Data processing agreement

What this agreement is

This is our data processing agreement: the written contract UK data protection law requires whenever one business handles personal data on another business's behalf. It sits alongside our Terms of service and you accept it when you accept those, so there's nothing separate for you to sign. If your own buyer or procurement team needs a copy for their file, ask us and we will send one: email us, or use the help desk inside the app.

Where the two say different things, the Terms decide, except on how we handle personal data on your behalf, which is this agreement's own subject and where this agreement decides. Read them here: Terms of service.

It uses two words the law cares about. The controller is the business that decides what personal data is collected and why. The processor is the business that holds it and acts on the controller's instructions.

• For the records you keep about your own customers, your staff, and your waste movements, you are the controller and we are your processor. You decide, we do.
• For your own account with us, and for the way we run and bill the service, we are the controller. That side is covered by our privacy notice, not by this agreement.

The processor here is Red Tape Software Ltd, company number 17401331, registered in England and Wales at 66 Paul Street, London, United Kingdom, EC2A 4NA. CarrierNote is our product name. The controller is your business, as named on your account.

What we handle for you, and why

We process the personal data you put into the service so that we can run the service you're paying for, and we carry on holding some of it after your account has gone, for exactly as long as the retention periods below say. We don't use your customers' data for our own purposes. We do email you, the account holder, about the service, and about our own products if you've asked for that.

The people whose data this is, and what we hold about them:

• Your customers: name, address, phone number, email address, and any notes you add.
• The people named on a waste movement: producers, carriers, and the site receiving the load, along with their signatures and the record of how each signature was taken: the time, the address it came from, the kind of device and browser, and the device's position if the signer allowed it.
• Your own staff who use the service: name, work email address, role, and their sign-in activity.
• Anyone who appears in a photo attached to a waste movement, which in practice means faces, number plates, and house frontages.

Your staff are a case on their own. Someone who leaves keeps their name on the notes they signed, because those are statutory records and neither of us can shorten them. What is not a statutory record is the trail of when they signed in, which we keep so a dispute about who did what can be looked into. We delete that 12 months after you remove them from your account. If somebody who has left asks you to erase them, that is the answer: the notes stay for the periods below, the sign-in history goes within the year.

We do it to store your records and show them on screen, to produce your transfer notes and consignment notes, to send those records where you tell us to send them, and to submit waste movements to DEFRA's Digital Waste Tracking service on your instruction.

What we promise

• We act on your instructions. Most of them you give by using the service, in what you record and what you send to DEFRA. You can also email us to ask for something the software won't do, and we'll tell you whether we can do it and what it will take.
• We won't use your data for anything else unless the law forces us to. If a court or the police order us to hand something over, we'll tell you who ordered it and what they took, unless the order itself bans us from telling you.
• Everyone who can reach your data is bound to keep it confidential, and there are very few of us. If one of us opens your records, the system records who opened them and what they touched, with the date and time, and we'll show you that record if you ask.
• We help you meet your own duties. If someone asks you for their data, or your regulator asks how it's handled, email us and we'll answer in writing within 10 working days, at no charge.
• We tell you if something goes wrong, on the timing set out below.
• When your account is closed, whether you asked us to or we ended the agreement, you can take your records with you, and we then delete everything except the records the law makes us keep, and the photographs attached to your waste movements. Both are listed below.

The records we cannot delete, even if you ask

Some of what you enter is a statutory record, which means the law tells us how long it has to be kept and neither of us can shorten that. An instruction to delete does not reach these:

• Waste transfer notes: at least two years from the date of transfer, under the Environmental Protection Act 1990 duty of care.
• Hazardous waste consignment notes, which Scotland calls special waste consignment notes: at least three years from the date the load moved, under the Hazardous Waste Regulations 2005 in England and Wales, and the equivalent rules in Scotland and Northern Ireland.
• Billing records and payments: six years from the end of the accounting period they fall in, under HMRC's record-keeping rules.

This is the law rather than our policy, and it protects you as much as it binds us: an inspector can ask you for a transfer note from two years ago, and you need to be able to produce it. Everything outside those windows is deletable in the ordinary way.

Photographs attached to a waste movement sit outside that list, and they are not deleted with everything else either. They are evidence you took rather than a record the law makes you keep, so we hold them for seven years to outlast the note they belong to. That period is ours rather than the law's, which is why you can delete any photograph from the app whenever you want to. Deleting one deletes the image file itself, not only the entry you see in the app. Closing your account does not bring those seven years forward, so each photograph goes when its own seven years are up.

Who else handles your data

We use a small number of other companies to run the service. The law calls them sub-processors, and we're responsible to you for what they do with your data. Each one is named, with what it handles and where it holds it.

See the current sub-processor list.

Before a new company starts handling your data, or one replaces another, we'll tell you at least 30 days beforehand by email to everyone with Account access. Object at any point before the change takes effect: email us at the address at the foot of this page, or use the help desk inside the app. We'll look for another way round it, and you'll have our answer within 5 working days. If we answer later than that, you get at least 14 days from our answer to decide, and the change waits that long even if it was due sooner. If there isn't a way round it, you can cancel before the change takes effect. Your records stay exportable either way.

