Privacy Notice

1. Two different roles

It matters which of these applies, because it decides who you should contact.

We are the controller for personal data we decide what to do with: our own users and their accounts, people who contact us or apply for an account, information published in public environmental registers, and data about how our website is used.

We are a processor for the waste movement data our customers enter into the platform. That data belongs to the customer. We handle it on their instructions under a data processing agreement, and we do not decide what it is used for.

If your details are in a waste movement record — for example as a driver or site contact — the business that entered the record is responsible for your data. Please contact them first; we will help them respond.

2. Data we hold as controller

People who use the platform

Name, email address, telephone number, job role, which organisation and sites you belong to, your notification preferences, when you last signed in, and your account credentials. We also keep records of invitations sent, notifications delivered, and any feedback you give us.

People who contact us or apply for an account

If you apply for an account we keep your name, email address, your organisation's name and address, and any note you add. If you use our contact form we receive your name, email address and message by email; we do not store the form submission in the platform. If you book a demonstration, the booking is handled by Calendly.

Information from public registers

We hold and keep up to date information from the Environment Agency and Natural Resources Wales registers of waste carriers, brokers, exemptions and permitted operators, and make it available to signed-in users of the platform so they can check who they are dealing with. It is not published on our website. Where the holder is a sole trader or an individual, that information is personal data — typically a name, trading address and permit details. It comes from those public registers, not from you. We also use it to identify organisations that may benefit from Wasters and to contact them about our services.

Website and application use

Our website and the application use analytics and advertising tools that collect your IP address, device and browser information, and the pages you visit. These are switched off until you agree to them, and you can change or withdraw your choice at any time. We keep a record of the choice you made and the date you made it. See our Cookie Policy.

Parts of the application are delivered from Google's servers each time it loads, so your IP address reaches Google whatever cookie choice you make. No cookies are set as a result.

3. Data we process for our customers

When a customer records a waste movement, that record can contain personal data about people who are not our users. Depending on the movement, this includes:

• contact names, email addresses, telephone numbers and addresses for the producer, carrier, broker and receiving site
• driver names, driving licence numbers, and training expiry dates
• vehicle and trailer registration numbers
• the names of staff who received or processed the waste
• free-text notes, which may mention people

We also keep records of what was submitted to the Digital Waste Tracking Service, and an audit trail of changes to movement records.

Documents customers upload. Customers can upload permits, licences, waste carrier registrations and similar documents. These often contain personal data — a sole trader's name and trading address, or a named permit holder. They are stored privately and are readable only by signed-in users who are authorised to see them.

Visibility to other organisations. Where more than one party to a movement uses Wasters, the movement record may be visible to each of them, so that everyone in the chain can work from the same record. It is not shown to Wasters customers who are not a party to that movement.

Submission to the Digital Waste Tracking Service. Waste movement information is submitted to the Digital Waste Tracking Service. This includes contact email addresses and telephone numbers for the receiving site and the carrier, the vehicle registration for road transport, and organisation names and addresses. Driver names and driving licence numbers are not submitted.

Once it reaches that service, the personal data in it is controlled by the UK environmental regulators, not by us or by our customer. Section 5 explains who they are.

Improving the platform. We may create anonymised, aggregated information from data in the platform — for example, lists of common waste descriptions and hazardous components — and use it to improve the platform for all customers and to produce industry insight. This information does not identify any person or organisation.

4. Why we use it, and our lawful basis

Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights. You can ask us for that assessment.

5. Who we share it with

We use the following providers. Each may handle personal data on our behalf. Our customers can also see our sub-processor list, which covers the providers that handle the data they put into the platform.

We also submit waste movement data to the Digital Waste Tracking Service, which is a legal requirement for our customers.

The four UK environmental regulators — the Environment Agency, Natural Resources Wales, the Scottish Environment Protection Agency, and the Department of Agriculture, Environment and Rural Affairs in Northern Ireland — are joint controllers of the personal data held in that service, and decide what is done with it. The Department for Environment, Food and Rural Affairs (Defra) and its suppliers run the service for them as their processor. Their own privacy notice explains how they handle that data.

We may disclose personal data where we are required to by law, or to establish or defend legal claims.

We do not sell personal data.

6. Sending data outside the UK

Some of our providers are outside the United Kingdom, as shown above. Where personal data is transferred outside the UK, we rely on the safeguards permitted under UK data protection law. For most of our providers this is the UK Addendum to the European Commission's standard contractual clauses, or the International Data Transfer Agreement; for others it is equivalent clauses approved for UK transfers. We assess whether further safeguards are needed in each case.

You can ask us which arrangement applies to any particular transfer, and for a copy of it.

7. How long we keep it

We keep personal data for as long as we need it, judged against these criteria:

• Account data — while you have an account, and afterwards while we may need it to deal with questions or claims
• Waste movement records — while the customer uses our service, and for three years afterwards so the customer can recover them if it needs to. The customer remains responsible for keeping its own records for the period the law requires.
• Records we must keep by law — for the period the law requires
• Enquiries and applications — while we are dealing with them and for a reasonable period afterwards
• Public register information — while it remains current, plus a record of changes
• Your cookie choice — until you change it or clear your browser storage

When a customer's agreement ends, they can ask for a copy of their data within 30 days. After that, access ends and we keep the data for three years, unless the customer asks us to delete it sooner, except for anything we must keep by law or that forms part of a record another customer still holds.

8. Your rights

You have the right to:

• ask for a copy of the personal data we hold about you
• have it corrected if it is wrong or incomplete
• have it deleted, in some circumstances
• restrict how we use it, in some circumstances
• object to us using it, where we rely on legitimate interests — including an absolute right to object to direct marketing
• receive it in a portable format, where we rely on consent or a contract
• withdraw consent at any time, where we rely on it

To exercise any of these, email info@wasters.io. We will respond within one month. We may ask you to confirm your identity, and we may ask what you are looking for if that helps us find it — in which case the month runs from when you reply.

9. Complaints

If you are unhappy with how we have handled your personal data, tell us at info@wasters.io. You do not need to use any particular form of words — just say what the problem is.

We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.

You can also complain to the Information Commissioner's Office at any time, whether or not you have come to us first:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline 0303 123 1113 · ico.org.uk/make-a-complaint

10. Changes to this notice

We update this notice when what we do changes. The date at the top shows when it last changed. Where a change materially affects you, we will tell you.

Version history

We keep a record of every version of this page. The version above is the one in force today.