Legal centreAcceptable Use Policy

Acceptable Use Policy

Last updated: 12 October 2026

This Acceptable Use Policy (the "Policy") sets out the rules you must follow when accessing or using QWTN (the "Service"), operated by WhealBit, trading as QWTN ("QWTN", "we", "us" or "our"). In this Policy, "you" and "your" mean the customer who has contracted with us (the account holder) and, where the context allows, any person you permit to access the Service. This Policy is incorporated into, and forms part of, our Terms of Service, and it must be read together with our Privacy Policy, our Data Processing Agreement (the "DPA"), our Service Level Agreement (the "SLA") and our sub-processor list. Capitalised terms not defined here have the meaning given to them in the Terms of Service. If there is a conflict between this Policy and the Terms of Service, the Terms of Service prevail unless they expressly state otherwise; on matters of acceptable use specifically, this Policy prevails over any shorter acceptable-use summary in the Terms.

By creating an account, or by accessing or using the Service, you confirm that you have read and accept this Policy. Where the Service is presented to you with an "I agree" checkbox or similar mechanism at sign-up, you accept the version of this Policy then in force.

Important terms - please read

Some terms in this Policy are particularly important and may affect your legal rights. Please read them carefully. In particular: section 2 (the Service is a record-keeping aid, you keep your Duty of Care, and we exclude liability for your compliance failures); section 3 (you must never use the Service to create false or misleading waste, health and safety or fleet records); section 9 (your indemnity to us for certain third-party claims); and section 11 (our right, in defined circumstances, to suspend, restrict or terminate your access, sometimes immediately and without prior notice, and the limits on our liability for doing so).

1. Who this Policy binds

This Policy binds you and everyone to whom you give access to the Service or to your organisation's account, including your owners, office staff, drivers, agents and contractors, and any of your own customers you invite to the client portal (together, your "Users"). You are responsible for the acts and omissions of all of your Users in connection with the Service as if they were your own, and you must ensure that every User complies with this Policy. You must not allow anyone who is not a permitted User to access the Service through your account, and you must keep login credentials, signing links and portal links confidential.

If you are an individual using the Service wholly or mainly outside your trade, business, craft or profession, you may be a "consumer". Where you are a consumer, this Policy still applies to you, but the consequences we may apply (in particular suspension and termination), and any indemnity or liability limit, will be applied proportionately and will not override your statutory rights, as described in sections 9, 11 and 14 and in the Terms of Service.

2. General obligation of lawful use; record-keeping aid only; no warranty

You must use the Service only for lawful purposes, in accordance with this Policy, the Terms of Service and all applicable laws and regulations, including (without limitation) the Environmental Protection Act 1990 and the waste Duty of Care, the Waste (England and Wales) Regulations 2011, the Hazardous Waste (England and Wales) Regulations 2005, health and safety law including RIDDOR, road transport and operator licensing law, data-protection law, and the Privacy and Electronic Communications Regulations 2003 ("PECR"). You are solely responsible for your own and your Users' compliance with the laws that apply to you, including how you use any outputs of the Service.

Scope reminder. QWTN is software for creating and keeping waste transfer notes and related operational, fleet and health and safety records. QWTN is not a waste carrier, broker or dealer and never takes custody of waste. Its EWC code and hazardous waste guidance, Environment Agency register and permit lookups, Companies House data, RIDDOR flags, risk ratings and walkaround checklists are record-keeping aids only and are not legal, environmental, health and safety or transport advice. You must not rely on the Service as a substitute for professional advice or for your own legal compliance.

