This Sub-processors List is published by WhealBit, trading as QWTN ("QWTN", "we", "us"). It forms part of, and is incorporated by reference into, the Data Processing Agreement at /dpa (the "DPA"), as that DPA and this list are in force from time to time, agreed between QWTN (acting as processor) and each business customer (acting as controller of the personal data it records in QWTN). It should be read together with our Privacy Policy, Terms of Service and Cookie Policy. Capitalised terms used but not defined here have the meaning given in the DPA; where a term is not defined in the DPA, it has the meaning given in the UK GDPR.
1. What a sub-processor is
A "sub-processor" is a third party engaged by QWTN to process personal data on our behalf in the course of providing the QWTN service to you, where that processing is carried out under our instructions and on behalf of you as controller. Under Article 28 of the UK GDPR we may only engage a sub-processor with your authorisation, and we must impose on each sub-processor, by written contract, data-protection obligations equivalent to those that apply to us under the DPA.
In accordance with Article 28(4) of the UK GDPR, where a sub-processor fails to fulfil its data-protection obligations we remain liable to you for the performance of that sub-processor's obligations. That liability applies to the same extent as, and is subject to the limitations and exclusions of liability set out in, the DPA and the Terms of Service; nothing in this list creates any liability beyond, or outside the caps and exclusions of, those documents, and nothing in this list excludes or limits any liability that cannot lawfully be excluded or limited.
This list does not include third parties that act as independent controllers in their own right (rather than as our sub-processors), or public data sources that we query at your request. Those are described separately in section 4 so that you have the full picture.
2. Your authorisation of these sub-processors
By entering into the DPA, you give your general written authorisation to our use of the sub-processors listed in section 3 to process personal data for the purposes described, on the basis of this list as in force at the time you enter into the DPA and as subsequently changed under sections 7 and 8. This authorisation is subject to the conditions in Articles 28(2) and 28(4) of the UK GDPR and to the notice and objection process set out in sections 7 and 8 below and in the DPA.
We engage each sub-processor under a written contract (in most cases the supplier's standard data processing terms) that imposes the obligations required by Article 28(3) of the UK GDPR, including obligations of confidentiality, technical and organisational security measures appropriate to the risk under Article 32, and assistance with data-subject rights and personal-data-breach notification. Where a sub-processor carries out any processing in a country that is not covered by UK adequacy regulations, that processing is covered, where applicable, by the UK Extension to the EU-US Data Privacy Framework (the "UK-US Data Bridge") for suppliers certified under it, or by an appropriate Article 46 transfer safeguard (for example the ICO International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses with the ICO UK Addendum), supported by a transfer risk assessment.
3. Current sub-processors
The following third parties are engaged by QWTN as sub-processors of the personal data you record in the Service. We will keep this list current and will update it before adding or replacing a sub-processor, in accordance with section 7. The suppliers' legal entities are Supabase, Inc.; Vercel, Inc.; Resend, Inc.; Cloudflare, Inc.; Upstash, Inc.; PostHog, Inc.
| Sub-processor | Purpose / processing | Personal data involved | Location / region | Safeguards |
|---|---|---|---|---|
| Supabase (Supabase, Inc.) | Primary application database (PostgreSQL), user authentication, and file storage (including uploaded photos, logos and documents). This is where the core service data is held and processed. | Account-holder and team member names, emails and roles; client, site and contact records; waste transfer notes and their parties; signatures (signer name, signature image, time of signing); permits and carrier details; collection schedules; fleet, walkaround, defect, maintenance, operator licence and weighbridge records; RAMS, near-miss reports (including any GPS location the user captures) and accident book entries, which include health data (special-category data under Article 9); quotes and invoices; customer portal access records; uploaded photos. | [Supabase project region to be confirmed] | Supabase's standard Article 28(3) DPA applies via its terms; for any processing, support or backup outside the UK/EEA, Supabase's transfer safeguards and a transfer risk assessment apply This is the row holding the highest-sensitivity data; access controls, row-level security and encryption in transit and at rest apply per the DPA TOMs schedule. |
| Vercel (Vercel, Inc.) | Hosting of the QWTN website and web application, global edge delivery, and execution of serverless functions (including API endpoints for notes, signing, email, billing and scheduled jobs), together with associated request, application and infrastructure logs. | Data submitted to or returned by the application during use, including any of the service data above passing through requests; technical and usage data such as IP address, device/browser information, and application and access logs. | Functions in London, UK (lhr1); global edge network; United States for certain support and logging | Vercel's standard Article 28(3) DPA applies via its terms; for processing outside the UK/EEA, the UK-US Data Bridge (where applicable) or Vercel's EU SCCs + UK Addendum, and a transfer risk assessment, apply |
| Resend (Resend, Inc.) | Delivery of transactional emails sent by the Service, such as sharing a waste transfer note, remote signature requests, team and customer portal invitations, quotes, invoices and payment reminders, driver schedules, accident and RIDDOR alerts, and account emails. | Recipient name and email address; email subject and message content (which may include a link to a note, signing page, portal or invoice, and summary details of the related record); delivery metadata such as send, open, bounce and delivery status. | United States | Resend's standard Article 28(3) DPA applies via its terms; for processing outside the UK/EEA, the UK-US Data Bridge (where applicable) or Resend's EU SCCs + UK Addendum, and a transfer risk assessment, apply |
| Cloudflare (Cloudflare, Inc.) | Bot and abuse protection (Cloudflare Turnstile) on the sign-up flow, to protect accounts and the Service against automated abuse. | End-user IP address; browser and device challenge signals; the Turnstile challenge token. No waste, fleet, health and safety or invoice data is sent to this service. | Global / United States | Cloudflare's standard Article 28 DPA applies via its terms; for processing outside the UK/EEA, the UK-US Data Bridge (where applicable) or Cloudflare's EU SCCs + UK Addendum, and a transfer risk assessment, apply |
| Upstash (Upstash, Inc.) | Rate limiting of requests (for example sign-in, signing links, contact and newsletter forms) to protect the Service against abuse. | Short-lived counters keyed to an IP address or account identifier, which expire automatically within minutes. No record content is stored. | [Upstash region to be confirmed] | Upstash's standard Article 28 DPA applies via its terms; for any processing outside the UK/EEA, the provider's transfer safeguards and a transfer risk assessment apply |
| PostHog (PostHog, Inc.) | Product analytics: how pages and features of the website and app are used, so that we can fix problems and improve the Service. | Pseudonymous identifiers, IP address, device and browser information, pages viewed and interaction events. We do not intentionally send record content (such as waste transfer note or accident details) to this service. | European Union (PostHog EU Cloud) | PostHog's standard Article 28 DPA applies via its terms; data is hosted in the EU, which is covered by UK adequacy regulations |
The descriptions above are provided to help you meet your own transparency and record-keeping obligations as controller. They do not vary the allocation of roles set out in the DPA. You remain the controller of the personal data you record in QWTN and are responsible for your own privacy notices to your staff, drivers, clients and other individuals; QWTN does not discharge that duty on your behalf.
Special-category data. The accident book records injuries, the body region affected and treatment received, which is health data, and near-miss and other free-text fields may also contain it. As controller, you are responsible for ensuring you have a lawful basis, including an Article 9(2) condition (for example the employment, social security and social protection condition in Schedule 1 to the Data Protection Act 2018) and, where required, an appropriate policy document, before entering special-category data, and for instructing your users accordingly. We process such data only on your documented instructions and apply our standard technical and organisational measures. We recommend recording only the detail you need, to support data minimisation under Article 5(1)(c).
No compliance guarantee. QWTN is a record-keeping tool only. We are not a waste carrier, broker or dealer, we do not provide legal or regulatory advice, and we do not warrant that use of the Service ensures compliance with the waste Duty of Care, hazardous waste rules, RIDDOR, DVSA or operator-licence requirements or any other legal obligation. You remain solely responsible for your own compliance. The substantive version of this carve-out is set out in the Terms of Service.
4. Independent controllers and data sources (not sub-processors)
The following services are used in connection with QWTN but are not our sub-processors of your service data, either because they act as independent controllers or because they are public sources we query, or content we load, at a user's request. They are listed here for transparency.
