Privacy notice

Who we are

CarrierNote is operated by Red Tape Software Ltd, registered in England and Wales under company number 17401331. Our registered office is 66 Paul Street, London, United Kingdom, EC2A 4NA.

We are registered with the Information Commissioner's Office, the UK's data protection regulator, under registration number ZC240267.

What data we collect

When you use CarrierNote, we may collect:

• Your name, email address, phone number, and business address (when you create an account or are added to a team).
• Customer records you enter into the system: customer names, addresses, phone numbers, and email addresses.
• Waste movement records, including EWC codes, weights, site addresses, carrier registration numbers, and e-signatures.
• When someone signs a waste movement, on your device or from a link we email them: the time, the internet address the signature came from, the kind of device and browser, and the device’s position if they allow it. We keep this with the note as evidence of who signed.
• Photos attached to waste movements (which may contain personal data such as faces, number plates, or house frontages).
• Billing records for your subscription: your plan, billing status, and the amounts you have been charged (card details are handled by our payment provider, not stored by us).
• Technical data: your IP address, browser type, and device information when you visit this website.
• Visits to this website: the page you read, the page that sent you here, your browser type, and your country. Cloudflare Web Analytics counts these for us without cookies. It uses your IP address to work out the country and doesn’t keep it, so we see totals rather than individual visitors.
• If you switch on notifications from the app, the details we need to send them to each device you use (see “Notifications from the app” below).
• If you create an account through one of our tagged links, we note which link it was for your workspace.

Why we collect it

We process your data on these lawful bases:

• Contract performance: to provide the service you signed up for, including waste record keeping, submission to DEFRA's Digital Waste Tracking service, managing your subscription, and sending the app notifications you have switched on.
• Legal obligation: waste transfer notes and hazardous waste consignment notes must be retained for at least two and three years respectively under the Environmental Protection Act 1990 and the Hazardous Waste Regulations 2005. Financial records are retained for six years under HMRC requirements.
• Legitimate interest: following up on enquiries you or your customers have submitted, improving the service, and counting visits to this website so we know which pages people find useful.

Marketing and prospect data

Separately from the records our customers keep in the app, CarrierNote holds a small amount of data about people who contact us as prospective customers: for example when you register your interest, use the free Waste Transfer Note tool, or send us an enquiry. For this data CarrierNote is the data controller (our customers control the customer records they hold in the app; this is different).

We hold your email address, and any name, company, or message you give us. If you reached us through one of our tagged links (for example in a newsletter, a directory listing or a video description), we also note which link it was, and keep that with your details. We use it only to count which of our links bring people to us. Our lawful basis is your consent, for marketing updates, or our legitimate interest in replying to an enquiry you started. We do not sell or share this data.

Now and then we also write to a waste business we have not met. The Environment Agency publishes a public register of permitted sites (sites that hold an environmental permit to take waste in) and of registered carriers. Where it shows a company that has to keep waste records, we may look up a business email address for that company and write to it, at most three times, to say what CarrierNote does. We write to companies, not to sole traders. Our lawful basis is our legitimate interest in telling a business about software built for a duty it already has. You can object at any time by replying, and we stop straight away and do not write again.

If you take part in one of our testing programmes, we ask for your feedback through an online form built with Tally, and your answers are kept with the rest of your prospect data.

You can unsubscribe from marketing updates at any time using the link in any email we send, or by replying to ask us to stop. If you ask us to erase your data we remove your personal details and keep only an anonymised record. We also anonymise prospect data automatically once we have had no contact from you for an extended period.

Notifications from the app

You can let the CarrierNote app send notifications to your phone or computer, for example to tell you we’ve replied to a support request you raised. They stay off until you tap Allow when your browser asks, and you can turn them off in the app at any time.

To send them, we store the address your browser gives us for notifications, two keys that encrypt each message, which kinds of notification you want, and a short label for the kind of device, such as “iPhone or iPad” or “Computer”, so you can tell your devices apart. We work the label out from your browser, and it holds nothing you type. We also note when you turned notifications on and when we last heard from the device, which is each time you open the app on it with notifications allowed.

