Byrne Waste Tracking · Data Processing Agreement

Version: 2026-10-16
Last updated: 16 OCTOBER 2026
Read with: Terms

Byrne Waste Tracking — Data Processing Agreement

⚠ This document has not been seen by a solicitor. It was written in-house to meet Article 28 of the UK GDPR, and every factual claim in it about how the service works has been checked against the live system rather than assumed. It is not legal advice — not to you, and not to us. If your own adviser wants changes, ask and we will look at them.

1. Who this is between, and how it takes effect

You (the Customer) — the business that holds the environmental permit and uses Byrne Waste Tracking to record waste received at its site.

Us (the Processor) — Wilf Byrne, trading as Byrne Digital Solutions, a sole trader, of 1 Kings Avenue, Newcastle-under-Lyme, ST5 8DA. wilf@byrnedigitalsolutions.co.uk · 07935 173034

This agreement forms part of the Byrne Waste Tracking Terms of Service. It takes effect the same way the Terms do — when you create an account or use the service. Neither of us signs anything. If your procurement process needs a dated copy of this document as a PDF, email us and we will send one.

Where this agreement and the Terms of Service disagree about data protection, this agreement wins.

2. Which of us is which

You are the controller. We are the processor.

You decide what waste your site takes, what gets recorded, who at your business can see it, and when a return goes to DEFRA. We store what you enter and put it into DEFRA's spreadsheet format for you. If you link your DEFRA account, we also send your records to DEFRA's service on your instruction. We do not decide what is recorded.

Using the service is your instruction to us to process the personal data described in clause 3 for the purposes described in clause 3. If you want us to do something with it that isn't described here, email us and we will confirm in writing before doing it.

If you are a consultancy or a technically competent manager using this on behalf of your own clients, your client is the controller and you act for them. You are responsible for having their authority to put their data in.

3. Article 28(3) particulars — what is actually processed

3.1 Subject matter

Providing Byrne Waste Tracking: software that records waste received at a permitted site and produces a completed copy of DEFRA's Receipt of Waste spreadsheet template.

3.2 Duration

For as long as you have an account, plus the wind-down period in clause 10.

3.3 Nature and purpose

Storage, organisation, retrieval and structured export of waste receipt records (and, if you link your DEFRA account, sending them to DEFRA's Report Receipt of Waste service), so that you can meet your Digital Waste Tracking duty. Plus the account admin needed to run it — sign-in, support, and telling you when something is wrong.

3.4 Types of personal data

Account data

Name and email address of each person you give access to
A hashed password (see clause 6 — we never hold or see the password itself)
Sign-in timestamps

Data typed onto waste records

Carrier, broker and dealer details — company name, registration number, address, and where entered, a named contact
Vehicle registration numbers. DEFRA require these for any load arriving by road. A vehicle registration can identify a person, particularly at a small firm where the van is the owner's
Named individuals, where a driver's or a contact's name is typed into a field
Site contact details

Technically competent manager records, where you use that part of the service

The manager's name, and the times they arrived at and left the site each day

Free text. Several DEFRA fields are free text. Anything a person types in can be personal data, and we cannot control what that is. See clause 3.6.

3.5 Categories of data subject

Your staff and anyone else you give an account to
Drivers, and staff of the carriers, brokers and dealers who bring waste to your site
Your technically competent manager
Any individual named in a free-text field

3.6 Special category data — please don't

Nothing in this service needs health data, biometric data, criminal offence data, or anything else in Article 9 or Article 10 of the UK GDPR. Do not type it into a free-text field. There is no technical control stopping you, so this is a real ask, not boilerplate: if it goes in, it is in a system that was not designed to hold it.

4. What we will and won't do with it

We will:

(a) process personal data only on your documented instructions, including about transfers outside the UK, unless the law requires otherwise — in which case we will tell you first, unless the law forbids us from telling you;
(b) not use your data for our own purposes. We will not use it to train anything, sell it, share it with other customers, or use it to market to anyone;
(c) keep it confidential (clause 5);
(d) apply the security measures in clause 6;
(e) only use the sub-processors in clause 7, on the terms in clause 7;
(f) help you answer requests from individuals (clause 8);
(g) help you with your own security, breach and impact-assessment duties (clause 9);
(h) tell you about a breach quickly (clause 9);
(i) delete or return your data at the end (clause 10);
(j) give you what you need to check we are doing all this (clause 11).

