Privacy Policy

Data Controller

Akash Waitage, trading as “Vyspiral”, a sole proprietorship (entreprise individuelle) with registered business address at 1, Rue N.S. Pierret, L-2335 Luxembourg, RCS Luxembourg No. A47291, VAT No. [pending] (“Vyspiral,” “we”), is the data controller for personal data processed through the Platform. As a sole proprietorship, Vyspiral has no separate legal personality; the data controller is, in law, Akash Waitage personally. Our privacy contact can be reached at privacy@vyspiral.com.

1. Overview

Vyspiral is committed to protecting your privacy. This policy explains how we collect, use, and protect your personal data in compliance with the General Data Protection Regulation (GDPR) and Luxembourg data protection laws.

2. Data We Collect

We collect the following types of personal data:

• Account information (name, email, phone number)
• Address information for pickup requests
• Photos uploaded as part of pickup requests
• Communication records between you and our platform
• Payment information (processed by third-party payment providers)
• Usage data and analytics

3. Waste Traceability Data Collection

As part of our waste logistics and traceability platform, we collect additional data to support proper waste handling, tracking, and future compliance reporting:

• Standardized waste type codes (e.g., European Waste Catalogue codes) to properly categorize waste materials
• Estimated quantities provided by customers and actual quantities measured by contractors during pickup
• Type of waste generator (household, business, construction, property manager) and optional site identifiers for tracking waste from multiple locations
• Timestamps (pickup start and end times), photos before and after pickup, contractor notes, and site cleanliness confirmations
• Details about treatment facilities where waste is delivered, including facility names, addresses, license numbers, and treatment methods (recycling, sorting, landfill, incineration, reuse, composting)
• Automatic hazard flags based on waste types to ensure proper safety handling
• Optional facility tickets, weighbridge receipts, and other disposal documentation

This waste traceability data is collected to provide transparency in waste handling, support contractors in their operations, enable future compliance reporting, and facilitate circular economy analytics. This information is stored for record-keeping purposes. Contractors remain responsible for all regulatory compliance and disposal obligations.

4. How We Use Your Data

We use your data to:

• Provide and improve our platform services
• Match you with appropriate waste removal providers
• Process payments and manage accounts
• Send service-related communications
• Ensure safety and prevent fraud
• Track waste from collection to final destination for transparency and accountability
• Generate pickup summary reports and documentation
• Support future compliance reporting and circular economy analytics
• Improve waste management practices and environmental outcomes

Purposes and Lawful Basis for Processing

We process personal data for the following purposes, each under the corresponding lawful basis (GDPR Article 6):

Automated Decision-Making

The Platform uses automated logic to match Jobs with eligible Contractors, rank Contractor invitations, and auto-approve standard-category Jobs for admin review. These processes influence which Contractors receive Job invitations and the order in which they are notified. No purely automated decision produces a legal or similarly significant effect within the meaning of GDPR Article 22 without the possibility of human review; Contractors and Customers may contact privacy@vyspiral.com to request human review of a specific matching or ranking outcome.

5. Data Sharing

We share your data only as necessary to fulfill our services:

• With Contractors assigned to your pickup request (address, photos, waste details, waste classifications, quantities)
• With treatment facilities for waste tracking and documentation purposes
• With payment processors for transaction processing
• With authorities when required by law or for compliance reporting

We do not sell your personal data to third parties.

Sub-processors

We use the following categories of sub-processors to operate the Platform. An up-to-date list with entity names is available on request to privacy@vyspiral.com.

International Data Transfers

Our primary hosting infrastructure is located within the European Economic Area. Certain sub-processors (Stripe, Google) may process data on servers located outside the EEA, including in the United States. Where this occurs, we rely on the European Commission's Standard Contractual Clauses (SCCs) or an equivalent adequacy mechanism, as maintained by the relevant sub-processor. A copy of the relevant safeguard can be requested at privacy@vyspiral.com.

6. Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

• You can request a copy of all personal data we hold about you
• You can request correction of inaccurate or incomplete data
• You can request deletion of your personal data, subject to legal retention requirements
• You can request that we limit how we use your data
• You can request your data in a structured, machine-readable format (JSON) for transfer to another service
• You can object to processing of your data for certain purposes
• You can withdraw consent for data processing at any time
• You can file a complaint with the Luxembourg National Commission for Data Protection (CNPD)

How to Exercise Your Rights:

To exercise any of these rights, please contact our Data Protection Officer at privacy@vyspiral.com or use the privacy controls in your account settings.

We will respond to your request within 30 days. For data export requests, we will provide your data within 48 hours. For account deletion requests, we will anonymize your personal data within 30 days, subject to legal retention requirements.

7. Data Retention and Deletion

We retain your data according to the following policies:

Active Accounts

We retain your data for as long as your account is active or as needed to provide services.

Completed Jobs

• Retained for 7 years from completion date for compliance and audit purposes
• Retained for 7 years from completion date
• Records older than 2 years are moved to cold storage (archived) but remain accessible
• Records are automatically deleted after 7 years, with 30-day advance notice to administrators

Cancelled Jobs

Cancelled job records are retained for 2 years from cancellation date, then automatically deleted.

Account Deletion

• 30-day recovery window after deletion request
• After 30 days, personal data is anonymized (name, email, phone, full address removed; city/country retained for analytics)
• Job records with anonymized data are retained for analytics and audit purposes
• User account data is permanently deleted after 2 years from account deletion

Audit Logs

Administrative action logs are retained for 7 years for compliance and security purposes.

Administrators may extend retention periods for specific records involved in disputes or legal proceedings.

8. Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format. We provide data portability through the following mechanisms:

• Your data is exported in JSON format, which can be easily imported into other systems
• Includes profile information, job history, payment history, waste traceability data, and temporary access URLs for uploaded documents
• Data exports are completed within 48 hours of your request
• Use the "Download My Data" feature in your account settings or contact privacy@vyspiral.com

You can transfer this data to another service provider or use it for your own records.

9. Security

We implement industry-standard security measures to protect your data:

• All data is encrypted in transit (TLS 1.2+) and at rest (AWS KMS)
• Role-based access controls ensure users can only access authorized data
• Multi-factor authentication (MFA) support for enhanced account security
• All uploaded files are encrypted in Amazon S3 with server-side encryption
• Continuous security monitoring and regular security audits
• Documented procedures for security incident response and notification

Children

The Platform is not directed at, and must not be used by, individuals under 18. We do not knowingly collect personal data from minors. If we become aware that we have done so, we will delete it promptly.

10. Contact Information for Privacy Requests

For any privacy-related inquiries or to exercise your GDPR rights, you can contact us through the following channels:

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we will provide prominent notice or seek your consent where required by law.