No warranty on aids; exclusion of related liability. The Service is provided without any warranty that its guidance, lookups, flags or outputs are accurate, complete or current. To the fullest extent permitted by law, we exclude all liability for any fine, fixed penalty, enforcement action, prosecution, clean-up cost or regulatory action (including by the Environment Agency, Natural Resources Wales, SEPA, NIEA, a local authority, the HSE, the DVSA or a Traffic Commissioner) arising from your reliance on the Service or its outputs, or from your own waste, safety, fleet or business decisions. This exclusion is subject to the non-excludable carve-outs in section 11 and the liability provisions of the Terms of Service: nothing in this Policy excludes or limits our liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot lawfully be excluded or limited under the Unfair Contract Terms Act 1977 or, where you are a consumer, the Consumer Rights Act 2015.

3. Prohibited content and conduct

You must not use the Service (including its data fields, file and photo uploads, signatures, notes, emails sent through the Service and the client portal) to create, store, upload, transmit, distribute, link to or otherwise make available any content, or to engage in any conduct, that:

  • is unlawful, or that infringes or misappropriates any third party's intellectual-property rights, trade secrets, privacy rights or other rights;
  • creates or records false, misleading, fabricated or backdated waste transfer notes, consignment notes, season tickets, weighbridge tickets, walkaround checks, maintenance records, RAMS, near-miss or accident records, or any other record intended to deceive a regulator, carrier, customer, employee or other third party;
  • applies another person's signature, or obtains a signature, without that person's knowledge and authority;
  • impersonates any person or entity (including a waste carrier, receiving site, regulator or public body), misrepresents a waste carrier registration, permit or exemption, or misrepresents your affiliation with any person or entity;
  • is defamatory, libellous, knowingly false, deceptive or fraudulent;
  • is harassing, threatening, abusive, bullying, hateful, discriminatory or that incites violence or hatred against any person or group, including on the basis of any protected characteristic;
  • is obscene, pornographic, sexually explicit, or otherwise indecent;
  • exploits or endangers children or any vulnerable person;
  • contains or distributes viruses, worms, trojans, ransomware, spyware or any other malicious code, or that is designed to disable, damage, interfere with or impair any software, hardware, system, network or data; or
  • constitutes spam, unsolicited or unauthorised advertising, promotional material, "phishing" or other deceptive messaging.

You are responsible for all content that you and your Users submit to the Service ("Customer Content"), for its accuracy, and for having all rights and lawful bases necessary to submit and process it.

4. Security and integrity of the Service

You must not, and must not permit any User or third party to:

  • access or attempt to access any account, team, data, system or network that you are not authorised to access, or use another person's credentials, signing link or portal link;
  • probe, scan, port-scan, test the vulnerability of, or breach or circumvent any authentication, security or access-control measure of the Service or its underlying infrastructure;
  • conduct any penetration test, load test, stress test, vulnerability assessment or red-team exercise (meaning any simulated attack or adversarial security exercise) against the Service without our prior express written consent;
  • introduce, upload or transmit any malicious code, or interfere with or disrupt the integrity, performance or availability of the Service or the data it contains;
  • scrape, crawl, harvest, data-mine or use any automated means to extract data from the Service or its free public tools (including the permit lookup, collector verification, waste site finder and EWC code pages) except through interfaces and export tools we expressly provide;
  • decompile, disassemble, reverse engineer or otherwise attempt to derive the source code, underlying ideas, algorithms or structure of the Service, except to the extent such acts are permitted by sections 50A to 50C of the Copyright, Designs and Patents Act 1988 (back-up copies; observing, studying and testing the program; and decompilation necessary to achieve interoperability) or by any other right that cannot lawfully be restricted, which rights are not excluded by this Policy;
  • circumvent, disable or interfere with any usage limit, plan limit, team-member limit, rate limit, CAPTCHA or other technical restriction of the Service;
  • impose an unreasonable or disproportionately large load on, or otherwise overload or flood, the Service or its infrastructure; or
  • use the Service to develop, train or benchmark a competing product or service.

