Data Protection Policy

W&S Waste Management Ltd

Approved: April 2026
Review Date: April 2027

Purpose

W&S Waste Management Ltd is committed to protecting the personal information of employees, customers, suppliers, contractors and all other individuals whose data we process.

We recognise the importance of maintaining the confidentiality, integrity and availability of personal information and are committed to complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable legislation.

W&S Waste Management Ltd is registered with the Information Commissioner’s Office (ICO).

ICO Registration Number: C1985232

Our Commitment

W&S will:

• Process personal data lawfully, fairly and transparently.
• Collect personal information only for legitimate business purposes.
• Ensure personal data is accurate and kept up to date where appropriate.
• Retain information only for as long as necessary.
• Protect personal information through appropriate technical and organisational security measures.
• Respect the rights of individuals under UK GDPR.
• Continually review and improve our data protection practices.

Responsibilities

All employees, contractors and temporary staff are responsible for protecting personal information that they access or process during the course of their work.

Managers are responsible for ensuring appropriate controls are implemented within their areas of responsibility.

Any actual or suspected personal data breach must be reported immediately in accordance with the Company’s Personal Data Breach & Security Incident Procedure.

Information Security

W&S protects personal information through a range of organisational and technical controls including:

• Role-based access controls.
• Secure passwords and authentication.
• Anti-virus and anti-malware protection.
• Firewalls and secure IT infrastructure.
• Secure storage of paper records.
• Confidential disposal of information.
• Staff awareness and training.

Data Sharing

Personal information will only be shared where there is a lawful basis for doing so and where appropriate contractual or legal safeguards are in place.

Data Retention

Personal information is retained only for as long as necessary to meet legal, regulatory, contractual and operational requirements.

Retention periods are managed in accordance with the Company’s Records Retention Policy.

Training

All employees receive data protection awareness training appropriate to their role and are expected to comply with this policy and supporting procedures.

Monitoring and Review

This policy will be reviewed annually, or sooner if legislation, guidance or business operations change.

Supporting Documents

This policy should be read alongside:

• Privacy Notice
• Records Retention Policy
• Personal Data Breach & Security Incident Procedure