Registered office: 8 Holdenby Drive, Corby, United Kingdom, NN17 5EH.
Contact: hello@dwtn.uk
1. Parties, scope and roles
These Data Processing Terms form part of the versioned agreement accepted by DWTN UK LTD and the customer named in the accepted order. They apply when DWTN processes personal data on the customer’s documented instructions to provide the DWTN service. The customer is the controller for personal data it or its users place in customer records. DWTN is the processor for that processing. DWTN acts separately as a controller for its own account, billing, security, support and legal-compliance activities, as explained in the Privacy Policy.
These terms apply with the UK GDPR and Data Protection Act 2018, as amended. They do not change an earlier agreement unless that agreement is expressly updated.
2. Processing particulars
| Subject matter | Personal data contained in customer accounts, waste-transfer records, operational records, documents and authorised integrations. |
|---|---|
| Duration | For the service term and, after it ends, for the period needed to return or erase the customer personal data, complete legally required retention and allow any encrypted backup snapshots to expire under the retention policy then in force. |
| Nature and purpose | Hosting and operating the customer’s DWTN service; receiving instructions from authorised users; creating, storing, retrieving, changing, transmitting and retaining records; providing support, security, backup and recovery; and returning or erasing data in accordance with these terms. Completed WTN records are stored in the production database. DWTN sends completed WTN PDF copies from notifications@dwtn.uk to the recipient address configured by the customer organisation’s administrator in its administration portal. The customer organisation selects and maintains that recipient address. Once received, an emailed PDF is an independent copy outside DWTN’s infrastructure; sending an email does not confirm delivery to an inbox. |
| Data subjects | Customer employees and users, drivers, administrators and supervisors; contacts at customers, suppliers, carriers, sites and waste recipients; and other people whose details appear in records entered by the customer. |
| Personal data | Names, business contact details, account roles, site and address information, signatures, job and vehicle references, waste descriptions and codes, dates, notes, transfer records, documents, audit events and technical access information needed to operate and secure the service. |
| Special-category and offence data | The forms do not require special-category or criminal-offence data, and the service is not designed to request it. Free-text fields could contain such information inadvertently. Customers should avoid including it; if it is necessary, contact DWTN first so the parties can agree the lawful instructions and safeguards needed. |
| Customer rights and duties | The customer determines the purposes and lawful basis for its records, provides required privacy information, gives documented instructions, authorises users and recipients, and decides retention periods subject to law. The customer may request information, assistance, return or erasure as set out below. |
3. Documented instructions and confidentiality
DWTN will process customer personal data only on documented instructions from the customer, including instructions in the accepted order, these terms, authorised service settings and requests from the customer’s nominated administrators. DWTN will notify the customer if it considers an instruction unlawful and will not carry out that instruction unless law requires it. If law requires processing without the customer’s instruction, DWTN will notify the customer beforehand where the law permits.
DWTN will ensure that people authorised to process customer personal data are subject to confidentiality obligations and receive access only as needed for their duties.
4. Security
DWTN maintains technical and organisational security measures appropriate to the risks, including access controls, encryption and backups. The production service is hosted on a UK-based OVHcloud VPS, and encrypted off-site backups are maintained in Oracle Cloud Infrastructure’s UK South region. If the service becomes unavailable, DWTN will take reasonable steps to restore it as soon as reasonably practicable. No specific uptime percentage, restoration time or recovery point is guaranteed. Backup arrangements substantially reduce the risk of permanent data loss but cannot guarantee complete restoration after a catastrophic incident. Nothing in this section affects either party’s mandatory data-protection obligations.
5. Other processors
The customer gives general written authorisation for DWTN to use the processors identified in Schedule 2 for the functions listed there. DWTN will impose written data-protection obligations on each processor that provide the protection required for the processing it performs and remains responsible to the customer for that processor’s performance of those obligations.
DWTN will give the customer advance notice of an intended addition or replacement and a reasonable opportunity to object on data-protection grounds before the change is used for the customer’s data. The parties will discuss a reasonable resolution. DWTN will provide information reasonably necessary to demonstrate compliance with these terms and keep the schedule current.
6. International transfers
DWTN will only make a restricted transfer of customer personal data where a transfer condition under the UK GDPR, including the applicable current rules in Articles 44A, 45A, 46 or 49, is met and the transfer complies with applicable law. Where required, DWTN will put in place an appropriate safeguard and complete and retain the applicable data-protection test or transfer risk assessment before the transfer. Encryption is a security measure; by itself it does not establish that a restricted transfer is lawful. Applicable transfer destinations and safeguards are described in Schedule 2.
7. Assistance with individual rights and compliance
Taking account of the nature of the processing, DWTN will assist the customer through appropriate technical and organisational measures, where possible, to respond to requests from individuals exercising their rights. DWTN will promptly refer a request it receives about customer-controlled data to the customer and will not answer it on the customer’s behalf unless instructed or legally required.
