Privacy Policy

01About this Policy

KaGo Transport Services Pty Ltd ("KaGo", "KTS", "we", "us" or "our") is committed to protecting the privacy of every individual whose personal information we handle. This Privacy Policy explains how we collect, use, store, disclose and protect personal information.

Some of the families we serve are escaping family violence, living in refuges or temporary accommodation, or working with a child protection caseworker. For those families, an address disclosed to the wrong person is not an administrative error. It is a risk to a child. That reality shapes everything in this policy.

This policy applies to all personal information we collect in connection with our transport services across Perth Metro and the South West of Western Australia, including through our website, our mobile apps, our booking and referral systems, and our advertising.

02Who We Are

KaGo Transport Services Pty Ltd is a children's transport service operating across Perth Metro and South West Western Australia. We provide safe, reliable, guardian approved transport for children to and from childcare centres, schools, extracurricular activities and essential appointments, generally between 6:30am and 6:30pm.

Many of the children we carry are referred to us by child protection caseworkers, health professionals, schools, women's refuges, Aboriginal community controlled organisations and other community partners. We are founded and proudly operating on Noongar Boodja country.

Our registered details

• KaGo Transport Services Pty Ltd, ABN 95 685 730 830
• U5 / 15 Prindiville Drive, Wangara WA
• U30 to 32 Vinnicombe Drive, Canning Vale WA
• 7 Albert Street, Busselton WA
• General enquiries: [email protected]
• Transport bookings and registrations: [email protected]

03The Laws We Follow

We handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth), the Information Privacy Principles in the Privacy and Responsible Information Sharing Act 2024 (WA), and the child safety and record keeping obligations that apply to our service.

Commonwealth privacy law

The Privacy Act 1988 (Cth) contains a small business operator exemption for organisations under a turnover threshold. We do not rely on it. Because we handle sensitive information about children and vulnerable families, we apply the thirteen Australian Privacy Principles as our operating standard by choice, whether or not the exemption technically applies to us in a given year. The statutory tort for serious invasions of privacy, which commenced on 10 June 2025, applies to us regardless of the exemption.

Western Australian privacy law

The substantive privacy provisions of the Privacy and Responsible Information Sharing Act 2024 (WA), known as the PRIS Act, commenced on 1 July 2026. The Act introduces eleven Information Privacy Principles that apply to the Western Australian public sector and, in defined circumstances, to contracted service providers to public entities. Where we act as a contracted service provider in connection with a State services contract, we comply with those principles in respect of that work. The notifiable information breach scheme under the PRIS Act commences on 1 January 2027 and we will comply with it from that date.

Children's privacy

The Privacy and Other Legislation Amendment Act 2024 (Cth) requires the Office of the Australian Information Commissioner to register a Children's Online Privacy Code by 10 December 2026. We are monitoring the Code and will update this policy and our systems to align with it.

Child safety, care and record keeping

• Children and Community Services Act 2004 (WA), including mandatory reporting obligations
• Working with Children (Criminal Record Checking) Act 2004 (WA)
• Education and Care Services National Law and National Regulations, where we transport children to or from an approved education and care service
• Road transport, work health and safety, taxation, employment and corporate record keeping laws that require us to retain certain records

04Information We Collect

We collect personal information that is necessary to provide our transport services safely and effectively.

About parents, guardians and authorised contacts

• Full name, email address and phone number
• Residential address, and pickup and drop off addresses
• Relationship to the child, and evidence of guardianship or authority to make decisions for the child
• Emergency contact details, and the names of people authorised or not authorised to collect the child
• Payment and billing information, processed securely through our payment provider
• Any subsidy, funding or referral arrangement that applies
• Communications with our team, including notes of calls relevant to a child's transport

