Waste Collection Highbury Privacy Policy

This Privacy Policy explains how Waste Collection Highbury collects, uses, stores and shares your personal data when you use our waste collection and related services. It applies to all individual and business customers of Waste Collection Highbury in our service area, as well as people who contact us about our services.

We are committed to protecting your privacy and handling your personal data in a lawful, fair and transparent manner in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018.

Who we are and how to contact us

Waste Collection Highbury is the organisation responsible for deciding how and why your personal data is processed. We are the data controller for the personal data described in this Privacy Policy.

If you have any questions about this Privacy Policy or how we handle your personal data, or if you wish to exercise any of your rights, you can contact us using the details provided on your service agreement, invoice or our main customer communication channels.

Personal data we collect

We only collect personal data that we need to deliver our services, manage our business and comply with legal obligations. The types of personal data we may collect include:

Identification and contact details, such as your name, business name, billing address, service address, telephone number and email address.

Service and account information, such as details of waste collection services you have requested or received, service frequency, container types, access instructions and correspondence relating to your account.

Payment and transaction data, such as invoices, payment records, payment method information and debt recovery records. We do not store full credit or debit card details if you pay by card; these are processed securely by our payment service providers.

Communication data, such as emails, letters, telephone call notes, contact form submissions and records of complaints or enquiries.

Technical and usage data, such as limited information about how you interact with our website and online customer tools, including IP address, browser type and pages viewed, where this is necessary to operate and secure our online services.

Operational and site information, such as photographs or notes relating to collection locations, access issues, contamination of waste or incidents at collection sites where this may indirectly identify an individual.

How we collect your personal data

We collect personal data in a variety of ways, including:

Directly from you when you request a quote, enter into a contract, arrange or modify services, make a payment, contact us by phone, email or other channels, or complete a form.

From your use of our services, for example when our teams record details about collections, containers or access instructions related to your property or site.

From third parties, such as payment processors, credit reference agencies, trade references or partners that refer you to our services, where this is necessary and lawful.

Automatically when you use our website, through the use of technical tools such as server logs and cookies where applicable and lawful. Any such data is limited to what is strictly necessary for security, performance and service improvement.

Lawful bases for processing your data

We only process your personal data when we have a lawful basis to do so. Depending on the specific activity, we may rely on the following lawful bases:

Contract. We process your personal data to enter into, manage and fulfil our contract with you, including providing waste collection services, maintaining your account, communicating about service changes, issuing invoices and processing payments.

Legal obligation. We process certain information to comply with legal and regulatory requirements, such as environmental regulations, waste transfer documentation, tax and accounting rules, and health and safety laws.

Legitimate interests. We process personal data where it is necessary for our legitimate business interests, provided that your interests and fundamental rights do not override those interests. This includes activities such as managing and improving our operations, training staff, monitoring and reducing missed collections, recovering debts, and responding to queries and complaints.

Consent. In limited circumstances we may rely on your consent, for example for certain types of direct marketing or optional cookies. When we rely on consent, you can withdraw it at any time using the contact details in this Policy or any unsubscribe option we provide.

How we use your personal data

We use your personal data for the following purposes:

To provide and manage waste collection and related services, including route planning, container delivery, scheduling and carrying out collections, and communicating about access issues or service disruptions.

To set up and administer your customer account, including opening new accounts, maintaining up to date contact details, managing service options and closing accounts when requested.

To handle payments and billing, including issuing invoices, processing payments, applying credits or adjustments and pursuing unpaid amounts where necessary.

To respond to your enquiries and complaints, and to communicate with you about service updates, safety information, changes to terms and conditions, price changes and relevant operational notices.

To manage our business operations, including monitoring service quality, improving our processes, training staff, analysing service performance and planning new services in the area.

To comply with legal and regulatory requirements, including keeping appropriate records, cooperating with regulators or authorities and managing health and safety or environmental incidents.

To protect our rights, property, employees and customers, including preventing and detecting fraud, misuse of services or illegal dumping of waste.

Data sharing and processors

We do not sell your personal data. We may share your personal data with trusted third parties where this is necessary and lawful. These third parties act either as data processors on our behalf or as separate controllers in their own right.

Data processors are service providers who process personal data on our instructions. We use processors for services such as IT hosting and support, customer relationship management systems, payment processing, communication tools, route and logistics software, document storage and professional advisors. We require all processors to protect your personal data, use it only in accordance with our instructions and implement appropriate security measures.

We may also share personal data with other organisations acting as independent controllers, including banks and payment providers, insurers, credit reference agencies, debt collection agencies, legal and professional advisers and regulators or public authorities where required by law.

Where any transfer of personal data involves a country outside the UK or European Economic Area, we will ensure that appropriate safeguards are in place, such as standard contractual clauses or an adequacy decision, in accordance with data protection law.

Data retention

We keep your personal data only for as long as necessary to fulfil the purposes we collected it for, including satisfying any legal, accounting or reporting requirements.

In general, we keep customer account and service information for the duration of your relationship with us and for a period afterwards. This allows us to respond to queries, manage any disputes and meet our record-keeping obligations. Financial and transaction records are typically kept for a minimum of six years after the end of the relevant financial year, in line with tax and accounting requirements.

In some cases we may retain data for a longer period, for example where there is an ongoing complaint, dispute or legal claim, or where the law requires us to keep specific records relating to waste movements or environmental compliance.

When personal data is no longer needed, we will securely delete or anonymise it so that it can no longer be associated with an identifiable individual.

How we protect your personal data

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction or damage. These measures include access controls, staff training, secure systems, physical security at our sites and appropriate backup and recovery procedures.

While we take reasonable steps to safeguard your data, no system can be completely secure. If we identify a personal data breach that is likely to result in a risk to your rights and freedoms, we will act in accordance with our legal obligations, which may include notifying you and the relevant supervisory authority.

Your data protection rights

Under data protection law, you have a number of rights in relation to your personal data. These rights are not absolute and may be subject to conditions and legal exemptions, but we will always consider and respond to any request you make.

Right of access. You can request confirmation that we process your personal data and ask for a copy of the data we hold about you, together with certain information about how we use it.

Right to rectification. You can ask us to correct or complete personal data that you believe is inaccurate or incomplete.

Right to erasure. In certain circumstances you can ask us to delete your personal data, for example where it is no longer needed for the purposes for which it was collected, or where you withdraw consent and there is no other legal basis for processing.

Right to restriction. You can ask us to restrict the processing of your personal data in certain situations, for example while we are verifying its accuracy or assessing an objection you have raised.

Right to object. You may object to our processing of your personal data when we are relying on legitimate interests as our lawful basis. We will stop processing unless we have compelling legitimate grounds to continue, or the processing is needed for legal claims.

Right to data portability. Where processing is based on consent or contract and carried out by automated means, you can request that we provide your personal data in a structured, commonly used and machine readable format, or that we transfer it to another organisation where technically feasible.

Right to withdraw consent. Where we rely on your consent, you can withdraw it at any time. This will not affect the lawfulness of processing before your consent was withdrawn.

If you wish to exercise any of these rights, please contact us using the details on your service documentation or our standard customer contact channels. We may need to verify your identity before we can act on your request.

Complaints and supervisory authority

If you are concerned about how we handle your personal data, we encourage you to contact us first so that we can try to resolve your concerns. You also have the right to lodge a complaint with the relevant data protection supervisory authority in the UK.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, how we process personal data or legal requirements. Any changes will apply from the date we publish the revised version. We recommend that you review this Policy periodically to stay informed about how we protect your personal data.