Effective Date: October 15, 2025

Overview and Scope

We at First Alt, a service of First Student, Inc. (the “Company,” “we,” “our,” or “us”) recognize the importance of protecting the privacy of personally identifiable information (“Personal Information” or “PII”) collected about you and other users (collectively, “Users”) through mobile application and website (collectively, the “First Alt Service(s)”). We are committed to ensuring that your privacy is protected. To that end, this Privacy Policy (“Policy”) discloses our practices regarding the collection, use, and disclosure of the PII we receive through Users’ use of the First Alt Service. Unless otherwise expressly agreed to in writing, your Personal Information will be processed according to the terms of this Policy. By using the First Alt Service, you accept the terms of this Policy. Your access and use of the First Alt Service is also subject to our Terms of Use available here: https://firststudentinc.com/terms-of-use-firstalt/

This Policy is drafted to comply with the California Consumer Privacy Act (“CCPA”) (as amended by the California Privacy Rights Act (“CPRA”)) and other emerging U.S. consumer data protection laws. We are the data controller of information we collect from Users through the First Alt Service. This Policy applies to the First Alt Service, which includes the Company mobile application, https://www.firstalt.com, its subdomains, and all of the websites and internet properties owned or operated by us, regardless of the medium by which the First Alt Service is accessed by Users (e.g., via a web or mobile browser).

Information We Collect

We are the sole owner of information collected on the First Alt Service. We collect several types of information from and about Users of the First Alt Service, including:

Personal Information: We may collect PII from you when you complete forms, navigate web pages, and in connection with other activities, services, features, or resources we make available on the First Alt Service. PII means any information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, including Sensitive PII. PII does not include publicly available information from government records, deidentified or aggregate information, or information excluded from the scope of the CCPA.

The types of PII we have collected, used, stored, and disclosed in the last twelve (12) months include the following categories of information:

Category	Type(s) of Information
Identifiers	First Name, Last Name, Email, Phone Number, Postal Address, IP Address
Driver and Vehicle Information	Vehicle Type, License Plate Number, Insurance Information
Internet or Other Similar Network Activities	Interactions with the First Alt Service
Sensitive PII	Geolocation Data, Driver’s License Number, Data Concerning Student Health Conditions   We only use Sensitive PII for business purposes necessary to deliver the FirstAlt Services.
Other Information	School, Equipment Type

Driver Eligibility Information: We may collect certain Personal Information from you as part of the onboarding process which may include: (i) fingerprinting, (ii) drug screening, (iii) verification of medical examinations, and/or (iv) TB skin tests. We may also collect certain information you provide as part of these checks, such as criminal background and motor vehicle record checks. Some driver eligibility information may be considered Sensitive PII. If you fail to provide any information related to such screenings, you may not be able to provide First Alt Service.

Location Tracking: To support operational efficiency and service reliability, we may capture driver location data at regular intervals (every 15 minutes) during operational hours (5:00 AM – 8:00 PM in driver time zone), Monday-Friday when the FirstAlt Service application is running in background and foreground.

Deidentified Information: We may collect deidentified information from you and aggregate information that cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to you as the source when you use the First Alt Service (“Deidentified Information”). Deidentified Information may include: (i) device type, (ii) device operating system, (iii) internet browser type, (iv) internet service provider, (v) referring/exit pages, (vi) date/time stamp, and (vii) clickstream information. Deidentified Information may also include telematics data including, but not limited to: (i) harsh braking, (ii) rapid acceleration, (iii) speeding, (iv) idle time, and (v) phone handling.

Company is committed to maintaining and using Deidentified Information in deidentified form and using reasonable measures to ensure that Deidentified Information we collect is not personally identifiable as required by applicable law. Company will not attempt to reidentify the information, except that the business may attempt to reidentify the information solely for the purpose of determining whether its deidentification processes is successful.

Children’s Information: We do not offer our services or promote the First Alt Service to, nor does the First Alt Service intentionally collect or retain PII directly from children who are younger than 18 years of age. If we discover that we have inadvertently collected information directly from a child under 18 years of age through the First Alt Service, we will promptly take all reasonable measures to delete such information from our systems. Notwithstanding the foregoing, we do receive children’s information from school district partners and such use is subject to contract terms between the school district partner and us.

