IMPORTANT — HOW THIS AGREEMENT IS ACCEPTED. This Data Processing Agreement (“DPA”) forms part of the Agreement described in section 2.2 of the AnyWaste Platform Terms, and applies wherever AnyWaste processes Personal Data on the Customer’s behalf. It is accepted, without signature, when the Customer accepts the Platform Terms at registration, or when the parties execute an Order Form or other agreement incorporating it. Updates to this DPA follow clause 2.3: fundamental changes — including any new processing purpose, any material expansion of AnyWaste’s data rights, or any material change to controller or processor roles — take effect for existing Customers only on positive acceptance, and continued use alone is not relied on for them. Enterprise customers may also execute this DPA as a signed agreement on request.
| Document | Data Processing Agreement |
| Version | 2.2 |
| Effective date | 2 September 2026 |
| Applies to | All customers of AnyWaste Global Ltd using the AnyWaste platform |
| Governing law | England and Wales |
| Data regulator | Information Commissioner’s Office (ICO), United Kingdom |
| Contact | hello@anywaste.com |
1.Definitions and Interpretation
1.1In this DPA, the following terms shall have the meanings set out below:
| Term | Meaning |
| “Agreement” | This Data Processing Agreement together with all Schedules and the AnyWaste Platform Terms. |
| “Controller” | The Customer: the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data. |
| “Processor” | AnyWaste Global Ltd, a company incorporated in England and Wales, which processes Personal Data on behalf of the Controller in connection with the provision of the Services. |
| “Personal Data” | Any information relating to an identified or identifiable natural person (as defined in Article 4(1) UK GDPR) which is processed by the Processor on behalf of the Controller under this Agreement. |
| “Processing” | Any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction. |
| “Data Subject” | An identified or identifiable natural person to whom Personal Data relates. |
| “Sub-processor” | Any third party engaged by the Processor to carry out Processing activities on Personal Data on behalf of the Controller. |
| “Personal Data Breach” | A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed. |
| “Applicable Data Protection Law” | The UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and any successor or amending legislation in force in the United Kingdom. |
| “Services” | The digital waste tracking, compliance, reporting, and software-as-a-service platform provided by the Processor via anywaste.com and app.anywaste.com. |
| “Technical and Organisational Measures” | The security measures implemented by the Processor as set out in Schedule 2 of this Agreement. |
1.2Terms not defined in this DPA have the same meaning as in Applicable Data Protection Law or the Platform Terms. In particular, “Aggregated Data”, “Anonymised Data”, “Derived Data”, “Anonymisation Standard” and “Confidential Commercial Information” have the meanings given in the Platform Terms.
1.3References to “Article” are references to articles of the UK GDPR. References to legislation include all subordinate legislation and any amendments or re-enactments.
2.How This Agreement Is Accepted
2.1This DPA is accepted without the need for a handwritten or electronic signature: by the Customer accepting the AnyWaste Platform Terms at registration; by entering into an Order Form or other written agreement that incorporates this DPA; or by executing this DPA as a signed agreement.
2.2The person completing the registration process represents and warrants that they have the authority to bind the Customer (the business entity) to the terms of this Agreement. Where a business entity uses the Platform through multiple Authorised Users, each such user’s access and use of the Platform constitutes the business entity’s continued acceptance of this Agreement.
2.3AnyWaste may update this DPA from time to time, using the change mechanisms in section 34 of the Platform Terms. For material changes, AnyWaste will provide not less than 30 days’ notice by email to the registered account holder and by a prominent notice on the Platform, and the Customer may terminate before the effective date if it does not accept the change. For fundamental changes — including any expansion of the purposes for which AnyWaste processes Personal Data or any new category of data use — the change takes effect for existing Customers only on the Customer’s positive acceptance recorded in-product; continued use alone is not treated as acceptance of a fundamental change.
2.4A copy of this DPA is available at all times on the AnyWaste website. Customers may download or print this DPA for their own records. AnyWaste will provide a copy by email on request to hello@anywaste.com.
3.Scope and Purpose of Processing
3.1The Processor shall process Personal Data only to the extent necessary to provide the Services and strictly in accordance with the documented instructions of the Controller as set out in this DPA and the Platform Terms.
3.2The subject matter, duration, nature, purpose, types of Personal Data, and categories of Data Subjects are set out in Schedule 1 (Processing Activities) to this Agreement.
