Privacy policy

Clean & Recycle is the data controller for the personal information described in this policy. That means we decide what is collected, why, and how long it is kept, and we are accountable for those decisions under the UK General Data Protection Regulation. If you have a question about anything here, or want to exercise one of the rights set out below, our data protection contact is privacy@cleanandrecycle.example and we aim to respond within five working days.

We collect only what we genuinely need in order to quote for work, deliver a collection service, and meet the record-keeping obligations placed on us as a licensed waste carrier. In practice that falls into four groups. When you contact us we hold the name, email address, telephone number and message you send. When you become a client we hold site addresses, named contacts, purchase order references and billing details. While we are serving you we generate operational records — collection times, weighbridge tickets and waste consignment notes. And whenever anyone uses this website we briefly log an IP address and basic request information.

That last category deserves a word of explanation, because it is the one people are most often surprised by. We log request data for a narrow and specific purpose: to keep the site available and to stop automated abuse of the contact form. It is not used to build a profile of you, it is not combined with any other dataset, and it is discarded after thirty days. We do not operate advertising cookies, third-party analytics trackers, or any form of cross-site tracking on this website.

We never ask for information we have no use for. If a form on this site requests something that is not obviously necessary for the service you are asking about, please tell us — that is a mistake on our part rather than a deliberate collection, and we would rather fix it than keep the data.

Data protection law requires us to identify a lawful basis for every use of personal information, and to be specific about it rather than relying on a general claim of legitimate business need. Where we reply to an enquiry or prepare a quotation, our basis is legitimate interests: you contacted us expecting a response, and answering you is the obvious and expected outcome. Where we deliver collections under an agreed schedule, our basis is performance of a contract. Where we keep duty-of-care paperwork and consignment notes, our basis is a legal obligation that applies to every licensed waste carrier in the country.

The practical consequence of that distinction matters to you. Information we hold because of a legal obligation cannot simply be deleted on request, because we are required to be able to produce it. Information we hold on the basis of legitimate interests can be, and we will act on an objection unless we can demonstrate compelling grounds that override your rights. We will always tell you which category your request falls into rather than refusing without explanation.

We do not sell personal data, we do not share it for anyone else’s marketing purposes, and we do not transfer it outside the United Kingdom except where a service provider we rely on operates elsewhere, in which case appropriate safeguards are in place. The small number of processors we use — for email delivery, hosting and accounting — act only on our documented instructions and are contractually prohibited from using your information for their own purposes.

Holding information indefinitely because it might one day be useful is both poor practice and, in most cases, unlawful. We therefore set a retention period for each category of data and delete or irreversibly anonymise it when that period ends, rather than leaving records to accumulate quietly in a mailbox or a spreadsheet.

Enquiries that do not result in a contract are kept for twelve months and then deleted. This gives us long enough to pick up a conversation that went quiet and to recognise a returning enquirer, without retaining the details of people who decided not to work with us. Client records are kept for the life of the contract and for six years afterwards, which is the period required for accounting and tax purposes and the period during which a contractual claim could still be brought. Waste consignment notes are kept for at least three years because the law requires it, and server logs are kept for thirty days.

If you ask us to delete your information we will do so within one month, except where one of the legal retention periods above applies. In that case we will tell you clearly which records we must keep, why, and when they will be destroyed — rather than simply declining the request.

This website sets a small number of strictly necessary cookies and nothing else. One is a session cookie, created only when an administrator signs in to manage the site; it is sealed, marked HTTP-only so that scripts cannot read it, and expires after eight hours. The others remember your chosen colour theme and whether you prefer light or dark mode. None of them contains personal data, none is used for tracking, and none is shared with a third party.

Because we set no advertising or analytics cookies, there is no consent banner on this site. That is a deliberate design decision rather than an oversight: a banner that asks permission to do something we are not doing would be misleading, and strictly necessary cookies do not require consent under the Privacy and Electronic Communications Regulations.

On security, all traffic to and from this site is encrypted in transit. Administrator passwords are hashed with bcrypt and are never stored in a form that we or anyone else could read, which means we genuinely cannot tell you your own password — we can only help you set a new one. Sign-in attempts are rate limited and accounts lock temporarily after repeated failures, which blunts automated password guessing.

Access to client records inside the business is limited to the people who need it to do their job, and that access is reviewed periodically. No system is perfect, and we would rather say so plainly than claim otherwise: if we ever become aware of a breach affecting your personal data, we will notify the Information Commissioner’s Office within seventy-two hours where required, and we will tell you directly where there is a high risk to your rights.