Responsible disclosure. You must promptly notify us if you discover any actual or suspected security vulnerability, unauthorised access, or breach affecting the Service, by emailing hello@qwtn.co.uk. So that we can protect other customers, you must not exploit, publicise or share any such vulnerability before we have had a reasonable opportunity to address it - for at least 90 days, or until we confirm a fix is deployed, whichever is earlier. Provided you act in good faith, comply with this section and give us that reasonable opportunity to remediate, we will not pursue claims against you for the act of testing or reporting under that disclosure. Nothing in this section restricts any disclosure that is required or protected by law, including a protected disclosure under the Public Interest Disclosure Act 1998 (whistleblowing).

5. Data-protection and privacy rules

Roles. In respect of the personal data you enter into the Service (for example the people named on waste transfer notes and their signatures, your clients' contacts, your staff and drivers, and health and safety and accident records), you (the organisation) are the data controller and we act as your data processor; our respective obligations are set out in the DPA, which you must comply with and which governs our processing of that data under Article 28 of the UK GDPR. Separately, for the personal data of the account holder and administrators (account, billing, login, usage, security and analytics data), and for website visitors, we act as an independent controller and process that data under our Privacy Policy.

As a condition of your use of the Service, you must:

  • have a valid lawful basis under the UK GDPR for processing each category of personal data you add to the Service, and (for any special-category data, such as injury and treatment details in accident records) an appropriate Article 9 condition (typically Article 9(2)(b) employment, via Schedule 1 Part 1 of the Data Protection Act 2018, where the injured person is your worker);
  • provide all privacy notices and information required by law to the people whose data you add, including signatories, drivers, staff and anyone you invite to the client portal;
  • ensure that the personal data you enter is accurate, relevant and not excessive, and keep it up to date;
  • use location data, photographs and signatures only for the specific record to which they relate; you must not use the Service for covert monitoring or tracking of individuals;
  • minimise special-category data: in particular, record only the health information you need for your accident book and RIDDOR obligations, and avoid putting health detail in free-text fields elsewhere; and
  • respond to data-subject requests as the controller, and not represent to any individual that QWTN is the controller of the data you manage in the Service.

How the Service handles location. The Service captures location only when a User chooses to (for example recording the GPS position of a near-miss, or placing a site on a map) and does not track devices or drivers continuously or in the background. You must not configure or use the Service in a way that misleads people about this, or that uses location, photos or signatures for purposes they were not told about.

International transfers. Some of our sub-processors are based in, or may process personal data in, the United States or elsewhere outside the UK. Where personal data is transferred outside the UK, we rely on UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses (or the UK Extension to the EU-US Data Privacy Framework for certified recipients), together with a transfer risk assessment where required, as recorded in the DPA and our sub-processor list.

6. Fair use, volume and rate limits

The Service is provided subject to fair-use principles and to the plan limits, volume limits and rate limits applicable to your subscription tier, as set out on our pricing page (Free: unlimited notes created, downloaded and printed, one user, no cloud storage. Solo: one user, £12 per month. Carrier: up to 5 team members, £29 per month. Fleet: unlimited team members, £69 per month). "Fair use" means use that is consistent with normal waste-documentation and operational use for a business of your size and tier and that does not impose a disproportionate burden on the Service or other customers. You must not exceed those limits, evade them, or use the Service in a way that is excessive, abusive or that materially degrades the experience of other customers. We may apply reasonable technical limits (for example on request rates, sign-ups, storage, uploads, emails sent, lookups or exports) and may take proportionate steps to protect the stability and security of the Service. We will give reasonable notice of any new or changed limit where practicable, except where immediate action is needed to protect the Service or comply with the law. Availability and any action we take under this section are subject to the SLA and to the force majeure provisions of the Terms of Service.

