Privacy Policy - STEP

Last updated: 27 April 2026

ICO registration number: ZA231107

This Privacy Notice explains how Sustainable Commute Solutions Limited, trading as HomeRun, handles personal data and related information in connection with HomeRun STEP, STEP+, pilots, dashboards, reports, analytics and related services.

HomeRun STEP is a school-travel intelligence platform used by councils, schools and authorised partners to understand school travel patterns, model likely travel behaviour, and support evidence-led planning for safer, healthier and more sustainable school journeys.

This notice applies to STEP. It does not replace the separate HomeRun App Privacy Policy, Cookie Policy, customer contracts, Data Processing Agreement or other product-specific terms.

Key points

STEP is used by councils, schools and authorised partners. Pupils and parents do not use STEP directly.
STEP processes limited pupil-origin data, such as postcode, year group and school attended, where this is supplied by councils or schools.
HomeRun usually acts as a processor when handling pupil data supplied by a council or school to deliver STEP.
Councils and schools remain responsible for deciding their lawful basis for sharing and using pupil data in STEP.
STEP does not process pupil names, pupil email addresses, parent/carer contact details, or pupil IDs as part of its standard council/school input dataset.
STEP does not request or process SEND data.
STEP uses modelling and machine-learning techniques to predict likely travel mode and support wider school-travel analysis.
STEP does not make solely automated decisions about individual pupils, parents, carers or households.
STEP outputs are used to support planning and prioritisation. They must not be used for enforcement, attendance, safeguarding, eligibility decisions, or decisions about individual pupils or families.
STEP may display aggregated postcode-level or Output Area-level outputs, heatmaps, school-level summaries, maps, dashboards, reports and similar planning information.
Authorised users may export STEP-processed outputs, depending on their account permissions.
HomeRun uses role-based access controls, mandatory multi-factor authentication and logical customer segregation to protect STEP data.
STEP is hosted in Google Cloud Platform’s London region, europe-west2.
Google is used as a processor for hosting and related infrastructure. Google Maps APIs are also used to calculate journey information from origin-destination postcode pairs.

1. Who we are

HomeRun is the trading name of Sustainable Commute Solutions Limited.

Company: Sustainable Commute Solutions Limited
Company number: 10203718
Registered office: Sustainable Workspaces, County Hall, 5th Floor, The Riverside Building, Belvedere Road, London, SE1 7PB
ICO registration number: ZA231107
Email: info@homerun-app.com
Website: www.homerun-app.com

In this notice, “HomeRun”, “we”, “us” and “our” refer to Sustainable Commute Solutions Limited.

2. What STEP is

STEP is HomeRun’s School Travel Evaluation Platform. It is a digital analytics and intelligence platform that helps councils, schools and authorised partners understand school-travel patterns and identify opportunities to reduce car dependency, improve road safety, support active travel and plan school-travel interventions.

STEP can be used to:

model likely current travel mode;
assess home-to-school journey patterns;
estimate travel distance and journey characteristics;
identify where walking, wheeling, cycling, public transport or other alternatives may be realistic;
support prioritisation of schools, routes, corridors and areas;
support planning for interventions such as School Streets, safer routes, park-and-stride, walking buses and active-travel programmes;
support funding bids, monitoring, evaluation and public-sector planning.

STEP is a planning and decision-support tool. It is not a tool for making decisions about individual pupils, parents, carers or households.

3. Who this notice is for

This notice is mainly for:

councils and local authorities using STEP;
schools and academy trusts using STEP;
authorised STEP users with council or school accounts;
consultants, developers or delivery partners who may be given access to STEP with council permission;
parents, carers or pupils who want to understand how pupil-related data may be used where a council or school uses STEP.

Pupils and parents do not interact with STEP directly. STEP is accessed through named accounts held by councils, schools and authorised users.

4. Our role under data protection law

HomeRun’s role depends on the processing activity.

4.1 When we act as processor

When a council or school provides pupil data to HomeRun so that we can deliver STEP services, the council or school is normally the controller and HomeRun acts as processor.

In this role, we process the data on the documented instructions of the relevant council or school and in accordance with our contract.

This usually applies to pupil-related data supplied for STEP, such as:

pupil home postcode;
pupil year group;
school attended or school URN;
other agreed datasets supplied by the council or school for the STEP project.

4.2 When we act as controller

HomeRun acts as controller for some processing connected to STEP, including:

STEP user account administration;
portal usage logs and service operation data;
security monitoring;
support communications;
service administration emails;
HomeRun app journey data used to train or improve STEP models, where HomeRun determines that use;
HomeRun’s own business records;
genuinely anonymised derived data that no longer identifies individuals.

