Draft — under legal review. Not yet in effect.
Privacy Policy
This policy explains what personal information Corom holds, why, who else handles it, where it is kept, how long it is kept, and the rights people have. It covers our Customers and users in the United States and the United Kingdom.
1. Who we are
Corom (the “Service”) is provided by The Company (“we” or “us”) to businesses that run recycling facilities and brokerages (our “Customers”), in the United States and the United Kingdom. The people a Customer lets use the Service are its “users”.
2. Our two roles
Data protection law treats us differently depending on whose information it is and who decides how it is used. Under UK law (the UK GDPR and the Data Protection Act 2018) these roles are “controller” and “processor”. US state laws use “business” and “service provider” or “processor” in much the same way.
- We are a processor (or service provider) for our Customers’ records. This covers the facility records and documents a Customer keeps in the Service, and the people named in them, such as drivers, haulers and contacts at suppliers and buyers. The Customer decides what goes in and how it is used, and we process it only on the Customer’s instructions, under our Data Processing Addendum. If your information is in a Customer’s records, please contact that Customer about it; we will help them respond.
- We are a controller (or business) for our own information: the account details of the people who sign in, sign-in and security records, terms acceptance records, privacy requests and other messages sent to us, and our business contacts. This policy applies to that information directly.
3. What we hold
Records our Customers keep (we are their processor)
- weigh events: the weight, time, scale, material, direction, ticket or docket number, supplier, buyer or disposal site, hauler and community of origin of each load, and who keyed or voided an entry by hand and why
- planned loads, their receiving disposition and the paperwork attached to them
- stock counts, bales created and production batches
- brokerage records: grades, receipts, shipments, prices and margins, preloaded loads, bills of lading and contamination readings
- reports made from those records, such as period reports and reports in the layout CAA asks for
- files people upload: bills of lading, tickets, spreadsheets, PDFs, scans and photos, including photos taken with the phone capture and Scan pages, and the text read from them
Text in uploaded files and photos is read automatically on the servers that run the Service, so it can be checked and arranged into reports. No outside reading or AI service is used for this.
When a Customer’s owner sets up its account, the Service also keeps the organization’s legal name, phone number and addresses, and the addresses of its locations.
About the people who use the Service (we are the controller)
- Accounts: name, work email address, role, the sites a person may see, whether the account is invited, active or switched off, who invited them and when they joined. Passwords are stored only as a one-way, salted hash, never as the password itself.
- Sign-in sessions: for each session, when it started, when it was last used and when it ended, with the browser’s description of itself and the network (IP) address it signed in from. People can see and end their own sessions in their settings.
- Security log: sign-ins, wrong passwords or codes, sign-in pauses, sign-outs, role changes, people switched off or back on, and data exports, each with the time, the person concerned and the network (IP) address. A Customer’s owners and admins can see the entries about their own people.
- Site access code: people who sign in with a shared access code are not identified by name. Their sign-ins and wrong tries are logged by network address only.
- Sign-in protection: after wrong sign-in tries we keep the network address, and for named sign-in the email address tried, with the times of the wrong tries, so we can pause sign-in after five wrong tries in 15 minutes.
- Terms acceptance: which version of the Terms and this policy was accepted, when, and by whom: the name and email of a named user, or for the shared access code, a random ID for the browser.
- Names on records: where someone enters a weight by hand or corrects a record, the Service keeps who they are or the name they give, and their reason.
- Privacy requests: what you enter in the form on our Contact page (name, email, kind of request, country, relationship to the Service and message), with the network address and time it was sent.
Technical information
Our hosting provider receives every request to the Service, including the network (IP) address, the browser’s description of itself and the address requested, and keeps logs of them under its own policies. We use these logs only to run, secure and fix the Service.
We do not ask for, and the Service is not meant to hold, special category or sensitive information such as health information, government ID numbers or financial account numbers.
