Registered office: 8 Holdenby Drive, Corby, United Kingdom, NN17 5EH.
Contact: hello@dwtn.uk
1. Who is responsible
DWTN UK LTD, company number 17495021, operates DWTN UK. Contact hello@dwtn.uk with “Privacy” in the subject. This notice covers the public DWTN website and DWTN commercial services.
We act as controller for enquiries, customer administration, billing, support and the security of our service. A customer organisation normally acts as controller for the personal information it enters into WTNs, operational records and user accounts; we process those records on its instructions. Contact that organisation about its use of your information. We will assist it with requests. The GDPR and data-processing terms describe that relationship. Existing customer contracts continue under their accepted terms unless the parties agree an update.
2. Information we use and where it comes from
- Enquiries and support: your name, business, email, telephone number if supplied, correspondence and attachments.
- Account administration: organisation and user details, roles, business contact information, subscription records, invoices and payment status. Passwords are stored as password hashes, not readable passwords.
- Customer records: names, contact and site details, job and vehicle information, waste descriptions and codes, signatures, transfer dates, notes and related documents supplied by users or authorised integrations.
- Service security: authentication tokens, login events, timestamps, IP addresses and device/browser or request information where recorded by the service or hosting infrastructure.
Information comes from you, your employer or customer organisation, other authorised participants in a waste transfer, and integrations enabled by that organisation. The service does not require health, criminal-offence or other special-category information, and its free-text fields could contain such information inadvertently. Please avoid including it; if processing it is necessary, contact DWTN first so appropriate instructions and safeguards can be agreed.
3. Purposes and lawful bases
| Purpose | Basis when we are controller |
|---|---|
| Respond to enquiries, provide accounts and administer an individual’s subscription | Steps requested before a contract and performance of that contract, where the individual is a contracting party. |
| Manage business contacts, support corporate customers and provide service notices | Legitimate interests in operating and supporting a business service, balanced against individuals’ rights. |
| Protect accounts, investigate misuse, maintain service integrity and handle disputes | Legitimate interests in security, fraud prevention and establishing or defending legal claims; legal obligations where applicable. |
| Keep statutory business records or respond to a valid legal requirement | Compliance with the relevant legal obligation. |
| Optional marketing or non-essential tracking requiring consent | Consent, requested separately before that activity. Accepting a contract is not consent to marketing. |
For customer-controlled records, the customer determines the purpose and lawful basis; our role is to process them under its instructions. We do not sell personal information or use customer WTN content for advertising. We do not use personal information to make solely automated decisions with legal or similarly significant effects.
4. Who receives information
Information is available to authorised users within the customer’s organisation according to their permissions, and to document recipients selected by that organisation. Hosting, encrypted backup and email service providers, and authorised support personnel may process information to deliver the service. Our current infrastructure providers are OVHcloud for UK hosting and Oracle Cloud Infrastructure for UK encrypted backups. Professional advisers or authorities may receive information where necessary for legal duties or claims.
Completed WTN records are stored in the production database. DWTN emails WTN PDF copies from notifications@dwtn.uk to the recipient address configured by the customer organisation’s administrator in its administration portal. The customer organisation chooses and maintains that recipient address. Once received, the PDF is an independent copy outside DWTN’s infrastructure; DWTN does not control its later retention or deletion. Sending an email does not confirm delivery to an inbox.
DEFRA receives data where an organisation’s integration is enabled and a submission is made. Customer reporting depends on organisation setup and activation. Stripe provides hosted checkout and billing management for Stripe-managed subscriptions. Stripe receives payment information directly; DWTN receives identifiers and status needed to administer the service, but not your full card number or CVC. See Stripe’s privacy notice.
5. International access and transfers
DWTN UK LTD hosts and stores customer data within the United Kingdom. Encrypted backups are securely maintained within the United Kingdom for business continuity, disaster recovery and data restoration purposes. Appropriate technical and organisational security measures protect customer data, including encryption, access controls and restricted access to authorised personnel. Customer data and backups are retained and deleted in accordance with applicable retention policies and legal obligations.
These statements describe storage locations; they do not mean every access, support activity or onward processing takes place in the United Kingdom. OVHcloud email services may be processed in France. Transfers to France rely on the applicable UK adequacy regulations for the European Economic Area. DWTN assesses any other restricted transfer or onward processing under the UK GDPR and uses an applicable lawful transfer mechanism where required. See the Data Processing Terms and supplier schedule.
6. Retention and deletion
We keep information only for the purpose for which it is needed, taking account of contractual, legal, security and dispute requirements. Enquiry and support records are kept while the matter is active and for a proportionate follow-up or claims period. Billing records follow applicable accounting and tax retention duties. Security information is retained according to its incident-investigation and audit purpose.
Active customer WTNs are stored in the production database and follow the customer’s documented retention instructions and applicable waste-record requirements. The application’s standard WTN retention setting is at least 730 days; it is not an automatic deletion timer. Cancellation, downgrading or Basic’s lack of archive access does not automatically delete records. Legally required accounting, contractual and acceptance records are retained for the periods required by law.
Encrypted off-site backup snapshots are maintained in Oracle Cloud Infrastructure UK South and expire under the established backup retention policy. Data deleted from active records may remain in a snapshot until expiry. Customer-held WTN PDF emails are independent copies outside DWTN’s infrastructure; DWTN does not control their retention or deletion. Customer-requested return or erasure is handled under the Data Processing Terms. If a snapshot is restored, DWTN will take reasonable steps to reapply applicable recorded deletion instructions before normal service resumes, where sufficient evidence remains available.
7. Your rights
Depending on the circumstances, you may request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. Where consent is used, you can withdraw it at any time without affecting earlier lawful processing. These rights have conditions and exceptions; they do not require the deletion of records we or the customer must lawfully retain.
Email us with enough information to locate the records. We may ask for proportionate identity verification. Requests are normally answered within one month, with any lawful extension or necessary clarification explained. There is normally no charge. For customer-controlled records, we will direct or pass the request to the responsible organisation and assist it.
You can complain to the Information Commissioner’s Office. You may contact us first so we can try to resolve the matter, but this does not limit your right to complain.
8. Required information, security and cookies
Account and operational details needed to deliver a requested function must be supplied for that function to work. Optional enquiry details need not be supplied. We protect personal information through access controls, tenant separation, protected credentials and HTTPS. Keep your devices and account credentials secure, and report suspected unauthorised access promptly.
The cookies policy explains automatic saved sign-in and on-device drafts. We will notify customers of material changes to this notice through an appropriate service notice. The version and date identify the notice currently in force.