About children in our care

• Full name, date of birth and age
• Childcare centre or school name, address and session times
• Pickup and drop off addresses, including refuge, kinship, foster or temporary accommodation addresses where relevant
• Photograph, where a family or centre provides one so drivers and aides can identify the child correctly at pickup
• Medical conditions, allergies, medication, disability, additional access needs, mobility requirements and behaviour support needs
• Child restraint and seating requirements
• Aboriginal or Torres Strait Islander status, where provided, so we can support cultural safety and report accurately to funders
• Any relevant support referral or caseworker information provided to us
• Whether the child is subject to a care arrangement, protection order, court order or safety plan, and any access or contact restrictions affecting transport
• Trip records, including pickup and drop off times and locations

About referral partners and professionals

• Name, role, organisation, phone and email of caseworkers, health professionals, school and centre staff and community workers who refer or coordinate transport
• The content of a referral or support letter, and any funding or payment agreement attached to it

About drivers, transport aides, applicants and staff

• Full name, contact details, address, date of birth and right to work evidence
• Driver's licence details, driving history and vehicle details
• Working With Children Check number, status and expiry
• National Police Clearance outcome
• Employment history, references, training, induction and competency records
• Payroll, superannuation, banking and tax information
• Shift, vehicle check, incident and trip completion records generated through the driver app

Website, app and advertising information

• Device identifiers, IP address and browser type
• Pages visited, time spent and interactions within the KaGo app and on our website
• Vehicle location data during active trips, where permission is granted
• Where you respond to one of our advertisements on Facebook or Instagram, the contact details and answers you submit through the ad form. See Section 12.

05How We Collect Information

Wherever it is reasonable and practicable, we collect personal information directly from the individual concerned. Because of how our service works, we also receive information from others.

• Directly from you, when you submit a booking request, register as a guardian, contact us by phone or email, complete a form on our website, or submit an enquiry form attached to one of our advertisements.
• Through the KaGo apps, when you use the KaGo Parent or Driver app, including location data during active trips where permission has been granted.
• From childcare centres and schools, when they refer children to our service or share information to coordinate transport.
• From government agencies and caseworkers, when children are referred to us through the Department of Communities or other support services, including through a care plan, safety plan or court order provided so we can transport a child lawfully.
• From health professionals and community organisations, including GPs, child psychologists, child health nurses, refuges and Aboriginal community controlled organisations providing a support letter or referral.
• From background check providers, for Working With Children Checks and National Police Clearances for drivers and transport aides.
• Automatically via our website and advertising, through cookies, analytics tools, advertising technologies and server logs.

Where we collect information about a child or a family from someone other than the parent or guardian, we take reasonable steps to make sure the family knows we hold it, unless doing so would create a risk to the child or another person, or unless we are legally prevented from doing so.

06How We Use Your Information

We will not use personal information for a purpose unrelated to why it was collected, unless we have consent or are otherwise permitted or required by law.

07Sensitive Information and Consent

Health information, disability information, Aboriginal or Torres Strait Islander status and information about a child's involvement with child protection are all sensitive information. We apply a higher standard to it.

• We collect sensitive information only where it is reasonably necessary for transporting a child safely, and with consent, unless the law authorises or requires us to collect it without consent.
• We may collect and use sensitive information without consent where it is necessary to lessen or prevent a serious threat to the life, health or safety of a child or another person, and consent cannot reasonably be obtained.
• Sensitive information is visible on a need to know basis. A driver or aide is told what they need to keep that child safe on that run, such as an allergy, a seizure plan or a person who must not approach the vehicle. They are not given the child's broader case history.
• Providing Aboriginal or Torres Strait Islander status is always optional and never affects whether a child can be transported.

Consent for sensitive information is obtained separately and expressly at the point of collection. Using our website or services is not, by itself, treated by us as consent to the collection of sensitive information.

08Children's Privacy

The safety and privacy of children is our highest priority. We transport children aged from 0 to 15 years. Children do not create accounts with us and do not provide us information directly. Bookings, authorisations and app access are controlled by a parent, guardian or authorised referral partner.

