRIVER APP

For drivers who use the app because a school has engaged them to drive its transport.

A1. Your school and BOBOK

Your school is the Data Fiduciary for your driver record and trip data, and BOBOK is its Data Processor. BOBOK is the Data Fiduciary for app security, crash and usage data, and your support conversations with BOBOK. Your account is created and removed by your school. BOBOK does not verify drivers.

A2. What we collect

• From your school: your name, mobile number (your login), photo, vehicle and route assignment, and, only if your school chooses, your driving licence number and a photo of your licence. BOBOK does not collect your Aadhaar number.

• Location: your phone's precise location only while a trip is active, from the moment you tap Start trip until you tap End trip, including when the app is in the background, is closed, or your screen is off. Location sharing stops when you tap End trip, or automatically one hour after the last child on the trip has been dropped, whichever is earlier. No location is collected when no trip is active.

• Speed, distance and stops: from your location the app works out the vehicle's speed, the distance travelled, and how long the vehicle was moving or stopped.

• Speed and stop alerts: if the vehicle goes above the speed limit set in the app (currently 60 km/h), or stays stopped for a long time during a trip, an alert with the speed, time and place is recorded and shown to your school and to parents of children on that trip. BOBOK does not give you a driving score and does not read your phone's motion sensors.

• Trip records: trip start and end, the route travelled, QR scans of children at boarding and drop-off, handovers you record, horn alerts you send to a stop, and any route notes.

• Photos at handover: if the person collecting a child is not on the parent's list, you record that person's photo, name and phone number in the app. You can take the photo with the camera or choose one from your phone. Tell the person it is being recorded to confirm the handover with the parent.

• Your profile photo: if you add or change it, taken with the camera or chosen from your phone.

• SOS: when you press SOS, your current location, the time and the type of emergency you select.

• Device data: push-notification token, device model, operating system and app version, login times and IP address, app usage events and crash diagnostics.

• Work done without internet: pickups and drops you mark while offline are kept on your phone and sent to the server when the connection returns.

A3. Why we use it

• To let your school run its transport: trips, child scans, handovers and alerts.

• To show the school and parents where the vehicle is, and to warn them of overspeed or long stops.

• To send SOS alerts to your school.

• To secure your account, fix faults and keep the app reliable.

• To meet legal obligations and to establish, exercise or defend legal claims.

A4. Who sees your data

• Your school: your profile, licence details (if recorded), your vehicle's live location, speed and route throughout each trip, and your trip, scan, handover, alert and SOS records.

• Parents: your name, photo and mobile number (so they can call you), the vehicle number, and the vehicle's live location, speed and trip alerts, from the time the vehicle is on its way to their child's stop until their child is dropped.

• SOS: your school's administration and transport staff, and BOBOK. The school may share it with parents of children on board where needed.

• Handover photos of unlisted persons: the parent concerned and BOBOK. They may be provided to the school or the authorities if a child-safety incident is investigated.

A5. Permissions the Driver App asks for

• Location, precise, "Allow all the time" (background). Why the app needs it: To share the vehicle's live position with the school and parents and to send pickup alerts. When it is used: Only between Start trip and End trip, including when the app is in the background or closed. A "BOBOK trip is live" notification stays visible the whole time.

• Camera. Why the app needs it: To scan children's QR codes, to photograph an unlisted person at handover, and to take your profile photo. When it is used: Only when you open the scanner or take a photo.

• Photos (optional). Why the app needs it: To choose an existing photo instead of taking a new one. When it is used: Only when you choose a photo. The app does not read your gallery otherwise.

• Notifications. Why the app needs it: For trip, SOS, school and account messages. When it is used: While you are logged in.

• Battery optimisation exemption (Android). Why the app needs it: So that Android does not stop location sharing in the middle of a trip. When it is used: During active trips.

Call, SMS and WhatsApp buttons open your phone's own apps. The Driver App does not read your contacts, call history or messages.

You can change these permissions at any time in your phone's Settings. Without location permission a trip cannot be started.

A6. How long we keep it

• Live position of the vehicle: Replaced by each new position

• Route travelled, speed and stop alerts for each trip: 18 months

• Trip, scan, handover and SOS records, including handover photos: 18 months

• Your driver profile and licence details: Until your school removes you, then 1 year

• Support chats: 18 months

• Terms-acceptance records: While your account exists, then 18 months

• Security and access logs: 18 months

PART B: BOBOK SCHOOL APP AND SCHOOL PANEL

For schools and their staff who use BOBOK ("School Users").

B1. Roles

Student, parent and driver data that the School enters, or that is generated for the School's transport and attendance: the School is the Data Fiduciary and BOBOK is its Data Processor, acting on the School's instructions under the School Terms and the School Agreement. The School is responsible for having a lawful basis, and verifiable parental consent, for every child it enrols and every document it uploads.

School User account data, the School's institutional and billing data, agreement-acceptance records, support conversations, and BOBOK's security and usage logs: BOBOK is the Data Fiduciary.