3.3The Controller is responsible for determining the lawful basis for processing under Article 6 UK GDPR (and Article 9 where special category data is involved) and for ensuring that its instructions to the Processor are lawful.
3.4If the Processor considers that any instruction from the Controller infringes Applicable Data Protection Law, the Processor shall notify the Controller immediately and shall not be required to follow that instruction.
3.5AnyWaste acts as Processor in respect of Personal Data processed to provide the Services on the Controller’s documented instructions.
3.6AnyWaste acts as a Controller in its own right in respect of the following processing, which is not carried out on the Controller’s instructions:
- account administration, billing and customer relationship management;
- securing the Platform, and detecting, preventing and investigating fraud, misuse and abuse;
- monitoring and improving the performance and reliability of the Platform;
- complying with AnyWaste’s own legal obligations; and
- creating Aggregated Data, Anonymised Data and Derived Data in accordance with sections 15 to 23 of the Platform Terms.
3.7Where AnyWaste acts as a Controller, its processing is described in the AnyWaste Privacy & Cookies Notice and this DPA does not apply to it.
3.8Whether AnyWaste acts as Processor or as Controller in respect of any particular processing activity is determined by reference to who determines the purposes and essential means of that activity, assessed activity by activity — not by the technical location of the data or by any single point in a processing pipeline. Where AnyWaste processes Personal Data for one of the purposes listed in clause 3.6 — including the preparation of data for, and the creation of, Aggregated Data, Anonymised Data and Derived Data — AnyWaste is a Controller of that processing from its commencement, and carries it out in accordance with data protection law and its Privacy & Cookies Notice, using anonymous information wherever it is sufficient for the purpose. All other processing of Personal Data under this Agreement is carried out as Processor on the Controller’s documented instructions. AnyWaste records the role, purpose and lawful basis for each processing activity in its internal Data Classification & Processing Register, a summary of which is available to the Controller on request.
4.Controller’s Obligations
4.1The Controller shall:
- ensure that there is a valid lawful basis under Applicable Data Protection Law for all Personal Data provided to the Processor;
- ensure that all necessary privacy notices have been provided to Data Subjects and all required consents obtained before providing Personal Data to the Processor;
- comply with its obligations under Applicable Data Protection Law in its role as Controller;
- ensure that all instructions given to the Processor comply with Applicable Data Protection Law;
- notify the Processor promptly of any changes to its instructions that may affect the Processor’s obligations;
- maintain accurate records of processing activities in accordance with Article 30 UK GDPR;
- ensure that any Personal Data provided to the Processor is accurate, complete, and relevant to the lawful purpose for which it is shared.
5.Processor’s Obligations
5.1The Processor shall:
- process Personal Data only on documented instructions from the Controller, except where required to do so by applicable law, in which case the Processor shall notify the Controller of that legal requirement before processing (unless prohibited by law);
- ensure that all persons authorised to process Personal Data are subject to appropriate confidentiality obligations or statutory obligations of confidentiality;
- implement and maintain appropriate Technical and Organisational Measures as set out in Schedule 2, in accordance with Article 32 UK GDPR;
- not engage any Sub-processor without prior authorisation of the Controller, save as provided in clause 8 of this DPA;
- assist the Controller, insofar as reasonably possible, in fulfilling its obligations to respond to Data Subject rights requests under Chapter III UK GDPR;
- assist the Controller in ensuring compliance with its obligations under Articles 32 to 36 UK GDPR, taking into account the nature of the processing and the information available to the Processor;
- at the choice of the Controller, delete or return all Personal Data after the end of the provision of the Services, and delete existing copies unless applicable law requires their retention;
- make available to the Controller all information necessary to demonstrate compliance with Article 28 UK GDPR obligations and allow for audits in accordance with clause 13 of this DPA;
- notify the Controller without undue delay upon becoming aware of a Personal Data Breach in accordance with clause 10 of this DPA.
6.Data Subject Rights
6.1The Processor shall, to the extent reasonably practicable, assist the Controller in responding to requests from Data Subjects exercising their rights under Chapter III UK GDPR, including: right of access (Article 15); right to rectification (Article 16); right to erasure (Article 17); right to restriction of processing (Article 18); right to data portability (Article 20); right to object (Article 21).
