Child Safety

1. What data do we process about minors?

Kidstoride collects only the data strictly necessary to manage the booked journey: the child's first name, age, and — if the parent voluntarily provides it — any accessibility needs.

This data is tied exclusively to the parent or legal guardian's booking. Minors do not have their own account and are not treated as independent profiles on the platform.

2. No advertising to minors

The platform displays no advertising of any kind. Kidstoride is a paid service with no advertising-based business model.

Children's data will never be used for advertising targeting, retargeting, or commercial communication, in compliance with Art. 28.1 of the Digital Services Act (DSA).

3. No profiling of minors

Children's data is not aggregated, analysed, or combined to build behavioural profiles, preference categories, or any other classification.

There are no per-child analytics and no automated decision-making affecting minors, in line with DSA Art. 28.2 and GDPR Art. 22.

4. Technical controls

• MinorDataGuard: a control layer that blocks any unauthorised access to children's data.
• Audit log: every access to children's data is recorded with a timestamp and the identity of the requestor.
• Minimum access: only the registered parent and the driver assigned to the trip may view the child's name and age, and only during the active trip window.
• Encryption in transit and at rest for all fields that identify a minor.

5. Legal basis for processing

Processing of children's data is based on GDPR Art. 6(1)(b) (performance of the transport contract entered into by the parent) and, where applicable, on explicit parental consent collected during registration under GDPR Art. 8.

Parents may at any time request deletion of their child's data through the account settings or by email.

6. Exercising rights and contact

To exercise rights of access, rectification, erasure, portability, or objection regarding children's data, email us at legal@kidstoride.com with the subject line «DSA/GDPR — Child Data».

We respond to requests within a maximum of 30 calendar days.