Privacy policy

Who we are

Laser Waste Ltd is a company registered in England and Wales, trading as Laser Waste.

We are the data controller for the personal data described in this notice, which means we decide what is collected and why.

This notice covers the personal data we collect through this website.

What we collect through the enquiry form

Only what you type, plus the small amount of context described at the end of this list.

• Your name, your organisation, and your email address or phone number.
• If you booked a slot, the date and time you chose; otherwise the fact that you asked to be called at the first opportunity.
• The collection postcode, the waste streams you selected, the alloys, the approximate quantity, whether the collection is one-off or ongoing, and anything you wrote in the message box.
• The names, file types and sizes of any photographs or safety data sheets you attached. The files themselves are not stored in our database — they are sent to us as attachments on the alert email and live in that mailbox.
• Whether you asked for marketing updates. This is recorded separately from your agreement that we may reply to you, and one is never taken as the other.
• The page you submitted from. We need this to know which part of the site produced an enquiry we have to answer.
• The site that referred you and any campaign parameters in the link you followed — only if you turned analytics on in the cookie panel. If you declined, or never chose, none of it is read and all of it reaches us empty.
• Your IP address and the time you submitted, recorded as evidence of the agreement you gave and kept for as long as the enquiry itself.

We ask for four things and treat the rest as optional. We do not use tracking pixels in our emails, and we do not buy personal data from anyone.

Our lawful basis for each purpose

• Replying to your enquiry, and keeping a record of it — legitimate interests (UK GDPR Article 6(1)(f)). You approached us about a business matter and a reply is what you asked for. We judge that you would reasonably expect this, that it cannot be done with less data, and that it does not override your interests. You can object at any time.
• Marketing updates — consent (Article 6(1)(a)), given by ticking a box that is never pre-ticked, and withdrawable in one click in every message we send.
• Analytics cookies — consent, under regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003. See our cookie policy.
• Keeping records the law requires us to keep — legal obligation (Article 6(1)(c)). Waste documentation must be retained under the Environmental Protection Act 1990 and the hazardous waste regulations, and identity records under the Scrap Metal Dealers Act 2013.

We do not ask for, and ask that you do not send us, any special category data. Nothing in the enquiry form calls for it.

How long we keep it

Enquiries are deleted 24 months after they are submitted. Every record carries the date it is due for deletion, and a scheduled job removes those that have reached it, so this happens whether or not anyone remembers.

When a record is deleted we keep proof that the deletion happened — its reference, the dates involved, and a one-way hash of the organisation name so we can still count repeat enquirers. None of that identifies you, and it cannot be reversed to recover what was deleted.

Records the law requires us to keep are a separate matter, and are held for their own statutory periods — three years for hazardous waste consignment notes, two for ordinary waste transfer notes, and six years for accounting records.

We chose 24 months because an enquirer who did not proceed often comes back within two years, and the record is what tells us what we discussed. No statute sets this period; UK GDPR requires only that we keep data no longer than necessary, and this is our judgement of that.

Who else sees it

We do not sell your data and we do not share it for anyone else's marketing. It reaches these suppliers only because they run parts of the service:

• Resend — delivers our email. Your enquiry passes through it, and any files you attached go with it.
• Railway — hosts the application and the database the enquiry is stored in.
• Vercel — serves this website.
• Cloudflare — its Turnstile service checks that the submission is not automated.
• Microsoft — our email is read and kept in Outlook, so your enquiry and any files you attached sit in that mailbox as well as in our database.
• Google Analytics — only if you accepted analytics cookies, and never your enquiry itself.

Each acts as our processor under a written contract and may use the data only on our instructions. We would also disclose data where the law requires it — to a waste regulator exercising its powers, for example.

Data sent outside the UK

Your enquiry is stored in the United Kingdom. Both the application and the database are hosted in a UK region, and this website is served from one, so the record itself does not leave the country.

Three of the suppliers above are United States companies, and personal data reaches them in the course of what they do: Resend when your enquiry is emailed to us, Cloudflare when the anti-spam check runs at the moment you submit, and Google if you accepted analytics cookies. Microsoft holds our mailbox and its storage location depends on the tenant.

Where personal data is transferred outside the UK we rely on the UK extension to the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on the Information Commissioner's International Data Transfer Agreement or UK Addendum, together with a transfer risk assessment.

You can ask us which mechanism applies to a particular supplier, and we will tell you.

Your rights

Under UK GDPR you can ask us to give you a copy of your data, correct it if it is wrong, delete it, restrict what we do with it, or provide it in a portable form. You can object to our processing on the basis of legitimate interests, and you can withdraw any consent you gave without affecting what we did beforehand.

Ask us using the contact details in the footer of any page, and we will respond within one month. There is no charge unless a request is manifestly unfounded or excessive. We may need to confirm who you are first.

Complaints

If you are unhappy with how we have handled your data, please tell us so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. Raising it with us first does not affect that right.

Automated decision-making

We do not make automated decisions about you and we do not profile you. The anti-spam check on the form decides only whether a submission looks automated, and it is set to let borderline cases through rather than block them — a real enquiry is never rejected by it.

Changes to this notice

If we change what we collect or why, we update this page before the change takes effect. The date at the top tells you when it last changed.