Legal

Sub-processors

Every company that handles personal data on CarrierNote's behalf, what each one does, and where it holds the data.

Version of 23 September 2026

A sub-processor is a company that handles personal data on our behalf so that we can run the service. We're responsible to you for what they do with it, so you're entitled to know who they are.

Before a new one starts, or one replaces another, we'll email everyone with Account access at least 30 days beforehand. Object before the change takes effect and you'll have our answer within 5 working days; if we answer later than that, you get at least 14 days from our answer to decide, and the change waits that long even if it was due sooner. If there's no way round it, you can cancel over it. Cancelling normally stops future payments and your plan runs to the end of the period you have already paid for, with the unused part not refunded. This is the one case where we refund it: cancel in the app and tell us the change is why, and the part you have not used goes back to your card, starting within 5 working days of you telling us. The plan then ends on the day we send the money rather than running to your renewal date.

That promise is part of our data processing agreement.

The two rules that let data leave the UK

EU adequacy. The UK government has decided that EU countries protect personal data to the UK's own standard, so keeping UK data in the EU is lawful and needs nothing further.

The UK Addendum to the EU Standard Contractual Clauses. For data going further than that, we use the standard contract the UK government publishes for the purpose. It's a fixed set of terms that binds the company receiving the data to protect it to the UK's standard.

Companies that handle data for us

Railway

What it does: Runs the application and the database. This is where your account and every record you enter live.
What it handles: Everything you enter into the service: your account, your customers, your waste records, and your billing history.
Where: Amsterdam, in the Netherlands. It is the only place our application and database run.
How the data gets there lawfully: EU adequacy, explained above.

Cloudflare

What it does: Stores the files the service holds, using its R2 storage product. It also counts visits to our public website, using its Web Analytics product.
What it handles: Documents, and the photos attached to waste movements. Those photos often contain personal data: faces, number plates, house frontages. For website visits, your IP address, which it uses to work out your country and doesn't keep.
Where: The files are somewhere in the European Union. Cloudflare guarantees they stay in the EU but does not tell us which country they sit in, and we can't make it, so asking us won't get you a different answer. This is the one thing on this page we cannot tell you, and we'll say so here if that ever changes. Website visits are counted in Cloudflare's data centres in the United States and Europe.
How the data gets there lawfully: EU adequacy for the files, explained above. For website visits, Cloudflare is certified under the UK extension of the EU-US Data Privacy Framework, a scheme the UK government recognises for sending data to the United States.

Resend

What it does: Sends the emails the service sends: password resets, team invitations, waste transfer notes sent on to your customer, and our own marketing emails where you have asked for them.
What it handles: The email address a message is sent to, and the contents of that message.
Where: The United States.
How the data gets there lawfully: The UK Addendum to the EU Standard Contractual Clauses, explained above. Resend is also certified under the UK extension of the EU-US Data Privacy Framework.

Stripe

What it does: Takes subscription payments. Card numbers go straight to Stripe and are never stored by us.
What it handles: Your billing contact details, your card details, and your payment history.
Where: The European Union and the United States. Our contract is with Stripe Payments Europe Limited, registered in Ireland.
How the data gets there lawfully: The UK Addendum to the EU Standard Contractual Clauses, explained above. Stripe's US company is also certified under the UK extension of the EU-US Data Privacy Framework.

Migadu

What it does: Hosts our support mailbox, so it handles anything you send us by email.
What it handles: Your email address and whatever you write to us, including anything you attach.
Where: France. That is where the mail servers are. Migadu is a Swiss company, so its own staff can reach the servers from Switzerland when they are fixing something.
How the data gets there lawfully: The UK government has decided that both France and Switzerland protect personal data to the UK's own standard.

Ideal Postcodes

What it does: Turns a postcode typed into a waste note into the list of addresses at it, so the address can be picked rather than typed.
What it handles: The postcode that was typed, and nothing else: no name, no account, and nothing about the note it is for.
Where: The United Kingdom and the European Union. Ideal Postcodes publishes that its data centres are in both and that data does not leave them; its ISO 27001 certificate covers the service.
How the data gets there lawfully: UK to UK where its UK data centres answer, so no transfer rules apply; EU adequacy, explained above, where its EU ones do.

Regulators we send data to

These aren't sub-processors, and the difference matters to you. A sub-processor does what we tell it. A regulator receives data because the law says it must, and decides for itself what to do with it afterwards. We can't instruct DEFRA to delete a waste record any more than you can.

DEFRA Digital Waste Tracking

What it does: Receives the waste movements you submit to the national waste tracking service.
What it handles: The waste record itself: codes, weights, sites, and the registration numbers of the parties. Photos and signatures are never sent.
Where: The United Kingdom.
How the data gets there lawfully: UK to UK, so no transfer rules apply.

The environmental regulators

What it does: They receive waste data because the law requires it, and they hold the public register we check a carrier registration number against. They are the Environment Agency in England, Natural Resources Wales, SEPA in Scotland, and NIEA in Northern Ireland.
What it handles: A carrier or permit registration number you enter. The register itself is already public.
Where: The United Kingdom.
How the data gets there lawfully: UK to UK, so no transfer rules apply.

DVSA

What it does: Answers the optional vehicle lookup on the vehicle form, which fills in a vehicle's make, model, and MOT expiry.
What it handles: A vehicle registration number. Nothing about a person is sent.
Where: The United Kingdom.
How the data gets there lawfully: UK to UK, so no transfer rules apply.

Questions

Email support@carriernote.co.uk.