Privacy Policy

Because of the nature of our services, we handle personal data in two distinct ways.

We act as controller for the personal data of website visitors, enquirers, customer contacts, suppliers and other business contacts — for example the name, email address and telephone number of the person who books a collection.

Customers frequently ask us to collect, reuse, recycle or destroy equipment that still contains data relating to their employees, customers or other individuals. In that situation the customer is the controller and we act as their processor, working only on their documented instructions and within the agreed service scope.

In this role:

• we do not use data held on collected equipment for our own marketing or for any unrelated purpose;
• access is limited to what is necessary to perform the agreed service — identifying and auditing assets, securely erasing or physically destroying data-bearing media, preparing audit records and issuing certificates;
• our staff and approved subcontractors are bound by confidentiality obligations and vetting appropriate to the work;
• we enter into a written processing agreement meeting the requirements of Article 28 UK GDPR where one is required; and
• the customer remains responsible for making lawful arrangements for the equipment and for giving us the instructions we need.

Depending on how you interact with us, we may collect:

• Identity and business details — your name, job title, company or organisation, and the names of colleagues or site contacts you provide to us.
• Contact details — email address, telephone number, collection address, postcode and other correspondence details.
• Enquiry and booking information — equipment types and quantities, collection requirements, site access arrangements, preferred dates, quotation details and your communications with us.
• Service and account information — collection records, asset references, data destruction and recycling certificates, waste transfer and consignment documentation, invoices, payment status and account history.
• Marketing preferences — whether you wish to hear from us, and the topics and channels you prefer.
• Technical information — IP address, browser and device type, approximate location derived from IP address, pages viewed, referring pages, cookie identifiers and security logs.
• Information you choose to send us — messages, attachments, feedback and survey responses.

We do not seek special category data (such as health, ethnicity or biometric data) or criminal offence data through our website or general enquiry channels. Please do not send sensitive personal data through a general enquiry form. If you need to tell us something sensitive to arrange a service — for example an access requirement — contact us first so we can agree a secure method.

We obtain personal data:

• directly from you, when you complete a form, email or telephone us, request a quotation or book a service;
• from colleagues within your organisation who provide your details as a site or accounts contact;
• automatically, through cookies and similar technologies when you use our website; and
• from publicly available business sources, such as company websites, business directories and Companies House, where we are researching a potential business relationship.

We use personal data only where UK data protection law permits. The table below sets out our purposes and the lawful basis we rely on under Article 6 of the UK GDPR.

Where we rely on legitimate interests, those interests are running and developing our business, delivering and improving our services, keeping our website and operations secure, maintaining accurate records and recovering sums owed to us. We consider the impact on you before relying on this basis, and we do not rely on it where your rights and interests override our own.

Where we rely on legitimate interests, those interests are running and developing our business, delivering and improving our services, keeping our website and operations secure, maintaining accurate records and recovering sums owed to us. We consider the impact on you before relying on this basis, and we do not rely on it where your rights and interests override our own.

We send service communications — collection confirmations, certificates, invoices and important notices — where they are necessary to deliver the service or meet a legal obligation. These are not marketing and cannot be opted out of while a service or account is active.

We send marketing communications only where we have a lawful basis under the UK GDPR and the Privacy and Electronic Communications Regulations (PECR). In practice this means where you have asked to hear from us, or where you are an existing business customer receiving information about similar services and were given the opportunity to opt out.

You can unsubscribe at any time using the link in any marketing message, or by emailing info@computeritdisposals.co.uk. If you unsubscribe we keep a minimal record of your request so that we can honour it.

Cookies are small files, or similar technologies such as pixels and local storage, placed on or read from your device. We use them to keep the website working, remember your choices, understand how the site performs and, where permitted, to measure and improve our marketing.

We use the following categories:

• Strictly necessary — required to deliver a service you have requested, including security, form submission and anti-spam. These do not require consent.
• Analytics and performance — help us understand how visitors use the site so we can improve it. Set only with your consent.
• Advertising and marketing — used to measure campaign performance and, where applicable, show relevant advertising. Set only with your consent.

