Privacy Policy

This policy explains what personal data Checkwright collects, why, how it is used, who it is shared with, and the rights you have over it. It applies to visitors of this website, to the staff of businesses that use the Checkwright application, and to the contacts of those businesses' own customers whose details appear on a transfer note.

Who we are

Checkwright is operated by Connor Stanley, a sole trader trading as 1Keel ("we", "us", "our"). We are the data controller for the personal data described in this policy.

What data we collect

We collect different data depending on how you interact with us:

Staff accounts

When a business signs up and adds its staff as users, we hold each user's name, email address, username, phone number and a securely hashed password. We never store passwords in plain text.

Waste transfer documentation

Waste transfer notes, hazardous waste consignment notes and related records created in the application contain the details needed to meet UK waste transfer note and consignment note requirements. This includes the contact details of the customers our own customers deal with: company name, contact name, address, postcode, town and email address, along with the waste description, quantity, EWC codes and signatures involved in each movement.

Billing information

Subscription payment is collected by GoCardless by Direct Debit. Card or bank details are entered directly into GoCardless's own hosted payment flow; they never pass through our servers or reach us in a form we can read.

Website enquiries

If you use the trial signup form on this website, we collect the details you provide (name, company, email, phone number, team size and any message) to set up your account and respond to you.

Technical and log data

Our servers generate operational logs (for example, request timestamps, error details and, where relevant to diagnosing an issue, a user's email address or IP address) which are used to run and secure the service. These are not used for marketing or profiling.

Cookies

This website does not use analytics, advertising or tracking cookies. We checked this directly against the live site before writing this policy, not assumed it. The Checkwright application does not use cookies at all: sign-in is handled with an access token held in your browser's local storage, not a cookie. If this ever changes, for example if we add analytics in future, we will update this policy first and ask for your consent before anything non-essential is set.

Why we use your data and our legal basis

• To provide the service (performance of a contract): creating your account, running the application, generating documents and processing subscription payments.
• To meet a legal obligation: the waste transfer and consignment note data recorded through Checkwright exists to satisfy statutory waste-tracking and record-keeping duties under UK waste law, including DEFRA's Digital Waste Tracking service.
• Legitimate interests: keeping the service secure and working reliably (server logs and monitoring), and responding to enquiries sent through this website.

Who we share data with

We share personal data with the following processors and, in one case, a regulator, and with nobody else. We do not sell personal data.

• GoCardless (payment collection): handles Direct Debit mandates and payment collection directly. If an organisation is deleted, we cancel its mandate with GoCardless, but GoCardless keeps its own payment records under its own regulatory retention obligations as an independent data controller.
• Resend (email delivery): sends transactional email on our behalf, such as account setup and billing notifications.
• Cloudflare (infrastructure): routes traffic to our servers and provides edge security (Cloudflare Pages, Tunnel and Access).
• Hetzner Cloud (hosting): runs the server our application and database are deployed on.
• Grafana Cloud (monitoring): receives application logs and metrics so we can keep the service running and diagnose problems.
• DEFRA (regulator, not a vendor): where a receiving site submits a waste receipt through the Digital Waste Tracking service, the relevant waste-tracking data is sent to DEFRA as required by law. This is a statutory submission, not a commercial data share.

International transfers

Our processors are chosen and configured with UK and EU data protection law in mind. Where any processor stores or processes personal data outside the UK, we ensure an appropriate safeguard is in place before that happens, such as the UK's International Data Transfer Agreement or the provider's own Standard Contractual Clauses, so that your data stays protected to UK GDPR standards wherever it is processed.

How long we keep data, and how to request erasure

Waste transfer notes and consignment notes are records we and our customers are legally required to keep, generally for at least two years, and in some cases longer. Under UK GDPR, Article 17(3)(b) specifically allows us to keep personal data where it is needed to comply with a legal obligation, even after someone asks for it to be erased. Records kept for waste compliance fall squarely into that category, so a full, immediate erasure of that data is very unlikely to be something we are able or required to do.

An organisation's owner can request deletion of their organisation's account from within the application (Organisation settings, "Danger zone"). This requires the owner's current password and typing the organisation's name to confirm, followed by clicking a confirmation link sent to their email, only clicking that link starts anything. Once confirmed, the organisation has 30 days in which the owner can sign back in and cancel it at any time; during that window no new records can be created. If it isn't cancelled, personal data (names, email addresses, phone numbers, login credentials) for every member of that organisation is then anonymised. Records already created for waste compliance are kept, unaltered, for the reason explained above, they are the retained record itself, not personal data with no independent basis to keep. The organisation's own business identity (for example, a waste carrier registration number) is also retained where it forms part of that compliance record, only the display name and login-linked personal details are removed. A subscription's Direct Debit mandate is also cancelled with GoCardless as part of this; GoCardless separately retains payment records under its own regulatory obligations as an independent data controller, which this process does not affect.

Only an organisation's owner can start this process, and doing so applies to the whole organisation, an individual staff member cannot delete their own account without going through their organisation's owner; ask your organisation's owner, or contact us, if you need your own access removed.

You can also contact us at any time at [email protected] to ask what data we hold about you, correct it, or request erasure of anything we are not legally required to retain. We will respond within one month and explain exactly what we can and cannot remove, and why.

Staff account data for a business that stops using Checkwright but does not go through the deletion process above is retained for as long as that business's records are retained, for the same reason as above, and is not automatically deleted or anonymised a fixed number of days after a subscription is merely cancelled, cancelling billing and deleting the organisation are separate actions.

Your rights

Under UK GDPR you have the right to:

• be informed about how your data is used (this policy);
• access the personal data we hold about you;
• have inaccurate data corrected;
• request erasure, subject to the legal obligation limits explained above, using the organisation deletion option described above or by contacting us;
• restrict or object to certain processing;
• receive your data in a portable format; and
• complain to the Information Commissioner's Office (ICO) if you believe your data has been mishandled.

To exercise any of these rights, email [email protected].

Security

We use industry-standard measures to protect personal data, including encrypted connections, securely hashed passwords, and access controls that limit staff data to the organisation that owns it. No method of transmission or storage is completely secure, but we take reasonable steps appropriate to the sensitivity of the data involved.

Children

Checkwright is a business tool intended for use by adults working for UK waste operators and is not directed at children. We do not knowingly collect data from children.

Changes to this policy

We may update this policy as the service changes. If we make a material change, we will update the "last updated" date above and, where appropriate, let existing customers know directly.

Contact

Questions about this policy or how your data is handled: [email protected].