Privacy Policy
Last updated: 25 August 2026
This policy explains how DutyOS Ltd (“DutyOS”, “we”, “us”) handles personal data when you use the DutyOS platform at dutyos.co.uk. We are a company registered in England and Wales, company number 08895470, registered office 8 Cresswell Road, Swanscombe, Kent, DA10 0FD. We are registered with the Information Commissioner’s Office as a data controller under reference ZC210419, registered on 30 July 2026.
1. Our two roles
DutyOS handles personal data in two distinct capacities, and your rights differ depending on which applies:
- As controller — for the account itself: the details of the person who signs up, their team members and drivers, billing records, and how the service is used. We decide how this data is handled.
- As processor — for the waste records our customers create. When a waste carrier records a waste transfer note naming their own customer, that customer’s details are entered by, and remain under the control of, the carrier. We only act on the carrier’s instructions.
If you are a waste producer whose details appear on a waste transfer note and you want that data corrected or removed, contact the waste carrier who created the record, not DutyOS. We cannot alter a carrier’s compliance records on a third party’s request.
2. What we collect
| Category | Examples | Why |
|---|---|---|
| Account details | Name, email address, phone number, company name, role | To create and secure your account |
| Waste records | Transfer and consignment notes, EWC codes, site addresses and postcodes, supplier and customer contact details, signatures | The core purpose of the service — statutory duty-of-care records |
| Driver and vehicle data | Vehicle checks, defect reports, weekly engineer checks, job records, photographs, and GPS location captured when a job or check is filed | To evidence where and when a collection or check took place |
| Billing | Subscription tier, payment status, invoice history | To take payment and meet accounting obligations |
| Technical | IP address, browser type, log and error data | Security, fraud prevention and diagnosing faults |
We do not collect special category data, and we ask that you do not enter it into free-text fields. We do not use your data to train machine learning models, and we do not sell it.
People at waste businesses we write to
Separately from our customers, we sometimes write one business email, with at most two follow-ups, to companies that operate a permitted waste site or hold an upper-tier waste carrier registration in England, to tell them DutyOS exists before the waste tracking duty applies to them. If you have received one of those emails, this is where your details came from and what we hold.
- Source — your company’s entry on the Environment Agency’s public register of environmental permits or its public register of waste carriers, brokers and dealers (company name, registration or permit reference, area), and the email address published on your company’s own website. The email tells you which register and which page. We do not buy lists and we do not use search engines or third-party databases to find addresses. Contains Environment Agency information © Environment Agency and/or database right.
- Who we write to — companies only. Sole traders and partnerships are excluded before any email is sent, because the e-privacy rules (PECR regulation 22) require it, and we check company status against Companies House.
- Legal basis — legitimate interests. We have recorded the assessment and will provide it on request.
- What we hold — company name, register reference, Companies House number, business email address, the page it was found on, sometimes a contact name, and a log of the decisions we made about the entry.
- Who else sees it — the email is sent through Woodpecker from a mailbox provided by Google Workspace. Both act on our instructions.
- How to stop — the unsubscribe link in the email, or reply “no thanks”, or write to privacy@dutyos.co.uk. A stop is permanent: we keep the address on a do-not-email list and never write to it again from any list.
- How long — entries we excluded are deleted within 30 days; entries we wrote to are deleted 12 months after the campaign closes; the do-not-email record and the fact that we once wrote to an address are kept so that we cannot write again; the decision log is kept for 6 years.
3. Cookies and similar technologies
We keep this deliberately minimal. Signed-in DutyOS uses only the cookies it cannot work without:
| Cookie | Purpose | Type | Lasts |
|---|---|---|---|
| sb-…-auth-token | Keeps you signed in (set by Supabase, our authentication provider) | Strictly necessary | While you stay signed in |
| dutyos-consent | Remembers your answer to the cookie banner, so it does not ask again | Strictly necessary | 6 months |
| _ga, _ga_… | Google Analytics — helps us see how visitors use our public pages (homepage, FAQ, this page). Set only if you press Accept on the cookie banner | Analytics — optional | Up to 2 years |
Analytics never runs inside the signed-in application, and never on consignment-note share links. If you press Reject, or simply ignore the banner, nothing beyond the strictly necessary cookies is set. To change your mind later, delete cookies for dutyos.co.uk in your browser — the banner will ask again on your next visit. We set no advertising cookies and do no cross-site tracking.
The application also stores one preference in your browser’s local storage (whether the regulatory-news panel is collapsed). It identifies nobody and never leaves your device.
