Customer Privacy Notice

This Privacy Notice explains how Innovex UK Limited trading as Wastetracka (“Innovex”, “we”, “us”, “our”) collects and uses your personal data when you use our mobile application, website, or related services (together, the “Platform”).

For the purposes of UK data protection law (including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 (“DPA 2018”)), Innovex UK Limited is the data controller for the personal data described in this notice.

Contact details

• Email:[email protected]
• Website: innovex.je
• Postal contact: marked “Data Protection” to our registered address (details available on request or via Companies House).

If you have any questions about this Privacy Notice, including any requests to exercise your rights, you can contact us using the details above.

What this Privacy Notice covers

This notice applies to:

• Customers using the Platform to request waste collection/disposal services;
• Carriers using the Platform to offer and perform waste services;
• Users who access our website or app (including admins and other account users);
• Individuals whose details appear in Job records, waste documentation or evidence;
• Individuals contacting us with enquiries, complaints or claims;
• Job applicants and candidates for roles at Innovex.

This privacy notice tells you what to expect us to do with your personal information.

• Contact details
• What information we collect, use, and why
• Lawful bases and data protection rights
• Where we get personal information from
• How long we keep information
• Who we share information with
• How to complain

What information we collect, use, and why

Account and identity data

• Name, job title or role
• Business or contact address
• Email address, phone number
• Account credentials (username, hashed password or login identifiers)

 Platform and Job data

• Job details you provide (e.g. location, access instructions, waste description)
• Customer and Carrier contact details linked to a Job
• Time and date stamps, GPS location coordinates, disposal site identifiers
• Photos and videos relating to jobs or waste (e.g. “before and after” images)
• Digital signatures and sign-off records on WTNs / Consignment Notes
• In-app messages or other communications via the Platform

Financial and transaction data

• Payment methods and transaction references
• Billing address and limited payment card details (tokenised or truncated)
• Payout details for Carriers (e.g. bank account or payment wallet identifiers)
  (Note: full card data is handled by our payment provider, not by us directly.)

 Technical and usage data

• Device information (e.g. device type, operating system, app version)
• Log information (e.g. IP address, timestamps, identifiers)
• Information on how you use the Platform (e.g. features used, session data)
• Cookie-related data and similar tracking technologies on the website or app

See our Cookie Policy for more detail about cookies and similar technologies.

 Communications and complaints data

• Records of enquiries, support tickets, complaints or claims
• Correspondence with us (e.g. emails, in-app messages, call notes)
• Information you choose to provide when you give feedback or reviews

 Recruitment data

For candidates we may process:

• Contact details (name, address, phone, email)
• CV, cover letter and application form details
• Employment and education history, references
• Right to work information and copies of ID documents
• Notes from interviews and assessments
• Criminal records information (where required for certain roles, subject to DPA 2018 Schedule 1 conditions and local law)

We will only request criminal records information where this is necessary and proportionate for the role and where law allows us to do so.

We do not intentionally collect special category data (e.g. health, ethnicity) via the Platform unless you choose to provide such information, or it is required by law and an appropriate legal basis and condition applies.

We collect this information to;

• comply with legal requirements,
• provide services and goods, including delivery
• for service updates or marketing purposes:
• deal with queries, complaints or claims:

How we collect personal data

We may collect your personal data in the following ways:

• Directly from you: when you create an account, use the Platform, contact us, complete forms, or participate in surveys or feedback;
• From other users: for example, a Customer may provide your details as a site contact, or a Carrier may upload photos including individuals;
• Automatically: via cookies, SDKs and similar technologies on our website or app (see our Cookie Policy);
• From third parties: such as payment providers, analytics providers, app stores, mapping and geolocation services, fraud prevention services;
• From public sources: such as Companies House or publicly available regulator or waste-site information.

Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information to provide services and goods are:

• Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
• Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
• Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.

Our legitimate interests are:

• We process personal data where it is necessary to: perform our contract with you (for example, to create your account and provide the WasteTracka tracking service); comply with our legal obligations under UK environmental and waste-tracking laws; and pursue our legitimate interests in operating, improving, and protecting our digital waste-management platform. Our legitimate interests include maintaining the security and integrity of the service, communicating important service updates, investigating misuse or complaints, and enhancing our systems to support compliance and efficiency. We only rely on legitimate interests where the processing is proportionate and does not override your privacy rights.

Our lawful bases for collecting or using personal information for service updates or marketing purposes are:

• Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
• Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.

