Privacy Policy

Last updated: 30 April 2026

Version: 2.0 (replaces all previous versions)

The Waste Group Limited (“we”, “us”, “our”) understands that your privacy is important to you and that you care about how your personal data is used. We respect and value the privacy of all of our customers and visitors and will only collect and use personal data in ways that are described in this Privacy Policy, and in a way that is consistent with our obligations and your rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR).

This Privacy Policy was last updated on 30 April 2026 to reflect changes in our payment processing arrangements, online ordering systems, marketing tools, and cookie management practices. It supersedes all previous versions of our Privacy Policy.

1.0 Information About Us

The Waste Group Limited is a private limited company registered in England and Wales under company number 08520953. Our registered office is:

The Waste Group Limited
22 Ringwood Road
Longham
Ferndown
Dorset
BH22 9AN

We are the data controller responsible for your personal data within the meaning of UK GDPR.

We are not legally required to appoint a Data Protection Officer, but we have designated a member of staff with responsibility for data protection. For any data protection enquiries, including subject access requests, please contact:

Data Protection Lead
The Waste Group Limited
22 Ringwood Road
Longham, Ferndown
Dorset, BH22 9AN

Email: orders@thewastegroup.co.uk

2.0 What Does This Notice Cover?

This Privacy Policy explains how we use your personal data: how it is collected, how it is held, how it is processed, how long we keep it, who we share it with, and what your rights are. It applies to:

• Our website, www.thewastegroup.co.uk, including all subpages and online services accessed through it.
• Our online ordering system (powered by WooCommerce) where customers can book and pay for skip hire and related services.
• Our quote request forms (skip hire, asbestos disposal, contact).
• Our customer service and operational interactions following an order or enquiry.
• Our marketing communications, where you have opted in to receive them.

This Privacy Policy does not apply to third-party websites that we may link to from our website. Those sites have their own privacy policies and we encourage you to read them.

3.0 What is Personal Data?

Personal data is defined by the UK GDPR and the Data Protection Act 2018 as “any information relating to an identified or identifiable natural person”. In simpler terms, personal data is any information about you that enables you to be identified, either directly or indirectly.

Personal data includes obvious information such as your name, address, email address, and telephone number. It also includes less obvious information such as IP addresses, cookie identifiers, online identifiers, and location data — even when these are not directly tied to your name.

The specific categories of personal data we collect are set out in Section 5.0 below.

4.0 What Are My Rights?

Under the UK GDPR, you have the following rights, which we will always work to uphold:

• Right to be informed — You have the right to know how we collect and use your personal data; this Privacy Policy is part of how we honour that right.
• Right of access — You can ask us for a copy of all personal data we hold about you (a “subject access request”).
• Right to rectification — If any data we hold about you is inaccurate or incomplete, you can ask us to correct it.
• Right to erasure — Also called “the right to be forgotten” — you can ask us to delete personal data we hold about you, subject to certain exceptions (such as data we are legally required to keep).
• Right to restrict processing — You can ask us to limit how we use your personal data.
• Right to data portability — You can ask for a copy of your data in a structured, machine-readable format so you can take it to another provider.
• Right to object — You can object to us using your data for particular purposes, including direct marketing — which you can opt out of at any time.
• Rights related to automated decision-making — We do not use your personal data for automated decision-making or profiling.
• Right to withdraw consent — Where we rely on your consent (for example, marketing emails or non-essential cookies), you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint — You can complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection — see ico.org.uk.

Further information about your rights can be obtained from the Information Commissioner’s Office (ICO) at ico.org.uk, or your local Citizens Advice Bureau. To exercise any of these rights, please contact us using the details in Section 11.0.

5.0 What Personal Data Do You Collect?

We may collect some or all of the following personal data, depending on which of our services you use and how you interact with us:

Identity and contact data: name, email address, telephone number, billing address, delivery address.

Order and transaction data: details of skip hire and other services you have ordered, order history, delivery dates, site access requirements, special instructions, invoice details.

Payment data: when you place an order through our website, payment is processed by Stripe (Stripe Payments UK Ltd). We do not store your full card details on our systems — Stripe processes and stores cardholder data on our behalf in accordance with PCI DSS standards. We retain a record of the transaction (amount, date, last four digits of card, payment confirmation) for our financial records.

