Privacy Policy
This Privacy Policy explains how EcoHaul Ltd collects, uses, stores, and protects your personal information in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Certified & Compliant
Contents
1. Introduction
About this Privacy Policy
EcoHaul Ltd ("we", "our", "us", or "EcoHaul") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our waste management platform and services.
Our Commitment
This policy applies to information we collect through:
- Our website and mobile applications
- Email, text, and other electronic communications
- Telephone and in-person interactions
- Third-party services and platforms we integrate with
Please read this policy carefully to understand our practices regarding your personal data. By using our services, you acknowledge that you have read and understood this Privacy Policy.
2. Data Controller
Who is responsible for your data
EcoHaul Ltd is the data controller responsible for your personal data. Our company details are:
Company Name
EcoHaul Ltd
Registered in England & Wales
Registered Address
EcoHaul Ltd, London, United Kingdom
Data Protection Officer
dpo@ecohaul.appICO Registration
Registered with the Information Commissioner's Office (ICO)
We have appointed a Data Protection Officer (DPO) who is responsible for overseeing questions in relation to this privacy policy. If you have any questions, please contact the DPO using the details above.
3. Information We Collect
Categories of personal data we process
We collect and process different types of personal data depending on how you interact with our services:
Identity Data
Contact Data
Financial Data
Technical Data
Usage Data
Location Data
Special Category Data
4. Legal Basis for Processing
Under what authority we process your data
Under the UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following legal bases:
Performance of Contract
Processing necessary to perform our contract with you or take steps at your request before entering into a contract.
Legitimate Interests
Processing necessary for our legitimate interests or those of a third party, provided your interests and rights do not override.
Legal Obligation
Processing necessary to comply with a legal obligation to which we are subject.
Consent
Where you have given clear consent for us to process your personal data for a specific purpose.
Where we rely on consent, you may withdraw your consent at any time by contacting us or using the preference settings in your account.
5. How We Use Your Data
Purposes for processing your information
We use your personal data for the following purposes:
6. Data Sharing
Who we share your information with
We only share your personal data when necessary to provide our services or when legally required. We share information with:
Service Providers
Drivers & Customers
Regulatory Authorities
Professional Advisers
We Never Sell Your Data
7. International Data Transfers
How we protect data transferred outside the UK
Some of our service providers may be located outside the United Kingdom. When we transfer personal data internationally, we ensure appropriate safeguards are in place:
- UK Adequacy Decisions: Transfers to countries recognized by the UK as providing adequate protection
- International Data Transfer Agreement (IDTA): UK-approved standard contractual clauses
- Binding Corporate Rules: For transfers within corporate groups with approved rules
- Additional Technical Measures: Encryption, pseudonymization, and access controls
You may request a copy of the safeguards we use for international transfers by contacting our Data Protection Officer.
8. Data Security
How we protect your information
We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
Encryption
TLS 1.3 in transit, AES-256 at rest
Access Controls
Role-based access, multi-factor authentication
Monitoring
24/7 security monitoring and threat detection
Regular Audits
Third-party security assessments and penetration testing
Employee Training
Regular data protection and security training
Incident Response
Documented procedures for security incidents
While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We encourage you to use strong passwords and enable two-factor authentication on your account.
9. Your Rights
Your data protection rights under UK GDPR
Under the UK GDPR and Data Protection Act 2018, you have the following rights regarding your personal data:
Right to Access
Request a copy of the personal data we hold about you
Right to Rectification
Request correction of inaccurate or incomplete data
Right to Erasure
Request deletion of your personal data in certain circumstances
Right to Restriction
Request restriction of processing in certain circumstances
Right to Data Portability
Receive your data in a structured, machine-readable format
Right to Object
Object to processing based on legitimate interests or for direct marketing
Rights Related to Automated Decisions
Not be subject to decisions based solely on automated processing
Right to Withdraw Consent
Withdraw consent at any time where we rely on consent
How to Exercise Your Rights
10. Data Retention
How long we keep your information
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.
Account Data
Legal and accounting requirements
Transaction Records
Tax and financial regulations (HMRC)
Communications
Customer service and dispute resolution
Marketing Preferences
Compliance with consent requirements
Security Logs
Security monitoring and incident response
Analytics Data
Service improvement
When personal data is no longer required, it is securely deleted or anonymized so that it can no longer be associated with you.
12. Children's Privacy
Protection of minors' information
Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18 years of age.
Age Requirement
If you believe we have collected information from a child under 18, please contact us immediately at dpo@ecohaul.app. dpo@ecohaul.app.
13. Changes to This Policy
How we notify you of updates
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.
When we make changes:
- We will update the "Last Updated" date at the top of this policy
- For significant changes, we will notify you via email or in-app notification
- We encourage you to review this policy periodically
Your continued use of our services after any changes indicates your acceptance of the updated policy.
14. Contact Us
How to reach us with questions or concerns
If you have any questions about this Privacy Policy, your personal data, or wish to exercise your rights, please contact us:
Data Protection Officer
Supervisory Authority
You have the right to lodge a complaint with the Information Commissioner's Office:
Helpline: 0303 123 1113