Legal
Privacy notice
Last updated 4 July 2026
PupilRoute is a decision-support service for special educational needs and disabilities (SEND) home-to-school transport. This notice explains how personal data is handled when a local authority uses the service.
Who is responsible for your data
When a local authority uses PupilRoute to plan its home-to-school transport, that authority is the data controller for the pupil and family information it holds. Astragrid Technologies Ltd ("we", "us"), which operates PupilRoute, acts as a data processor, processing that information only on the authority's documented instructions under a data processing agreement.
The public demonstration at this website uses synthetic data only. No real pupil or family information is present in the demo environment.
What we process, and why
| Category | Examples | Purpose |
|---|---|---|
| Pupil records | Home location, school, year group, SEND profile and needs (for example wheelchair access, escort, sensory) | Assess statutory transport eligibility and plan suitable, safe routes |
| Route and vehicle data | Stops, journey geometry, vehicle capacity and accessibility, assignments | Optimise routes and match capable vehicles |
| Account data | Name, work email, authority, role | Provide invite-only, role-based access and maintain an audit trail |
| Audit records | Who did what, and when | Accountability and information governance |
Lawful basis
The controlling authority determines the lawful basis under the UK GDPR. For statutory home-to-school transport this is typically a public task (Article 6(1)(e)), with special category SEND data processed under conditions relating to substantial public interest and the provision of education and social care (Article 9). We process personal data solely to deliver the service to the authority.
Storage and security
- Data is hosted on managed cloud infrastructure within the United Kingdom / European region.
- Access is invite-only and least-privilege: no login of any kind grants access without a provisioned account, and each user sees only their own authority's data.
- Connections are encrypted in transit. Every change is stamped with the signed-in user's identity and appended to an immutable audit trail.
Retention
We retain personal data only for as long as the controlling authority instructs, in line with its own retention schedule. On termination, data is returned or securely deleted as agreed.
Your rights
You have rights over your personal data, including access, rectification, erasure, restriction and objection. Because the authority is the controller, please direct requests to your local authority in the first instance. We will support the authority in responding. You may also complain to the Information Commissioner's Office.
Contact
For data protection questions about the PupilRoute service, contact misi@pupilroute.uk.