6.2The Processor shall promptly forward to the Controller any request received directly from a Data Subject that relates to the Controller’s processing activities, and shall take no action on such a request without the Controller’s written instruction.
6.3The Controller is solely responsible for responding to Data Subject requests. The Processor shall provide the necessary technical assistance to facilitate such responses within a reasonable timeframe agreed between the parties.
7.Security of Processing
7.1Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, the Processor shall implement and maintain appropriate Technical and Organisational Measures to ensure a level of security appropriate to the risk, including as appropriate:
- pseudonymisation and encryption of Personal Data where appropriate;
- the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services;
- the ability to restore availability and access to Personal Data in a timely manner following a physical or technical incident;
- a process for regularly testing, assessing, and evaluating the effectiveness of technical and organisational measures.
7.2The Technical and Organisational Measures in place as at the date of this Agreement are set out in Schedule 2. The Processor may update such measures from time to time, provided that updates shall not materially reduce the level of protection afforded.
8.Sub-processors
8.1By accepting this DPA, the Customer provides general written authorisation for the Processor to engage Sub-processors. The current list of authorised Sub-processors is set out in Schedule 3 and will be updated as Sub-processors change.
8.2Prior to engaging any new Sub-processor, the Processor shall notify the Controller by updating Schedule 3 on the AnyWaste website and providing not less than 30 days’ prior written notice to the registered account holder by email (“Sub-processor Change Notice”).
8.3The Controller may object to any new Sub-processor on reasonable grounds relating to data protection by notifying the Processor in writing within 14 days of the Sub-processor Change Notice. If the parties cannot resolve the objection within 30 days, either party may terminate the Services on written notice without liability for such termination.
8.4Where the Processor engages a Sub-processor, it shall impose data protection obligations on that Sub-processor by way of a written agreement that provides at minimum the same level of protection as this DPA. The Processor shall remain fully liable to the Controller for the Sub-processor’s performance of those obligations.
9.International Transfers
9.1The Processor shall not make a restricted transfer of Personal Data outside the United Kingdom unless a transfer mechanism recognised under Applicable Data Protection Law is in place and the applicable data protection test is met, supported by a transfer risk assessment where one is required. Transfers to countries covered by UK adequacy regulations (including the EEA) are permitted on that basis. Remote access to Personal Data from outside the United Kingdom is treated as a transfer. The Sub-processor Register identifies the location of each Sub-processor and the mechanism relied on.
9.2Where transfers to third countries are agreed, the Processor shall ensure that an appropriate safeguard is in place in accordance with Chapter V UK GDPR, including:
- an adequacy decision by the UK Secretary of State under Article 45 UK GDPR;
- appropriate safeguards under Article 46 UK GDPR, such as UK International Data Transfer Agreements (IDTAs) or UK Addendum to the EU Standard Contractual Clauses;
- a derogation under Article 49 UK GDPR where applicable.
9.3The Processor shall promptly notify the Controller if any safeguard in place for an international transfer is no longer valid.
10.Personal Data Breaches
10.1The Processor shall notify the Controller without undue delay and, where feasible, within 48 hours of becoming aware of a Personal Data Breach affecting Personal Data processed under this Agreement.
10.2Such notification shall include, to the extent available at the time:
- a description of the nature of the breach, including the categories and approximate number of Data Subjects and records concerned;
- the contact details of the relevant privacy contact at AnyWaste;
- a description of the likely consequences of the breach;
- a description of the measures taken or proposed to address the breach.
10.3The Processor shall cooperate fully with the Controller to enable the Controller to comply with its obligations under Articles 33 and 34 UK GDPR in respect of notifying the ICO and, where required, Data Subjects.
10.4The Processor shall not make any public announcement or notification to Data Subjects regarding a Personal Data Breach without the Controller’s prior written consent, except as required by applicable law.
11.Data Protection Impact Assessments
11.1The Processor shall provide reasonable assistance to the Controller in carrying out Data Protection Impact Assessments (DPIAs) required under Article 35 UK GDPR, where such assessments concern processing activities carried out by the Processor.
11.2The Processor shall provide reasonable assistance to the Controller in consulting the ICO where required under Article 36 UK GDPR.
12.Records of Processing Activities
12.1The Processor shall maintain accurate and up-to-date records of all categories of processing activities carried out on behalf of the Controller in accordance with Article 30(2) UK GDPR. Such records shall be made available to the ICO on request.