A notification only says there’s something to look at, such as “We’ve replied”. It never contains your name, anyone’s contact details, or what a support request says. You open the app to read it. We also note when you last opened each support request, so we send one alert until you’ve seen it.

Each message travels through the push service your browser uses: Apple’s on an iPhone or iPad and for Safari on a Mac, Google’s for Chrome and most Android browsers, Mozilla’s for Firefox, and Microsoft’s for Edge. Your browser picks the service, not us. The message is encrypted so they can’t read it, but they do see where it is going and when it was sent. They aren’t on our sub-processor list, because they deliver for your browser rather than handling data for us.

We send notifications about your use of the service and never use them for marketing. We delete a device’s details when you turn notifications off in the app, when your browser’s push service tells us the device no longer accepts them, or when your account is deleted. We also delete them once we haven’t heard from the device for 12 months. If you block notifications in your browser or phone settings instead, they stop arriving, and we delete the details when the push service tells us the device no longer accepts them or after 12 months, whichever comes first.

How long we keep it

• Waste transfer note records and PDFs: at least two years from the date of transfer (Environmental Protection Act 1990, Duty of Care).
• Hazardous waste consignment notes: at least three years (Hazardous Waste Regulations 2005).
• Billing and payment records for your subscription: six years (HMRC).
• Customer records and account data: seven years from last interaction, unless a shorter period is requested and no legal retention requirement applies.
• Waste movement photos: kept with the customer record they belong to, so seven years from last interaction. They are extra evidence rather than part of the transfer note itself, so you can delete an individual photo from the app before then.
• Notification details for a device: until you turn notifications off in the app, your browser’s push service tells us the device no longer accepts them, or your account is deleted, and never more than 12 months after we last heard from the device.
• Screenshots and other images you attach to a support request: one year from when they were attached. After that the request shows that the image has expired.

Where your data is stored

The systems we run ourselves are hosted in the European Union: the Netherlands for the application and the database, which is where your account and your waste records live. Documents and photos sit in a data centre elsewhere in the EU. Our storage provider guarantees the EU rather than one named country, so we can't tell you which one. The UK government has decided that EU countries protect personal data to the UK's own standard, so keeping UK data there is lawful.

Three of the companies we rely on handle data in the United States. Resend sends our email, so it handles the address a message goes to and what's written in it. Stripe takes subscription payments, so it handles your billing details. For those two we rely on the standard contract the UK government publishes for sending personal data abroad, called the UK Addendum to the EU Standard Contractual Clauses: a fixed set of terms that binds the company receiving the data to protect it to the UK's standard. Cloudflare counts visits to our public website in its data centres in the United States and Europe, and uses your IP address only to work out which country you're in. All three companies are certified under the UK extension of the EU-US Data Privacy Framework, a scheme the UK government recognises for sending data to the United States.

Our sub-processor list names every company that handles data on our behalf, what each one does, and where it holds the data. If you're a customer, our data processing agreement sets out what we do with the records you keep for your own customers.

Cookies

Details of the cookies this site uses are in our cookie notice.

Your rights

Under UK GDPR, you have the right to:

• Request a copy of the personal data we hold about you (a subject access request). We will respond within one calendar month.
• Ask us to correct inaccurate data or complete incomplete data.
• Ask us to delete your personal data, where no legal retention requirement prevents it.
• Object to processing based on legitimate interest.
• Complain to the ICO (ico.org.uk) if you believe your data has been mishandled.

To make a request, email support@carriernote.co.uk.

Contact

If you have questions about this policy, email support@carriernote.co.uk. We don't have a separate data protection officer, so your question reaches the same shared inbox as everything else and one of us answers it. If you would rather write, our registered office address is 66 Paul Street, London, United Kingdom, EC2A 4NA.