Vilmak Ltd ("Vilmak", "we", "us", "our") — a company registered in England and Wales, company number 17425133, registered office: Bowen Suite, The Globe Centre, 1 St. James Square, Accrington, BB5 0RE · Effective date: 28 September 2026
This policy explains how we collect, use, and protect personal data within DWTN — the waste transfer note software we provide to business customers ("tenants") who share the platform at dwtn.vilmak.co.uk, each with their own isolated account, used by tenant administrators and drivers. It does not cover the main vilmak.co.uk marketing website, which has its own privacy policy.
If anything here is unclear, contact us at info@vilmak.co.uk.
For data processed inside DWTN, where the tenant company (your employer, or the business that set up your account) determines the purposes and means of processing driver-related data, the tenant is the data controller for that data — for example, the waste transfer notes its drivers record. Vilmak acts as a data processor for that data, running the software on the tenant's behalf and only processing it according to the tenant's instructions. If you are a driver using the app, questions about how your employer uses your data should first be directed to your employer; Vilmak can explain what the software does, but the employer sets the policy on how that data is used.
Vilmak is also, separately, a data controller for certain information it needs to run its own business — for example, the billing and account-administration contact for a tenant company (once paid plans begin), support correspondence, and security/audit logs of platform access. This is data Vilmak processes for its own purposes, not on a tenant's instructions, so Vilmak — not the tenant — is responsible for it.
Legal entity: Vilmak Ltd
Company number: 17425133 (registered in England and Wales)
Registered office: Bowen Suite, The Globe Centre, 1 St. James Square, Accrington, BB5 0RE
Contact: info@vilmak.co.uk
Processed by Vilmak as controller, for running its own business rather than on a tenant's instructions:
Processed by Vilmak as a data processor, on the tenant company's instructions:
Also processed by Vilmak as a data processor, on the tenant company's instructions, and collected as part of recording a waste transfer note. Generally linked to the named driver or admin who recorded it, and may also include names of individuals at other organisations (for example, a named contact for a carrier or receiving site) if the tenant enters that information:
Because location data and a signature image are more sensitive than a simple timestamp, the tenant should make sure its drivers are aware that recording a note captures their location and signature at that moment.
Strictly necessary session and security cookies, including cookies used to maintain authenticated sessions and protect form submissions. We do not use advertising, analytics, or tracking cookies in DWTN.
| Purpose | Data used |
|---|---|
| Log you in and keep your account secure | Account data |
| Create, store, and display waste transfer notes, and generate CSV / PDF / government-format exports | Waste transfer note data |
| Let a tenant admin manage the driver roster and reset a driver's password | Account data |
| Pre-fill carrier, receiving site, and vehicle details on new notes | Account + waste transfer note data |
| Send transactional emails (password resets for admin accounts) | Account data |
| Respond to support requests | Business/account administration data |
| Bill tenant companies, once a paid plan is in place | Business/account administration data |
| Detect misuse and keep the platform secure | Security/audit logs |
| Keep the service running and recoverable (backups) | All of the above, backed up on a schedule |
Tenant account data and platform usage: where Vilmak processes personal data on behalf of a tenant company, it does so as a data processor in accordance with the tenant's documented instructions and the Data Processing Agreement, and as necessary to provide the service under its contract with the tenant company. Vilmak may also process certain information where necessary for its legitimate interests, including operating, maintaining, securing and improving the platform, and preventing misuse.
Vilmak's own business and account administration data (billing contacts, support correspondence, security/audit logs): processed under Vilmak's legitimate interest in running its business, invoicing tenant companies, providing support, and keeping the platform secure.
Waste transfer note data (including driver-linked records): the tenant company acts as the controller for this data and is responsible for determining and documenting the appropriate lawful basis and purposes for processing it — including its own waste duty of care obligations. Depending on the tenant's circumstances, this may include legal obligation, legitimate interests, or another lawful basis available under UK GDPR.
Recording a driver's location and signature at the point a note is created may constitute a form of workplace monitoring. The tenant is responsible for assessing whether its use of the Service constitutes workplace monitoring and for ensuring that monitoring is lawful, necessary, proportionate and transparent, including providing appropriate information to its drivers and, where required, carrying out a data protection impact assessment.
Vilmak does not independently determine employment outcomes, disciplinary action, or other employment decisions based on data recorded in the Service. Any such decisions remain entirely the responsibility of the tenant company.
We use a small number of subprocessors to run the service. We do not sell personal data, and we do not use advertising or analytics networks.
| Subprocessor | Purpose | Data involved |
|---|---|---|
| IONOS Cloud Ltd. (company number 3953678) | Hosting the platform's server and database (all application infrastructure) | All data stored in the platform |
| IONOS (SMTP mail service) | Sending transactional emails: password resets for admin accounts | Name, email address |
| IONOS Object Storage (eu-central-3, Berlin, Germany) | Off-site storage of encrypted-in-transit database and file backups, in addition to the local copy kept on the server | All data stored in the platform, as part of full backups |
The platform's server and database are hosted in the United Kingdom. Database and uploaded-file backups are taken automatically on a nightly schedule, retained for 14 days on a rolling basis, and kept both locally on the same server and off-site with IONOS Object Storage in their eu-central-3 region (Berlin, Germany). This means personal data is transferred outside the UK to the European Economic Area (EEA) as part of routine backups. The UK's data protection framework recognises the EEA as providing an adequate level of protection for personal data, so this transfer does not require additional safeguards beyond compliance with UK GDPR.
DWTN uses only strictly necessary cookies — the session cookie that keeps you logged in, and a CSRF-protection cookie that helps secure form submissions. These are not used for advertising or analytics — but if that changes, this section and a cookie banner will be added.
Subject to some exceptions, UK GDPR gives you the right to: ask what personal data we hold about you and get a copy (access); correct inaccurate data (rectification); ask for data to be deleted (erasure), where applicable; object to or restrict certain processing; and receive your data in a portable format.
If you are a driver, the waste transfer note features in this app are provided to your employer to help them meet their waste duty of care obligations. Requests about your in-app activity data should generally go to your employer first, since they are the data controller who decides how it's used — but if you contact Vilmak directly, where the tenant is the controller we will normally refer your request to the relevant tenant company and assist as required. If you are a tenant admin, contact info@vilmak.co.uk.
You also have the right to complain to the UK Information Commissioner's Office (ICO) if you believe your data has been mishandled.
We may update this policy from time to time. The "effective date" at the top will be updated when we do, and material changes will be communicated to tenant administrators.
Email: info@vilmak.co.uk
© 2026 Vilmak Ltd (company number 17425133). DWTN — Digital Waste Transfer Note system.