• A child's record is only ever created through a verified parent, guardian, centre or referral partner.
• We never use a child's personal information for marketing, advertising, profiling, targeted content or any commercial purpose unrelated to their transport.
• Access to child records inside our systems is restricted by role and logged.
• All drivers and transport aides who handle child related information hold a current Working With Children Check.
• We do not publish a child's name, image or identifying details on our website, in our advertising, on social media or in any promotional material without express written consent, and never for a child in the care of the State without departmental approval.
• Older children capable of forming their own views may ask us about the information we hold about them. We will respond in a way appropriate to their age and circumstances, taking into account their safety and any care arrangements in place.

Where a child is the subject of a care order, safety plan or protection order, the person or agency with legal authority for that child controls decisions about their information, and we act on the instructions of that person or agency.

If you believe information about a child has been collected or used inappropriately, contact us immediately using the details in Section 18.

09Location and GPS Tracking

Live GPS tracking is one of the core safety features of our service, so we set out plainly how it works.

What is tracked

We track the location of KTS vehicles during operational runs. We do not track children. A child does not carry a device from us, and we do not monitor a child's location outside a KTS vehicle.

Who can see it

An authorised parent or guardian can see the live position of the vehicle carrying their child, and receives pickup and drop off confirmations. A guardian sees the vehicle in relation to their own child's trip only. They do not see other children on the run, other children's addresses, or other families' details.

Drivers and aides

Vehicle location data also shows where a driver is while they are on shift. We use this for dispatch, route management, safety, incident investigation and confirming trip completion. This is explained to drivers during onboarding and is covered in employment documentation.

Turning it off

Location tracking is part of the safety model of the service and cannot be switched off for an individual child's trip. A guardian can turn off push notifications on their own device at any time through their device settings, without affecting the child's transport.

10Disclosure of Information

We disclose personal information only where it is necessary, and only to the extent necessary. We do not sell, rent or trade personal information. We do not disclose personal information for third party marketing purposes.

11Child Safety and Mandatory Reporting

We will not promise confidentiality where a child's safety is at stake.

Under the Children and Community Services Act 2004 (WA), certain categories of worker have a legal duty to report a reasonable belief of child sexual abuse to the Department of Communities. From 1 November 2024, early childhood workers in Western Australia became mandatory reporters, joining groups including doctors, nurses, midwives, teachers, police officers, psychologists, school counsellors, out of home care workers and departmental officers.

Beyond any individual legal duty, KTS operates as a child safe organisation. Every member of our team is required to report concerns about a child's safety or wellbeing through our internal child safety process. Where we form a concern, we will:

• report it to the Department of Communities, the Police, or both, as the circumstances require
• share the information reasonably necessary to protect the child
• do so without first seeking the consent of the parent or guardian, where seeking consent would place the child at risk or compromise an investigation

We may also use or disclose personal information without consent where we reasonably believe it is necessary to lessen or prevent a serious threat to the life, health or safety of any individual.

12Website, Cookies and Advertising

Cookies

Our website uses cookies and similar technologies. Cookies are small text files stored on your device. We use:

• Essential cookies, required for the website to function correctly.
• Analytics cookies, which help us understand which pages are visited and how visitors navigate the site.
• Preference cookies, which remember your settings and choices on return visits.
• Advertising cookies and similar technologies, which support the delivery and measurement of our advertising, as described below.

You can control or disable cookies through your browser settings, though disabling some cookies may affect how the website works.

Advertising on Facebook and Instagram

We advertise our service on Meta platforms, including Facebook and Instagram, to reach families who need transport, childcare centres and schools, community partners and prospective drivers. Two things happen as part of that, and we set both out plainly.

Enquiry forms attached to our advertisements

Some of our advertisements include a form you can complete without leaving Facebook or Instagram. If you complete one, we receive the contact details and answers you provide, such as your name, email address, phone number, the area you are in, the age of your child, the centre or school involved and when you would prefer to be contacted.

We use that information to contact you about transport for your child, to answer your enquiry and to set up a booking if you want one. We store it in our customer management system alongside other enquiries. Information submitted through a form on a Meta platform is also handled by Meta in accordance with Meta's own privacy policy, and we are not responsible for Meta's handling of it.

