What we collect, why we hold it, who else can see it, and how to get it back or deleted.
RouteCabin is school and staff transport software made by IT Vision Private Limited, Garden Heights, Garden Town, Lahore, Punjab, Pakistan. This policy covers both the routecabin.com website and the RouteCabin application. It is written to be read, not to be survived — if anything here is unclear, write to info@routecabin.com and we will explain it.
This distinction decides who you should talk to, so it comes first.
When you visit our website or hold a RouteCabin account, we decide what to collect and why. In data-protection language we are the controller, and this policy governs it.
When a transport operator or school uses RouteCabin to manage their passengers, they decide what to record and why. We only hold and process it on their instructions. They are the controller; we are the processor. If you are a parent, a student or a driver and you want your records changed or deleted, ask the operator who transports you — they control that data, not us. We will help them do it, and if you cannot reach them, contact us and we will try to put you in touch.
Nothing that identifies you, unless you accept analytics cookies. Our web server keeps standard access logs (IP address, page requested, time, browser) for security and troubleshooting. If you accept analytics, Google Analytics measures which pages are read and roughly where visitors come from. You can decline, and declining costs you nothing — see our Cookie Policy.
Your name, email address, phone number, company name and whatever you write in the message. We use it to answer you and, if you become a customer, to set up your account.
This is the part that matters most, so we will be specific rather than vague. An operator using RouteCabin can record:
We do not sell any of it, we do not use it to train anything, and we do not look at it except when an operator asks us to help with a specific problem.
Most passengers in a school transport system are children, and their records include home address, home coordinates and a photograph. We treat that as the most sensitive data on the platform. It is stored in the European Union, it is never sent to an advertising or analytics provider, and it is visible only to the operator that entered it — never to another operator on the platform, and never on any public page.
Operators are responsible for having a lawful reason to hold a child's data and, where the law requires it, for obtaining a parent or guardian's consent. Our public self-registration form asks for acceptance of the operator's own terms before anything is submitted.
| What | Why we may hold it |
|---|---|
| Running your account | Performing the contract we have with you |
| Server and security logs | Our legitimate interest in keeping the service up and unbreached |
| Answering an enquiry | Steps taken at your request before entering a contract |
| Analytics and the chat widget | Your consent, which you may withdraw at any time |
| Passenger, guardian and driver records | On the operator's instructions — their lawful basis, not ours |
| Invoices and accounting records | Legal obligations we are under |
RouteCabin runs on servers in Dunkirk, France, inside the European Union. Your account data and everything your operators enter is stored there and is not copied elsewhere for routine operation.
Two optional services sit outside the EU, and neither of them receives passenger records:
Our own team works from Pakistan and can access systems for support. Pakistan is not covered by a European adequacy decision, so that access is governed by the safeguards in our Data Processing Agreement.
A short and complete list. We do not sell data, and we do not share it for advertising.
| Who | What they get | Where |
|---|---|---|
| OVH | Hosts the servers; holds everything at rest | France |
| FOXAF | Chat messages; WhatsApp messages an operator chooses to send | Canada |
| Google Analytics | Website page views, only with consent | United States |
| Bunny Fonts | Serves the site's typefaces; sets no cookies and keeps no logs | European Union |
Route optimisation runs on our own server using straight-line distances by default. If an operator switches on road-network routing, stop coordinates are sent to the routing service they configure. No names accompany them.
We will also disclose data if a court or a law we are subject to requires it. If that happens and we are permitted to tell you, we will.
Deleting a passenger, driver or payment inside the app removes it from every list, report and total straight away — the operator can no longer see or use it. The underlying row is retained but hidden, so that a deletion made in error can be undone and so that historical accounts stay consistent.
That is not the same as erasure, so we offer erasure separately. If you ask us to erase a record permanently, we destroy the row itself along with everything attached to it — attendance, fee slips, payments and uploaded images. It cannot be recovered afterwards. Ask your operator, or write to us, and we will carry it out within 30 days.
If you are in the UK or the European Economic Area, the law gives you the rights below. We extend them to everyone who asks, wherever they live, because it is simpler and fairer than keeping two standards.
Write to info@routecabin.com. We will reply within 30 days. We will not charge you, and we will not ask why.
If your data is in an operator's account — you are a parent, a student or a driver — send your request to that operator. They hold it and they control it. We will help them act on it, and we will act on it ourselves where they instruct us to.
If a breach ever puts your data at risk, we will tell the relevant supervisory authority within 72 hours and tell you without undue delay.
IT Vision Private Limited, Garden Heights, Garden Town, Lahore, Punjab, Pakistan
Email info@routecabin.com
Phone +92 332 777 3902
If you are in the European Economic Area or the UK and you think we have handled your data badly, please tell us first — we would rather fix it. You are also entitled to complain directly to your national data protection authority. In Romania that is the ANSPDCP; elsewhere in the EU, the European Data Protection Board lists them all.
If we change anything that materially affects you, we will email account holders and update the date at the top. Minor wording fixes will not get an email.