Privacy Policy

This Privacy Policy explains how WhealBit, trading as QWTN ("QWTN", "we", "us" or "our"), collects, uses and protects personal data for which we are the controller. This covers people whose data we decide how and why to process: account holders and the individuals named as billing or administrative contacts on an account; visitors to our website at qwtn.co.uk and users of our free tools; people who contact us for support or general enquiries; and people on our newsletter list. It also explains, at a high level, the data we handle as a processor on behalf of our business customers when they use QWTN to run their waste, fleet and health and safety records. This notice forms part of our legal suite and should be read alongside our Terms of Service, Data Processing Agreement, Cookie Policy and Sub-processors list.

1. Who we are and how to contact us

QWTN is a UK software-as-a-service product for waste carriers, skip hire firms and trades who move waste. It is used to create, sign and store waste transfer notes (including EWC codes and the waste hierarchy declaration), issue season tickets, request remote e-signatures, keep client and site records, track waste permits, schedule collections, run driver job lists, manage vehicles (DVSA walkaround checks, defects, maintenance, expenses, operator licences and weighbridge tickets), keep health and safety records (RAMS, near misses and an accident book), track containers, send quotes and invoices, and give customers access to a client portal. QWTN is not a waste carrier, broker or dealer: we never take custody of waste, and we do not collect payments on our customers' invoices.

The controller responsible for the personal data described in this notice is:

• Legal entity: WhealBit, trading as QWTN
• Trading address: St Ives, Cornwall
• ICO registration number: [ICO registration number to be confirmed]
• Data protection / privacy contact: privacy@qwtn.co.uk
• General contact: hello@qwtn.co.uk

For any question about this notice, to exercise your rights, or to raise a privacy concern, please contact us at privacy@qwtn.co.uk.

This notice describes our data-protection practices. It does not vary, expand or replace the contractual rights, warranties, disclaimers and limitations of liability set out in our Terms of Service, which govern the commercial relationship between us and our customers. If there is any conflict on a commercial matter, the Terms of Service prevail; nothing in this notice creates any warranty or contractual commitment beyond those in the Terms of Service or beyond what data protection law requires.

2. Scope of this notice - and what it does not cover

This notice covers personal data for which we are the controller. It does not cover the personal data that our business customers enter into QWTN about their own staff, drivers, clients, signatories and other people (for example the names on a waste transfer note, a driver's walkaround check, or an injured person's entry in the accident book). For that data the customer is the controller and we act only as a processor following the customer's instructions. This notice is therefore not the privacy notice for a driver, member of staff, client contact or portal user whose data a QWTN customer manages. If that is you, please ask the business that uses QWTN, which is responsible for telling you under Articles 13 and 14 of the UK GDPR.

The processor terms that govern our handling of that data on a customer's behalf are set out in our Data Processing Agreement. Section 9 below explains the controller/processor split in plain terms.

3. The personal data we collect (as controller)

We collect and process the following categories of personal data about account holders, billing/administrative contacts, website visitors and enquirers:

• Account data: business name and details (which you may look up from Companies House or the Environment Agency public register when you sign up), the account-holder's name, work email address, phone number, role, waste carrier registration details, company logo, and login credentials (passwords are stored only in hashed form by our authentication provider, Supabase).
• Billing data: billing contact name and email, subscription plan, trial status, Stripe customer reference and transaction history. We do not collect or store full payment-card details. Card data is collected and processed directly by Stripe, our payments provider, which is PCI-DSS Level 1 certified and acts as an independent controller for that card data.
• Usage, device and log data: IP address, browser and device type, operating system, approximate location derived from IP, pages and features used, timestamps, diagnostic and security logs, and product analytics events collected through PostHog (see Section 7). We use this to operate, secure and improve the Service. IP addresses are also used transiently to rate-limit requests (for example sign-in, contact, newsletter and remote-signing requests) to protect against abuse.
• Bot-protection data: when you sign up, Cloudflare Turnstile checks that you are a person rather than an automated script, using browser and device signals.
• Cookies and similar technologies: as described in our Cookie Policy.
• Support and communications data: the content of messages, emails and enquiries you send us (including through our contact form, which records your email address and IP address), and our replies.
• Newsletter data: your email address and your preferences, where you have signed up to our newsletter, or where we contact existing business customers about similar products.

