Privacy policy

Who is responsible for your data

AnyWaste Global Ltd is the data controller for account data, billing data and website analytics. Our registered company details and contact address are in the footer of every page.

For the waste records our customers create in the service, the customer is the controller and we act as their processor: we hold and transmit those records on their instructions and do not use them for our own purposes.

What we collect

We collect four kinds of data, and nothing else:

• Account data — your name, email address, the organisation you belong to and your role in it. Created when you register and kept current by our authentication provider.
• Waste consignment data — everything a waste transfer note legally has to carry: the description, quantity and classification of the waste, the containers, the time and place of transfer, the names and addresses of the parties, carrier registration details, and the name and signature of the person signing at each stage. Some of this is personal data about your staff and your counterparties.
• Billing data — your subscription, plan and invoice history. Card details are entered directly with Stripe and never reach our systems.
• Website statistics — aggregate page views and referrers, collected without cookies and without anything that identifies an individual visitor.

Why we are allowed to hold it

Under UK GDPR every use of personal data needs a lawful basis. Ours are:

• Performance of a contract — providing the service you signed up for, including your account, your organisation and the records you create.
• Legal obligation — waste transfer notes and hazardous waste consignment notes are statutory records under the Environmental Protection Act 1990 and the regulations made under it. Where a customer submits records to DEFRA Digital Waste Tracking through us, we transmit them because the law requires the record to be made.
• Legitimate interests — keeping the service secure, investigating misuse, supporting customers, and contacting businesses about the service. We balance these against your interests, and you can object at any time.

Who we share it with

We do not sell personal data, and we do not share it for advertising. We use the following providers to run the service, each under a contract that limits them to processing data on our instructions:

Where a provider is outside the UK, transfers are made under the UK International Data Transfer Addendum or the equivalent standard contractual clauses.

Separately, we transmit waste records to DEFRA Digital Waste Tracking when a customer uses that feature. That is a disclosure to a regulator under a legal obligation, not a commercial arrangement — and it is the point of the feature. We may also disclose data where we are required to by law, or to establish or defend legal claims.

How long we keep it

Waste records are kept for at least as long as the law requires them to be retained — two years for waste transfer notes, and longer for hazardous waste consignment notes. We keep them for the life of your account and for a period after it closes, so that a record remains available to every party to a transfer and to a regulator asking about it, which is the whole purpose of the document.

Account and billing data are kept while your account is open and for six years afterwards, in line with the retention period for accounting records. Website statistics are aggregate and are not tied to an individual at any point.

Corrections are added, not erased

This one is unusual enough to call out. The waste record is stored as an append-only audit trail: every change is recorded as a new entry alongside the old one, with who made it and when. That is what makes it usable as evidence of duty of care compliance, and it is deliberate.

The practical consequence is that a mistake is corrected by adding a correcting entry rather than by rewriting history, and that a request to erase personal data from a completed statutory record will usually be refused — we are required to keep that record, and the right to erasure does not apply where processing is necessary to comply with a legal obligation. We can still correct an inaccuracy, and we will always tell you which of the two we have done.

Cookies

The service sets one strictly necessary cookie, which keeps you signed in. It is required for the application to work and cannot be turned off while you are using it.

We use no advertising, tracking or profiling cookies. Our website statistics are collected by Plausible, which is cookieless and stores nothing on your device — which is why this site has no cookie banner asking for consent it does not need.

Your rights

You can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict how we use it, object to processing we carry out under legitimate interests, or ask for your data in a portable format. Where we hold data as a processor for one of our customers, we will pass your request to them and help them answer it.

Write to us at the address in the footer. We respond within one month. If you are unhappy with our answer you can complain to the Information Commissioner’s Office at ico.org.uk, though we would rather you came to us first so we can put it right.

Changes to this policy

When we change how we use personal data we update this page and change the date at the top. Where a change materially affects you we will tell account holders directly rather than relying on you noticing.