Data Processing Agreement

1. Definitions

“Personal Data”, “Processing”, “Data Subject”, “Controller”, “Processor”, “Sub-processor”, and “Personal Data Breach” have the meanings given in the GDPR. “Platform Data” means the Customer personal data made available to the Processor through the Platform for the purpose of performing a Job.

2. Subject Matter and Duration

The Processor processes Platform Data on behalf of the Controller for the duration of the Contractor Agreement, and thereafter only as necessary to comply with Section 10 (Return or Deletion of Data).

3. Nature and Purpose of Processing

The Processor processes Platform Data solely to perform waste collection and related services requested by Customers through the Platform, including scheduling, site access, pickup execution, and evidence documentation.

4. Categories of Data Subjects

• Customers who submit pickup requests.
• Individuals present at a pickup address (e.g., building occupants), to the limited extent their data appears incidentally in pickup evidence.

5. Categories of Personal Data

No special categories of data (GDPR Art. 9) are intended to be processed. If the Processor becomes aware that special-category data has been incidentally captured, it must notify the Controller without undue delay.

• Identification data: name, phone number.
• Location data: pickup address, and where applicable, site identifier or access instructions.
• Visual data: before/after photographs of the pickup site.
• Job-related data: waste classification, quantity, notes exchanged via in-Job messaging.

6. Processor Obligations

The Processor shall:

• process Platform Data only on the documented instructions of the Controller, unless required otherwise by EU or Member State law;
• ensure that persons authorized to process Platform Data are subject to a duty of confidentiality;
• implement appropriate technical and organizational measures to ensure security appropriate to the risk (Annex 2);
• not engage a sub-processor without the Controller’s prior written authorization, and inform the Controller of any intended change so it may object;
• assist the Controller, insofar as reasonably possible, in responding to Data Subject rights requests;
• assist the Controller with security of processing, breach notification, and data protection impact assessments;
• at the Controller’s choice, delete or return all Platform Data at the end of the services, unless storage is legally required;
• make available all information necessary to demonstrate compliance, and allow for and contribute to audits on reasonable notice.

7. Sub-processors

The Processor may engage sub-processors (e.g., subcontracted crew, disposal or treatment facilities) only where necessary to perform a Job and where bound by data-protection obligations no less protective than those in this DPA. The Processor remains fully liable to the Controller for the acts and omissions of its sub-processors.

8. International Transfers

The Processor will not transfer Platform Data outside the European Economic Area without the Controller’s prior written consent and, where required, an appropriate transfer mechanism (e.g., Standard Contractual Clauses).

9. Personal Data Breach Notification

The Processor will notify the Controller without undue delay, and in any event within 24 hours of becoming aware, of any Personal Data Breach affecting Platform Data, providing sufficient information for the Controller to meet its obligations under GDPR Articles 33 and 34.

10. Return or Deletion of Data

Within 30 days of termination of the Contractor Agreement, or earlier on the Controller’s request, the Processor will delete or return all Platform Data in its possession, and certify deletion in writing on request, save where retention is legally required.

11. Liability

Each Party is liable for damage caused by processing that infringes the GDPR only where it has not complied with obligations specifically directed to processors, or has acted outside or contrary to the Controller’s lawful instructions. Nothing limits either Party’s liability toward Data Subjects under Article 82 GDPR.

12. Term and Governing Law

This DPA takes effect on the same date as the Contractor Agreement and remains in force for as long as the Processor processes Platform Data on the Controller’s behalf. It is governed by the laws of the Grand Duchy of Luxembourg.

Annex 2 — Technical and Organizational Security Measures

• Access to Platform Data limited to personnel who need it to perform the relevant Job.
• Devices used to access the Platform must be protected by a passcode or biometric lock.
• Photographs and notes must be submitted only through the Platform, not retained locally beyond what is necessary to complete the Job.
• Prompt reporting of lost or stolen devices that may have contained Platform Data.
• Compliance with the confidentiality obligations in Section 10 of the Contractor Agreement.