How We Collect Information

The information we collect depends on what Users do when they visit or utilize the First Alt Service. We collect PII and Deidentified Information in various ways, including:

Directly from You: We collect PII when you voluntarily submit PII to us when you upload documents or information on the First Alt Service, while completing forms on the First Alt Service, and in connection with other activities, services, features, or resources we make available on the First Alt Service. The PII we collect depends on what you do when you visit or utilize the First Alt Service or how you choose to communicate with us.

Through Your Use of the First Alt Service: We may collect PII and Deidentified Information that the mobile application or website transmits when you use the First Alt Service. We may also collect Deidentified Information about how you access and interact with the First Alt Service through the use of automated tracking technologies, such as session cookies, persistent cookies, and web beacons.

A cookie is a small data file that is transferred to an internet browser, which enables the First Alt Service to remember and customize your subsequent visits. We may use session cookies to make it easier for you to navigate the First Alt Service. In particular, we may use session cookies to record session information, such as which web pages you visited and to track your activity on the First Alt Service. Session cookies expire when you close your browser. We may also use persistent cookies to track and target your interests to enhance your experience on the First Alt Service. Persistent cookies remain on your device for an extended period of time. Additionally, we may use web beacons, which are single-pixel, electronic images embedded in the First Alt Service that allow us to gather information about your browsing activities on the First Alt Service.

Most internet browsers automatically accept cookies. However, you can instruct your internet browser to block cookies or to provide you with a warning prompt before you accept cookies from the First Alt Service. Please refer to your internet browser’s instructions to learn more about these functions. If you reject cookies, the functionality of the First Alt Service may be limited and you may not be able to participate in several of the First Alt Service’s features.

From Third Party First Alt Services: We may collect PII about you from third parties (e.g., dispatch partners, school district partners) whose privacy practices may differ from the practices described in this Policy. We do not make any representations or warranties concerning, and will not in any way be liable for, any informational content, products, services, software, or other materials available through third parties. Your use of third parties’ services and/or third party websites is governed by and subject to the terms and conditions of those third parties and/or third party websites. We encourage you to carefully review the privacy policies and statements of such third parties and/or third party websites.

How We Use Information

We may use Users’ PII for lawful business purposes: (i) as necessary for the performance of our contract with Users, (ii) for our legitimate interests, so long as they are not overridden by Users’ own rights and interests, or (iii) as required by law. These purposes include:

Delivery of the First Alt Services: We may use your PII and/or Deidentified Information to facilitate our delivery of the First Alt Services to you and improve the First Alt Services.

Verify Driver Eligibility: We may use your PII to verify your eligibility to serve as a driver.

Communicate with You: We may use your PII to deliver trip reminders and facilitate communications directly with you.

Operational Continuity: We may use your location data to facilitate operational continuity, including but not limited to the timely identification and assignment of substitute drivers in the event of scheduling conflicts, unavailability, or other unforeseen circumstances in the provision of First Alt Service.

Customer First Alt Service and User Communications: We may use your PII to help us respond to your inquiries, questions, requests, and support needs more efficiently. We may also communicate with you regarding enhancements or changes to the First Alt Service.

User Experience Personalization: We may use your PII and/or Deidentified Information in the aggregate to analyze Users’ browsing and usage activities and patterns in order to understand Users’ interests and preferences with respect to the First Alt Service and our services. This will help us optimize your experience on the First Alt Service.

Business Optimization: We may use your PII and/or Deidentified Information to improve the content on our web pages and mobile application, to customize the content and layout of our web pages, and in managing our everyday business needs. We may also use your feedback to improve the First Alt Service and our services. All of this is done with the intention of making the First Alt Service more useful for you.

Safety and Security: We may use your PII and/or Deidentified Information to promote the safety and security of the First Alt Service, our users, and other parties. For example, we may use the information to authenticate users, protect against fraud and abuse, respond to a legal request or claim, conduct audits, and enforce our terms and policies.

We will not collect additional categories of PII or use PII we collected for materially different, unrelated, or incompatible purposes without providing you notice.

How We Disclose Information

We may disclose Users’ PII to third parties for a business purpose as described below. Otherwise, we do not sell, rent, lease, or “share” PII, and will not disclose Users’ PII to third parties without your permission. The CCPA defines “sharing” as the disclosure of PII for cross-context behavioral advertising.

