Legal

Privacy Policy

Last updated: 14 July 2026

This policy is provided as a starting point and should be reviewed by a qualified legal adviser before you rely on it.

This policy explains how ComplyWaste handles personal data when you use our website, our driver app and our office dashboard. We are committed to protecting your privacy and to processing personal data lawfully, fairly and transparently under the UK GDPR and the Data Protection Act 2018.

Who we are

ComplyWaste is operated by Level44 LTD, trading as ComplyWaste (“ComplyWaste”, “we”, “us”). We are the data controller for the personal data described in this policy. Registered in Northern Ireland, company number NI723850. Registered address: Campsie House, Belfast, Northern Ireland, BT14 8FH. You can reach our privacy team at [email protected].

What we do

ComplyWaste is a mobile-first service for UK waste firms. Carriers use it to create Digital Waste Transfer Notes, and receivers use it to record DEFRA Digital Waste Tracking / Receipt of Waste records. To provide the service we process a limited amount of personal data, described below.

What data we collect and why

We keep the personal data we collect to a minimum. The categories we process, and the lawful basis for each, are:

• Account email address — used to sign you in. Authentication is passwordless (magic-link), so we never store a password. Lawful basis: performance of a contract.
• Names of users and drivers — so that transfer notes and receipts are attributed correctly and your team can be managed. Lawful basis: performance of a contract.
• Company details on transfer notes — carrier, producer and receiver details recorded on waste movements. Lawful basis: performance of a contract and legal obligation.
• Waiting list / waitlist emails — if you ask to be kept informed before you hold an account. Lawful basis: consent, which you can withdraw at any time.
• Payment information — handled by Stripe. Card details are entered with, and stored by, Stripe; ComplyWaste does not receive or store card numbers. Lawful basis: performance of a contract.
• Service and security data — basic logs needed to run and secure the service. Lawful basis: legitimate interests in operating and protecting the service.

The waiting list

If you join our waiting list we use the email address you give us only to send you updates about ComplyWaste and to let you know when you can sign up. This is based on your consent. You can withdraw consent and unsubscribe at any time using the link in any email, or by contacting [email protected]. We do not sell or share waitlist emails with third parties for their own marketing.

How long we keep data

We keep personal data only for as long as we need it for the purposes above, or for as long as the law requires.

• Waste records — Waste Transfer Notes and waste receipts are legal records. Waste Transfer Notes must be retained for a minimum of two years, and other compliance records for the periods set by law. This legal retention obligation overrides erasure requests for those specific records: we cannot delete a waste record we are required to keep.
• Account data — kept for as long as your account is active, then deleted or anonymised after a reasonable period, subject to the retention obligation above.
• Waitlist emails — kept until you unsubscribe or we close the waiting list.

Sub-processors we rely on

We use a small number of trusted providers to deliver the service. Each processes personal data only on our instructions:

• Stripe — payment processing.
• Maileroo — transactional and service email delivery.
• Hetzner — our hosting provider, for the servers that run the service.

Our website analytics use umami, which is cookieless and does not track individuals or build personal profiles.

International transfers

ComplyWaste runs on self-hosted infrastructure located in the EU/UK (Hetzner). As standard, your data is not transferred outside the UK/EEA. Where a sub-processor operates internationally, we rely on appropriate safeguards recognised under UK data protection law.

Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data rectified;
• have your data erased — subject to the legal-retention exception for waste records described above;
• restrict how we process your data;
• data portability;
• object to processing based on legitimate interests.

To exercise any of these rights, email [email protected]. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk, though we'd appreciate the chance to put things right first.

Cookies

We use only essential cookies and do not run advertising or cross-site tracking. For details, see our Cookies Policy.

Changes to this policy

We may update this policy from time to time. When we do, we'll revise the “last updated” date above and, where changes are significant, let account holders know.

Contact us

For any privacy question, contact [email protected]. For general support, contact [email protected].