B2. What we collect about the School and School Users

• School User accounts: name, mobile number, email, role and permissions, and an optional profile photo; login and activity logs (panel actions with time and IP address).

• The School: legal name, address, registration or affiliation details, GSTIN (or declaration of being unregistered), contact persons.

• Bank account (account holder, account number and IFSC), used only to pay slot refunds. The account number is encrypted and shown masked.

• School Agreement acceptance records: the signatory's name and designation, the mobile number that received the OTP, the verification time, IP address and device, the declaration of authority, and a fixed copy of the signed agreement with its fingerprint (hash).

• Orders and payments: slot and ID card orders, invoices, refunds and credit notes. Card and bank payment details are handled by our payment partner and are not stored by BOBOK.

• Device and app data (School App): push-notification token, device model, operating system and app version; app usage events and crash diagnostics.

• Dashboard layout preferences, stored in Google Firebase (Firestore).

The School App does not read or collect the location of a School User's device. The live vehicle positions it shows come from the Driver App.

B3. Data the School provides about others

BOBOK processes this data for the School.

• Students: name, gender, date of birth, blood group (optional), photograph, class, section, roll number, admission number and date, previous school (optional), route and bus, plan type, EWS/RTE status, registration number and allotment letter (optional), complimentary-access indicator, ID card number and QR code; optional documents (birth certificate, Aadhaar card, report card, transfer certificate, caste certificate) and masked Aadhaar number.

• Parents and guardians: mobile number (their app login), email (optional), parents' and guardian's names, occupation, current and permanent address, masked Aadhaar number (optional).

• Drivers: name, mobile number, photo, driving licence number and licence photo (both optional), vehicle and route assignment.

• Operational records: scans, gate check-ins, trips, routes travelled, speed and stop alerts, handovers and SOS alerts.

Optional documents are visible only to authorised School Users. They are never shown in the Parent or Driver apps and never sent to the AI provider. BOBOK does not collect Aadhaar in full; where recorded, it is held in masked form. For the Aadhaar card upload, the School should use the masked Aadhaar available from UIDAI.

B4. Why we use it

• To provide the platform to the School: accounts, roles, student and transport management, gate operations, alerts, ID cards and reports.

• To process slot and card orders, invoices, credit notes and refunds.

• To record the School Agreement and its acceptance.

• To give support, handle grievances, and keep the platform secure and reliable.

• To meet legal, tax and accounting obligations, and to establish, exercise or defend legal claims.

B5. Permissions the School App asks for

• Camera. Why the app needs it: To scan student QR codes at the gate and to photograph students or documents. When it is used: Only when you open the scanner or take a photo.

• Photos and files (optional). Why the app needs it: To choose a photo or document to upload to a student, driver or school record. When it is used: Only when you choose a file. The app does not read your gallery or files otherwise.

• Notifications. Why the app needs it: For SOS alerts from drivers, and school, order and account messages. When it is used: While you are logged in.

Call, email and WhatsApp buttons open your phone's own apps. The School App does not read your contacts, call history or messages.

B6. Cookies on the school panel

The school panel uses only essential cookies: to keep you logged in, to protect forms against misuse (CSRF token) and to remember your language. After login, Tawk.to also sets cookies to run support chat. They are not used for tracking or advertising. Blocking them will stop login and chat from working.

B7. How long we keep it

• Live position of a vehicle: Replaced by each new position

• Route travelled, speed and stop alerts for each trip: 18 months

• Trip, scan, gate, handover and SOS records: 18 months

• Student records and documents: As instructed by the School; if the School leaves BOBOK, 30 days for export, then deleted

• Driver and School User profiles: Until the School removes them, then 1 year

• Invoices, payment, refund and credit-note records: 8 years (company and tax law)

• School Agreement acceptance records: Term of the agreement plus 3 years

• Support chats and complaints: 18 months

• Consent and terms-acceptance records: While the account exists, then 18 months

• Security and access logs: 18 months

B8. Requests about School-held data

When a parent, student or driver asks BOBOK to exercise their rights over School-held data, BOBOK passes the request to the School, which decides on it. BOBOK assists the School in responding.

BOBOK will notify the School without undue delay, and within 72 hours, of a personal-data breach affecting School data. Where the law permits, BOBOK will inform the School before disclosing School data to an authority. By using BOBOK, the School authorises the service providers listed below, including transfers outside India permitted under the DPDP Act.

PART C: WEBSITE AND BUSINESS CONTACTS

For visitors to bobok.in and people we deal with in the course of business. BOBOK is the Data Fiduciary for this data.

C1. What we collect

• Website visits: our website has no public forms and uses no analytics, advertising or tracking tools. Our hosting provider records standard server logs (IP address, browser type, pages requested and time) for security and reliability.

• School contacts: when BOBOK's team contacts or meets a school, we record the name, designation, phone number and email of the school's representatives, and notes of our discussions, in our customer relationship management (CRM) system.