Free tools. Our free waste transfer note tool works without an account. The draft note, including any names, addresses and signatures you type or draw into it, is kept in your own browser's local storage on your device and is not sent to us. Our other free tools (permit lookup, collector verification, waste site finder, EWC code and hazardous waste checkers) query public registers on your behalf; we do not ask you for personal data to use them.

Where we ask you to provide data to enter into or perform our contract with you (for example, to open and bill an account), providing it is a contractual requirement; if you do not provide it we will not be able to supply the Service.

4. How we use your data, and our lawful basis for each purpose

Under the UK GDPR we must have a lawful basis for each processing purpose. The table below sets out, for each purpose, the lawful basis we rely on, and - where that basis is legitimate interests - the specific interest in question.

Where we rely on legitimate interests, we carry out and document a balancing assessment for each such purpose to confirm that our interests are not overridden by your interests, rights and freedoms. You can ask us for more information about the relevant assessment, and you have the right to object (see Section 12).

Where we rely on consent (for example, our newsletter), you can withdraw your consent at any time - this is as easy as giving it - by using the unsubscribe link in any marketing email or by contacting us at privacy@qwtn.co.uk. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

5. Location data (only when you capture it)

QWTN does not track the location of any person or vehicle continuously or in the background. A device's precise location is used only when a user actively chooses to capture it: for example, pressing the button to record the GPS position of a near miss, using "locate me" on the map, or picking a site's position on a map. Site and client addresses may also be converted into map coordinates from their postcode. Apart from this, and as a controller in our own right for security purposes, we may derive only approximate, IP-based location from log data as described in Section 3. Location captured inside a customer's account belongs to that customer (the controller), which is responsible for telling its staff about it.

Your browser asks your permission before any page can read your device's location. You can refuse or withdraw that permission at any time in your browser or device settings; the relevant features then work without it, and you can enter an address or postcode instead.

6. Special-category data (accident and injury records)

This is primarily relevant to the data we handle as a processor, but we explain it here for transparency. QWTN's health and safety module includes an accident book. Where a customer records an accident, the injury, the part of the body affected, the treatment given (for example first aid or hospital treatment) and whether the incident is reportable under RIDDOR, that information is about a person's health and is special-category data under Article 9 of the UK GDPR. In that situation the customer is the controller and is responsible for identifying both an Article 6 lawful basis (typically legal obligation, Art 6(1)(c)) and an Article 9 condition (typically the employment, social security and social protection condition in Article 9(2)(b), supported by the condition in Schedule 1 Part 1 paragraph 1 of the Data Protection Act 2018, together with the appropriate policy document that paragraph requires). Where the injured person is not the customer's employee (for example a member of the public), the customer should consider which condition applies. We process this data only on the customer's instructions, restrict access to it to the customer's authorised users, and do not use it for any purpose of our own.

Electronic signatures. When someone signs a waste transfer note, RAMS document or other record in QWTN, including through a remote signing link sent by email, we store the signer's name, the image of the drawn signature and the date and time of signing, as part of the customer's record. The signer's IP address is used transiently to rate-limit signing requests; it is not stored with the signature. Signatures are not biometric data: QWTN does not analyse signature dynamics or perform any biometric matching.

7. Cookies and similar technologies

Our website and app use cookies and similar technologies, including browser local storage. Strictly necessary storage (needed to keep you signed in and the Service secure) is always set. We also currently use PostHog product analytics on our website and app, which stores an identifier in a cookie and in local storage on your device and is loaded without first asking for your consent. Full details, including the cookies used, their purposes and duration, and how to block or delete them, are in our Cookie Policy.

8. Sharing your data and our sub-processors

We do not sell your personal data within the meaning of applicable law, and we do not disclose it to third parties for their own marketing or monetisation. We share personal data only with the trusted service providers we use to run QWTN (our sub-processors), and where we are required or permitted by law. We require each sub-processor, under a written contract, to provide guarantees and undertake obligations consistent with Article 28 of the UK GDPR, including appropriate security and confidentiality measures; each sub-processor is engaged under its standard Article 28 data processing terms.

