Security and data protection
Children’s data, kept like a school record.
Shield100 holds the name of a child and the minute they got on a bus, so we keep as little as the job allows and we keep it in the EU.
Our position
The smallest register that works.
A transport register is one of the few school systems that touches a child outside the school gate. That is worth being careful about. So the register holds the least it can: who rides, on which line, and at what minute they were seen safely aboard and safely delivered.
There is no live tracking of a child through the day, no photographs, and nothing sold or shared. A parent sees their own children and no one else’s — and that boundary is enforced inside the database itself, so no mistake in a screen can widen it. If a school leaves us, its register leaves with it.
The charter
Four clauses we hold ourselves to.
These are not settings. They are how the product is built, and they do not have an off switch.
- Clause 1
Invitation only
There is no sign-up page. Every account is created by your school, and your school can end it.
- Clause 2
Data resident in the EU
Hosted in Frankfurt. GDPR is the floor we build on, not a badge we bought.
- Clause 3
Row-level security
A parent can only ever see their own child. That rule lives in the database, not in the interface, so no screen can leak past it.
- Clause 4
Contractor-agnostic
Change bus companies any year you like. The register belongs to the school, and it stays.
The whole record
What we store, and what we do not.
This is the complete list. If a field is not on the left-hand column, Shield100 does not ask for it and has nowhere to put it.
We store
- The child’s name
- Their year group
- Which line and which stop
- The time they boarded and the time they were delivered
- A guardian contact: name, email, phone
We do not store
- GPS traces of children
- Photographs of children
- Medical records, beyond a short note the steward needs
- Anything shared with third parties or advertisers
Residency
Where your data lives.
In Frankfurt, Germany, inside the EU. It is not copied to another region, and it is not read by anyone outside the small team that keeps the service running.
If your school leaves, ask us and we delete the register — riders, guardians and boarding history — within thirty days, and confirm it in writing. Nothing is kept back for analytics.
For your data protection officer
The four questions they always ask.
Who is the controller and who is the processor?
Your school is the controller. Shield100 is the processor and acts only on your school’s instructions. A Data Processing Agreement sets that out in writing before any real child is entered.
What is the lawful basis for holding a child’s name?
Your school’s own basis for running its transport and keeping pupils safe. We add no basis of our own, and we never process the data for our own purposes — no profiling, no training, no marketing.
Do you use sub-processors, and where are they?
Yes, two: the hosted database and the service that delivers invitation and boarding emails. Both are named in the Data Processing Agreement, and we tell your school before that list changes.
Can a parent ask for their child’s record, or its erasure?
Yes. Your office can export or delete a rider’s record — including the boarding history — from inside Shield100, so a subject access request or an erasure request can be answered the same day, without writing to us.
A Data Processing Agreement is available on request.
Ask for it before you commit to anything. Your legal team and your DPO should read it while the pilot is still just a conversation.