However, we may sell, rent, or lease Deidentified Information collected through the First Alt Service to third-parties. As described above, Deidentified Information cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to you as the source, and is not considered Personal Information.

To Our Affiliates: We may disclose your PII to affiliates and subsidiaries, including companies within the First Group America group.

To Dispatch and School District Partners: We may disclose your PII to trusted dispatch partners responsible for scheduling drivers’ rides and routes as well as school districts we partner with in providing the First Alt Service.

To First Alt Service Providers: We may disclose your PII to third party service providers that assist us in providing user support, communicating with Users, and promoting our services, as well as third party service providers that provide other services to us relating to our services and/or the First Alt Service.

Law Enforcement, Safety, and Legal Processes: We may disclose your PII to law enforcement or other government officials if it relates to a criminal investigation or alleged criminal activity. We may also disclose your PII: (i) if required or permitted to do so by law; (ii) for fraud protection and credit risk reduction purposes; (iii) in the good-faith belief that such action is necessary to protect our rights, interests, or property; (iv) in the good-faith belief that such action is necessary to protect your safety or the safety of others; or (v) to comply with a judicial proceeding, court order, subpoena, or other similar legal or administrative process.

Sale or Acquisition of Assets: If we become involved in a transaction involving the sale of our assets, such as a merger or acquisition, or if we are transferred to another company, we may disclose and/or transfer your PII as part of the transaction. If the surviving entity in that transaction is not us, the surviving company may use your PII pursuant to its own privacy policies, and those policies may be different from this Policy.

Type of Information Disclosed

In the last twelve (12) months, we have disclosed the following categories of PII to third parties for a lawful business purpose:

• Identifiers;
• Driver and Vehicle Information;
• Internet or Other Similar Network Activities;
• Geolocation Data;
• Sensitive PII;
• Other Information; and
• Driver Eligibility Information.

Security

The security and confidentiality of your PII is very important to us. We use commercially reasonable security measures to protect your PII on the First Alt Service. However, no data transmitted over or accessible through the internet can be guaranteed to be 100% secure. As a result, while we attempt to protect your PII, we cannot guarantee or warrant that your PII will be completely secure (i) from misappropriation by hackers or from other nefarious or criminal activities, or (ii) in the event of a failure of computer hardware, software, or a telecommunications networks.

Data Retention

We will retain Users’ PII (including Sensitive PII, where applicable) while they maintain an account with us or to the extent necessary to provide the services through the First Alt Service. Thereafter, we will keep PII for as long as reasonably necessary: (i) to respond to any queries from Users; (ii) to demonstrate we treated Users fairly; (iii) for ordinary business continuity procedures; or (iv) to comply with any applicable laws. We delete PII within a reasonable period after we no longer need the information for the purposes set out in this Policy.

Legal Rights

CCPA California Resident Rights

If you are a California resident, the CCPA grants you certain data privacy rights. Your rights include the:

• Right to Access: You have the right to request a copy of the specific pieces of PII that we have collected about you in the previous twelve (12) months. The information will be delivered by mail or electronically. Upon receipt of a Verifiable Consumer Request, we will disclose:
  • The categories of PII we have collected about you;
  • The categories of sources from which PII is collected;
  • Our business purpose for collecting PII;
  • The categories of third parties with whom we share PII, if any; and
  • The specific pieces of PII we have collected about you.
• Right to Data Portability: You have the right to receive your PII in a portable, readily usable format that allows you to transmit your information to another entity without hindrance.
• Right to Correct Inaccurate Information: You have the right to request that we correct inaccurate information about you that we maintain.
• Right to Deletion: You have the right request that we delete your PII.
• Right to Be Free from Discrimination: You have the right to not be discriminated against by us for exercising any of your rights under the CCPA. Unless permitted by the CCPA, we will not:
  • Deny goods or services to you;
  • Charge different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties;
  • Provide a different level or quality of goods or services to you; or
  • Suggest that you will receive a different price or rate for goods or services or a different level or quality of goods or services.

To exercise your rights, please use the Verifiable Consumer Request method described below. Please be aware that your rights (including those enumerated elsewhere in this Policy) are limited to the extent permitted by applicable law.

Additional California Privacy Rights

California’s “Shine the Light” law permits Users of the First Alt Service that are California residents to request certain information regarding our disclosure of PII to third parties for their direct marketing purposes. To make such a request, please contact us at the Contact Information provided below.