Our host, Vercel, measures page-loading speed (Core Web Vitals) on every page. This uses no cookies and no local storage, identifies nobody, and records only the page path, the device type and browser, the country, and the timings themselves. It runs regardless of the banner because it stores nothing on your device.
4. Location data
Where a driver files a job or vehicle check, the platform may record the device’s GPS coordinates at that moment. This exists to evidence that a collection happened at the site claimed — a common requirement in duty-of-care disputes and Environment Agency enquiries. It is a point-in-time capture tied to a specific record. DutyOS does not track drivers continuously, and does not record location when the app is not being used to file something.
5. Legal bases
- Performance of a contract — operating your account and the service you pay for.
- Legal obligation — waste records must be created and retained under the Environmental Protection Act 1990 and the Hazardous Waste Regulations, and waste receipts you submit through us go to DEFRA’s Digital Waste Tracking service as required by the waste tracking rules; we also keep accounting records as required by law.
- Legitimate interests — keeping the platform secure, preventing fraud, diagnosing faults, and evidencing compliance activity; and the business outreach described in section 2, which is sent to companies only. We balance these against your rights.
- Consent — for optional marketing only. You can withdraw it at any time.
6. Who we share data with
We use the following processors. Each is bound by contract to handle data only on our instructions:
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication and file storage |
| Vercel | Hosting the web application |
| Railway | Hosting the API |
| Stripe | Payment processing — card details go directly to Stripe and are never stored by us |
| Resend | Sending transactional email such as invitations and alerts |
| Ideal Postcodes | UK address lookup when you search for an address |
| Google Analytics | Visitor statistics for our public pages — only if you accept the cookie banner, and never inside the signed-in application |
| Woodpecker | Sending the business outreach emails described in section 2, from our separate domain getdutyos.co.uk — never used for account email |
| Google Workspace | The mailbox those outreach emails are sent from and replied to |
DEFRA — Digital Waste Tracking. When you record a receipt of waste and submit it to the Digital Waste Tracking service (including automatic retries of a queued submission), the receipt is sent to the Department for Environment, Food & Rural Affairs, which operates that service as a data controller in its own right — not as our processor. A submission includes the waste details, the receiving site’s name, permit number and address, and the carrier’s details: organisation name, registration number and, where entered, a vehicle registration. These are statutory submissions made on your instruction under the waste tracking rules; once delivered, DEFRA holds the data under its own retention and privacy policies.
We may also disclose data where required by law, including to the Environment Agency or a local authority exercising statutory powers, and to professional advisers or a buyer in connection with a sale of the business.
7. International transfers
We aim to keep data in the UK or European Economic Area. Where a provider processes data outside those regions, the transfer is covered by UK International Data Transfer Agreements, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision. You can ask us which safeguards apply to a specific provider.
8. How long we keep it
- Waste transfer notes — at least 2 years, as required by duty-of-care rules.
- Hazardous waste consignment notes — at least 3 years.
- Billing and accounting records — 6 years.
- Account data — for the life of the account, then deleted or anonymised within 90 days of closure, except where a retention period above still applies.
- Business outreach entries — as set out in section 2: excluded entries within 30 days, contacted entries 12 months after the campaign closes, the do-not-email record indefinitely, the decision log 6 years.
Statutory retention overrides deletion requests. We cannot delete a compliance record before its retention period expires, even if asked.
9. Security
Data is encrypted in transit and at rest. Access is restricted by row-level security so an account can only reach its own records. Two-factor authentication is available and we recommend enabling it. No system is perfectly secure, but we will notify you and the ICO of any qualifying breach within the statutory timeframe.
DutyOS Ltd holds a Cyber Essentials certificate for the whole organisation, issued 18 September 2026 and valid for twelve months. Cyber Essentials is the National Cyber Security Centre’s baseline standard for an organisation’s own devices, accounts and cloud services; the assessment covered the whole organisation, and the certificate can be checked on the IASME registry.
10. Your rights
Under UK GDPR you can ask us to:
- give you a copy of your data, or provide it in a portable format;
- correct data that is wrong or incomplete;
- delete data, subject to the retention rules above;
- restrict or object to how we use it;
- stop sending you marketing.
Email privacy@dutyos.co.uk. We respond within one month. We may ask you to verify your identity first.
11. Complaints
Please raise concerns with us first. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk, or by calling 0303 123 1113.
12. Changes
We will update this page when our practices change and revise the date at the top. If a change materially affects your rights we will tell you by email or in the app before it takes effect.