Sub-processors

Wasters Limited · Version 1.1 · Last updated

When we process personal data for our customers, we use the sub-processors listed below. Each is bound by data protection terms no less protective than those in our Data Processing Agreement, and we remain responsible for them.

We give customers at least 30 days' notice before adding or replacing a sub-processor, by email to their administrators, and we may also show the notice in the Wasters platform. A customer can object on reasonable data protection grounds, as set out in clause 3.2 of the Data Processing Agreement.

Current sub-processors

Sub-processor
Supabase Inc.
What they do
Database, sign-in, file storage and server functions
Where the data is processed
United Kingdom (London)
Personal data involved
All customer data held in the platform
Transfer safeguard
UK Addendum to the EU Standard Contractual Clauses
Sub-processor
Amazon Web Services
What they do
Infrastructure on which Supabase runs
Where the data is processed
United Kingdom (London)
Personal data involved
As Supabase
Transfer safeguard
Via Supabase
Sub-processor
Google Cloud (Firebase Hosting)
What they do
Delivering the Wasters application to your browser
Where the data is processed
Google's global network
Personal data involved
IP address and request information
Transfer safeguard
Google Cloud Data Processing Addendum
Sub-processor
Google Maps Platform
What they do
Address search, geocoding, maps and route planning
Where the data is processed
Google's global network
Personal data involved
Addresses entered in the platform; IP address when maps are displayed
Transfer safeguard
Google Cloud Data Processing Addendum
Sub-processor
Google Cloud (Vertex AI)
What they do
Assessing a movement record when a user asks for an assessment
Where the data is processed
United States (Oregon)
Personal data involved
The details of the movement assessed, including the producer, carrier, broker and receiving site recorded on it, and anything entered in its handling notes
Transfer safeguard
Google Cloud Data Processing Addendum
Sub-processor
Ideal Postcodes (IDDQD Ltd)
What they do
Postcode and address lookup
Where the data is processed
United Kingdom
Personal data involved
Postcodes and addresses
Transfer safeguard
Not needed (UK)
Sub-processor
Resend Inc.
What they do
Sending emails, including invitations and notifications
Where the data is processed
United States
Personal data involved
Recipient name and email address; email content, which may include movement details
Transfer safeguard
UK Addendum to the EU Standard Contractual Clauses
Sub-processor
Functional Software Inc. (Sentry)
What they do
Monitoring errors in the application
Where the data is processed
European Union
Personal data involved
User identifier and email address; technical details of the error
Transfer safeguard
UK Addendum to the EU Standard Contractual Clauses

Not sub-processors

These receive data, but do not process it on our behalf:

  • The Digital Waste Tracking Service. Records you authorise are submitted to the service. The four UK environmental regulators are joint controllers of that data; Defra operates the service for them.
  • Companies House. We look up company details on the public register when you register.
  • Other parties to a movement who use Wasters, who may see the movement record as described in our terms.

Version history

We keep a record of every version of this page. The version above is the one in force today.

Version
1.1
In force from
What changed
Added Google Cloud (Vertex AI), the service that assesses a movement when a user asks for an assessment. It was already in use and missing from the list.
Version
1.0
In force from
What changed
First published list of the sub-processors that handle the personal data our customers put into the platform.