Data processing and sub-processors
Last updated 25 October 2026
This page explains what happens to personal data when you use LoadLog. It is written for the people who ask the detailed questions: a data protection lead, a procurement team, or a customer who needs a data processing agreement before they can sign.
It sits alongside our Privacy Policy and Terms of Service. Where the two differ about processing on your behalf, this page is the summary and the Terms are the contract.
Who is responsible for what
The first question is always who the controller is.
| Data | Controller | LoadLog's role |
|---|---|---|
| Waste Transfer Notes, load records and digital signatures | You, the site | Processor |
| Carrier hub records: drivers, vehicles, plant, competence and uploaded documents | You, the carrier | Processor |
| Your account, users, billing and support conversations | LoadLog | Controller |
| Security and audit logs | LoadLog | Controller |
If you are a waste site, you are the controller for your loads and for any carrier records you keep. If you are a carrier, you are the controller for your drivers' records. We act on your instructions, and we do not sell your data or use it for advertising.
What we hold on your behalf
- Waste Transfer Notes: EWC codes, waste descriptions, quantities, containment, carrier and vehicle details, signatures.
- Carrier records: driver names, driver numbers, internal references, licence and document expiry dates, notes, and the status of each driver.
- Uploaded documents: images and PDFs of licences, certificates and other evidence, with their type, reference, expiry and a checksum.
- Vehicle records: registration, vehicle type, insurance and test dates, and DVSA vehicle attributes where a lookup has been run.
- Competence records: scheme, membership number and expiry.
- User records: name, email, role and the audit entries those users create.
Where it is stored
| Component | Provider | Location |
|---|---|---|
| Application hosting | IONOS | United Kingdom |
| Database and authentication | Supabase | London (eu-west-2) |
| Document storage | Cloudflare R2, EU jurisdiction | European Union |
| Transactional email | Resend | United States |
| Direct Debit | GoCardless | United Kingdom and European Union |
| Support chat | Chatwoot | United States |
| Website analytics | Google Analytics | United States |
Database and application data stay in the United Kingdom. Uploaded documents are held in Cloudflare's EU jurisdiction. Transfers within the UK and to the EU rely on the UK's adequacy regulations. Transfers to the United States rely on the UK-US data bridge or the International Data Transfer Addendum, depending on the provider.
Sub-processors
These are the third parties that process personal data for us, and what each one sees.
| Provider | Purpose | Personal data | Location |
|---|---|---|---|
| Supabase | Database, authentication, file metadata | All data held in the Service | London, UK |
| IONOS | Application hosting | All data held in the Service | UK |
| Cloudflare | Document storage (R2), CDN and security | Uploaded document images | EU |
| Resend | Transactional email | Name, email address, email content | US |
| Chatwoot | Support chat | Name, email, conversation content | US |
| Website analytics, only where you accept analytics cookies | IP address, device, pages viewed | US | |
| Trustpilot | Review invitations for paying customers | Name, email, site name | EU and UK |
We keep each provider on its standard data processing terms, which include the UK GDPR processor obligations. We do not add a provider that needs your data for its own purposes.
GoCardless is not a sub-processor. It collects Direct Debit payments as an independent data controller, so its use of payer data is governed by its own merchant terms and privacy notice rather than by a processor agreement with LoadLog.
Regulators and public services
Some data has to go to a public body because the law requires it, or because you have asked us to check something.
| Recipient | What is sent | Why |
|---|---|---|
| DEFRA Digital Waste Tracking Service | Waste Transfer Note data | Statutory submission |
| DVSA | Vehicle registration mark | Vehicle details lookup at your request |
These are not sub-processors. They are the recipients the Service exists to talk to.
Security
- Data is encrypted in transit with TLS, and at rest by Supabase and Cloudflare.
- Uploaded documents sit in a private bucket. They are never public. Each view is a signed link that expires after five minutes.
- Access is scoped to your organisation, checked by role on the server, and enforced again by row level security in the database.
- Access to the site administration console requires multi-factor authentication.
- Sensitive actions, including exports and document downloads, are recorded in an audit log.
- Database backups are managed by Supabase.
How long we keep it
| Record | Retention |
|---|---|
| Carrier compliance records (drivers, vehicles, plant, competence) | 6 years after the record is superseded, then deleted or anonymised |
| Uploaded document images | 12 months after expiry or removal of the driver or document |
| Driver numbers | Kept permanently so a number is never reused. When a driver is removed, the name, notes and internal reference are pseudonymised |
| Account and user records | Life of the account, then deleted 90 days after the export window closes |
| Invoices and payment records | 6 years |
| Audit log entries | Your organisation chooses 6, 12, 18 or 24 months. Security and billing events are kept longer for our own records, hidden from your organisation view |
The full detail is in our Privacy Policy.
Your rights, and the requests we handle for you
If a driver, employee or contact asks you for their data, you can pass the request to us and we will help you answer it inside the statutory month. If you ask us to, we will handle it on your behalf. We will not answer a request about your data directly without your instruction, unless the law requires us to.
If a personal data breach affects your data, we will tell you without undue delay and give you what you need to meet your own obligations, including the 72 hour deadline for notifying the ICO where it applies.
When your account ends you get a 30 day export window in CSV and PDF. After that, data is deleted on the schedule above, except financial records, which we must keep for 6 years.
Need a signed DPA?
Many customers need a data processing agreement on file before they can use the Service. Ask through the contact form and we will send our standard DPA for signature, or review the one your organisation uses.
Data Protection Officer: Robin Calvert
RDC IT Solutions Ltd, Box 63, Elder House, 548-550 Elder Gate, Milton Keynes, MK9 1LR
Or use the contact form. We do not publish a direct email address or telephone number for data protection
queries.
Changes to this page
Last updated 25 October 2026. We will update this page when a sub-processor, a storage location or a retention period changes, and we will give notice before a new sub-processor starts processing your data.