Abandoned cart data: if you start a checkout but do not complete it, our cart recovery system (CartBounty Pro) may capture the email address and contact details you have entered, along with the contents of your basket, so that we can send you a reminder to complete your order. You can opt out of this at the checkout, and we delete this data after 30 days if the cart is not converted to an order.

Marketing data: if you subscribe to our marketing emails, we collect your email address, name, and your communication preferences. We use Mailchimp to manage marketing communications (see Section 9.0).

Website usage data: when you visit our website, we automatically collect technical information including your IP address (which we anonymise), browser type, device type, the pages you visit, and how you interact with the site. We use this data to improve our website and services. See Section 12.0 for details on cookies and tracking.

Communications data: records of correspondence between you and us, including emails, telephone calls (where notified), and messages submitted via our website.

Job application data: if you apply for a role with us, we collect your CV, cover letter, employment history, references, and any other information you provide as part of your application.

6.0 How Do You Use My Personal Data?

Under the UK GDPR we must always have a lawful basis for using personal data. The lawful bases we rely on include:

Performance of a contract — where we need to process your data to fulfil an order, deliver a skip, provide a quote, or otherwise perform our obligations to you.

Legitimate interests — where we have a legitimate business reason to process your data, such as improving our services, preventing fraud, securing our systems, or contacting you about an order in progress. We always balance our legitimate interests against your rights and interests.

Consent — where you have actively opted in, such as subscribing to marketing emails or accepting non-essential cookies. You can withdraw your consent at any time.

Legal obligation — where we are legally required to process data, such as retaining financial records for HMRC purposes.

Specifically, your personal data will be used for one or more of the following purposes:

• Processing skip hire orders and other service bookings placed via our website, by phone, or by email.
• Taking and processing payment for orders, via Stripe.
• Managing your customer account and order history.
• Communicating with you about your order, delivery, collection, or enquiry.
• Sending you abandoned-cart recovery emails (where you have entered your email at checkout but not completed the order) — you can opt out at checkout.
• Sending you marketing communications about our services, where you have opted in. You can unsubscribe at any time using the link in any marketing email.
• Responding to enquiries, quote requests, and customer support questions.
• Improving our website, products, and services using anonymised analytics data.
• Verifying your identity for security purposes.
• Preventing fraud, securing our systems, and detecting misuse.
• Complying with our legal and regulatory obligations, including waste-carrier record-keeping requirements under the Environmental Protection Act 1990.
• Processing job applications and managing recruitment.
• Defending or pursuing legal claims.

We will not send you marketing communications unless you have opted in to receive them, and we will always provide a clear unsubscribe option in every marketing email. Your decision to opt out of marketing will not affect the service we provide to you in any other way.

7.0 How Long Will You Keep My Personal Data?

We will not keep your personal data for any longer than is necessary in light of the reasons for which it was first collected. The following retention periods apply:

• Contact form submissions — three months from receipt.
• Skip hire customer records (orders, accounts) — two years from your last order or account login.
• Online order records (WooCommerce) — six years (financial record-keeping requirement).
• Abandoned cart data (CartBounty Pro) — thirty days from cart abandonment, then deleted unless converted to an order.
• Marketing list subscriptions (Mailchimp) — until you unsubscribe, after which we retain only the unsubscribe record.
• Job applications — end of recruitment process, plus six months for unsuccessful candidates.
• Financial transaction records (anonymised) — six years from the end of the relevant financial year (HMRC requirement).
• Cookie consent records (Complianz) — twelve months from consent given, or until withdrawal.
• Customer support emails — two years from last interaction.
• Website analytics data (anonymised) — fourteen months (Google Analytics default).

At the end of the applicable retention period, your personal data will be securely deleted or fully anonymised so that it can no longer be linked to you.

8.0 How and Where Do You Store or Transfer My Personal Data?

Your personal data is primarily stored in the United Kingdom. Our website hosting, customer database, and operational systems are all UK-based.

However, some of our service providers (data processors) are based outside the UK or operate global infrastructure. Specifically:

Mailchimp (operated by The Rocket Science Group LLC, a US company): we use Mailchimp to manage and send marketing emails. Personal data of subscribers is stored on Mailchimp’s US-based servers. Transfers to the US are protected by Standard Contractual Clauses approved by the UK government and by Mailchimp’s certification under the EU-US Data Privacy Framework where applicable.