Some features also send limited data to third-party sources at your request, which act on their own account rather than as our sub-processors: Companies House and the Environment Agency public register (company and permit lookups), postcodes.io (postcode lookups), Clearbit (finding a company's website and logo from its name), map tile providers OpenStreetMap and Esri (which receive your IP address when a map loads), and Google Fonts (signature fonts in the app). Our full list is maintained at Sub-processors. We may also disclose personal data where required by law, court order or a regulator (for example the Environment Agency, HSE, HMRC or the ICO), or to establish, exercise or defend legal claims. If we sell or reorganise our business, personal data may transfer to the buyer or successor, who will be required to continue to protect it in accordance with applicable data protection law; if the recipient's handling will differ materially from this notice we will tell you and, where the law requires, seek your consent.

9. The controller / processor split, explained plainly

QWTN wears two hats:

• We are the controller for account data, billing data, website visitor data, newsletter data and support enquiries - the data described in this notice. We decide why and how it is processed.
• We are a processor for the data a customer enters into QWTN: waste transfer notes and the people named on them, signatures, clients and their sites, client portal users, team members and drivers, vehicle and walkaround records, near misses and accident records, RAMS, quotes, invoices and photos. The customer is the controller of that data: it decides why and how it is used, and it is responsible for telling the people concerned about it and for having a lawful basis (and, for accident and injury records, an Article 9 condition). We process that data only on the customer's documented instructions, as set out in our Data Processing Agreement.

Client portal users. When a customer invites one of its own clients to the client portal, we send that person an email sign-in link and set a session cookie so they can view the notes and invoices the customer shares with them. The customer is the controller of that portal user's data.

10. International transfers

We aim to store and process personal data in the United Kingdom or the European Economic Area (the EEA benefits from UK adequacy, so transfers there need no additional safeguard). Our application functions run in London and our product analytics are stored in PostHog's EU cloud. Where a provider carries out a transfer to a country that the UK has not deemed adequate (for example, email delivery through Resend, or support, backup or engineering operations of our hosting, bot-protection or payment providers that may take place in the United States), we ensure that an appropriate Article 46 safeguard is in place - such as the ICO International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses together with the ICO UK Addendum - or that the recipient is certified under the UK Extension to the EU-US Data Privacy Framework. You can ask us for more information about these safeguards.

11. How long we keep your data (retention)

We keep personal data only for as long as necessary for the purposes set out above, then delete or securely anonymise it.

• Account data: we delete account data within 90 days of account closure, to handle wind-down, disputes and reactivation requests, unless we need to keep it longer for a live dispute or a legal obligation.
• Billing, tax and accounting records: we keep these for at least 6 years to meet UK tax (HMRC) and accounting obligations.
• Support and newsletter data: for as long as needed to handle your enquiry or until you unsubscribe or object, plus a short suppression record so we honour your opt-out.
• Usage and log data: for up to [log retention period to be confirmed], appropriate to security, troubleshooting and capacity needs. Rate-limiting counters expire within minutes.

Separately, customers (as controllers) must keep certain records for statutory minimum periods, and QWTN's storage, export and deletion features are designed to support these. Paid plans include cloud storage of notes for at least 2 years. These are the customer's obligations, not ours, but for transparency the main UK minimums are:

12. Your rights

Under the UK GDPR you have the following rights in relation to personal data we hold about you as controller. You can exercise any of them by contacting us at privacy@qwtn.co.uk. We will respond within one month (extendable by up to two further months for complex requests, in which case we will tell you). We will not charge a fee unless your request is manifestly unfounded or excessive, or repetitive, in which case we may charge a reasonable fee or refuse the request, explaining why.

