Privacy notice
Last updated: . This notice explains how we handle personal data under the UK GDPR and the Data Protection Act 2018.
1. Who we are
ScrapOS ("we", "us") is the data controller for the personal data described below.
- Registered name: [ScrapOS Ltd — registered company name]
- Registered address: [registered company address]
- Company number: [company number]
- Privacy contact: privacy@scrapos.site
2. What we collect
- Information you give us through the early access form: your name, work email address and any optional yard details (site footprint, weighbridge indicator make).
- Portal account data if you use the application: username, hashed password, role and the waste-tracking records you create.
- Technical data collected automatically by our web server: IP address, browser type, requested page and time of request (standard server logs).
We do not use analytics, advertising or tracking cookies on this website. See our cookie policy.
3. Lawful basis and purposes
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Contacting you about the early access pilot and sending updates you asked for | Consent — Art. 6(1)(a) |
| Providing and securing the portal and its records | Performance of a contract — Art. 6(1)(b); legitimate interests — Art. 6(1)(f) |
| Keeping server logs and preventing abuse | Legitimate interests — Art. 6(1)(f) |
| Meeting legal, tax and accounting obligations | Legal obligation — Art. 6(1)(c) |
Where we rely on consent you can withdraw it at any time by emailing us or using the unsubscribe link in any email.
4. Marketing
We use EmailOctopus to manage our mailing list and send email. Your name and email address are processed on our behalf as a processor. Our emails comply with the Privacy and Electronic Communications Regulations (PECR); every marketing email includes an unsubscribe link.
5. Who we share data with
We do not sell your personal data. We share it only with service providers who help us run the service:
- EmailOctopus — mailing list and email delivery.
- DigitalOcean — server hosting (our servers are in the [region, e.g. London]).
- Google Fonts — the site loads web fonts from Google, which receives your IP address when your browser fetches them. See our cookie policy.
We may also disclose data where required by law or to protect our legal rights.
6. International transfers
Some providers (for example, EmailOctopus and Google) may process data outside the UK. Where that happens we rely on an adequacy regulation or the International Data Transfer Agreement / Addendum, or equivalent safeguards. Contact us for a copy of the safeguards used.
7. How long we keep it
- Pilot enquiries: up to 24 months from your last interaction, or until you ask us to delete them.
- Consent records: for as long as we rely on your consent, plus 24 months.
- Portal records: for as long as your account is active, then [retention period] to meet legal and accounting obligations.
- Server logs: up to [e.g. 30 days].
8. Your rights
You have the right to access your data, to have inaccurate data corrected, to have it erased, to restrict or object to processing, to data portability, and to withdraw consent. Email privacy@scrapos.site and we will respond within one month.
If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
9. Security
We protect data with TLS in transit, bcrypt password hashing, access controls and regular updates. No method of transmission or storage is completely secure, but we take reasonable steps to protect your information.
10. Children
Our services are intended for business use and are not directed at children under 16. We do not knowingly collect their data.
11. Changes
We may update this notice. Material changes will be posted here with a new "last updated" date.
12. Contact
Questions or requests: privacy@scrapos.site.