| Service | What it does | Data involved | Role |
|---|---|---|---|
| Stripe (Stripe Payments UK, Ltd. and/or Stripe, Inc.) | Subscription billing and payment for QWTN paid plans, including card details entered at checkout and the billing portal. | Account-holder name and email, billing details, subscription and transaction records. Full card numbers are captured by Stripe and never received by QWTN. | Independent controller for card and payment data (Stripe states it operates to PCI-DSS Level 1). Stripe does not process your clients', staff or waste records. |
| Companies House (UK Government) | Company name and number lookup when a user searches for a business. | The search term entered (usually a company name or number). Public register information is returned. | Public data source, queried on the user's request. |
| Environment Agency public registers (UK Government) | Waste carrier, broker and dealer registration and permit lookups. | The search term entered (registration number, name or postcode). Public register information is returned. | Public data source, queried on the user's request. |
| postcodes.io | Converting a postcode into an approximate location for maps and site search. | The postcode entered. | Public data source, queried on the user's request. |
| Clearbit company lookup | Suggesting a company's website and logo during set-up. | The company name entered only. | Third-party data source, queried on the user's request. |
| Google Fonts (Google LLC) | Delivering signature-style fonts used in the app. | The user's IP address and browser information, as part of the font request. | Content delivery; Google acts as independent controller for its request logs. |
| OpenStreetMap tile servers and Esri imagery | Displaying map and satellite tiles in the app's maps. | The user's IP address and the map area being viewed, as part of the tile request. | Content delivery; each provider acts as independent controller for its request logs. |
5. Retention
We retain personal data only for as long as needed to provide the Service and to meet legal and contractual obligations. In outline, and subject to the detail in the DPA and our Privacy Policy:
- Core service data held in Supabase is retained for the life of your account and for any period you are required to keep it, then deleted or anonymised. Statutory minimums you may need to observe include waste transfer notes for 2 years, hazardous waste consignment records for 3 years, accident book and RIDDOR records for 3 years and invoices for 6 years; you, as controller, set the applicable retention rule.
- Rate-limiting counters held in Upstash expire automatically within minutes.
- Operational logs (for example Vercel request/infrastructure logs and Resend email delivery logs), analytics events and backups are retained for limited periods in line with each supplier's standard retention policy, then deleted or overwritten.
6. International transfers
We aim to keep service data stored and processed within the UK or another country covered by UK adequacy regulations (which currently includes the EEA). Where a sub-processor carries out any restricted transfer to a country that is not covered by UK adequacy regulations, we rely, where applicable, on the UK-US Data Bridge for certified suppliers or on a valid Article 46 transfer mechanism (such as the ICO IDTA, or the EU Standard Contractual Clauses together with the ICO UK Addendum), supported by a documented transfer risk assessment. The position for each sub-processor is set out in the "Safeguards" column above. We keep our transfer and adequacy positions under review, including under the Data (Use and Access) Act 2025 and its amendments to the UK GDPR. Our Privacy Policy explains how this applies to the personal data we hold.
7. How we notify you of changes to sub-processors
We may add a new sub-processor, or replace an existing one, from time to time as the service evolves. Before a new or replacement sub-processor begins processing personal data on our behalf, we will:
- update this page to reflect the addition or change and update the "last updated" date in section 10; and
- provide advance notice to customers of at least 30 days by email to the account-holder and/or by an in-product or website notice, in accordance with the DPA.
To receive notice of changes, you can email privacy@qwtn.co.uk to be added to our sub-processor change notification list. We recommend that you also check this page periodically and keep your account-holder contact details up to date so that you receive notices. If the notification list is not yet live, the advance-notice email described above is the operative method.
We may make an urgent change to a sub-processor on shorter notice where this is reasonably required to maintain the security or continuity of the Service, or where an existing sub-processor ceases to provide the relevant service. In that case we will give notice as soon as reasonably practicable and your objection right in section 8 continues to apply.
8. Your right to object
If you have a reasonable, good-faith data-protection objection to a new or replacement sub-processor, you may object by giving us written notice within 30 days from notice, setting out the grounds for your objection.
If you object, we will work with you in good faith to address your concern. Where we are reasonably able to do so, we will seek to make the Service available to you in a manner that avoids the use of the objected-to sub-processor for your data. If we are unable to provide a reasonable alternative within a reasonable period, you may terminate the affected service in accordance with the DPA and the Terms of Service, and, where the DPA so provides, receive a pro-rata refund of fees paid in advance for the unused portion of the affected service. To the extent permitted by law and subject to our Article 28(4) liability, such termination is your sole and exclusive remedy where an unresolved good-faith objection prevents us from providing the affected service, and we are not liable for any resulting interruption that is beyond our reasonable control or caused by a sub-processor's outage or force-majeure event. Nothing in this section limits any rights you may have that cannot lawfully be excluded or limited; and, where you are a consumer, nothing in this section affects your statutory rights under the Consumer Rights Act 2015 or the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013.
9. Contact
If you have any questions about our sub-processors, this list, or the safeguards described here, please contact us at privacy@qwtn.co.uk, or write to WhealBit, St Ives, Cornwall. QWTN's website and app are at qwtn.co.uk.
10. Changes to this list
This Sub-processors List forms part of the DPA and may be updated from time to time as described in section 7. The version published on this page at any given time is the current list, and we maintain an archive of prior versions so that the version in force when you entered into the DPA can be identified. This list was last updated on 12 October 2026.