Draft — under legal review. Not yet in effect.
Data Processing Addendum
A summary of the Data Processing Addendum (DPA) that governs how the Company processes personal information in our Customers’ records. It forms part of our Terms of Service. The full DPA is available on request.
Who does what
The Customer is the controller of the personal information in its records (a “business” under US state laws). The Company is its processor (a “service provider” or “processor”), and processes that information only on the Customer’s documented instructions. The DPA is written to meet Article 28 of the UK GDPR and the processor and service-provider rules of US state privacy laws such as the CCPA and the Colorado Privacy Act.
The processing
| Item | Details |
|---|---|
| Subject matter | Providing the Service: a records system for recycling facilities and brokers. |
| Duration | While the Customer uses the Service, and until its data is deleted afterwards (within 30 days). |
| Nature and purpose | Storing, displaying, adding up and reporting on records; reading text from uploaded files on our own servers; signing users in; support. |
| Personal information | Names, work emails and roles of users; names of people who key or correct records, with their reasons; names and details of drivers, haulers and contacts at suppliers, buyers and disposal sites, as entered or contained in uploaded documents and photos; network addresses and sign-in records. |
| People concerned | The Customer’s users (employees and contractors), and people named in its records and documents. |
| Sensitive information | None intended. Customers are asked not to upload it. |
What we commit to
- process personal information only on the Customer’s documented instructions, and tell the Customer if we think an instruction breaks the law;
- make sure everyone who handles it is bound to keep it confidential;
- keep appropriate security measures, described on our Security page;
- use only the subprocessors on our Subprocessors page, which the Customer authorizes in general, with at least 30 days’ notice and a right to object before adding one, and pass the same data protection duties on to them;
- help the Customer answer requests from people exercising their rights, and with security, breach notices, data protection impact assessments and consultations with regulators;
- tell the Customer of a personal data breach without undue delay after becoming aware of it, with what we know and updates as we learn more;
- at the end, delete or return the Customer’s personal information as it chooses, within 30 days, unless the law requires us to keep it;
- make available the information needed to show we meet these duties, and allow and contribute to audits, including inspections, by the Customer or an auditor it appoints, on reasonable notice;
- for US Customers, not sell or share the information, not use it outside the business relationship, and not combine it with other information except as those laws allow.
Transfers from the United Kingdom
Customer data is stored in the United States. For UK Customers, the DPA includes the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses as the safeguard for that transfer.
Getting the full DPA
The full DPA, ready to sign, is available on request. Ask at the Contact page.