Waste Collection Surrey Privacy Policy

This Privacy Policy explains how Waste Collection Surrey collects, uses, stores and shares personal data about our customers. It applies to all Waste Collection Surrey customers in our service areas within Surrey, including domestic, commercial and public sector customers who use or enquire about our waste collection, recycling and related services.

Who we are and scope of this policy

Waste Collection Surrey provides waste collection, recycling, clearance and related services to customers located in Surrey. For all activities described in this Privacy Policy, Waste Collection Surrey is the data controller. This means we determine how and why your personal data is processed.

This Privacy Policy applies whenever you interact with us as a customer or potential customer, for example when you contact us for a quotation, book a collection, sign a contract, visit our website, or communicate with us by telephone, email or post.

Personal data we collect

We collect and process different types of personal data depending on how you interact with us and the services you use. This may include:

Contact details such as name, address, email address, telephone number and location within Surrey where services are provided.

Service and contract information such as details of the services you request, service addresses, bin sizes, collection schedules, contract terms, pricing, payment status and service notes.

Billing and payment information such as billing addresses, payment method details, payment history, invoices, credit notes and records of financial transactions. Card data is handled in a way that complies with relevant payment security requirements. We do not store full card details when this is not necessary.

Communication records such as emails, letters, web forms, text messages and records of telephone calls where lawful, including enquiries, complaints, feedback, and requests relating to your rights under data protection law.

Technical and usage data such as IP address, device identifiers, browser type, approximate location, access times, and pages visited when you access our website, along with basic cookie information necessary for site functionality and security.

Operational data such as route planning information, driver logs, proof of collection records, time and date stamps, and photographs taken to evidence waste collection or site conditions where needed for our services and legal obligations.

How and why we use your personal data

We use your personal data only where we have a lawful basis to do so. The main purposes and corresponding lawful bases are:

To provide and manage services. We use your data to provide quotations, set up and manage your account, schedule and carry out collections, maintain service records, and manage customer service. The lawful basis for this is the performance of a contract or taking steps at your request before entering into a contract.

To manage billing and payments. We process billing and payment information to issue invoices, take payments, process refunds and manage debt recovery. The lawful basis is performance of a contract and our legitimate interest in recovering sums due.

To respond to enquiries and communicate with you. We use your contact details and communication records to respond to your questions, handle complaints, and keep you updated about service-related matters. The lawful basis is performance of a contract and our legitimate interests in providing good customer service.

To comply with legal and regulatory obligations. We may process personal data to comply with environmental, health and safety, tax, accounting, fraud prevention, and other legal obligations. The lawful basis is compliance with legal obligations.

To improve and protect our services. We may use technical data, service data and limited usage information to monitor performance, improve routes, maintain security, prevent abuse, and plan capacity. The lawful basis is our legitimate interests in operating and improving our business and services.

Marketing communications. We may send you information about services that are similar to those you have already purchased. The lawful basis is our legitimate interests in promoting our services. Where required, we will obtain your consent before sending marketing communications and you can withdraw consent or opt out at any time.

Data sharing and processors

We do not sell your personal data. We may share personal data with carefully selected third parties where necessary for the purposes described above, including:

Service providers and processors who act on our instructions, such as IT and hosting providers, customer management platforms, payment processors, route planning and logistics providers, call handling and communication tools, and professional advisers. These organisations are bound by contract to protect your data and may not use it for their own purposes.

Waste processing and disposal partners where operationally required to manage your waste in accordance with legal and regulatory requirements, and where customer details must be included on documentation or transfer notes.

Regulators, public authorities and law enforcement agencies where required by law or where necessary to protect our rights, property or safety, or the rights, property or safety of others.

Business partners or successors in the context of a business sale, merger, restructuring or similar transaction, in which case we will take steps to ensure your privacy rights continue to be protected.

Data retention

We keep personal data only for as long as is necessary for the purposes for which it was collected, and to meet legal, accounting or reporting requirements. Retention periods depend on the type of record and our relationship with you, but in general:

Customer account and service records are usually kept for up to six years after the end of the contract or last service, in line with limitation periods for legal claims.

Invoices, payment records and financial documents are usually retained for at least six years to comply with tax and accounting laws.

Enquiry and complaint records are typically retained for up to three years after resolution, unless they form part of a contractual or legal record that we must keep for longer.

Technical data and basic usage logs are generally kept for shorter periods, often up to twelve months, unless we need them for security, fraud prevention, or legal purposes.

When personal data is no longer required, we will securely delete or anonymise it so that it can no longer be linked to you.

International data transfers

Where we use service providers that are located outside the United Kingdom or European Economic Area, or that store data in other countries, we take steps to ensure that your personal data remains protected. This may include using standard contractual clauses or other safeguards approved under data protection law. You can contact us for more information about these safeguards.

Your data protection rights

As a customer of Waste Collection Surrey, you have important rights under data protection law in relation to your personal data. These include:

Right of access. You can request confirmation of whether we process your personal data and receive a copy of the personal data we hold about you.

Right to rectification. You can ask us to correct inaccurate or incomplete personal data about you.

Right to erasure. You can ask us to delete your personal data in certain circumstances, for example where it is no longer needed for the purposes for which it was collected, or where you withdraw consent and there is no other lawful basis for processing.

Right to restriction. You can ask us to restrict the processing of your personal data in certain situations, such as while we are investigating a concern raised by you.

Right to object. You can object to our processing of your personal data where we rely on legitimate interests as the lawful basis, including for direct marketing. We will stop processing unless we have compelling legitimate grounds or are required to do so by law.

Right to data portability. In some cases, you can request to receive personal data that you provided to us in a structured, commonly used and machine readable format and have it transmitted to another controller where technically feasible.

Right to withdraw consent. Where we rely on your consent for processing, you may withdraw this consent at any time. This will not affect the lawfulness of processing carried out before you withdraw consent.

You also have the right to lodge a complaint with a data protection supervisory authority if you believe your data protection rights have been infringed. We encourage you to contact us first so we can try to resolve your concerns.

Security of your personal data

We use appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include access controls, secure systems, staff training, and regular review of our data handling practices. While no system can be completely secure, we are committed to protecting your information and continually improving our safeguards.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or the way we process personal data. When we make significant changes we will take reasonable steps to inform you, for example by updating our website and indicating the date of the latest revision. We encourage you to review this Policy regularly to stay informed about how we handle your personal data.