4.3 Anonymised data

Data protection law applies to personal data. It does not apply to information that has been genuinely anonymised so that individuals are no longer identifiable.

Some STEP processing involves pseudonymised or non-directly identifying data before outputs are aggregated or anonymised. Pseudonymised data can still be personal data where an individual could be identified directly or indirectly.

We therefore distinguish between:

pseudonymised or non-directly identifying data, such as pupil postcode, year group and school attended without names or contact details;
aggregated outputs, such as postcode-level, Output Area-level or school-level summaries;
genuinely anonymised data, where individuals are no longer identifiable.

5. Lawful basis for processing

Where a council or school supplies pupil data to HomeRun for STEP, the council or school is normally responsible for identifying and documenting its lawful basis under UK GDPR.

For local authorities, the lawful basis will commonly be public task, where the processing is necessary for official functions relating to school travel, transport planning, road safety, air quality, active travel, climate, education, public-health planning or public-service planning.

Where a school, academy trust or other organisation uses STEP, that organisation is responsible for confirming the lawful basis that applies to its own processing and data sharing.

Where HomeRun acts as controller, we rely on the following lawful bases depending on the activity:

Creating and managing STEP user accounts: legitimate interests in providing and securing the STEP service.
Portal usage logs and security monitoring: legitimate interests in operating, improving and protecting STEP.
Service, support and administrative emails: legitimate interests, or contract where applicable.
Responding to legal or regulatory obligations: legal obligation.
Pseudonymised HomeRun app journey data used for STEP model training: consent, where collected through the HomeRun app.
Retaining and using genuinely anonymised data: this is not personal data once it has been genuinely anonymised.

6. What data STEP processes

The data processed in STEP depends on the customer project, the datasets supplied by the council or school, and the configuration of the platform.

6.1 Pupil-related data supplied by councils or schools

STEP’s standard pupil-related input data may include:

pupil home postcode;
pupil year group;
school attended;
school Unique Reference Number, where applicable.

Councils or schools may also choose to provide additional agreed datasets, such as:

hands-up survey results;
existing mode-of-travel data;
home-to-school transport data;
passenger transport eligibility or usage data;
other school-travel datasets agreed for the project.

STEP does not require pupil names, parent/carer names, home addresses, email addresses, phone numbers or pupil IDs for its standard modelling process.

6.2 Data STEP does not request or process

STEP does not request or process SEND data.

STEP is not designed to process safeguarding information, attendance records, behaviour records, criminal offence data, biometric data or pupil contact details.

6.3 HomeRun app journey data used for model training

HomeRun may use pseudonymised HomeRun app journey data to train, validate and improve STEP’s travel-mode prediction model.

This may include:

origin postcode;
destination school;
selected journey mode;
student year.

Direct identifiers, such as names, email addresses and phone numbers, are not used for this model-training purpose.

HomeRun app users should also refer to the separate HomeRun App Privacy Policy for information about app data processing.

6.4 Public and third-party datasets

STEP uses public, open and licensed datasets to improve school-travel modelling and contextual analysis. These may include datasets relating to:

schools and school characteristics;
school-level contextual information, including free school meal indicators where included in public school datasets;
postcode, Output Area, LSOA, MSOA and local authority geographies;
deprivation and socioeconomic indicators;
area-level income estimates;
area-level health, demographic or public-health indicators;
walking, cycling and transport statistics;
car or van availability;
public transport stops and connectivity;
road safety and collision statistics;
roads, pavements, cycle lanes, bus lanes, speed and other transport-network data;
topography and route characteristics;
Ordnance Survey mapping and transport-network datasets.

These public and third-party datasets are used as contextual features. They are not used to infer an individual pupil’s income, health status, deprivation status or personal circumstances.

6.5 STEP user account and portal data

For STEP user accounts, HomeRun collects and uses the user’s work email address.

STEP also records portal usage information, including:

pages viewed;
actions taken within the portal.

Support requests may be handled through HomeRun’s email inbox or Pipedrive.

7. Where STEP data comes from

STEP data may come from:

local authorities;
schools;
academy trusts;
HomeRun app users, where app users have provided consent for relevant app data use;
public datasets;
licensed third-party datasets, such as Ordnance Survey datasets;
customer support interactions with STEP users.

Councils and schools are responsible for ensuring they have appropriate lawful basis, notices and permissions to provide data to HomeRun for STEP.

8. How STEP uses data

STEP uses data to provide school-travel analytics and planning intelligence.