4. Cookies
The Service sets only the cookies below. Each one is strictly necessary to provide something you asked for: signing in, recording what you agreed to, or remembering a setting you chose yourself. Under the UK’s Privacy and Electronic Communications Regulations (PECR), strictly necessary cookies do not need consent, so the Service shows no cookie banner. There are no advertising, analytics or tracking cookies, and no third-party scripts or fonts are loaded. If we ever want to use a cookie that is not strictly necessary, we will ask first.
| Cookie | What it does | How long it lasts | Why it is needed |
|---|---|---|---|
trace_gate | Keeps a browser signed in with a site access code. Holds an expiry time and a signature, nothing else. | 30 days, or until you sign out | Signing in |
trace_person | Keeps a person signed in to their own account. Holds a random key; the server keeps only a scrambled copy of it. | Ends 12 hours after it was last used and after 14 days at most, or when you sign out | Signing in |
pilot_session | Keeps a person signed in by name in the pilot sign-in. Holds the user’s internal ID, an expiry time and a signature. | 14 days, or until you sign out | Signing in |
trace_terms | Remembers that this browser accepted the current Terms of Service and Privacy Policy, and as whom, so you are not asked again. | 1 year | Recording what you agreed to before using the Service |
trace_site | Remembers which of your organization’s sites you chose. | 1 year | A setting you chose |
look | Remembers which look of the Service you chose. | 1 year | A setting you chose |
onboarding_check | Shows a preview feature on a browser that opened the preview link. | 1 year | A feature you asked for |
You can delete these cookies in your browser at any time. You will then need to sign in again, accept the terms again and choose your settings again.
5. Why we use information, and our lawful bases
For the information we control, UK law requires a lawful basis for each use. We rely on the following. We do not rely on consent for any of them.
| Purpose | Information | Lawful basis (UK) |
|---|---|---|
| Running accounts: signing people in, showing them what their role allows | Name, work email, role, sites, account status, password hash, sign-in sessions | Contract where you are the Customer or act for it in agreeing to our terms. Otherwise legitimate interests: providing the Service your organization signed up for to the people it chose. |
| Keeping the Service secure: limiting sign-in guesses, the security log, finding and stopping misuse | Network (IP) addresses, email addresses tried, browser descriptions, times of sign-ins, wrong tries, pauses, sign-outs and account changes | Legitimate interests: protecting our Customers’ records, their users’ accounts and the Service from unauthorized access. |
| Recording who accepted which version of our terms | Name and email of a named user, or a random ID for a browser; version; time | Legitimate interests: being able to show what was agreed, and when. |
| Answering privacy requests and other questions | What you tell us: name, email, the kind of request, your country, your relationship to the Service and your message, with the network address and time it was sent | Legal obligation for requests under data protection law. Legitimate interests for other questions: answering the people who write to us. |
| Dealing with our business contacts: our Customers’ account contacts, and people who ask about the Service | Name, work email, phone, company and what we discussed | Contract with our Customers. Legitimate interests: running our business and telling business contacts about the Service. We stop if you ask. |
| Keeping records the law requires, and dealing with legal claims | What is needed for the purpose | Legal obligation, and legitimate interests in establishing or defending legal claims. |
Where we rely on legitimate interests, we have weighed them against your rights and expectations; you can ask us for details. For our Customers’ records, the Customer is responsible for having a lawful basis, and we act only on its instructions.
We do not sell personal information, share it for cross-context behavioral or targeted advertising, or use Customer records for advertising. We do not send marketing through the Service.
6. Who else handles it
- Our subprocessors, the outside services that host the Service and its database, listed on our Subprocessors page.
- The Customer whose account you use: its owners and admins can see the records and user details in its account, and the security log entries about its people.
- Where the law requires it, such as a valid court order. Where we are allowed to, we tell the Customer first.
- Professional advisers, such as lawyers and accountants, under a duty of confidentiality.
- A successor, if our business is merged or sold, under the same protections.
7. Where it is kept, and transfers from the UK
The Service is hosted, and its database is kept, in the United States, for Customers and users in both the United States and the United Kingdom.
When personal information from the United Kingdom is sent to the United States, UK law requires a safeguard. We use the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, in our agreements with UK Customers and with our providers. Where a provider takes part in the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”), that framework may be used instead. You can ask us for a copy of the safeguards that apply.
8. How long we keep it
- Customer records and files are kept for as long as the Customer uses the Service. Records are not changed or removed in place: a correction is kept beside the original with a name and reason, so the history stays complete. When a Customer leaves or asks, we delete its data as our Terms of Service describe (within 30 days).
- Account details are kept while the Customer uses the Service. A person who is switched off stays listed, so the history of who did what still makes sense, and is deleted with the Customer’s data.
- Sign-in sessions stop working 12 hours after last use, or after 14 days at most. The record of each session is kept with the security log.
- The security log and privacy requests are kept until we delete them. We are setting a fixed period and will state it here before this policy takes effect.
- Wrong sign-in tries are used only for the 15-minute limit and are cleared when someone next signs in correctly from that address.
- Terms acceptance records are kept for as long as the Customer uses the Service, as evidence of what was agreed.
- Backups made by our database provider are removed as those backups expire.
- Business contacts and correspondence are kept while we deal with that person or company, and afterwards only as long as the law requires or a claim could arise.
- Cookies last as long as the table above says.
9. Your rights in the United Kingdom
If you are in the United Kingdom, you have these rights over personal information we control:
- Access: to know whether we hold personal information about you and to get a copy of it.
- Rectification: to have inaccurate information corrected and incomplete information completed.
- Erasure: to have information deleted where there is no good reason for us to keep it.
- Restriction: to ask us to hold information but not use it, for example while its accuracy is checked.
- Portability: to receive information you gave us in a common, machine-readable format, or have it sent to another organization, where we rely on contract or consent.
- Objection: to object to our use of information based on legitimate interests. We then stop unless we have compelling grounds. You can always object to direct marketing.
- Automated decisions: not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you. The Service does not make such decisions about people. Its readiness scores and charge estimates describe records, not individuals, and people review them.
To use any of them, send a request with the form on our Contact page or write to us at the Contact page. It is free. We may ask you to confirm who you are. We answer within one month, and if a request is complex or one of several we may extend that by up to two more months, telling you why within the first month.
If your information is in a Customer’s records, we pass your request to that Customer and help it respond, because the Customer decides about that information.
If you are unhappy with how we handle your information, please tell us first. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk.
10. Your rights in the United States
Several US states, including California (the CCPA, as amended by the CPRA), Colorado (the Colorado Privacy Act), Virginia, Connecticut, Utah, Texas and Oregon, give their residents rights over personal information held by businesses that meet those laws’ thresholds. Where such a law applies to us, and subject to its exceptions, residents may ask to:
- know what personal information we hold about them, how we got it and why, and get a copy of it in a portable format;
- correct inaccurate information;
- delete information;
- opt out of the sale of personal information, its sharing for cross-context behavioral or targeted advertising, and profiling that has legal or similarly significant effects. We do none of these, and have not done so in the past 12 months.
We use sensitive personal information, such as a password, only to provide the Service and keep it secure. Because we do not sell or share personal information, there is nothing for a Global Privacy Control signal to switch off.
To make a request, use the form on our Contact page or write to us at the Contact page. An authorized agent may make a request for you with your signed permission. We will confirm who you are before acting, and answer within 45 days, or tell you if we need up to 45 more as the law allows. If we decline a request, you may appeal by replying to our answer; we answer appeals within the time the law sets, and if you are a Colorado resident you can contact the Colorado Attorney General if you disagree with the result. We will not treat you differently for exercising these rights.
If your information is in a Customer’s records, or you use the Service through your employer, we act on that Customer’s instructions and will pass your request to it.
11. Children
The Service is for businesses and is not directed at children: not at anyone under 16 in the United Kingdom, or under 13 in the United States. We do not knowingly collect their information. If you believe a child’s information has reached us, please tell us and we will delete it.
12. Security
Our Security page describes how the Service protects information, and what it does not do yet. If we confirm a breach affecting a Customer’s data, we tell that Customer as our Terms of Service describe. Where a breach affects information we control, we tell the ICO and the people affected when the law requires it.
13. Changes to this policy
When we change this policy in a material way, we announce it in the Service and email our Customers’ account contacts at least 30 days before it takes effect, and every user is asked to accept the new version on their next visit. The version label and effective date are at the top of this page.
14. Contact
Questions about this policy or your information, and privacy requests: use the form on our Contact page, or write to us through the Contact page.