Google (Analytics, Tag Manager, and any advertising products): Google operates global infrastructure. We anonymise IP addresses where technically possible. Transfers are protected by Standard Contractual Clauses.

Stripe (Stripe Payments UK Ltd): primarily processes payment data in the UK and EU. Limited international processing may occur for fraud prevention, secured by Standard Contractual Clauses.

Hotjar (Hotjar Ltd, Malta): user behaviour analytics processed within the European Union.

In all cases where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses, adequacy decisions, or other legally recognised transfer mechanisms.

The security of your personal data is essential to us. We take a number of important measures including:

• Encryption of data in transit (HTTPS / TLS) and at rest where appropriate.
• Restricted access to customer data on a need-to-know basis.
• Strong password and access control policies.
• Regular security updates of our systems and plugins.
• PCI DSS compliance for payment processing (handled by Stripe).
• Secure deletion of paper records and digital data at end of retention.
• Staff training on data protection responsibilities.

9.0 Do You Share My Personal Data?

We do not sell your personal data to third parties. We do, however, share certain personal data with trusted service providers (“data processors”) who help us deliver our services. These processors only act on our instructions and are bound by contractual data protection obligations.

The current data processors we share personal data with are:

• Stripe Payments UK Ltd — processes online payments. Receives cardholder name, billing address, payment card details, and transaction amount. Primarily UK-based with limited international processing for fraud prevention.
• CartBounty Pro (Streamline) — supports recovery of abandoned shopping carts. Receives email address, name, telephone, basket contents, and abandonment timestamp. Stored on our UK-hosted WordPress database.
• Mailchimp (The Rocket Science Group LLC) — sends marketing emails to subscribers. Receives email address, name, marketing preferences, and engagement data (opens, clicks). US-hosted with Standard Contractual Clauses in place.
• Google LLC (Analytics, Tag Manager, Ads) — provides website analytics, tag management, and advertising measurement. Receives anonymised usage data, cookie identifiers, anonymised IP address, and conversion events. US and global infrastructure with Standard Contractual Clauses.
• Hotjar Ltd — provides user behaviour analytics including session recordings and heatmaps. Receives anonymised browsing behaviour and screen interactions, with all personally identifiable input field data suppressed. Hosted in Malta / European Union.
• Complianz BV (Iubenda) — manages cookie consent and consent record-keeping. Receives consent choices, anonymised consent identifiers, and timestamps. Hosted in the Netherlands / European Union.
• WooCommerce (Automattic Inc.) — provides the e-commerce platform powering our online ordering. Order details, customer name, delivery address, and contact details are stored on our UK-hosted WordPress database.
• Email service providers — used to send transactional emails such as order confirmations and quote responses. Receives email address, name, and message content. Hosting location varies by provider, primarily UK/EU.

In addition to the processors above, there are limited circumstances in which we may share personal data without your consent:

• Where we are legally required to do so by a court order, regulatory authority, or law enforcement request.
• Where required to comply with our obligations as a licensed waste carrier (Environment Agency reporting).
• Where required to defend our legal rights or those of a third party.
• In the event of a sale, merger, or restructuring of our business — in which case any successor entity will be bound by this Privacy Policy.

After completing an order, you may also be contacted by us (or by an automated review-request service operating on our behalf) to ask for feedback on our services. You can opt out of these requests at any time.

10.0 How Can I Access My Personal Data?

If you want to know what personal data we hold about you, you can submit a subject access request. This is free of charge in most cases. To submit a request, contact our Data Protection Lead using the details in Section 11.0.

If your request is “manifestly unfounded or excessive” (for example, repeated identical requests), we may charge a reasonable administrative fee, or refuse to act on the request. We will explain our reasons if this is the case.

We will respond to your subject access request within one calendar month of receiving it. For complex or multiple requests, we may extend this by up to two further months and will let you know if this is the case.

You may also exercise any of the other rights described in Section 4.0 by contacting us using the same details.