Tell us straight away if you think an instruction you have given us breaks data protection law. We will tell you if we think one does.

5. Confidentiality

Access to production data is limited to one person: Wilf Byrne, from one computer. There are no employees, no contractors and no support agency. Nobody else has the database password.

If that ever changes, anyone given access will be under a written confidentiality obligation before they get it, and clause 7 covers anyone who becomes a sub-processor.

6. Security — what actually exists

Everything in this clause has been tested on the live system, and the date of the last test is given. Nothing is listed here because it sounded good.

6.1 Separation between customers

Row-level security is switched on for every table in the database — organisations, sites, movements, waste items, memberships, invitations and manager attendance. Your records are separated at database level, not just hidden by the app. That distinction matters: a bug in the app cannot show your loads to another operator, because the database itself refuses.

Tested by signing in as a stranger with a valid account and trying to read everything: zero rows returned across all seven tables, and no ability to create anything. Last re-verified 6 September 2026, and on 23 and 27 August 2026 before that. Two unrelated consultancies sharing one manager were tested the same way: each sees only their own client.

The function that saves a load checks your membership itself and takes the user's identity from the signed-in session, never from what the browser sends — so an offline device cannot claim to be somebody else.

6.2 Passwords

Sign-in is by email and password. Passwords are hashed with bcrypt (the same scheme the authentication platform uses; 60-character $2a$ hashes, verified directly in the database). We never store, see, print or email a password in readable form. There is no route by which we could tell you what your password is — only set a new one.

6.3 Encryption in transit

The app is served over HTTPS only. Every connection to the database requires TLS (sslmode=require); a connection that will not do TLS is refused.

Our database provider states that data is also encrypted at rest on their platform. That is their statement, not something we have independently tested — we have said so rather than repeat it as our own claim.

6.4 Backups

A full backup runs every night at 19:30 — a scheduled task on our own machine, set up on 5 September 2026, which catches up if the computer was off. Every table is exported, including the sign-in records, because a backup you cannot sign in to is not a backup. The last ten nightly copies are kept, and each one is copied to a separate server in London.

Restoring has been proved, not assumed. On 25 August 2026 a real waste movement and its waste item were deleted from the live database, the restore was run, and the record came back identical — reference, permit, deployment reference, carrier, timestamp, weight and all.

API credentials and passwords are deliberately excluded from backups, and the backup script refuses to run if one gets in.

6.5 Monitoring

The live app and the database are both checked every hour, 07:00 to 21:00, every day. The check looks for content only the real app contains — a page that returns "OK" but is not the app still counts as an outage. If it fails, we get an email: one alert per outage and one all-clear, so an alert is never ignored.

6.6 No third-party tracking

The app contains no analytics, no advertising tags and no tracking pixels. The only third party your browser contacts is the database. (Until 23 September 2026 it also fetched two typefaces from Google Fonts; they are now served from our own domain — see clause 7.3.)

6.7 What we do not have — read this before you rely on us

Being straight about the gaps is worth more to you than a longer list above.

There is no point-in-time recovery. We are on a free database tier that does not offer it. If the database were lost entirely, the worst case is losing up to one day of records, restored from the previous night's backup. Your own export is the answer to that: the service lets you export at any time and we recommend you do it regularly.
There is no two-factor authentication on customer accounts yet. Sign-in is email and password. Use a password you use nowhere else.
We hold no security certification — no ISO 27001, no SOC 2, no Cyber Essentials — and no third-party penetration test has been done. The testing described above is our own.
Monitoring is automated; the response is one person, who is not available 24 hours a day.
This is a one-person business. If you need a supplier with a security team, we are not it, and you should know that before ten of your sites are on it rather than after.

7. Sub-processors

You give general authorisation for the following. These are all of them.