Verifiable Consumer Requests

You can exercise your legal rights by submitting a Verifiable Consumer Request to us by:

• Calling us at 1-844-930-1776.
• Emailing us at USPrivacy@FirstGroup.com

Only you, or someone legally authorized to act on your behalf, may make a Verifiable Consumer Request related to your PII. Making a Verifiable Consumer Request does not require you to create an account with us. You may only make a Verifiable Consumer Request for access to PII twice in a 12-month period.

The Verifiable Consumer Request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative; and
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with PII if we cannot verify your identity or authority to make the request and confirm the PII relates to you. We will only use PII provided in a Verifiable Consumer Request to verify the requestor’s identity or authority to make the request.

Response Timing and Format

We will acknowledge receipt of a Verifiable Consumer Request within ten (10) business days. We endeavor to respond to Verifiable Consumer Requests within forty-five (45) days of its receipt. If we require more time (up to ninety (90) days), we will inform you of the reason and extension period in writing. Any disclosures we provide will only cover the 12-month period preceding the Verifiable Consumer Request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

We do not charge a fee to process or respond to Verifiable Consumer Requests, unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Do Not Track Disclosure

Some internet browsers may transmit “do-not-track” signals to websites with which the browser communicates. The First Alt Service does not currently respond to these “do-not-track” signals.

SPAM

We do not participate in bulk email solicitations that you have not consented to receiving (i.e., “Spam”).  We do not sell or disclose customer lists or email address lists to unrelated third parties. Except as otherwise provided herein, we do not share PII with any third party advertisers.

Third Party Links

The First Alt Service may contain links to other websites or applications (“Linked Services”) that are not owned by the Company. We do not control the collection or use of any information, including PII, which occurs while you visit Linked Services. Therefore, we make no representations or warranties for —and will not in any way be liable for—any content, products, services, software, or other materials available on Linked Services, even if one or more pages of the Linked Service are framed within a page of the First Alt Service.

Furthermore, we make no representations or warranties about the privacy policies or practices of the Linked Services, and the Company is not responsible for the privacy practices of those Linked Services. We encourage you to be aware of when you leave the First Alt Service and read the privacy policies of Linked Services.

Modifications

We reserve the right to update this Policy from time-to-time in our sole discretion. If our privacy practices change materially in the future, we will post an updated version of the privacy policy to the First Alt Service. It is your responsibility to review this Policy for any changes each time you use the First Alt Service. We will not lessen your rights under this Policy without your explicit consent. If you do not agree with the changes made, we will honor any opt-out requests made after the Effective Date of a new privacy policy.

Accessing, Updating, and Controlling Information

If you ever wish to access, update, change, delete, opt-out of us sharing, or otherwise control your PII, or cancel your user account you may do so by making such changes through your user account or contacting us at the Contact Information provided below. To help us process your request, please provide sufficient information to allow us to identify you in our records. We reserve the right to ask for additional information verifying your identity prior to disclosing any PII to you. Should we ask for verification, the information you provide will be used only for verification purposes, and all copies of the information will be destroyed when the process is complete.

If you wish to opt-out of receiving update messages and/or direct marketing communications from us, you may opt-out by (i) following any instructions included in the communication or (ii) contacting us at the Contact Information provided below, or (iii) by making such changes through your user account. Please be aware that although you may opt-out of update messages and/or direct marketing communications, we reserve the right to email you administrative notices regarding the First Alt Service, as permitted under the CAN-SPAM Act.

If you wish to delete your First Alt account without logging in, please contact us by calling our helpline number at 833-201-4436 from your registered mobile number or by sending an email from your registered email address with the subject “Request for Account Deletion” to support_altprod@firstgroup.com. Our team will handle your request per our data collection policy.

Contact Information

If you have questions about this Policy or wish to contact us with questions or comments, please contact us at:

Attn: North American Privacy Office

First Student, Inc.

191 Rosa Parks Street, 8th Floor,

Cincinnati, OH 45202

• Phone: 1-844-930-1776.
• Email: USPrivacy@FirstGroup.com

Effective Date

This Policy was last modified as of the effective date printed above. This version of the privacy policy replaces and supersedes any prior privacy policies applicable to the First Alt Service.