13.Audit Rights
13.1The Processor shall make available all information necessary to demonstrate compliance with this DPA and Article 28 UK GDPR.
13.2The Processor shall allow for audits, including inspections, conducted by the Controller or a mandated auditor, subject to the following conditions:
- the Controller shall provide not less than 30 days’ prior written notice of any audit;
- audits shall be conducted during normal business hours and in a manner that minimises operational disruption;
- audits shall not be conducted more than once in any calendar year unless there is a reasonable belief that a breach of this DPA has occurred;
- the auditor shall execute a confidentiality agreement with the Processor prior to commencing the audit;
- the cost of any audit shall be borne by the Controller unless the audit reveals a material breach of this DPA, in which case the cost shall be borne by the Processor.
13.3Where the Processor provides a relevant third-party audit certification (including ISO 27001 or SOC 2) or a completed information security questionnaire, this shall satisfy the Controller’s audit rights in respect of the matters covered by that certification or questionnaire.
14.Deletion and Return of Personal Data
14.1On termination or expiry of the Services, or earlier on the Controller’s written request, the Processor shall, at the Controller’s election:
- return all Personal Data to the Controller in a commonly used and machine-readable format; or
- securely delete or destroy all Personal Data processed under this Agreement.
14.2The Processor shall provide written confirmation of deletion or destruction within 30 days of the termination date.
14.3The Processor may retain Personal Data to the extent required by applicable law, provided that the Processor notifies the Controller of such requirement and processes the retained data only as required by law.
14.4The Processor’s back-up systems shall remove Personal Data within a maximum of 90 days of any deletion request.
14.5Clauses 14.1 to 14.4 do not require the Processor to delete Aggregated Data, Anonymised Data or Derived Data created before termination in accordance with sections 15 to 23 of the Platform Terms, provided that such data continues to meet the Anonymisation Standard and does not disclose Confidential Commercial Information.
15.Liability
15.1Each party’s liability under this DPA is subject to the limitations and exclusions set out in the Platform Terms.
15.2Subject to clause 15.1, the Processor shall indemnify the Controller against claims, losses, damages and costs arising from the Processor’s breach of this DPA or of Applicable Data Protection Law, to the extent attributable to the Processor. This indemnity is subject to the limitations of liability in the Platform Terms.
15.3Subject to clause 15.1, the Controller shall indemnify the Processor against claims, losses, damages and costs arising from: (a) the Controller’s breach of this DPA or of Applicable Data Protection Law; and (b) any Personal Data submitted to the Platform by the Controller or its Authorised Users in respect of which the Controller did not have a lawful basis or had not given the notices required by Applicable Data Protection Law, including personal data relating to drivers, site contacts and other third parties. This indemnity is subject to the limitations of liability in the Platform Terms.
16.Term and Termination
16.1This DPA commences on the date of the Customer’s acceptance and continues for the duration of the Services.
16.2Either party may terminate this DPA on written notice if the other party materially breaches any provision and fails to remedy the breach (if capable of remedy) within 30 days of written notice.
16.3Clauses 7, 10, 14, and 15 shall survive termination of this Agreement.
17.General Provisions
17.1Governing Law. This DPA is governed by the laws of England and Wales. The parties submit to the exclusive jurisdiction of the courts of England and Wales.
17.2Entire Agreement. This DPA, together with the Platform Terms and all Schedules, constitutes the entire agreement between the parties with respect to the processing of Personal Data, and supersedes all prior agreements, representations, and understandings.
17.3Amendments. AnyWaste may update this DPA from time to time in accordance with clause 2.3 and section 34 of the Platform Terms. The current version shall always be published on the AnyWaste website, with an archive of superseded versions.
17.4Severability. If any provision is found to be invalid, illegal, or unenforceable, the remaining provisions shall continue in full force.
17.5Priority. In the event of any conflict between this DPA and the Platform Terms, this DPA shall take precedence in respect of data protection matters.
