Privacy notice
Draft for legal review, dated 31 October 2026. This notice has not yet been reviewed by a solicitor.
This notice explains how personal data is used when you visit labchemicaldisposal.co.uk, contact us, ask us to arrange a collection or use the Chemical Register.
Who we are
The controller is Box 4 Digital Group Ltd, company number 17253991, Suite 114b Business First, Davyfield Road, Blackburn, Lancashire BB1 2QY. ICO registration number [TO CONFIRM]. Contact: info@labchemicaldisposal.co.uk or 0208 088 8371.
When an organisation uses the Chemical Register, that organisation is usually the controller of the personal data in its register, and we act as its processor. Our data processing terms cover that. Please contact your organisation about your data in its register. This notice covers what we hold for our own purposes.
What we collect
When you make an enquiry or ask for a demo: your name, work email, phone number, organisation, sector, site postcode, approximate container count, anything you write in free text, any stock list you upload, preferred times and the time you gave your consent. Stock lists usually hold chemical data, but please do not include personal details in them that we do not need.
When you set up an account: your name, work email, organisation, role, sign-in details and any settings you choose. We store a hash of your password, not the password itself.
When you use the software: activity needed for the service and for security, including audit entries showing who changed what and when.
For a collection: site address, contact names and phone numbers for the day, access notes, and the names and signatures on consignment notes and related documents.
For billing: the names and contact details of finance staff, purchase order numbers, invoices and payment records.
For suppliers: the names and contact details of people at carriers and other suppliers, and their portal logins.
Technical data: IP address, browser details, date and time and pages requested, which our servers log. Cookies are covered in our cookies policy.
How we use it and our lawful bases
| What we do | Lawful basis |
|---|---|
| Reply to an enquiry, prepare a quote or arrange a demo | Legitimate interests, or steps towards a contract |
| Provide the software and collections you have asked for | Contract, or legitimate interests where the contract is with your employer |
| Keep consignment notes and waste records, and meet tax and accounting rules | Legal obligation, and legitimate interests |
| Keep the service secure, including audit entries and logs | Legitimate interests |
| Send service messages about your account or job | Contract, or legitimate interests |
| Use non-essential cookies, if any are used | Consent |
We do not send marketing email without a lawful basis. If you receive marketing and want it to stop, tell us and we will stop.
Who we share it with
Carriers and consignees. To arrange a collection, the carrier and the consignee need the site address, a contact and the waste details. Those details also appear on the consignment note, which by law travels with the waste.
Regulators and public bodies. We may share information with the Environment Agency, Natural Resources Wales, SEPA, the Northern Ireland Environment Agency, HMRC or others where the law requires it.
Service providers. These act on our instructions.
| Provider | What for | Where |
|---|---|---|
| OVH | Hosting of the website, application, database and stored files | UK (Barking) |
| Hetzner | Nightly backup storage, which contains the database and stored files | Germany |
| Hugging Face, routing to the inference provider DeepInfra | AI assistant, using DeepSeek V4 Flash. Calls contain chemical data and label photographs. Personal data is stripped where identified, but photographs may contain unintended personal information. | May be outside the UK. [TO CONFIRM] |
| Email delivery provider | Sending service email | [TO CONFIRM] |
We do not sell personal data.
Transfers outside the UK
Backups are stored in Germany. The UK treats the European Economic Area as providing adequate protection for personal data. AI calls may be processed outside the UK, potentially including the United States. They are designed not to contain personal data, but a label photograph could capture something unintended, so please photograph the container alone. The safeguards that apply to those transfers are [TO CONFIRM].
How long we keep it
Consignment notes and disposal records: a minimum of three years, or longer where a record is still needed.
Invoices and accounting records: as long as tax and company law requires, normally six years. [TO CONFIRM]
Enquiries that do not lead to a job: [TO CONFIRM].
Account data: for as long as the account is open, then as set out in our data processing terms.
Backups: 30 dated folders are kept, and older ones are deleted on a rolling basis. Data deleted from the live system can remain in a backup until that backup expires.
Server logs: [TO CONFIRM].
Security
Our security page describes what is in place and what is not, including what we do not hold.
Your rights
Under UK data protection law you can ask for a copy of your personal data, ask us to correct it, ask us to delete it or restrict how we use it, object to how we use it and, in some cases, ask for it to be moved to another provider. You can withdraw any consent at any time. These rights have limits. For example, we may have to keep waste records even if you ask us to delete them.
We do not make decisions with legal or similarly significant effects about you solely by automated means. AI output in the Chemical Register is a suggestion that a person has to confirm.
To use your rights, contact us using the details above. If you are unhappy with how we have handled your data, please tell us first so that we can try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
Changes
We will update this notice when our use of data changes, and show the date at the top.