Cancelling over this is the one case where we give money back. Normally your plan runs to the end of the period you have already paid for and the unused part is not refunded. Here it is: tell us you are cancelling because of the change, and we refund the part of the period you have not used, to the card you paid with. On an annual plan that is the months you have left. To take it, cancel in the app as you normally would and tell us the change is why, so we refund rather than let the plan run out. We start the refund within 5 working days of you telling us, and your bank takes a few days after that to show it. Because we are paying that part back, the plan ends on the day we send the money rather than running on to your renewal date, and you go to the free plan from that day. That day is the one we can give you in advance, and we tell you what it is when we start the refund. Everything you have recorded stays where it is and stays exportable.

Regulators are a different thing. Waste data goes to DEFRA, and to the environmental regulator for the nation a load moves in: the Environment Agency in England, Natural Resources Wales, SEPA in Scotland (the Scottish Environment Protection Agency), and NIEA in Northern Ireland (the Northern Ireland Environment Agency). They receive it because the law says so, and they decide for themselves what to do with it.

DVSA, the Driver and Vehicle Standards Agency, is on that list for a narrower reason. When someone on your account uses the optional vehicle lookup, we send DVSA a registration number and it tells us the vehicle's make, model, and MOT expiry date. Nothing about a person is sent.

None of them is our sub-processor. We cannot instruct a regulator to delete a waste record, which is why they are listed separately.

A change of owner is not one of these. If our business is sold, the buyer takes our place as your processor and inherits this agreement whole, so nobody new starts handling your data on the day it happens and the notice above does not apply to it. If the new owner later changes who handles your data, that is an ordinary change to the list and it gets the notice and the objection right like any other. What a sale itself entitles you to is in our Terms of service, under "If we are sold, or we stop".

Sending data outside the UK

The systems we run ourselves are in the European Union. The UK government has decided that EU countries protect personal data to the UK's own standard, so keeping UK data there is lawful and no extra paperwork is needed.

Two of our providers hold data in the United States: Resend, which sends our email, and Stripe, which takes payments. For those we rely on the standard contract terms the UK government publishes for this purpose, called the UK Addendum to the EU Standard Contractual Clauses. It is a set contract that binds the receiving company to UK-standard protection. Both companies are also certified under the UK extension of the EU-US Data Privacy Framework, which is a scheme the UK government recognises for transfers to the US.

One provider is an exception, and it is better said here than found. Cloudflare stores your files, and it guarantees they stay in the European Union without telling us which country they sit in. We cannot make it tell us, so asking us will not get you a different answer, and we would rather you knew that now than after you had put it on a form. If your own customer needs a named country, this is the one question these documents cannot answer for them, and we will tell you if that ever changes. Every other provider is placed by country on the list.

See where each provider holds your data.

How we keep it secure

• Data is encrypted while it travels between your browser and us, and it stays encrypted while it sits on our providers' disks. Railway encrypts the database, and Cloudflare encrypts every stored file.
• Your records and another company's records are kept apart by the database itself, not by the software remembering to keep them apart. Somebody signed in to another account cannot reach your data, even if the software has a bug.
• Only the people who run CarrierNote can reach your data, and every time one of them changes something on an account it is written to a log that cannot be edited.
• Once a transfer note is saved, it cannot be deleted before its legal date. That rule sits in the storage rather than in the software, so a software update cannot get round it and neither can we.
• Passwords are scrambled before they are stored, so nobody here can read yours.

What we offer your auditor is this agreement, a written answer to their questions within 10 working days, and a completed security questionnaire within 20 working days. Both deadlines are under "Showing you we're doing this" below. If they want a copy of any of it for their own file, ask us and we will send it. What we do not offer is an on-site inspection or access to our systems, because a shared service cannot let one customer walk through another customer's data. Ask us if that is not enough for you and we will say what else we can do.

If there's a breach

A personal data breach is any security failure that destroys, loses, changes, or exposes personal data. If one happens to data we hold for you, we'll tell you without undue delay and within 24 hours of finding out. That covers a breach at any of the companies on our sub-processor list, not only one at our end: they hold your data on our behalf, so their problem is our problem.

Finding out means the point where we are reasonably sure something has happened, not the point where we have finished working out what. We do not wait until we know how many people are affected, or how it happened, before we tell you. When the breach is at one of our providers, our 24 hours run from the moment they tell us, because that is when we find out; we then press them for the detail while your own clock is running.

We can't make a provider tell us quickly, so we don't promise a deadline that isn't ours to keep. What we do instead is show you the delay. When a breach is theirs, we tell you when they say they found out as well as when they told us, so you can see how long it had been known before it reached you. Your own 72 hours start when we tell you, not when they found out, so a slow provider never eats into your time to report. What it costs you is the chance to act early, which is why we publish both times and say so if we think a notice reached us late.

We tell everyone on your account with Account access, which is what your Team page calls the setting: the people who can manage your team, your plan and your billing, by email to the addresses on the account. Each account gets its own message, rather than one email carrying every customer's address. The 24 hours are ordinary hours: they run through nights, weekends and bank holidays, because your 72 to the Information Commissioner's Office do too. If you hear about a breach of your data before we do, tell us at the address at the foot of this page. We treat that as the moment we found out, we confirm we have it, and you get what we know by the end of the same 24 hours.