We do not ask for a child's medical information, disability information, financial account details or government identifiers through an advertising form. If we need that information, we collect it directly and securely once you are in contact with our team.

Pixels and measurement tools

We use business tools provided by Meta Platforms, including the Meta Pixel and conversion measurement tools, on our website. These tools collect information about your visit, such as pages viewed, buttons clicked and forms submitted, and share it with Meta.

We use this to measure whether our advertising is working, to understand which pages families and partners find useful, and to show our advertisements to people who are likely to need our service. Meta and other companies use cookies, web beacons and similar technologies to collect or receive information from our website and elsewhere, and use that information to provide measurement services and to target advertisements.

You can opt out of interest based advertising through the following:

• Your Facebook or Instagram ad preferences, within your account settings on those platforms
• youronlinechoices.com.au, the Australian industry opt out page
• optout.aboutads.info, the Digital Advertising Alliance opt out page
• Your browser or device settings, which allow you to block or limit advertising cookies and identifiers

We do not use information about a child, or information about a family's involvement with child protection, health or disability services, for advertising targeting of any kind. Advertising audiences are built from website visitors and general interest and location signals, never from our child transport records.

Marketing communications

We may send service messages about a child's transport. These are not marketing and you cannot unsubscribe from them while your child is using the service. We may also send occasional updates about KTS, our services and our advocacy work. You can unsubscribe from those at any time using the link in the message or by contacting us, and unsubscribing will never affect a child's transport.

Third party links

Our website and apps may contain links to third party websites and services, including the Apple App Store, Google Play, mapping services and the websites of partner organisations. This policy does not apply to those services. We encourage you to read their privacy policies. We are not responsible for their content or their privacy practices.

13Service Providers and Overseas Storage

We use third party providers to run our service. These include our transport platform and its parent and driver apps, our website and customer relationship management platform, cloud hosting and backup, email, messaging and notification delivery, payment processing, accounting and payroll, and the advertising and analytics tools described in Section 12.

We require these providers to protect personal information, to use it only to deliver services to us, and to comply with applicable privacy law, under data processing agreements.

Storage outside Australia

Some of the technology providers we rely on store or process personal information outside Australia. This includes the United States, where Meta Platforms handles the advertising and measurement information described in Section 12, and where several of the cloud hosting, website and communications platforms we use operate their infrastructure.

Where we disclose personal information to a provider located outside Australia, we take reasonable steps to ensure the recipient handles it in a manner consistent with the Australian Privacy Principles, including through contractual data protection commitments.

We keep a current register of our service providers, the categories of personal information each one handles and the countries in which that information is stored. You can request a copy of that register, as it relates to information about you or a child you are the parent or guardian of, by contacting our Privacy Officer using the details in Section 18.

Our preference, and our direction of travel, is to hold operational data about children and families within Australia.

14Data Security and Data Breaches

How we protect information

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. Our measures include:

• Encrypted storage and transmission of personal information
• Role based access control, so team members see only what their role requires
• Individual accounts with unique credentials, secure password requirements and multi factor authentication on administrative systems
• Access logging on child and family records
• Working With Children Checks and National Police Clearances for drivers and aides before they commence
• Confidentiality obligations in employment agreements, and privacy and child safety training at induction
• Immediate removal of access when a team member leaves
• Data processing agreements with third party service providers
• Secure destruction of paper records and secure deletion of digital records at the end of their retention period
• Regular review of our data handling practices and systems

No method of electronic storage or transmission is completely secure. While we work hard to protect your information, we cannot guarantee absolute security. If you suspect a data security incident, notify us immediately using the details in Section 18.