11.0 How Do I Contact You?

To contact us about anything to do with your personal data and data protection, including to make a subject access request, please use the following details:

Data Protection Lead
The Waste Group Limited
22 Ringwood Road
Longham, Ferndown
Dorset, BH22 9AN

Email: orders@thewastegroup.co.uk
Telephone: 0800 652 0160 (freephone)

If you are not satisfied with how we have handled your data or a complaint, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow, Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

12.0 Cookies and Similar Technologies

Cookies are small text files that are placed on your device when you visit a website. We use cookies and similar tracking technologies to make our website work, to understand how visitors use our site, to remember your preferences, and (where you have consented) to deliver relevant marketing.

When you first visit our website you will see a cookie consent banner (managed by Complianz) which lets you choose which categories of cookies to accept. You can change your preferences at any time by clicking the cookie settings link in the website footer.

We categorise our cookies as follows:

Strictly necessary cookies — required for the website to function and for you to use core features such as the shopping basket, checkout, and login. These cannot be turned off in our systems and we do not require your consent for them under UK PECR.

Statistics / analytics cookies — help us understand how visitors interact with our website by collecting anonymised information. We use these via Google Analytics 4 and Hotjar. These require your consent.

Marketing cookies — used to track visitors across websites and to display relevant advertising. These include Google Ads cookies and conversion tracking. These require your consent.

Functional cookies — remember your preferences (such as cookie consent itself, or items in your basket between visits).

If you reject non-essential cookies, you can still browse and order from our website. The shopping basket and checkout work using strictly necessary cookies only.

A complete and up-to-date list of every cookie used on our website, including the third party that sets it, the data collected, and the retention period, is available in our Cookie Policy (linked from the footer of every page) and in the cookie preferences panel accessible via the cookie settings link.

If you would prefer to manage cookies at the browser level, most modern web browsers allow you to (1) be notified when a cookie is set, (2) view existing cookies, (3) delete cookies, or (4) block all cookies. The exact steps differ by browser — please consult your browser’s help documentation.

Please note that cookies cannot harm your computer, and we do not store personally identifiable information such as full payment card details in any cookies we set.

13.0 Children’s Privacy

Our services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data without verifiable parental consent, please contact us using the details in Section 11.0 and we will take steps to delete the information.

14.0 Marketing and Advertising

We use the following marketing and advertising tools, where you have given the relevant consent:

Google Analytics 4: for understanding how visitors use our website. We use IP anonymisation and do not allow Google to use this data for its own purposes.

Google Tag Manager: to manage tracking tags on our website in a centralised way.

Google Ads conversion tracking: where we run paid advertising campaigns, we measure which adverts lead to enquiries or orders. This relies on Google Consent Mode v2 — no advertising data is collected unless you have accepted marketing cookies.

Mailchimp: for sending email newsletters and marketing communications to subscribers. You can unsubscribe at any time using the link in every marketing email, or by contacting us directly.

Hotjar: for understanding website usability through anonymised session recordings and heatmaps. We have configured Hotjar to suppress all keystrokes and form input, so personal data entered into forms is never captured.

Cart recovery emails: if you start a checkout and provide your email address but do not complete the order, we may send up to two reminder emails. Each contains a clear opt-out link, and you can prevent these from being sent at all by opting out at the checkout itself.

You can manage all marketing-cookie-based tracking via the cookie consent banner on our website.

You can manage email marketing preferences by using the unsubscribe link in any marketing email or by contacting us using the details in Section 11.0.

15.0 Third-Party Links

Occasionally, we may include links to third-party websites, products, or services on our website (for example, links to industry bodies, regulatory authorities, or partner organisations). These third-party sites have their own privacy policies, and we have no responsibility or liability for the content, activities, or privacy practices of those sites. We encourage you to read their privacy policies before submitting any personal data to them.

16.0 Data Breaches

We take the security of your personal data very seriously. In the unlikely event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours of becoming aware of it, in accordance with our obligations under UK GDPR.

Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay.

17.0 Changes to This Privacy Policy

We may change this Privacy Policy from time to time. This may be necessary, for example, if the law changes, if we change our business in a way that affects personal data protection, or if we add or remove service providers.

Any material changes will be communicated to active customers and marketing subscribers by email. Minor changes will be made available via this page. The “Last updated” date at the top of this Privacy Policy will always reflect the most recent version. We encourage you to review this Privacy Policy periodically.