Privacy Policy

1. Introduction & Scope

This Privacy Policy explains how Wastesync Ltd ("WasteSync", "we", "us", or "our") collects, processes, and protects personal data and commercial compliance records across:

• Our primary marketing website (wastesync.co.uk)
• Our automated compliance auditor, the Defra & SEPA Submission Monitor (monitor.wastesync.co.uk)
• Our offline-first weighbridge capture and sync middleware ("WasteSync Capture")

2. Data We Collect

Depending on how you interact with our services, we may collect and process:

• Facility & Operator Data: Company name, facility name, environmental permit number, site postcode, and regional jurisdiction (England, Wales, Scotland, or Northern Ireland).
• Contact Information: Full name, business email address, role/job title, and telephone number provided during pilot applications or monitor onboarding.
• Defra / Regulator API Credentials: Read-only API tokens and client keys entered into the Submission Monitor to verify receipt status. These are immediately encrypted at rest using AES-256-GCM.
• Weighbridge & Waste Tracking Telemetry: Load tickets, EWC waste codes, gross/tare/net tonnages, carrier registration numbers, vehicle registrations, and sync timestamps required for regulatory duty of care verification.
• Technical & Log Data: IP addresses, browser user agent, device timestamps, and outage event metadata required for security, audit verification, and system reliability.

3. Lawful Basis for Processing (UK GDPR Article 6)

We process your data strictly under recognized legal bases defined by UK GDPR:

• Contractual Necessity (Art. 6(1)(b)): Delivering daily 07:00 AM submission audits, running offline weighbridge syncs, and managing pilot agreements.
• Legal Obligation & Environmental Duty of Care (Art. 6(1)(c)): Assisting waste operators in complying with statutory Digital Waste Tracking mandates under the Environment Act 2021 and regulator standards (DEFRA, SEPA, Natural Resources Wales, and NIEA).
• Legitimate Interests (Art. 6(1)(f)): Maintaining resilient uptime, preventing duplicate ticket submissions, detecting security anomalies, and improving platform performance.

4. UK Data Sovereignty & "Vault" Architecture

Your commercial waste intelligence and driver details are governed by stringent technical safeguards:

• UK Sovereign Hosting: All WasteSync databases and application services are hosted exclusively in Google Cloud Platform (GCP) Region europe-west2 (London, UK). Your data never leaves the United Kingdom.
• Vault Separation: We cryptographically separate Driver Personal Identifiable Information (PII) from waste tonnage and EWC data. When audits or SEPA/DEFRA logs are inspected, personal identifying data is not exposed.
• End-to-End Cryptography: All traffic in transit is secured with TLS 1.3. Defra API tokens and database records are encrypted at rest with AES-256-GCM.

5. Data Retention Periods

We retain compliance and telemetry data in accordance with statutory guidelines:

• Waste Transfer Records & Audit Logs: Retained for a minimum of 2 years (standard non-hazardous Duty of Care) or up to 6 years for regulatory continuity.
• Monitor API Credentials: Retained only for the active duration of your monitoring subscription; deleted immediately upon facility deactivation.
• Contact & Pilot Inquiries: Retained for the duration of the pilot agreement or until you request removal.

6. Your Rights Under UK GDPR

As a data subject, you hold statutory rights regarding your personal data:

• Right of Access: Request a copy of personal information we hold about you (Subject Access Request).
• Right to Rectification: Request correction of incomplete or inaccurate records.
• Right to Erasure: Request deletion of personal data, subject to mandatory environmental statutory retention periods.
• Right to Restrict or Object: Restrict processing under specific circumstances or object to legitimate-interest processing.
• Right to Data Portability: Export your reconciliation and audit logs in standardized CSV/JSON format.

To exercise any of these rights, contact our Data Protection Officer at alastair@wastesync.co.uk.

7. Supervisory Authority

If you have any concerns regarding how we process your data, you have the right to lodge a formal complaint with the UK supervisory authority: