Privacy Policy
- Version 3.0
- Effective 10 November 2026
Approved 10 November 2026
We explain here how Rubbish Ideas Ltd, trading as Rubbish Portal ("Rubbish Portal", "we", "us"), uses personal information. This notice covers our website, accounts, customer communications, payment administration and AI-assisted features. It should be read with our Terms and Conditions and, where we process personal information on behalf of an organisation, our Data Processing Addendum.
Our aim is to be clear about the distinction between information we use to operate our own business and information customers ask us to process in their Portal accounts. If you have a question or wish to exercise your rights, email support@rubbishportal.com.
1. Who we are and when we are a controller or processor
Rubbish Ideas Ltd is a company registered in England and Wales (company number 11452752). Its registered office is 11 Richmond Terrace, Clifton, Bristol, BS8 1AB, United Kingdom. Our service is Rubbish Portal, available at https://www.rubbishportal.com. Our privacy contact is support@rubbishportal.com. This is the contact for privacy questions and complaints; we do not claim to have appointed a statutory data protection officer unless such an appointment is formally confirmed and published.
We generally act as a controller for information about people who visit our website, register or administer accounts, contact us, pay for our services, receive marketing or interact with our support and security processes. We decide why and how to use that information for those purposes.
When an organisation uses the Portal to store or analyse operational records about its staff, visitors, suppliers or other people, we generally act as a processor on that organisation's documented instructions. The organisation remains responsible for its lawful basis, notices to the individuals concerned, and decisions about who may access or disclose its records. Our Data Processing Addendum governs that processor relationship. Particular activities may involve a different allocation of roles depending on who determines the purposes, and we assess these separately.
If you are included in records uploaded by a venue, festival, organiser, waste manager or supplier, please ordinarily direct your request to that organisation. You may also contact us; we will route processor-related requests appropriately and assist the customer as required by law.
2. What information we collect
Depending on your interaction with us, the information may include:
- Account and contact details: name, email address, telephone number, organisation, role or job title, organisational affiliations, account identifiers, invitations, permission settings, login details and preferences.
- Identity and authentication information: email-code events, sign-in security records, and limited Google sign-in details when you choose Google authentication. We do not request your Google password.
- Customer operational content: venue and event information, tags, attendance or travel-survey records, product and meal details, stock and sales records, collection and sorting data, transport and accommodation information, utilities and carbon inputs, documents, photographs, spreadsheets, invoices or transfer notes, and comments entered by authorised users. These are often business records, but may contain names, contact details, signatures, journey information or other personal information.
- AI interactions: messages, follow-up corrections, attachments or extracted text used in an AI request; the relevant authorised context supplied to complete it; model responses; draft proposals; approvals, rejections and save-status receipts; and troubleshooting and evaluation records associated with the interaction.
- Payments and commercial information: subscription plan, billing contact, invoice and transaction identifiers, payment status and correspondence. Card collection is handled by our payment provider; we do not intend to store full payment-card numbers.
- Technical, usage and security records: IP address, browser and device data, approximate location inferred from network information, time stamps, visited areas, access and audit events, errors, submitted forms associated with faults, feature use and performance statistics.
- Communications: messages sent to support, enquiries, surveys, feedback, marketing preferences and records needed to resolve requests.
We obtain information from you, your organisation's authorised users, connected organisations within the Portal, authentication and payment providers, service logs, and documents or datasets uploaded on a customer's instructions. Customer-provided content may concern individuals who have not personally visited our website.
The Portal is not designed to collect special-category data (such as health or biometric information), criminal-offence information or highly sensitive identity documents. Please remove such information where it is unnecessary. Where it nevertheless appears incidentally in uploaded customer records, we handle it under the applicable customer instructions, access controls and legal obligations; we do not assume that an incidental upload makes it lawful.
3. Why we use information and the legal bases
For processing where Rubbish Ideas Ltd is the controller, we use the following purposes and lawful bases under the UK GDPR (and applicable EU GDPR). The appropriate basis depends on the individual and circumstances; an employee of a customer may not personally be a party to our contract.
| Purpose | Typical information | Legal basis |
|---|---|---|
| Create and manage accounts, authenticate users, administer customer contracts and deliver services | Account, organisation, permissions, support and transaction details | Contract where you personally are party; otherwise legitimate interests in performing and administering services for the organisation |
| Provide support, resolve faults and maintain service quality | Contact, support, relevant diagnostic records and limited AI transcripts where necessary | Legitimate interests in support, reliable operation and improving service; contract where applicable |
| Prevent unauthorised access, fraud, misuse and security incidents | Authentication events, access logs, IP addresses, audit records | Legitimate interests in protecting customers and systems; legal obligation where applicable |
| Administer subscriptions, taxation and financial records | Billing, payment and transaction details | Contract where applicable; legitimate interests in invoicing; legal obligation for tax and accounting |
| Respond to privacy requests, legal claims and regulatory enquiries | Identity verification and relevant records | Legal obligation; legitimate interests in establishing, exercising or defending legal rights as applicable |
| Send essential account, security and service notices | Contact and account details | Legitimate interests in service administration or contract where applicable |
| Send marketing, where lawfully permitted | Business contact and marketing preferences | Consent where required, or legitimate interests subject to electronic-marketing rules and your right to object |
| Produce permitted internal service statistics and improve quality | Minimised usage data, aggregated measurements and sampled incident records | Legitimate interests, subject to an assessment of necessity and the impact on individuals; consent where separately required |
For customer operational content that we process as a processor, the customer determines the lawful basis and purposes. Our processing is governed by its instructions and our Data Processing Addendum rather than by claiming our own blanket legitimate interest in all uploaded data. We do not use a customer's identifiable operational records to advertise to individuals or to train our own general-purpose AI model.
You must provide certain account details to obtain access and certain payment information where a paid subscription is selected. Other fields are optional, though omitting information needed for a requested feature may prevent that feature from operating.
4. How organisations and connected parties may see information
The Portal is designed to allow venues, organisers, suppliers, distributors and waste-management partners to collaborate. Depending on their approved role and connections, authorised users at another organisation may be able to see shared activity records, reports, associated names or evidence provided for that relationship. Visibility is determined by the application's permission and connection rules, not simply by the fact that two parties use the Portal.
A customer is responsible for inviting appropriate users, granting permitted connections and reviewing their continuing access. We are responsible for implementing our access-control obligations. Removing a user or a connection may not remove copies or reports already lawfully exported by another organisation. We do not make uploaded customer documents public merely because they were uploaded.
6. Rubbish Bot and other AI-assisted features
Rubbish Bot supports conversational onboarding, operational data entry, document and spreadsheet extraction, product and material matching, analysis of authorised Portal data and sustainability guidance. An AI model can interpret language and prepare a draft, but Portal code is responsible for permission checks, data validation, supported calculations and execution of permitted operations. Where a feature proposes a business-record change, the user is shown an appropriate review and confirmation step. A generated message is not proof that a record has been saved.
After the approved migration, our planned primary inference service is Amazon Bedrock using Anthropic Claude Haiku 5.5, called from AWS London (`eu-west-2`) through the EU geographic inference profile. The model can process text and images, including selected extracts of uploaded documents. The profile may route the request to AWS processing regions in the United Kingdom and European Union, not necessarily London on every request. We will verify the profile's destination list, applicable service terms and retention settings before using customer information. We do not describe EU routing as UK-only processing.
The information sent for a specific AI task may include your message, a relevant portion of earlier conversation, selected customer-provided files or images, authorised Portal records and retrieved guidance. We aim to minimise this material and do not intentionally send entire accounts or unrestricted customer databases to a model. Files and retrieved text are treated as source evidence, not instructions that can override permissions or authorise database changes.
Storage and model training: The Portal may retain conversation histories, task context, accepted corrections, audit events and save confirmations for service delivery, support and fault investigation. This retention is separate from transient model processing. AWS Bedrock's handling of model inputs and outputs is governed by the model, API, account configuration and AWS terms; we do not claim universal zero retention, absence of all human review, or UK-only processing without verification. Our intended configuration keeps optional full-content model-invocation logging disabled and applies the approved retention policy. We do not use identifiable customer content to train general-purpose models without a separate lawful basis, appropriate customer authority and a clear specific arrangement.
Historical AI providers: Before the Bedrock cutover, certain Portal AI features and document-scanning functions used direct DeepSeek processing. Depending on the date and feature, information sent through those functions may have been transferred to the People's Republic of China under the then-applicable provider arrangements. Moving future traffic to Bedrock does not retrospectively change those transfers or automatically remove copies held under earlier terms. We will disclose material provider changes and respond to questions about applicable historical processing.
AI outputs can be inaccurate, omit context, misread a quantity or use a source incorrectly. They are decision support, not independently assured carbon inventories, regulatory certifications or legal advice. We distinguish verified records, estimates and hypothetical scenarios where the feature supports that distinction. Users should review consequential recommendations and confirm proposed changes. We do not use Rubbish Bot to make decisions about an individual that produce legal or similarly significant effects solely through automated processing without the safeguards required by applicable law.
Where manual forms or alternative workflows are offered, users may choose them. Some AI-assisted features may be unavailable or restricted by account plan, geography, configuration or permissions. We will describe the alternatives accurately in the product rather than promising that every feature has a manual equivalent.
7. Google sign-in
Google sign-in is optional where offered; email-code sign-in is an alternative. We request the standard OpenID Connect identity details needed for authentication, such as email address and whether it is verified, a Google account identifier, and basic profile information. We do not obtain your Google password or permission to read your Gmail, Drive, Calendar or contacts merely through this sign-in. The Portal's account-linking rules may require an existing authorised account and verified email address.
We use the details for sign-in and account security. Google operates its own service under its privacy terms. You can disconnect the app from your Google account settings; doing so does not automatically delete your Rubbish Portal account or historic account records. Contact us for an appropriate deletion or access request.
8. International processing and transfers
We are established in the United Kingdom. Our suppliers and customers may operate internationally. The EU geographic Bedrock profile is a processing-area control for that AI feature, not a guarantee that all service, billing, application or support information remains in the UK/EEA. Some other suppliers may process or support services from countries outside those areas, depending on their configurations and contractual arrangements.
Where a transfer is restricted under the UK GDPR or applicable EU GDPR, we assess the data flow and use an appropriate legal mechanism, which may include an adequacy regulation or decision, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, or EU Standard Contractual Clauses, together with any required data protection test and supplementary safeguards. A general statement in these Terms or acceptance of the Portal's sign-up agreement is not itself an international-transfer safeguard. Ask our privacy contact for relevant details.
Transfers from the EEA to the UK are subject to the applicable EU adequacy framework. Where an EEA representative is legally required for our direct activities, its details will be added after the appointment is verified. We do not identify a UK representative for an already UK-established company as a substitute for its actual controller details.
9. How long we keep information
We keep personal information only as long as necessary for the relevant purpose, subject to contractual deletion instructions, legal obligations, dispute preservation and a documented retention schedule. Different records have different lifecycle rules:
| Category | Retention criterion |
|---|---|
| Account and organisational administration | While needed to operate authorised accounts and manage the relationship; afterwards only for genuine legal, security, contractual or accounting requirements |
| Operational records uploaded by customers | As directed by the customer and its contract/Data Processing Addendum, subject to return, export, deletion, other legitimate access rights and statutory obligations |
| AI conversations, task history and approvals | While needed for the active service, auditability, support and approved quality review; then deleted or de-identified under the documented conversation schedule |
| Uploaded source documents and temporary extraction files | For the active import and the defined review/recovery window; longer retention only when kept as a customer record or required under contract or law |
| Error and security logs | For a limited, risk-based period necessary to investigate incidents and maintain security, with access restrictions and deletion schedules |
| Billing, tax and accounting records | For the applicable statutory and financial recordkeeping period |
| Backups | Under the documented backup rotation; restored copies remain subject to deletion controls and lawful retention exceptions |
Closing an individual user account does not automatically erase another organisation's records or copies that other authorised users must retain. We will explain applicable export and deletion routes and handle valid rights requests. We may anonymise information where legally and technically appropriate, but pseudonymised or re-identifiable datasets remain subject to data protection law.
10. How we protect information
We use proportionate technical and organisational safeguards intended to protect confidentiality, integrity and availability, including access controls, authenticated sessions, tenant-scoped authorisation, provider security controls, monitoring and incident handling. Security arrangements are reviewed as the service and suppliers change. No internet-connected system is without risk, and we cannot promise absolute security.
If a personal data breach occurs, we investigate and notify affected customers, regulators or individuals where and when required by law and our contracts. Customer documents should be submitted only through the authorised features, not through unrelated support channels unless requested securely.
12. Marketing and communications
We send necessary service messages about accounts, security, billing and changes to the Portal. We send promotional messages only where lawful under applicable electronic-marketing and data protection rules. You can unsubscribe from marketing or object to direct marketing using the message's unsubscribe mechanism or by emailing us. Opting out of marketing does not stop necessary service notices.
We do not use uploaded customer operational records to build marketing profiles of festival attendees or other people.
13. Children and third-party personal information
The service is designed for adult business users aged at least 18 and is not directed at children. Customer records may nevertheless contain incidental information relating to people under 18, including where a festival or other organisation records attendance or operational information. The customer must determine whether that information is appropriate and lawful to upload; we process it under the applicable instructions and protections.
If we become aware that a child has opened an account contrary to our eligibility rules, we will take appropriate steps to restrict or close that account and handle personal information lawfully. Contact our privacy team if you believe a record requires urgent review.
14. Your data protection rights
Depending on the applicable law and context, you may have rights to access information, correct inaccuracies, request erasure, restrict processing, receive portable information, object (particularly to direct marketing), and withdraw consent where consent is the basis. The rights are not absolute; statutory exceptions and retention obligations may apply. We will explain a refusal where required.
Email support@rubbishportal.com with the request and enough information to identify the relevant account or context. We may take proportionate steps to verify identity and authority. We aim to respond within the applicable legal period; under UK data protection law this is normally one calendar month, subject to permitted extensions and special rules. We will not charge for ordinary requests unless the law permits a fee.
If an organisation uploaded your information, it may be the controller. We will help identify the appropriate contact and assist the organisation rather than disclose its records without authorisation.
15. Complaints and regulators
You may complain to us about how we use personal information by emailing support@rubbishportal.com. We will acknowledge a UK data-protection complaint within 30 days, take appropriate steps to investigate, keep you updated and provide an outcome without undue delay. A complaint is distinct from a request to exercise individual rights.
You may also complain to the Information Commissioner's Office (ICO) at https://ico.org.uk/. If the EU GDPR applies, you may have the right to complain to the relevant EEA supervisory authority. Contacting us first is helpful but does not remove your right to approach a regulator.
16. Changes to this notice and contact details
We review this notice when our suppliers, AI models, data flows, product features or legal obligations materially change. The published page will display the effective date. Where a change materially affects how we use personal information, we will provide appropriate advance information or obtain permission where required, rather than rely solely on silent publication.
Privacy contact: support@rubbishportal.com
Rubbish Ideas Ltd, company number 11452752
Registered office: 11 Richmond Terrace, Clifton, Bristol, BS8 1AB, United Kingdom
Website: https://www.rubbishportal.com