Our legitimate interests are:

• WasteTracka may contact users about changes to the service, app functionality, or system availability because it has a legitimate business need to: Keep users informed about important operational or safety changes; Notify users of updates that affect how they use the service; Ensure users continue to meet legal or compliance obligations (for example, new data requirements under waste-tracking regulations); Maintain security and service integrity (e.g. updates to privacy terms, data protection settings, or fraud prevention tools).

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for collecting or using personal information for legal requirements are:

• Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
• Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
• Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.

Our legitimate interests are:

• We process certain personal data to comply with our legal obligations under UK environmental and waste management laws. This includes recording, transmitting, and retaining waste-tracking information as required by regulators. Separately, we have a legitimate interest in maintaining a secure, reliable, and compliant digital waste-tracking service. This includes using limited personal information to: improve our systems and ensure regulatory accuracy; provide users with essential service and compliance updates; and prevent misuse or fraudulent activity. We only rely on legitimate interests where such processing is necessary, proportionate, and does not override your rights and freedoms.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for collecting or using personal information for recruitment purposes are:

• Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

• Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
• Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
• Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.

Our legitimate interests are:

• We may process personal data when handling enquiries, complaints, or legal claims relating to the WasteTracka service. Our legitimate interest is to investigate and resolve issues, manage our relationship with users, and protect our legal rights. This may include recording correspondence, verifying facts, and sharing information with relevant parties (such as legal advisers or regulators) where necessary. Where we are legally required to handle or report certain complaints — for example, to an environmental regulator — we process that data under our legal obligation instead.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Where we get personal information from:

• Directly from you
• Publicly available sources

Childrens data

You must be at least 18 years old and have the legal capacity to enter into contracts. You agree to provide accurate, current, and complete registration information and to keep it updated. Therefore, we do not knowingly store or process data of children.  If you are aware of a child using our service, please notify us at once via the contact details at the end of this notice.

How long we keep information:

We keep personal data only for as long as reasonably necessary for the purposes set out in this notice, including to meet legal, accounting, or reporting requirements.

• Platform accounts and waste records – typically up to 7 years from the end of the relevant relationship or Job, reflecting statutory record-keeping and limitation periods;
• WTNs and Consignment Notes – retained for at least the minimum periods required by law (e.g. 2 years for WTNs and the applicable statutory period for hazardous/special waste documentation), and longer where necessary in line with environmental and regulatory requirements;
• Financial and transaction records – generally 6–7 years for tax and accounting purposes;
• Complaints and claims – retained for the duration of the issue and for a reasonable period afterwards, typically aligned with applicable limitation periods;
• Recruitment records – usually up to 6–12 months after the recruitment process ends if you are unsuccessful, unless you agree to a longer retention; if you are hired, your data will become part of your HR file and retained in accordance with our HR retention schedule.

We may retain some data for a longer period where required by law or where necessary in connection with legal claims. We will not normally keep data beyond what is reasonably necessary.

Who we share information with

Data Sub-processors

We may share your data with our Sub-processors who provide services to us as part of our service you can find more information about how they process your personal data in their privacy notices these include:

• Stripe: This data processor does the following activities for us: Payment platform
• Google inc: Google provide App store services and App Distribution and Analytics
• Apple Inc: Apple provide App store services and App Distribution and Analytics

Others we may share personal information with:

• Professional or legal advisors
• Financial or fraud investigation authorities
• Relevant regulatory authorities
• External auditors or inspectors
• Professional consultants
• Organizations we’re legally obliged to share personal information with
• Marketing and advertising partners
• Data Analytics and monitoring services
• Our digital marketplace partners including waste disposal and processing providers

Some of our service providers may be located outside the UK (and the EEA). Where personal data is transferred internationally, we will ensure that:

• The destination country has been found to provide an adequate level of protection by the UK Government; or
• We have put in place appropriate safeguards, such as the UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses (as adapted for UK transfers), plus additional safeguards where required.

Data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

• Your right of access – You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. Read more about the right of access.
• Your right to rectification – You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.
• Your right to erasure – You have the right to ask us to delete your personal information. Read more about the right to erasure.
• Your right to restriction of processing – You have the right to ask us to limit how we can use your personal information. Read more about the right to restriction of processing.
• Your right to object to processing – You have the right to object to the processing of your personal data. Read more about the right to object to processing.
• Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. Read more about the right to data portability.
• Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

How to complain

If you have any concerns about our use of your personal data, or wish to exercise any of the rights listed above you can contact us at the email address below, you can also use this address if you wish to make a complaint to us using the contact details below in the first instance.

email:  [email protected]

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

We may update this Privacy Notice from time to time, for example to reflect changes in law, technology or our services. When we do so, we will post the updated version on our website and update the “Last updated” date below.

 

Last updated: 12 November 2025