7. Acceptable use of emails, signing links and the client portal

The Service lets you send waste transfer notes, signing requests, quotes, invoices, reminders, team invitations and client portal invitations by email. These features are provided for legitimate, operational communication with the people involved in your work. They are not a marketing channel. You must not use them to send unlawful, infringing, defamatory, harassing, discriminatory, obscene or otherwise prohibited messages (as described in section 3), to send spam or bulk unsolicited messages, to distribute malware or malicious links, or to send marketing or commercial messages in breach of PECR or other applicable law. You must only invite people to the client portal who are entitled to see the documents shared with them. You are responsible for the content of all messages sent through your account and for ensuring they comply with data-protection law.

For clarity, our own service and transactional communications to you (for example account, sign-in, billing and security emails) are necessary to operate the Service and are not direct marketing under regulation 22 of PECR. Any direct marketing we send to account holders is sent in accordance with PECR and our Privacy Policy.

8. No resale or unauthorised commercial exploitation

Unless we have agreed otherwise in writing, you must not resell, sublicense, rent, lease, lend, time-share, host as a service bureau (that is, operate the Service to process the data of third parties as a commercial service), distribute or otherwise make the Service available to, or use it for the benefit of, any third party other than your own permitted Users for your own business purposes. Using the Service to record transfers you are party to, including for your own customers and (on the Fleet plan) your subcontractors, is permitted. You must not remove, obscure or alter any proprietary notices, branding or attributions, except where white-label features are made available to your subscription tier and used in accordance with our instructions.

9. Your responsibility and indemnity

You are responsible for ensuring that you and your Users comply with this Policy. To the extent permitted by law, you agree to indemnify us against losses, damages, liabilities, and reasonable and properly incurred costs and expenses (including reasonable legal fees) that we incur as a result of third-party claims (including claims by your Users, staff, customers or by a regulator) to the extent arising from: (a) your or your Users' breach of this Policy; (b) your unlawful or non-compliant processing of personal data through the Service, or your failure to have a lawful basis or to give required notices; (c) any false or misleading record created through your account; or (d) Customer Content that infringes a third party's rights or breaches applicable law.

This indemnity is subject to the following conditions and limits:

  • we will promptly notify you in writing of any claim for which we seek indemnity, and will not admit liability or settle it without your prior written consent (not to be unreasonably withheld or delayed);
  • we will give you the conduct of the defence and settlement of the claim if you so request and confirm in writing that the claim is covered by this indemnity, and we will provide reasonable cooperation at your cost;
  • we will take reasonable steps to mitigate our loss;
  • the amount you must indemnify will be reduced proportionately to the extent that our own act, omission, breach or negligence caused or contributed to the loss; and
  • this indemnity does not extend to any fine, penalty or sanction imposed on us for our own non-compliance, and nothing in it requires you to indemnify us for any liability that cannot lawfully be transferred or excluded.

Whether the amounts payable under this indemnity sit within, or outside, the aggregate liability cap in the Terms of Service is determined by the Terms of Service, which you should read together with this section. If you are a consumer, this indemnity does not apply to you to the extent it would not be fair or binding under the Consumer Rights Act 2015; your liability as a consumer is limited to what the general law allows.

10. Reporting abuse or violations

If you become aware of any actual or suspected breach of this Policy, any misuse of the Service (including a waste transfer note or signing request you believe was sent fraudulently in your name), any security vulnerability, or any unlawful or harmful content, please report it promptly: security, abuse and general matters to hello@qwtn.co.uk, and data-protection or privacy matters to privacy@qwtn.co.uk. Please include enough detail for us to identify and investigate the issue. We will handle reports in accordance with our Privacy Policy and applicable law.

11. Consequences of breach

If we reasonably consider, on reasonable grounds, that you or any of your Users have breached this Policy, or that your use of the Service poses a genuine security, legal or operational risk, we may take any one or more of the following actions, acting reasonably and proportionately to the breach or risk:

  • issue a warning and require you to remedy the breach;
  • remove, disable access to, or quarantine offending Customer Content, signing links or portal access;
  • suspend your or any User's access to all or part of the Service;
  • terminate your account or subscription in accordance with the Terms of Service; and
  • report the matter to law-enforcement or regulatory authorities (including the Environment Agency or other waste regulator), and cooperate with them, where we are required to do so by law or reasonably consider it necessary.

Where practicable, we will give you notice before suspending or restricting your access and an opportunity to remedy the breach. However, we may act immediately and without prior notice only where: (a) the breach involves illegal activity; (b) there is a material threat to the security, integrity or availability of the Service or to other customers' data; (c) we are required to act by law or by a regulator; or (d) your account is in non-payment beyond any applicable cure period. Where we act without prior notice, we will notify you promptly afterwards, give our reasons, and provide a route for you to respond or appeal. We will restore access promptly once we are reasonably satisfied the issue is resolved. Where we suspend access, we will, where lawful and practicable, still allow you to export the records you are legally required to keep.

To the extent permitted by law, we will not be liable for losses arising from any action reasonably and proportionately taken in accordance with this section, provided we acted in good faith and on reasonable grounds. This does not exclude or limit: (i) liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot lawfully be excluded or limited; (ii) any service-credit or other remedy available to you under the SLA; or (iii) our liability where the suspension, restriction or termination was not in fact justified. If you are a consumer, any suspension or termination will be applied fairly, this exclusion will not apply where the action was not justified, and your non-excludable statutory rights are unaffected; where a suspension of a consumer's access was unjustified, you may terminate and obtain a pro-rata refund of any prepaid fees for the unused period. Suspension or termination does not relieve you of fees accrued up to the effective date, save where a refund is required by law or the Terms of Service (see the Terms of Service for the refund position).

12. Changes to this Policy

We may update this Policy from time to time, for example to reflect new features, changes to the law, or new security or abuse risks. Where a change adversely affects you, we will give you reasonable advance notice (by email or in-app) before it takes effect, together with the reason for the change. You may terminate your subscription without penalty before the change takes effect, and obtain a pro-rata refund of any prepaid fees for the unused period, if you do not accept the change. For genuinely onerous changes (for example a material expansion of the indemnity in section 9), we will ask you to accept the updated Policy by an affirmative action rather than relying on continued use. For other changes, your continued use of the Service after the change takes effect means you accept the updated Policy. Changes do not apply retroactively to liabilities or rights already accrued. We keep dated versions of this Policy; the "last updated" date shown on this page shows when it was last revised.

13. Relationship to other documents and third-party rights

This Policy supplements, and does not replace, the Terms of Service, the Privacy Policy, the DPA and the SLA, and should be read with our sub-processor list and Cookie Policy. The Service depends on third-party providers (including our database, authentication and storage host, our hosting and serverless-function provider, our payment processor and our transactional-email provider, as listed in the sub-processor list) and on public data sources such as the Environment Agency registers and Companies House. Changes to sub-processors are handled in accordance with the DPA. To the extent permitted by law and subject to the SLA, the Terms of Service and the non-excludable carve-outs referred to in sections 2 and 11, we are not liable for the failure, suspension, or acts or omissions of third-party providers or data sources to the extent beyond our reasonable control, which are addressed by the force majeure provisions of the Terms of Service. Except as expressly provided, a person who is not a party to the Terms of Service (of which this Policy forms part) has no right under the Contracts (Rights of Third Parties) Act 1999 to enforce any of its terms.

14. Governing law and jurisdiction

This Policy and any dispute or claim arising out of or in connection with it are governed by the law of England and Wales, and are subject to the dispute-resolution and jurisdiction provisions of the Terms of Service, which provide for disputes to be resolved by the courts of England and Wales. Nothing in this Policy deprives a consumer of the protection of the mandatory rules of the law of their place of residence, or of the right to bring proceedings in their home UK courts.

15. Contact

Questions about this Policy can be sent to hello@qwtn.co.uk, or by post to WhealBit, St Ives, Cornwall [full postal address to be confirmed]. QWTN is operated by WhealBit.