If a breach occurs

If personal information we hold is lost, accessed without authorisation or disclosed without authorisation, we will:

1. contain the breach immediately and stop any ongoing exposure
2. assess within thirty days whether it is likely to result in serious harm
3. where serious harm is likely, notify affected individuals and the Office of the Australian Information Commissioner as soon as practicable, and tell people what happened, what information was involved and what steps they should take
4. notify the Department of Communities and any other referring agency where a child in their care is affected
5. review what failed and fix it

We apply the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth) as our standard. The notifiable information breach scheme under the PRIS Act (WA) commences on 1 January 2027 and we will comply with it from that date in respect of information held as a contracted service provider.

Because of the families we serve, we treat any breach involving a restricted address as a high harm event by default, regardless of the number of records involved.

15Data Retention

We retain personal information for as long as it is needed to provide our services and to meet our legal, regulatory and contractual obligations. When it is no longer required, we destroy or de-identify it securely.

How long we keep a record depends on what it is. Three rules govern every retention decision we make:

• Where the law sets a minimum retention period, we keep the record for at least that long. Employment, payroll and taxation records are kept for at least seven years, and financial records for at least five years, in line with taxation and employment law.
• Records relating to the safety or wellbeing of a child are held for an extended period. Australian child safe record keeping expectations, including those arising from the Royal Commission into Institutional Responses to Child Sexual Abuse, mean these records are retained well beyond the life of a transport arrangement so that a child can access them in adulthood if they ever need to.
• Where no legal minimum applies, we keep the record only for as long as it serves the purpose it was collected for, and no longer. Operational records such as location traces, and contact records from website enquiries that do not proceed to a booking, are held for a short period and then deleted.

The specific retention period for each category of record is set out in our internal Records Retention Schedule, which is reviewed with our legal advisers and updated when the law changes. You can ask us how long we will keep a particular record about you, or about a child you are the parent or guardian of, by contacting our Privacy Officer using the details in Section 18. We will tell you.

16Your Rights

Under the Australian Privacy Principles you have the right to:

• Access the personal information we hold about you, or about a child you are the parent or guardian of.
• Correct personal information that is inaccurate, out of date, incomplete, irrelevant or misleading.
• Complain about how we have handled personal information. See Section 17.
• Withdraw consent where we rely on consent as the basis for using information, noting this may affect our ability to provide services.

To exercise any of these rights, contact our Privacy Officer in writing using the details in Section 18. We will ask you to verify your identity and, where the request concerns a child, your authority to make it. We will respond within thirty days. There is no charge to make a request, though we may charge a reasonable cost for retrieving and providing a large volume of material, and we will tell you before we do.

When we may refuse

We may refuse access, in whole or in part, where the law allows or requires it. This includes where giving access would pose a serious threat to the life, health or safety of a person, would unreasonably affect the privacy of another person, would prejudice a child protection matter or a law enforcement investigation, or where a court order or care arrangement restricts disclosure. Where we decline a request we will explain why in writing and tell you how to complain.

Anonymity

You can contact us anonymously with a general enquiry. We cannot transport a child anonymously, because we need to know who the child is, where they are going, and who is authorised to release and receive them.

17Complaints

If you think we have mishandled personal information, tell us. We take privacy complaints seriously and we would rather hear about a problem directly.

1. Contact our Privacy Officer using the details in Section 18, setting out what happened and what you would like us to do.
2. We will acknowledge your complaint within five business days.
3. We will investigate and respond in writing within thirty days. If a matter is complex and we need longer, we will tell you why and when you can expect an answer.

If you are not satisfied with our response, you can escalate to:

• Office of the Australian Information Commissioner, for matters under the Privacy Act 1988 (Cth). Visit oaic.gov.au or call 1300 363 992.
• Office of the Information Commissioner, Western Australia, for matters under the PRIS Act relating to our work as a contracted service provider.

Concerns about the safety of a child should not wait for a privacy process. Contact the Department of Communities Central Intake Team, or call 000 in an emergency.

18Changes and Contact Us

We review this policy at least annually, and whenever our services, systems, obligations or the law change. When we make changes we update the version number and date at the top of this page. Where a change is material, we will notify you by email if we hold your email address, or by a prominent notice on our website. The current version is always published at kagotransportservices.com.au.