Taking account of the processing and information available to DWTN, it will provide reasonable assistance with security obligations, personal-data breach notifications, data-protection impact assessments and consultation with the Information Commissioner’s Office. DWTN will make available information reasonably needed to demonstrate compliance and will allow proportionate audits or inspections by the customer or its authorised auditor on reasonable notice. Audit arrangements must protect other customers’ data and service security, but will not prevent regulatory access or an investigation required by law.
8. Personal-data breaches
DWTN will notify the customer without undue delay after becoming aware of a personal-data breach affecting customer personal data. The notice will include the information then reasonably available about the nature of the breach, likely consequences and measures taken or proposed. DWTN will provide further information as it becomes available and reasonably assist the customer’s investigation and response. The customer remains responsible for deciding whether it must notify individuals or the regulator.
9. Return, erasure and retention
When processing ends, the customer may instruct DWTN to return or erase the customer personal data. DWTN will comply with the customer’s choice unless law requires retention, and will securely erase remaining copies when they are no longer required for that lawful purpose. Customer records are not automatically erased when an account is cancelled or downgraded. The service’s standard WTN retention setting is at least 730 days and is not an automatic deletion timer; the customer must set and manage retention appropriate to its legal duties.
Data erased from the active production database may remain in an encrypted off-site backup snapshot until it expires under the retention policy then in force. Backup snapshots are not available for ordinary service use. Customer-held WTN PDF emails are separate copies outside DWTN’s infrastructure; DWTN does not control their retention or deletion. If a snapshot is restored, DWTN will take reasonable steps to reapply applicable recorded return or erasure instructions to restored data before normal service resumes, where sufficient evidence remains available. Legally required accounting records and immutable acceptance evidence are retained in accordance with applicable law and the Privacy Policy.
10. Contact and precedence
Send documented instructions, rights requests about customer data, or privacy and security concerns to hello@dwtn.uk, identifying the customer organisation. These terms govern the parties’ processor relationship and prevail over conflicting commercial wording on that processing. They do not limit an individual’s statutory rights or either party’s obligations to a regulator.
Schedule 1 — Security measures
- HTTPS protects communications with the service.
- Passwords are stored as one-way password hashes; session credentials can be revoked.
- Role-based authorisation and organisation-scoped database access separate customer accounts.
- Access to production systems is restricted to authorised operational personnel; application audit events record relevant administrative activity.
- Application input is validated, dependencies and system changes are managed, and operational logs are reviewed for service and security issues.
- Production customer data and backups are protected by encryption, access controls, restricted access for authorised personnel, and tested recovery procedures.
- DWTN UK maintains documented incident management, backup and recovery procedures to support the security, availability and continuity of its services.
Schedule 2 — Processors and transfer register
Schedule 2 identifies the infrastructure providers and processing activities relevant to the current service. DWTN uses UK-based production hosting and UK-based encrypted backup storage. A provider’s UK storage location does not, by itself, determine the location of all access, support, or onward processing. The applicable processor terms and any transfer safeguards remain subject to the parties’ service arrangements and applicable law.
| Provider | Service | Location | International transfer mechanism and status |
|---|---|---|---|
| OVHcloud — OVH SAS | Application hosting, database hosting and customer data storage | United Kingdom | UK storage; any remote access or onward processing is assessed separately under applicable data-protection law. |
| OVHcloud — OVH SAS | Transactional email services | France | UK adequacy regulations cover the EEA for the relevant transfer. Access and onward processing are assessed separately. |
| Oracle Cloud Infrastructure — Oracle Corporation UK Limited | Encrypted backup storage | UK South (London), United Kingdom | UK storage; any remote access or onward processing is assessed separately under applicable data-protection law. |
Stripe is used for DWTN’s subscription billing and payment collection. It receives account and payment information, not customer WTN content. Stripe describes itself as a processor for some activities and an independent controller for others; the applicable role and Stripe contracting entity depend on the Stripe service and agreement. Stripe is therefore not listed here as a processor of customer WTN data. See Stripe’s Data Processing Agreement and Privacy Policy.
Where a customer instructs an integration to transmit a waste record to DEFRA, DEFRA is an external recipient performing its own statutory functions, not a processor engaged by DWTN. Customer-specific integration credentials and submission choices remain under the customer’s control.
Schedule 3 — Storage locations and transfers
DWTN UK LTD hosts and stores customer data within the United Kingdom. Encrypted backups are securely maintained within the United Kingdom for business continuity, disaster recovery and data restoration purposes. Appropriate technical and organisational security measures protect customer data, including encryption, access controls and restricted access to authorised personnel. Customer data and backups are retained and deleted in accordance with applicable retention policies and legal obligations.
These locations describe where hosting and backup data are stored. They do not, by themselves, establish that every access, support activity or onward processing takes place in the United Kingdom. The email service location and any other transfer or onward processing are handled under the transfer rules in clause 6 and the relevant provider terms. DWTN will assess any restricted transfer and use an applicable lawful transfer mechanism where required.
DWTN UK uses OVHcloud for its UK-hosted production infrastructure and Oracle Cloud Infrastructure’s UK South (London) region for encrypted offsite backups. These services support the hosting, operation and recovery of the DWTN platform. Further information about our service providers and data-processing arrangements is set out in our Privacy Policy and this Data Processing Agreement.