# WasteStart Mobile - Privacy Policy

**Last updated:** 22 June 2026

## 1. About this policy

This policy explains how the **WasteStart Mobile** app ("the app") handles
personal data. It applies to drivers and field staff who use the app to carry
out collection rounds for a waste or recycling operator.

The app is published by **Waste Start Limited** ("WasteStart", "we", "us"), a
company registered in **Ireland** (Company No. 788567) with its registered
office at **Unit 6e, Nutgrove Office Park, Rathfarnham, Dublin 14, D14 A0X2,
Ireland**.

**Who controls your data.** WasteStart Mobile is a workforce app. The operator
that employs you (your "employer") decides what work data is collected and why,
and is the **data controller** for that data. WasteStart acts as a **data
processor** on the employer's behalf for the operational data described below,
and as a **controller** only for the limited data needed to run and support the
app itself (e.g. your account and support correspondence). If you want to
exercise your data-protection rights over your work data, your employer is the
first point of contact — see [Section 9](#9-your-rights).

## 2. Data we collect

We only collect data needed to run the app and carry out your work.

| Data | Examples | Why |
|------|----------|-----|
| **Account details** | Name, email address, organisation/employee identifiers | Sign you in and show your account |
| **Precise location** | GPS position while you navigate; your location while you have an active schedule and the app is open | Calculate and follow HGV-safe routes, and show your dispatcher where the round is |
| **Photos** | Images you attach to an issue report | Tell the back office about a problem on site |
| **Work data** | Schedules, jobs, statuses, weighbridge weights, issue reasons and notes you enter | Run your collection round and keep the office up to date |
| **Technical data** | App version, device/OS, a push-notification (FCM) token, diagnostic logs | Deliver notifications, keep the app working and support you |

We do **not** collect data from children, and the app is not directed at anyone
under 18 (see [Section 11](#11-children)).

> **How your location is used.** There are three distinct flows:
> 1. **On-device navigation** — your GPS position drives turn-by-turn guidance on
>    the device.
> 2. **Routing (HERE)** — when you navigate online, your location and destination
>    are sent to our mapping provider, HERE Technologies, to calculate the route.
>    Offline maps run on your device with no such request.
> 3. **Dispatcher visibility** — while you have an active schedule and the app is
>    open, it sends your location to WasteStart roughly every 30 seconds so your
>    employer's office can see where the round is. This is a periodic snapshot,
>    not continuous second-by-second tracking; it pauses when the app is in the
>    background and stops when no schedule is active.

## 3. How we use your data

We use the data above to:

- authenticate you and maintain your session;
- show your daily schedule and jobs, and record updates you make;
- calculate and provide HGV-safe turn-by-turn navigation, online and offline;
- let you report on-site issues with notes and photos;
- store changes on your device and sync them with the office when you have a
  connection (offline-first operation);
- send operational notifications;
- diagnose problems and provide support.

**Lawful bases (UK GDPR / EU GDPR).** Processing is carried out on the basis of
**performance of a contract** (with your employer / providing the service),
**legitimate interests** (running, securing and improving the service), and
**legal obligation** where applicable. Your employer determines the lawful basis
for the work data it controls.

## 4. Who we share it with

We do not sell your personal data. We share it only with:

- **Your employer** — the operator you work for, who sees your job updates,
  issue reports, related work data, and your location while you have an active
  schedule (see [Section 2](#2-data-we-collect)).
- **HERE Technologies** — our maps and routing provider. When you navigate
  online, route requests (including your location and destination) are processed
  by HERE, as an independent controller under its own privacy terms, to
  calculate a route. Offline maps run entirely on your device with no such
  request.
- **Google / Firebase** — solely for operational push notifications via Firebase
  Cloud Messaging. Delivering a notification requires sending a device
  registration token to Google. We do **not** use Firebase Analytics, Firebase
  Crashlytics, or any other analytics or crash-reporting service.
- **Service providers** acting on our instructions (e.g. hosting), under
  contract.
- **Authorities or third parties** where required by law, or to protect our
  rights, safety, or the integrity of the service.

## 5. International transfers

Where data is processed outside the UK/EEA, we rely on appropriate safeguards
(the UK International Data Transfer Agreement / EU Standard Contractual
Clauses, or an adequacy decision).

## 6. How long we keep it

- **Account data:** for as long as your account is active, then deleted or
  anonymised within 30 days of deactivation.
- **Work data:** retained under your employer's retention policy (they are the
  controller).
- **Location:** used transiently for navigation and not retained as a history on
  the device. The positions sent for dispatcher visibility are handled under your
  employer's retention policy (they are the controller for that data); where
  WasteStart stores them on the employer's behalf, they are not retained longer
  than 90 days.
- **Diagnostic logs:** 90 days.

## 7. How we protect it

- Data in transit is encrypted with **HTTPS/TLS**.
- Your authentication token is held in the device's **secure storage**
  (Android Keystore).
- Cached work data is stored locally on your device so the app works offline.
  Signing out clears it: all cached schedules, jobs, drafts, queued changes and
  attached photos are deleted from the device, and your authentication token is
  removed from secure storage.
- Access to back-office systems is restricted and authenticated.

## 8. Permissions the app requests

| Permission | Why |
|------------|-----|
| Location (precise/approximate) | HGV-safe navigation and routing |
| Camera | Attach photos to issue reports |
| Notifications | Operational alerts |
| Network/Internet | Sync with the office and fetch maps/routes |
| Foreground service | Keep navigation running while you drive |

You can change permissions in your device settings; some features won't work
without them (e.g. navigation needs location).

## 9. Your rights

Under UK GDPR / EU GDPR you have the right to access, rectify, erase, restrict,
or object to processing of your personal data, and to data portability.

Because your employer is the controller of your work data, **please contact your
employer first** to exercise these rights. For app-account or support data that
WasteStart controls, contact us at **support@wastestart.com**.

You also have the right to complain to your data-protection supervisory
authority. WasteStart is established in Ireland, so its lead authority is the
**Data Protection Commission** (Ireland, <https://www.dataprotection.ie>). If you
are in the UK, you may instead contact the **Information Commissioner's Office
(ICO)** (<https://ico.org.uk>).

## 10. Deleting your account and data

Accounts are provisioned by your employer; you cannot create one yourself within
the app. To request deletion of your account and associated personal data,
contact your employer or email **support@wastestart.com**. We will action
verified requests within 30 days, subject to any legal retention
obligations. Signing out of the app immediately clears all your data held on the
device (see [Section 7](#7-how-we-protect-it)).

## 11. Children

WasteStart Mobile is a workplace tool intended for employed drivers aged 18 or
over. It is not directed at, and we do not knowingly collect data from,
children.

## 12. Changes to this policy

We may update this policy from time to time. We will post the updated version
here and change the "Last updated" date. Material changes will be communicated
through your employer or in the app.

## 13. Contact

- **Data/privacy enquiries:** support@wastestart.com
- **Support:** support@wastestart.com
- **Postal:** Waste Start Limited, Unit 6e, Nutgrove Office Park, Rathfarnham, Dublin 14, D14 A0X2, Ireland
- **Data Protection Officer:** none currently appointed. **ICO registration:** N/A — WasteStart is an Irish entity; its lead supervisory authority is the Data Protection Commission (Ireland).