7.1 Who they are

Sub-processor	What they do	Where	What personal data they hold
Supabase	Database and sign-in	United Kingdom — London region (`eu-west-2`), verified against the live project	Everything in clause 3.4
Netlify	Serves the app's files (static hosting)	US company, global edge network	Request metadata only — IP address and browser headers. See 7.2
Oracle Cloud	Holds the nightly offsite backup copy	United Kingdom — London (`uk-london-1`)	A copy of everything in clause 3.4
Microsoft (Microsoft 365)	Our email — support and account correspondence	Microsoft state UK storage for UK tenants	Names, email addresses and whatever is in an email you send us

7.2 Why Netlify sees so little

The app is a set of files in your browser that talks to the database directly. Waste records and account data never pass through Netlify. Netlify serves the page; the data goes straight from your browser to the database in London. The only personal data Netlify handles is the metadata any web host sees — your IP address and browser headers — and because its network is global, that part may be handled outside the UK. Netlify's own data processing terms cover those transfers using the UK Addendum to the Standard Contractual Clauses.

7.3 One thing we fixed

Until 23 September 2026 the app loaded two typefaces from Google Fonts, which meant your browser made a request to Google and Google saw the IP address. No waste records or account data were involved. It was a transfer we did not need to be making, so the font files are now served from our own domain and Google is no longer contacted. We have written it down here rather than left it out.

7.4 Changes

We will give you at least 30 days' notice by email before we add or replace a sub-processor. You may object on reasonable data protection grounds; if we cannot resolve it, you may terminate without penalty and without paying for the rest of the period.

We remain responsible to you for what our sub-processors do, as if we had done it ourselves.

8. Helping you with people's rights

If someone asks you for their data, asks you to delete it, objects, or exercises any other right under Chapter III of the UK GDPR, we will help you answer.

In practice, most of it you can do yourself: you can export your data from the service at any time, and you can remove a user's access. For anything you cannot do from the screen, email us and we will come back within 5 working days — well inside the month you have to answer them.

If a request comes to us instead of you, we will not answer it ourselves. We will pass it to you promptly, because it is your call to make, not ours.

9. Security incidents and breaches

We will tell you about a personal data breach affecting your data without undue delay, and in any event within 24 hours of becoming aware of it. We will tell you what has happened, what data and roughly how many people are affected, what the likely consequences are, and what we are doing — and we will keep telling you as we find out more, rather than waiting until we have the full picture.

Be aware of what "becoming aware" means here. Monitoring is hourly, not continuous, and this is a one-person business. The 24 hours runs from the point we know, and we are not promising to know instantly. We would rather say that than let you assume otherwise.

We will help you with your own duty to report to the ICO within 72 hours, and with telling affected individuals if you have to.

We will also help you, so far as we reasonably can, with data protection impact assessments and any consultation with the ICO that follows one.

10. What happens at the end

10.1 Export whenever you like

You can export your records at any time while you have an account, in DEFRA's own format. Your records are yours. We claim no ownership of them.

10.2 The statutory records are yours to keep, not ours

This matters, so it is not buried. You are the operator. The duty to keep waste records is yours and it does not transfer to us. Waste transfer notes must be kept for two years, hazardous waste consignment notes for three, and your permit may require longer. We are not your archive. If you leave and later need a record for an Environment Agency inspection, it needs to be in your possession, not ours.

So: export everything before you close the account. We will remind you when you cancel.

10.3 Deletion

Your account stays readable for 30 days after it closes, so you can still export.
After that we delete your personal data within 90 days of the account closing.
Backup copies containing it are overwritten as the backup rotation cycles — currently the last ten nightly copies, so within about two weeks of deletion.
If you want it deleted sooner, ask, and we will do it. Say so plainly, because it cannot be undone.
We keep only what the law requires us to keep — for example basic billing records for tax purposes, which do not include your waste records.

11. Audit

We will give you the information you need to show that we are meeting Article 28, and will allow and contribute to audits by you or an auditor you appoint, on reasonable notice, once a year — or more often if there has been a breach or a regulator requires it.

Practically, for a business this size, that means: this document, written answers to your security questionnaire, and evidence of the tests described in clause 6. If you want to see the row-level security test run, we will run it while you watch. An on-site inspection of a one-person business has little to inspect, but if your own compliance regime requires one we will not refuse it — we will just agree how it works first, and you cover your auditor's cost.

12. General

Governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction.
Liability under this agreement is subject to the limits in clause 8 of the Terms of Service.
If any part of this is unenforceable, the rest still stands.
We may update this agreement. We will give at least 30 days' notice by email of anything material, and if you do not accept it you may cancel before it takes effect.

13. Asking us something

Any question about this — including one from your consultant, your auditor or your insurer — goes to wilf@byrnedigitalsolutions.co.uk. We reply the same working day.