• Job applications sent to careers@bobok.in: your CV and the details you provide.

• Emails and messages you send us.

C2. Why we use it

• To operate and secure the website.

• To contact schools about BOBOK and follow up on their interest.

• To assess job applications.

• To respond to your messages, and to meet legal obligations.

C3. Cookies on the website

We use only essential cookies: to remember your language preference and, when you log in to a BOBOK panel, to keep you logged in and protect forms against misuse. We do not use cookies for tracking or advertising, so no consent banner is shown.

C4. How long we keep it

• Server and security logs: 18 months

• School contact records in our CRM: Until the school asks us to stop contacting it

• Job applications: Until the role is filled, then 18 months, unless you ask us to delete sooner

• Emails: 18 months, unless needed for an ongoing matter

SERVICE PROVIDERS

These companies process data for BOBOK. Each receives only what it needs for the purpose shown.

• Hostinger. Purpose: Application servers, database, file storage and website hosting. Used in: All. Location: India.

• Google Firebase Realtime Database. Purpose: Live trip location, route and trip alerts. Used in: Driver App, School App and panel. Location: Singapore.

• Google Firebase Cloud Messaging and Firestore. Purpose: Push notifications; School App dashboard layout preferences. Used in: Driver App, School App. Location: Google's global infrastructure.

• Google Firebase Analytics and Crashlytics. Purpose: App usage and crash diagnostics. Never receives location. Not used for advertising. Used in: Driver App, School App. Location: Google's global infrastructure.

• Google Maps. Purpose: Maps and route display. Used in: Driver App, School App and panel. Location: Google's global infrastructure.

• Gupshup. Purpose: Login OTP, SMS and WhatsApp service messages. Used in: Driver App, School App and panel. Location: India.

• Zoho Mail. Purpose: System emails, including order-status and refund emails; BOBOK's email. Used in: School panel, Website. Location: India.

• Cashfree Payments. Purpose: Payment processing. Used in: School App and panel. Location: India.

• BOBOK's printing partners. Purpose: Printing ID cards. They receive only the print-ready card file, under confidentiality obligations. Used in: School App and panel. Location: India.

• Tawk.to. Purpose: Support chat, prefilled with the user's name and contact details. Used in: Driver App, School App, school panel after login. Location: Outside India.

• Anthropic PBC. Purpose: AI assistant in the Parent App (processes a parent's question with limited trip context). Used in: School-held trip data. Location: USA.

WHERE DATA IS STORED

BOBOK's application servers, database and files (Hostinger) and email (Zoho Mail) are in India. Live trip data (Google Firebase Realtime Database) is processed in Singapore. The other providers marked above process limited data outside India, as permitted under the DPDP Act.

YOUR RIGHTS

You may ask to access, correct or erase your personal data, withdraw a consent you gave, ask us to stop contacting you, nominate a person to exercise your rights, or raise a grievance. Write to privacy@bobok.in.

We acknowledge within 24 hours, resolve grievances within 15 days and other requests within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

DELETING YOUR ACCOUNT AND DATA

Driver and School User accounts are created by the School, not inside the app, so they are also removed by the School.

• Drivers: ask your school to remove you, or write to privacy@bobok.in with your registered mobile number in the message. We pass the request to your school and confirm to you when it is done.

• School Users: ask your School administrator to close your account, or write to privacy@bobok.in.

• A School leaving BOBOK: the School's data stays available for export for 30 days and is then deleted.

When an account is removed, the profile is deleted after the period shown in the tables above. Some records are kept longer where the law requires it or a safety record must be preserved: trip, handover and SOS records (18 months), and invoices and payment records (8 years).

CHILDREN

The Driver App and the School App are tools for adults: drivers, and school staff. They are not directed at children and children do not hold accounts in them. Information about students is entered by the School, which is responsible for obtaining verifiable parental consent. BOBOK does not use children's data for advertising.

SECURITY, BREACHES AND DISCLOSURE

We use reasonable security safeguards, including encryption in transit and of sensitive fields at rest, role-based access controls, application servers hosted in India and audit logging.

If a personal-data breach affects you, the School concerned and, where the DPDP Rules require, the Data Protection Board of India and you will be informed.

We disclose personal data only on a lawful order or request from an authorised government agency.

CHANGES AND LANGUAGE

We will publish changes on this page with a new effective date. Before a material change takes effect, drivers are notified in the Driver App, and Schools are notified in the panel and by email; users of the apps are asked to accept the updated version.

This policy is available in Hindi or any other language listed in the Eighth Schedule to the Constitution of India on request to privacy@bobok.in.

CONTACT

Grievance Officer and Child Safety Officer: Angela Maringmei, angela@bobok.in (alternate: Shaily Singh)

Data protection contact: privacy@bobok.in

Bobok Private Limited, 12, 4th Floor, Flat No. 400, A Ajit Singh House, Hauz Khas, New Delhi 110016