SCHEDULE 1Processing Activities
| Subject matter | Processing of personal data of waste operators, company representatives, drivers, and authorised users in connection with the provision of digital waste tracking, consignment note management, duty of care documentation, hazardous waste records, and regulatory reporting services via the AnyWaste platform. |
| Duration | For the duration of the Services and for such further period as required by applicable law. |
| Nature of processing | Collection, recording, storage, retrieval, organisation, structuring, use, disclosure by transmission, and deletion of personal data via the AnyWaste digital platform, including automated processing for the generation of waste transfer documents, dashboards, and regulatory returns. |
| Purpose | To enable the Controller to create, manage and retain digital waste transfer notes (WTNs), hazardous waste consignment notes (HWCNs), dangerous goods notes (DGNs), duty of care records and regulatory compliance data under applicable waste and digital waste tracking legislation. Regulatory submission functionality applies only where identified as live and included in the Services. |
| Types of personal data | Full name; email address; telephone number; job title and employer details; vehicle registration numbers; carrier licence reference numbers; digital signature data; login credentials (stored in hashed form only); IP address and device identifiers; audit log data; any personal data contained within waste movement documentation entered or uploaded by the Controller. |
| Categories of data subjects | Employees, contractors, and representatives of waste producer organisations; employees, contractors, and representatives of waste carrier and logistics organisations; employees of waste recycling and treatment facility operators; drivers and logistics personnel; waste brokers and waste managers; local authority personnel; any other natural persons whose data is included in waste documentation processed via the Platform. |
| Special categories | None ordinarily expected. The Controller is solely responsible for ensuring that no special category personal data (as defined in Article 9 UK GDPR) is submitted to the Platform unless expressly agreed in writing with the Processor. |
SCHEDULE 2Technical and Organisational Security Measures
The following measures are in place as at the date of this Agreement. AnyWaste may update these measures over time; any updates shall not materially reduce the level of protection afforded to Personal Data.
ACCESS CONTROLS
- Role-based access control (RBAC) restricting access to Personal Data to authorised personnel on a need-to-know basis.
- Multi-factor authentication (MFA) required for all administrative access to production systems.
- Individual user accounts with unique credentials; shared accounts are not permitted on production systems.
- Regular access reviews conducted to revoke access for personnel who no longer require it.
ENCRYPTION
- All Personal Data is encrypted in transit using TLS 1.2 or higher.
- Personal Data stored in databases is encrypted at rest using industry-standard encryption (AES-256 or equivalent).
- Encryption keys are managed using industry-standard key management practices with appropriate separation of duties.
SYSTEM AND NETWORK SECURITY
- Firewalls, intrusion detection systems, and security monitoring tools are deployed to protect processing environments.
- Vulnerability assessments and penetration testing are conducted periodically.
- Security patches and updates are applied in accordance with a documented patch management policy.
- Production environments are logically separated from development and test environments.
DATA BACKUP AND RECOVERY
- Regular automated backups of all Personal Data are performed and tested periodically.
- Documented incident response and disaster recovery procedures are maintained.
- Recovery time and recovery point objectives are defined and reviewed regularly.
PERSONNEL MEASURES
- All personnel with access to Personal Data receive data protection training on appointment and regularly thereafter.
- All employees and contractors are bound by contractual confidentiality obligations.
- Background checks are conducted for roles with access to sensitive data, in accordance with applicable law.
INCIDENT MANAGEMENT
- A documented Personal Data Breach response procedure is maintained and tested.
- All security incidents are logged, investigated, and reported in accordance with this DPA and Applicable Data Protection Law.
SCHEDULE 3Authorised Sub-processors
The current list of authorised Sub-processors — identifying each provider, its processing purpose, primary processing location and applicable transfer safeguard — is published at anywaste.com/sub-processors and forms part of this Schedule.
AnyWaste will give not less than 30 days’ notice of any addition or change in accordance with clause 8.2. Customers may subscribe to receive change notices by email, and may request a copy of the current list at any time by contacting hello@anywaste.com.
SCHEDULE 4Contact Details
| Processor | AnyWaste Global Ltd |
| Registered address | 2 Victoria Hall, Coombe Lane, Axminster, Devon, EX13 5AX, United Kingdom |
| Company number | 13460286 |
| Privacy contact | hello@anywaste.com |
| Data Protection contact | Privacy Lead, hello@anywaste.com |
AnyWaste Global Ltd | Registered in England & Wales | anywaste.com | hello@anywaste.com
This document is published on the AnyWaste website and is updated from time to time. The version displayed on the website is always the current operative version.