This may include:

modelling likely current travel mode;
generating journey-level predictions internally before aggregation;
calculating journey distance, duration and route characteristics;
analysing school catchments and travel patterns;
estimating the environmental and congestion impact of school travel;
identifying opportunities for walking, wheeling, cycling, public transport or other alternatives;
modelling modal-shift scenarios;
prioritising schools, routes, corridors or areas for potential intervention;
supporting funding bids, monitoring and evaluation;
producing dashboards, maps, reports and aggregated exports;
maintaining, validating, securing and improving STEP;
training and improving travel-mode prediction models where permitted.

9. AI, machine learning and automated decision-making

STEP uses machine-learning models to predict likely travel mode. Other data-modelling methods are used to assess journey feasibility, modal-shift potential, intervention opportunities and planning scenarios.

STEP may generate journey-level predictions internally before results are aggregated for customer-facing dashboards, reports, maps or exports

STEP does not make solely automated decisions about individual pupils, parents, carers or households. STEP is not used to make decisions with legal or similarly significant effects on individuals.

STEP outputs are used as decision-support information and are subject to human review by HomeRun, councils, schools or authorised users before they are used for planning or prioritisation.

A council may use STEP outputs to help decide which schools, routes or areas should be prioritised for investment or intervention. STEP outputs must not be used for enforcement, attendance, safeguarding, eligibility, individual transport entitlement, or decisions about individual pupils or families.

10. What STEP users can see

STEP users can only access information according to their account permissions.

Depending on their role and permissions, users may see:

school-level summaries;
aggregated postcode-level outputs;
aggregated Output Area-level outputs;
heatmaps showing the number of pupils within postcode or Output Area boundaries;
school catchment and journey-pattern maps;
route, corridor or area-level analysis;
modelled mode-share estimates;
scenario modelling;
public contextual indicators such as school-level FSM information, area-level deprivation indicators and area-level income indicators.

STEP does not show pupil names, parent/carer names, home addresses, contact details or pupil IDs.

STEP may display aggregated origin patterns using postcode boundaries, Output Area boundaries, heatmaps or similar geographic visualisations.

11. Exports

Authorised STEP users may export STEP-processed outputs, depending on their permissions.

Exports may include:

aggregated tables;
postcode-level aggregated outputs;
school-level reports;
maps;
PDFs;
CSVs or similar files;
other STEP-processed outputs.

STEP users cannot download the raw pupil data uploaded to STEP through the portal. They can only access STEP-processed outputs.

HomeRun does not retain customer exports, reports or maps after they are generated, unless otherwise agreed or required for support, security or contractual purposes.

12. Who can access STEP

STEP is account-based and permission-controlled.

12.1 Council users

Council users can access STEP outputs within their own authority, according to their account permissions.

Council users cannot access outputs for other authorities unless the relevant parties have authorised sharing.

12.2 School users

School users can access outputs for their own school only, unless additional access has been expressly authorised.

12.3 Consultants, developers and delivery partners

Councils may authorise named third-party users, such as consultants, developers or delivery partners, to access STEP.

These users may be able to view and export the same STEP outputs as the council, depending on the permissions set for their account.

12.4 HomeRun staff

Authorised HomeRun personnel may access row-level pseudonymised journey records where necessary to provide, maintain, validate, secure, test or improve STEP.

HomeRun staff access is role-based and limited to personnel who need access for their role.

13. Sharing and recipients

HomeRun does not sell STEP personal data.

HomeRun may share or make data available in the following ways:

The recipients and purposes are as follows:

Relevant council customer: may access STEP outputs for its authority for planning, prioritisation, reporting and decision support.
Relevant school user: may access STEP outputs for that school for school-travel planning and reporting.
Council-authorised consultants, developers or delivery partners: may access STEP outputs according to permissions set by or for the council, to support council-approved planning, design, delivery or analysis.
Google Cloud Platform: hosts STEP data in HomeRun’s cloud environment for hosting, storage, backups and infrastructure.
Google Maps APIs: may receive origin-destination postcode pairs or related location data for journey, routing and mapping calculations.
Pipedrive: may receive STEP user support information where support is handled through Pipedrive, for customer support and service administration.
Legal, regulatory or public authorities: may receive information required by law for legal compliance.

14. Google Cloud, Google Maps and other datasets

STEP is hosted on Google Cloud Platform in the London region, europe-west2. Backups are stored in the same region.

STEP uses Google Maps APIs to calculate journey information. For this purpose, origin-destination postcode pairs or related location data may be sent to Google.

Ordnance Survey datasets and other public datasets used by STEP are downloaded and stored by HomeRun in the UK. STEP does not send pupil data to Ordnance Survey or other public dataset providers as part of normal processing.

15. International transfers

STEP data is hosted in the UK. HomeRun restricts access to STEP data to the UK or European Economic Area.

