Privacy Policy
Last updated: 25 October 2026
1. Introduction
LoadLog ("we", "our", "us") is committed to protecting and respecting your privacy. This policy explains how we collect, use, disclose and safeguard your personal information when you use our website (loadlog.co.uk) and the LoadLog application (app.loadlog.co.uk), collectively referred to as the "Service".
This policy is issued by RDC IT Solutions Ltd, a company registered in England and Wales (company number 05362929), with its registered office at 128 City Road, London, EC1V 2NX. We are registered with the Information Commissioner's Office under registration number ZC133129. Where we collect and use account, billing and technical data to provide and administer the Service, RDC IT Solutions Ltd acts as the data controller. Where you use the Service to submit Waste Transfer Notes, carrier hub records, driver and vehicle records, uploaded documents or other compliance data containing personal data, you act as the data controller and RDC IT Solutions Ltd acts as a data processor on your instructions, as described in our Terms of Service. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Information We Collect
We may collect and process the following categories of personal data:
- Identity Data: Full name, organisation name, job title.
- Contact Data: Email address, business address, telephone number.
- Account Data: Username, password (hashed), account preferences, DEFRA API registration code, and the date and document version of your acceptance of our Terms of Service.
- Transaction Data: Details of your subscription plan, payment history and Direct Debit mandates processed via GoCardless.
- Technical Data: IP address, browser type and version, device information, time zone setting, operating system.
- Usage Data: Pages visited, features used, time spent on the Service, WTN submission activity, and usage counts for our free tools (the time of use, the referring page, the number of items, and a hash of the IP address that is regenerated each day).
- Waste Transfer Data: EWC codes, waste descriptions, vehicle registrations, carrier details, and digital signatures as required for DEFRA compliance.
- Carrier Hub Data: driver names, driver numbers, internal references, licence and document expiry dates, driver status, notes, uploaded document images (licences, certificates and other evidence), vehicle records, plant records and competence records.
3. How We Use Your Information
We use your personal data for the following purposes:
- To provide, maintain and improve the Service
- To process your subscription payments via GoCardless Direct Debit
- To submit Waste Transfer Notes to the DEFRA Digital Waste Tracking Service on your behalf
- To maintain carrier records, including drivers, vehicles, plant, competence and uploaded documents, and to send expiry reminders to the account administrator
- To produce inspection packs and exports that you request
- To communicate with you about your account, including service updates and support
- To comply with our legal obligations, including those under environmental regulations
- To detect and prevent fraud, unauthorised access and other misuse of the Service
- To send you information about LoadLog that may be of interest (with your consent where required)
4. Lawful Basis for Processing
Under UK GDPR, we rely on the following lawful bases: performance of a contract (providing the Service you signed up for), legal obligation (compliance with environmental and tax legislation), legitimate interests (improving our Service and securing our platform), and consent (where you have explicitly agreed to marketing communications).
Where we process carrier hub data as your processor, your lawful basis applies and we act on your instructions. We do not decide the purposes of that processing.
5. Data Storage and Security
Your data is held on servers provided by IONOS in the United Kingdom and a Supabase database in London (eu-west-2). Uploaded documents are stored with Cloudflare R2 in its EU jurisdiction. Support conversations are held with Chatwoot in the United States. Data is encrypted in transit using TLS and at rest using AES-256 encryption. Access to personal data is restricted to authorised personnel, and access to the site administration console requires multi-factor authentication.
We keep personal data only for as long as we need it. Carrier compliance records are kept for 6 years after the record is superseded. Uploaded document images are deleted 12 months after the expiry or removal of the driver or document. Account records are deleted 90 days after the export window closes. Financial and transaction records are kept for 6 years to meet legal obligations, including HMRC requirements. Audit log entries are kept for the period your organisation selects, between 6 and 24 months, and a small set of security and billing events is kept longer for our own records, hidden from your organisation view. The periods for each type of record are set out on our data processing page.
6. Data Sharing and Third Parties
We may share your data with the following categories of recipients:
- DEFRA: Waste Transfer Note data submitted via the Digital Waste Tracking Service API
- GoCardless: Payment processing and Direct Debit management (an independent data controller for payments)
- IONOS: Web hosting and cloud infrastructure
- Supabase: Database hosting and authentication
- Cloudflare: Document storage in its EU jurisdiction
- Resend: Transactional email delivery
- Chatwoot: Support chat
- Trustpilot: Review invitation emails for paying customers
- Google: Website analytics (Google Analytics), only where you have accepted analytics cookies
We do not sell your personal data. When you ask us to look up a vehicle, we send the registration mark to DVSA and receive the vehicle's details; DVSA does not receive your account details. We engage each processor on terms that include UK GDPR processor obligations and, where data leaves the UK, an appropriate transfer mechanism. Transfers within the UK and to the EU rely on the UK's adequacy regulations. Transfers to the United States rely on the UK-US data bridge or the International Data Transfer Addendum.
A current list of our sub-processors, the data each one sees and where it is stored is published on our data processing page.
7. Your Rights
Under UK data protection law, you have the right to:
- Request access to your personal data (subject access request)
- Request correction of inaccurate or incomplete data
- Request erasure of your personal data (right to be forgotten)
- Object to processing of your personal data
- Request restriction of processing
- Request data portability
- Withdraw consent at any time (where consent is the lawful basis)
To exercise any of these rights, please visit our contact page. We will respond within one calendar month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
9. Changes to This Policy
We may update this privacy policy from time to time. We will tell you about material changes by email or by a notice in the application before they take effect. When we publish an updated policy, we may ask you to review and accept it the next time you sign in, and we record the version you accepted and the date in your organisation's audit log. We encourage you to review this policy periodically.
10. Contact Us
If you have any questions about this privacy policy or our data protection practices, please contact us at:
Visit our contact page.
Data Protection Officer: Robin Calvert
RDC IT Solutions Ltd, Box 63, Elder House, 548-550 Elder Gate, Milton Keynes, MK9 1LR
We do not publish a direct email address or telephone number for data protection queries.
Registered office: 128 City Road, London, EC1V 2NX. Registered in England and Wales, company number 05362929. ICO registration ZC133129.