• Right of access - to be told whether we process your data and to receive a copy of it.
• Right to rectification - to have inaccurate data corrected and incomplete data completed.
• Right to erasure ("right to be forgotten") - to have your data deleted in certain circumstances, subject to our legal retention duties (see Section 11).
• Right to restriction - to have our processing limited in certain circumstances.
• Right to data portability - to receive certain data you provided in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
• Right to object - to object to processing based on legitimate interests (including profiling) and to object to direct marketing at any time, in which case we will stop using your data for direct marketing.
• Right to withdraw consent - where we rely on consent, to withdraw it at any time (see Section 4).
• Rights relating to automated decision-making - see Section 13.
• Right to complain to the ICO - see Section 14.

Where your data is held in QWTN by a business that uses it (for example as a driver, a client contact, a portal user or a person named on a waste transfer note), your rights requests should generally be directed to that business as the controller; we will assist it in responding as required by our Data Processing Agreement.

13. Automated decision-making, profiling, and our compliance checks

We do not make decisions about you that are based solely on automated processing and that produce legal effects concerning you or similarly significantly affect you. QWTN's compliance aids - such as EWC code and hazardous waste suggestions, duty of care checks, permit and carrier register lookups, licence reminders, risk scoring on RAMS and RIDDOR reportability flags - are guidance only. They display informational prompts and do not make automated decisions about individuals.

For the avoidance of doubt, these checks are informational aids only. QWTN does not guarantee, and is not responsible for, a customer's compliance with its waste Duty of Care, the hazardous waste rules, RIDDOR, DVSA or operator licence requirements, or any other environmental, health and safety, transport, tax or other law. Responsibility for legal compliance, including classifying waste correctly and checking that the people it passes waste to are authorised, rests entirely with the customer. This reflects the position in our Terms of Service, which govern the warranties and liability that apply to the Service. If any feature ever evolves into solely automated decision-making with legal or similarly significant effects, we will update this notice and put the safeguards required by law in place first.

14. Complaints and the ICO

If you have a concern about how we handle your personal data, please contact us first at privacy@qwtn.co.uk so we can try to resolve it. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

• Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• Helpline: 0303 123 1113
• Website: https://ico.org.uk

15. Security

We implement appropriate technical and organisational measures to protect personal data, proportionate to the risk. Our measures currently include, for example, encryption in transit and at rest, access controls and row-level tenant isolation in our multi-tenant database, role-based access for team members, signed and expiring links for shared notes and remote signing, bot protection and rate limiting, logging and monitoring, backups and a breach-response process, and confidentiality undertakings from people who handle data. Because the right measures change over time, we keep these under review and may vary them, provided they remain appropriate to the risk; this is a description of our practices, not a contractual warranty.

16. Children

QWTN is a business tool and is not directed at children. We do not knowingly collect data directly from children through our website, free tools or account sign-up. Customers are responsible for recording any personal data about young people (for example an injured young worker in the accident book) lawfully. If you believe a child has provided us with personal data as a controller, please contact us at privacy@qwtn.co.uk and we will take appropriate steps.

17. Marketing choices

You can opt out of marketing at any time by using the unsubscribe link in any marketing email or by contacting us at privacy@qwtn.co.uk. We will still send you essential service messages (for example, about billing, security or important changes to the Service) where we are entitled to do so, as these are not marketing.

Where we send marketing emails to existing business customers about our similar products, we rely on the "soft opt-in" under the Privacy and Electronic Communications Regulations (PECR): we contact you only where we obtained your contact details in the course of a sale (or negotiations for a sale) of similar services, we offer an opt-out at the point we collect your details and in every message, and we stop as soon as you opt out. The soft opt-in applies to individual and sole-trader subscribers; messages to corporate-body recipients fall outside PECR Regulation 22 but we still offer an opt-out in every message.

18. Changes to this notice

We may update this notice from time to time to reflect changes in the Service, our practices or the law (including ongoing reforms under the Data (Use and Access) Act 2025). When we make material changes we will update the "last updated" date shown with this notice and give reasonable advance notice by email or in the Service before they take effect, and where a change requires your consent we will obtain it. Please review this notice periodically.

19. How to contact us

For any privacy question or to exercise your rights, contact our data protection contact at privacy@qwtn.co.uk, or write to us at St Ives, Cornwall. For anything else, email hello@qwtn.co.uk. Our legal entity details are set out in Section 1.