Where Google processes location or routing data through Google Maps APIs, that processing is governed by Google’s applicable data protection terms.

HomeRun will only transfer personal data outside the UK or EEA where permitted under applicable data protection law and with appropriate safeguards in place.

16. How long we keep data

HomeRun keeps STEP data only for as long as needed for the purposes described in this notice, unless a longer period is required by law or agreed in the relevant customer contract.

The retention periods and approaches are as follows:

Raw council or school upload files: retained until the council or school asks HomeRun to remove them, or until the contract ends.
Processed or pseudonymised pupil-related datasets: retained for longitudinal analysis, service delivery, model validation and statistical purposes unless deleted, returned or anonymised under the relevant contract.
Genuinely anonymised datasets: may be retained indefinitely.
Dashboard cache: cleared weekly.
Customer exports, reports and maps: not retained by HomeRun after generation, unless otherwise agreed or required for support, security or contractual purposes.
STEP user account data: retained for 90 days after account closure or contract end.
Portal usage logs: retained for 90 days.
Security, access and audit logs: retained for 90 days, unless longer retention is required for investigation or legal purposes.
Backups: retained for up to 1 year.
Support records: retained as needed to provide support and maintain business records, then deleted or archived according to HomeRun’s internal retention procedures.

Where HomeRun processes pupil data as processor, deletion or return of data is handled in accordance with the relevant customer contract and documented instructions from the controller.

17. Security

HomeRun uses technical and organisational measures designed to protect STEP data.

These include:

hosting STEP in Google Cloud Platform’s UK London region;
logical segregation between customer organisations using organisation IDs;
role-based access controls;
mandatory multi-factor authentication for all users;
quarterly access reviews;
annual penetration testing;
staff confidentiality obligations;
access restrictions for HomeRun personnel;
secure cloud storage and backup controls;
security monitoring and incident-response procedures.

HomeRun holds active Cyber Essentials Plus certification, most recently from November 2025.

No system is completely secure. HomeRun maintains procedures to prevent, detect, investigate and respond to security incidents.

Where HomeRun acts as processor, HomeRun will notify the relevant controller of personal data breaches in accordance with UK GDPR and applicable contractual obligations.

18. Cookies and analytics

STEP uses strictly necessary cookies for login and session management.

STEP may also use analytics technologies, including Google Analytics, to understand portal usage and improve the service, where permitted by law and applicable cookie settings.

Where analytics cookies or similar technologies are not strictly necessary, HomeRun will use them only where permitted under applicable law.

19. Service and administrative emails

HomeRun uses STEP user contact details to send service, security, support and administrative communications.

HomeRun does not use STEP account details for unrelated marketing emails.

20. Individual rights

Individuals have rights under data protection law. These may include rights to:

access personal data;
correct inaccurate personal data;
request erasure;
restrict processing;
object to processing;
data portability, where applicable;
complain to the Information Commissioner’s Office.

The rights available in a particular case depend on the data, the lawful basis for processing, and whether HomeRun is acting as controller or processor.

21. Requests relating to pupil data

Where HomeRun processes pupil data on behalf of a council or school, the council or school is normally the controller and is responsible for responding to requests from pupils, parents or carers.

If HomeRun receives a request relating to pupil data that we process as processor, we will refer the request to the relevant council or school, or assist them in responding, as required by UK GDPR and our contract.

Because STEP data is pseudonymised and does not include pupil names, direct identifiers or contact details, HomeRun may not be able to identify an individual pupil from a request without support from the relevant council or school.

Individuals may contact HomeRun about STEP privacy matters using the contact details below, but we may need to involve the relevant council or school to handle the request properly.

22. Complaints

If you have a question or concern about how HomeRun handles STEP data, please contact us first.

Email: info@homerun-app.com

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection.

ICO website: www.ico.org.uk

23. Changes to this notice

HomeRun may update this STEP Privacy Notice from time to time.

When we make material changes, we will update the “Last updated” date at the top of this notice and, where appropriate, notify customers or users through the STEP platform, email or our website.

24. Related documents

This notice should be read alongside, where applicable:

the HomeRun App Privacy Policy;
the HomeRun Cookie Policy;
the STEP customer contract;
the STEP Data Processing Agreement or Data Processing Schedule;
the STEP Sub-processor List;
the HomeRun EULA, where relevant;
customer-specific data-sharing or onboarding documents.

25. Contact HomeRun

For questions about this STEP Privacy Notice or HomeRun’s handling of STEP data, contact:

HomeRun / Sustainable Commute Solutions Limited
Sustainable Workspaces, County Hall, 5th Floor
The Riverside Building
Belvedere Road
London SE1 7PB
United Kingdom