We'll tell you what happened, which data and roughly how many people are affected, what we think the consequences are, and what we're doing about it. If we don't have all of that at first, you'll get what we have and the rest as we learn it, because you have your own 72-hour deadline to report a breach to the Information Commissioner's Office and waiting on us for a complete picture would eat into it.

Helping you answer people's requests

Anyone whose data you hold can ask you for a copy of it, ask you to correct it, or ask you to delete it. Those requests come to you, because you're the controller, and you have one month to answer.

The service does most of the work for you. Any customer record has an "Export data" button that produces everything the service holds about that one person: their record, their addresses, their jobs, their transactions, their waste movements, and the photographs on those movements as image files inside the download. If someone has more photographs than one download can sensibly hold, the file says so and lists the ones it left out, with the path your own staff use to fetch each of them. That is one person's data, which is what these requests ask for. Getting your whole account out is a different job, and what that copy holds is in our Terms of service, under "Ending the agreement, and getting your data out". If a request needs something the button doesn't cover, email us and we'll help at no charge, within the 10 working days this agreement gives a data protection question.

If a request reaches us instead of you, we'll pass it to you rather than answer it ourselves, and we'll tell you we've done so.

A waste movement you have already sent to DEFRA can still be corrected. Change it in the app and send it again, and DEFRA holds the corrected version. We keep each earlier version, and you can download any of them, because a correction that hid what the note said before would be worth less to an inspector than the correction itself.

Taking a person off a note already sent is the one we cannot do. The note is a statutory record, so it cannot be deleted until the period above has run, and DEFRA has its own copy that we have no way to instruct. If someone asks you to erase their data and it sits on a note like that, tell them the law requires you to keep it, and email us if you want help saying so.

Showing you we're doing this

Two things we will do. We'll answer questions about how your data is handled, in writing, within 10 working days. And we'll complete a standard security questionnaire, the sort a council sends before it buys something, within 20 working days.

Those deadlines are for questions about data protection. Asking us for a copy of one of your own records is ordinary support, and the Terms of service promise an answer within one working day and the copy itself within 10 working days.

Cancelling, and closing your account

Cancelling and closing are two different things, and only closing leads to anything being deleted. You cancel from inside the app, and it stops future payments: your plan keeps working until the end of the period you have already paid for, so nothing you have paid for is cut short. Your account stays open after that, you can still sign in and export what you recorded, and nothing you have recorded is deleted. What changes at that point is that you go back to the free plan, called Pilot, for new waste movements. That is 10 a calendar month, and the count starts again on the 1st. A movement counts whether it produces a waste transfer note or a consignment note. You can pick a paid plan again whenever you like.

We will not close your account because you have stopped paying or stopped signing in. Closing is normally something you ask us for, and it is permanent. The Terms of service set out the one case where we may end the agreement ourselves, which is a serious or repeated breach of them, and you get the same 30 days to read and export either way.

To close the account, ask us: email us or use the help desk inside the app. We will email everyone with Account access to say we have been asked, and we close the account seven days later unless one of them tells us not to. The closing date goes to all of them in writing before it happens. If the only person with Account access has left, email us and we will sort the access out first. Export your records before you email us, although you can still export during the 30 days that follow.

For 30 days from the date we close it, you can still sign in and export, but you cannot record anything new. That is the same either way, whether you asked us to close it or we ended the agreement. If you asked us to and you change your mind, email us inside those 30 days, because after them we cannot put the account back; if we ended it, putting the account back is our decision rather than yours, and the export window is the part you can rely on.

After that we delete everything except the records the law makes us keep and the photographs attached to your waste movements. Those go as each period above ends, so they do not all go on the same day, and we will not warn you before each one. Keep your own copy of anything you might need after those dates.

How long this agreement lasts, and how it changes

It applies for as long as we hold personal data for you, and that is longer than your subscription: the statutory windows above run whether or not you still have an account, and this agreement governs that data until the last of them ends.

The one thing it cannot outlive is the company. If we stopped running the service altogether, these periods would end with it, and the notice we give you is the window in which to take your records out. What that notice is, and what we would try to do first, is in our Terms of service, under "If we are sold, or we stop".

If we change it in a way that affects your rights, we'll email everyone with Account access at least 30 days beforehand. Small corrections, like a clearer sentence or a fixed typo, we'll make without telling you, and the date at the top of this page says when we last touched it.

The small ones are published too. Every change we make to this agreement is listed at the foot of this page, with the date we made it, whether or not we emailed you about it.

How to reach us

This page asks you to email us in several places: a question about your data, a security questionnaire, objecting to a new sub-processor, closing your account, or changing your mind inside the 30 days that follow. Every one of them comes to this address: support@carriernote.co.uk.

For what we do with your own account data, rather than the records you keep for your customers, see our privacy notice.

Changes to this document

This is the first version of this document, and nothing on it has changed since we published it. Every change we make from here goes on this list with the date we made it, including the ones we judge too small to email you about.