Vilmak Ltd ("Vilmak", "we", "us", "our") — a company registered in England and Wales, company number 17425133, registered office: Bowen Suite, The Globe Centre, 1 St. James Square, Accrington, BB5 0RE · Effective date: 28 September 2026
This Data Processing Agreement ("DPA") forms part of the agreement between the tenant company ("Controller") and Vilmak Ltd ("Processor"), for the provision of DWTN (the "Service"), and applies whenever Vilmak processes personal data on the Controller's behalf. It is incorporated by reference into our Terms of Service.
This DPA applies for the duration of the Controller's use of the Service under the Terms of Service, and for so long afterwards as Vilmak retains any personal data processed on the Controller's behalf.
Vilmak processes personal data solely to provide the Service: operating the platform, storing and displaying waste transfer note and account data, generating exports (CSV, PDF, and government-format spreadsheets), sending transactional notifications, and maintaining backups, all as instructed by and configured by the Controller through its use of the Service.
Personal data processed may include: name and email address of Authorised Users; hashed passwords; role (tenant administrator or driver) and default vehicle registration number; and waste transfer note data linked to a driver or admin, including source/carrier/receiving-site details, waste item and hazard/POP records, location coordinates captured at the point of recording, a digital signature image, signer name and timestamp, uploaded photographs, and free-text notes. Note content may occasionally include personal data of individuals at other organisations (for example, a named contact for a carrier or receiving site) where the Controller enters that information.
The Controller's employees, contractors, and other individuals authorised by the Controller to use the Service (tenant administrators and drivers), and, incidentally, individuals named within waste transfer note content who are not themselves Authorised Users (for example, a contact named at a carrier or receiving site).
Vilmak will process personal data only on the Controller's documented instructions, which are given by the Controller's configuration and use of the Service, and as otherwise agreed in writing, unless required to do otherwise by law — in which case Vilmak will inform the Controller before processing, unless prohibited from doing so.
Vilmak will ensure that any personnel authorised to process personal data are subject to a duty of confidentiality.
Vilmak implements appropriate technical and organisational measures, including:
The Controller authorises Vilmak to engage the following sub-processors:
Vilmak will inform the Controller of any intended changes to sub-processors, giving the Controller a reasonable opportunity to object on reasonable data-protection grounds. Vilmak remains responsible for the acts and omissions of its sub-processors as if they were its own.
Personal data is stored primarily within the United Kingdom, with off-site backups additionally stored within the European Economic Area (Berlin, Germany). The UK's data protection framework recognises the EEA as providing an adequate level of protection for personal data, so this transfer does not require additional safeguards beyond compliance with UK GDPR. If Vilmak engages a sub-processor outside the UK or EEA in a jurisdiction not covered by adequacy regulations, Vilmak will put in place an appropriate transfer mechanism (such as the UK's International Data Transfer Addendum) before doing so, and will update this DPA accordingly.
Vilmak will, taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures to respond to requests from data subjects exercising their rights under data protection law. Where a data subject contacts Vilmak directly, Vilmak will refer the request to the Controller and provide reasonable assistance as required.
Vilmak will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, and will provide reasonably available information to help the Controller meet its own breach-notification obligations.
Vilmak will provide reasonable assistance to the Controller, taking into account the nature of processing and information available to Vilmak, where the Controller is required to carry out a data protection impact assessment or consult with a supervisory authority — including in connection with location and signature capture, which the Controller should consider as part of any workplace-monitoring assessment.
On reasonable written notice, and no more than once per year (except following a security incident), Vilmak will provide the Controller with information reasonably necessary to demonstrate compliance with this DPA. Audits will in the first instance be conducted remotely, through documentation and written responses to reasonable questions; an on-site or physical inspection will only be arranged where reasonably necessary and by mutual agreement on timing. Any audit must be conducted in a manner that does not provide the Controller with access to any other tenant's data or systems, is subject to reasonable confidentiality safeguards, and is at the Controller's own cost unless the audit identifies a material breach of this DPA by Vilmak.
On termination of the Service, Vilmak will, at the Controller's choice, delete or return all personal data processed on the Controller's behalf, and will delete existing copies, within the timeframe set out in the Terms of Service, except to the extent retention is required by applicable law.
Liability under this DPA is subject to the limitations and exclusions set out in the Terms of Service.
This DPA is governed by the laws of England and Wales. In the event of any conflict between this DPA and the Terms of Service regarding the processing of personal data, this DPA prevails.
© 2026 Vilmak Ltd (company number 17425133). DWTN — Digital Waste Transfer Note system.