Privacy Policy

1. Data Controller

Cloud4Waste Ltd is the Data Controller for personal data processed through the Cloud+ platform. If you have any questions about how we handle your personal data, please contact our Data Protection contact at info@cloud4waste.com.

2. What Personal Data We Collect

We collect the following categories of personal data:

• Account & Identity Data: Full name, email address, company name, job role, phone number.
• Company & Business Data: Business address, company registration details, billing information.
• Technical & Usage Data: IP address, browser type, device information, pages visited, feature usage, session duration.
• Machine Telemetry: Sensor readings, cycle counts, machine status signals, gateway identifiers, timestamps.
• Payment Data: Billing details processed securely via Stripe. We do not store full card numbers on our systems.
• Communication Data: Messages sent within the platform, support enquiries, email correspondence.
• Waste & Environmental Data: Waste types, collection records, bale counts, sustainability metrics.

3. How We Collect Personal Data

• Directly from you when you register, configure your account, or contact us.
• Automatically through the platform when you use the service (usage logs, session data).
• From connected IoT devices and gateways associated with your machinery.
• From third parties such as Trade Customer companies who invite you to the platform.

4. Lawful Basis for Processing

We process your personal data under the following lawful bases (UK GDPR Article 6):

• Contract (Art. 6(1)(b)): To perform our contract with you — providing access to and operation of the Cloud+ platform.
• Legal Obligation (Art. 6(1)(c)): To comply with applicable legal and regulatory requirements, including financial record-keeping.
• Legitimate Interests (Art. 6(1)(f)): To improve our platform, prevent fraud, maintain security, and send service-related communications. We have carried out a legitimate interest assessment and are satisfied these interests are not overridden by your rights.
• Consent (Art. 6(1)(a)): Where we send optional marketing communications or use non-essential cookies, where your consent has been obtained.

5. How We Use Your Personal Data

• Providing, maintaining, and improving the Cloud+ platform.
• Managing your account, subscription, and billing.
• Sending service notifications, invoices, and transactional emails.
• Facilitating waste collection marketplace connections.
• Generating sustainability and ESG reports on your behalf.
• Detecting and preventing fraud, abuse, and security incidents.
• Complying with legal and regulatory obligations.
• Conducting internal analytics to improve platform performance.

6. Data Sharing & Third Parties

We share personal data only where necessary, with the following recipients:

• Stripe Inc. — Payment processing. Stripe is PCI-DSS compliant. See Stripe's Privacy Policy at stripe.com/privacy.
• Resend — Transactional email delivery (invitations, notifications, invoices).
• Cloud Infrastructure Providers — Data hosting and storage (servers located in the UK/EEA).
• Trade Customer Companies — If you are an End Customer, your account manager (Trade Customer) will have access to data about your machines and sites.
• Waste Collectors — Where you engage collectors via the Marketplace, relevant job and location data will be shared with them.
• Legal & Regulatory Authorities — Where required by law, court order, or to protect our rights.

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

7. International Data Transfers

Where personal data is transferred outside the UK or EEA (e.g. to Stripe's US servers), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) or reliance on UK adequacy decisions, to protect your data in accordance with UK GDPR requirements.

8. Data Retention

• Account and Customer Data is retained for the duration of your Subscription plus 30 days following termination or deletion.
• Financial and billing records are retained for 7 years to comply with UK tax and accounting obligations.
• Machine telemetry data may be retained for up to 3 years for historical trend analysis, unless you request earlier deletion.
• Anonymised and aggregated data (which cannot identify you) may be retained indefinitely.
• After the retention period, data is securely deleted or anonymised.

9. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your data where there is no compelling reason for continued processing.
• Right to Restriction: Request that we restrict processing of your data in certain circumstances.
• Right to Data Portability: Receive a structured, machine-readable copy of your data to transfer to another service.
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
• Rights related to Automated Decision-Making: The right not to be subject to solely automated decisions that significantly affect you.

To exercise any of these rights, contact us at info@cloud4waste.com. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Security

We implement appropriate technical and organisational security measures to protect your personal data, including: TLS 1.2+ encryption for data in transit; encryption at rest for stored data; role-based access controls; regular security reviews; and strict third-party data processor vetting. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and affected individuals without undue delay, in accordance with UK GDPR Article 33/34.

11. Cookies

We use cookies and similar tracking technologies on the Platform. Please refer to our Cookie Policy for full details of the cookies we use and how to manage them.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify you by email or via a prominent notice on the platform before the changes take effect. We encourage you to review this policy periodically.

13. Contact Us

For any privacy-related queries or to exercise your rights, please contact: info@cloud4waste.com
For general support: info@cloud4waste.com
To make a complaint to the regulator: Information Commissioner's Office (ICO) · ico.org.uk · 0303 123 1113