We ask for consent before setting non-essential cookies, and you can change or withdraw your choices at any time.

Our website may load third-party services, including Google Tag Manager and Google Analytics, Google Maps and anti-spam tools such as reCAPTCHA. These services may process technical information when their features load.

We do not sell personal data. We share the minimum information necessary with:

• Service providers supporting our website, hosting, email, IT security, form delivery, analytics, customer administration, accounting, payment processing, transport, recycling and certificate production.
• Subcontractors and operational partners who help us collect, transport, process or document equipment, where this is necessary to deliver the agreed service.
• Downstream treatment and recycling facilities and, where required, regulators such as the Environment Agency, in connection with waste documentation and duty-of-care obligations.
• Professional advisers, insurers, auditors, certification bodies, law-enforcement bodies or courts where disclosure is necessary or legally required.
• A buyer, investor or successor in connection with a business sale, restructuring or transfer, subject to appropriate confidentiality and legal safeguards.

Where a supplier processes personal data on our behalf, we put a written contract in place requiring it to act only on our instructions, keep the data confidential and secure, and meet applicable data-protection requirements. We do not permit suppliers to use your information for their own unrelated marketing.

We keep personal data only for as long as necessary for the purpose for which it was collected, to deliver services, resolve disputes, meet legal, tax and accounting requirements, maintain reliable business records and protect our legal rights. Our standard retention periods are:

Records may be deleted sooner where they are no longer needed, or kept longer where a legal claim, investigation, regulatory request or statutory requirement makes this necessary. When personal data is no longer required we delete it or securely anonymise it.

Personal data held on customer equipment as a processor is handled according to the agreed service — typically erased or destroyed at the point of processing — and is not retained by us beyond the records needed to evidence the work.

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. These measures include access controls and authentication, encrypted transmission, secure premises and controlled handling of equipment, staff vetting and confidentiality obligations, training, supplier due diligence, backups and secure disposal.

Data destruction is carried out to recognised industry standards, and destruction methods are confirmed in the certificate issued for each job.

No method of internet transmission or electronic storage can be guaranteed to be completely secure. We maintain procedures to identify, investigate and, where required, report personal data breaches to the Information Commissioner’s Office and to affected individuals.

Subject to the conditions and exemptions in UK data protection law, you have the right to:

• Access — obtain a copy of the personal data we hold about you and information about how we use it.
• Rectification — have incomplete or inaccurate information corrected.
• Erasure — have information deleted where there is no good reason for us to continue holding it.
• Restriction — limit how we use information while an issue is being checked.
• Portability — receive certain information in a structured, commonly used, machine-readable format.
• Object — object to processing based on legitimate interests. You have an absolute right to object to direct marketing.
• Withdraw consent — where our processing relies on consent, withdraw it at any time. This does not affect processing carried out before withdrawal.

To exercise a right, email info@computeritdisposals.co.uk or write to us at the address mentioned below. We may need to verify your identity before we respond. We will respond within one month, although the law allows us to extend this by up to two further months for complex or repeated requests — we will tell you if that applies.

There is normally no charge. We may charge a reasonable fee, or refuse a request, where the law permits because the request is manifestly unfounded or excessive.

If your request relates to data held on equipment we handled for one of our customers, we will refer you to that customer, who is the controller for that data, and we will support them in responding.

If you are unhappy with how we have handled your personal data, please contact us first so we can investigate and try to put things right.

You also have the right to complain to the UK Information Commissioner’s Office (ICO), the supervisory authority for data protection in the United Kingdom:

Contacting us first does not affect your right to complain to the ICO at any time.

Our website and services are intended for businesses and organisations, not children. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, please contact us so that we can review and delete it where appropriate.

Our website contains links to external websites, including certification bodies, mapping services, social media and partner sites. We are not responsible for the privacy practices, content or security of those websites. Please read their privacy notices before providing personal data to them.

We may update this policy when our services, technology or legal obligations change. The current version is always published here with a revised version number and effective date, shown in the document control panel at the top of this page. Where a change is material, we will notify affected customers and contacts through an appropriate channel.

If you have a privacy question, wish to exercise a right, or want to update your communication preferences, contact us: