Privacy Policy and GDPR Notice

This privacy notice describes how and why we process your personal information and how we keep it safe to protect your privacy. This notice is intended to comply with the General Data Protection Regulation (GDPR).

Who are we?

Routeware provides route optimization, route management and in-vehicle technology to the municipal waste, street cleansing and highways maintenance sectors and to the private companies that serve the municipal sectors. Routeware is a company registered in Scotland and our company registration number is SC201416. Our registered address is Routeware Ltd, Q Court, 3 Quality Street, Edinburgh, EH4 5BP. We are registered with the Information Commissioner’s Office. Our registration number is ZA304456.

On what basis do we collect, hold use and/or process personal information?

We will only collect, hold, use and/or process your personal information where we are legally allowed to do so. To achieve this, we will ensure that your personal information is:

• Processed lawfully, fairly and transparently
• Collected and processed for specific, explicit and legitimate purposes
• Adequate, relevant and limited to what is necessary for the legitimate purpose of processing
• Kept accurate and up to date
• Only kept for so long as is necessary
• Processed securely using appropriate technical and organisational measures to protect your data 

Under Article 6 of GDPR, the lawful basis which is relevant to the personal data we hold will fall into one of the following categories:

• Contract (Article 6(1)(b)) – to fulfill our contractual obligation to you or in relation to discussions with you before entering into a contract. For example, in connection with recruitment of our staff.
• Legal Obligation (Article 6(1)(c)) – to fulfill a legal or statutory requirement such as complying with HMRC data submission requests in connection with payroll. 
• Legitimate Interests (Article 6(1)(f)) – in connection with the legitimate interest of carrying out our business as a leading layer in our market of interest. This includes cases where we process our own data, such as contact and marketing information in relation to managing a successful position in our marketplace, for example, in connection with developing an understanding of our market or contacting contacts in our niche industries whose organisations qualify as potential customers. It also includes cases where we are legitimately processing data on behalf of our customers as part of our business services, for example in relation to local authority waste collection activities at particular addresses where that local authority deploys our hosted waste management software. 
• Consent (Article 6(1)(a)) – Where we hold specific data and where none of the above lawful basis apply, we with then only hold your data with your consent. Where we require consent, we will provide you with notice explaining how we will process your data, give you the choice to provide consent or not and explain how you can withdraw your consent. Once we have your consent, we will review the need to hold your Personal data and request your continuing consent at a reasonable frequency based on the sensitivity of the data held. You may choose to withdraw your consent at any time, but be aware that we shall cease processing your personal data unless we are required to do so under applicable laws.

Why do we process personal information and how do we process it?

We process your personal information for four main reasons:

• Where you are an employee of our company will be because you are an employee of our organization to enable you or your organization
• Where your organisation is a customer or potential customer for our products and services and we process your information so that we can understand the market we operate in, so that you can buy or use our products or services and so that we can communicate with you to make you aware of these products and services.
• Where you have services provided to you by one of our customers who are typically local authorities or private contractors in the municipal services market, we process information in our hosted environmental services solutions on behalf of our customers.
• Where you are a supplier to allow us to select you and do business with you.

Who do we share personal data with?

We will never sell – that is, disclose without your explicit consent or unless directed by law – your information to a third party.

We will only share your information with a third party or transfer your data outside of the UK/EU if we need to and where it complies with our legal obligations and when we have ensured there are adequate protections in place to protect your information.

If we need your consent we will provide you with the reason for sharing, the details of the third party and the opportunity to provide or refuse your consent. You will be able to easily withdraw your consent in the same way in which you gave it.

Where we rely on a different lawful basis such as legitimate interest or contractual, we will do so only to the extent permitted by such lawful basis.

We may share your information with:

• Suppliers we use for our back office systems such as HR systems
• Suppliers we use for our hosted or managed services for the purposes of hosting these
• The third party owner or licensor of any third party software (such as road network data) for the purpose of licensing and administering access, use and support of these.
• Suppliers we use to provide event facilities and services for the purpose of providing the events

How long do we keep your information?

We will only keep your personal information for as long as we have a lawful basis for processing it. Where you have entered into a contract with us either directly or through a main contractor, subcontractor arrangement, we will keep your information for the duration of the contract and for such a period thereafter as we are permitted by law to comply with financial legislation and for so long as is necessary for the establishment, exercise or defence of legal claims. 

Where we no longer have a basis for keeping your information, we will delete it within 6 months.

Data Subject Rights

As a Data Subject defined under GDPR, you have specific data privacy rights under the GDPR. 

In summary, your Data Subject Rights are as follows:

• Basic information (such as our identity, or that of the controller if not us, the reason and basis on which we process your personal data, together with as much information to ensure fairness and transparency) and to be informed
• Object: to object to processing of personal data where such is done by us in certain circumstances, for example for our legitimate interests or direct marketing
• Withdraw consent: to withdraw your previously given consent
• Access: to be aware of and verify the lawfulness of the processing
• Rectification: to correct personal data if it is inaccurate or incomplete 
• Erasure: to request the removal or deletion of personal data 
• Restrict processing: to restrict the processing of personal data 
• Data portability: to obtain and reuse personal data and to direct us to transport this data to another entity in a common, machine-readable format
• Be aware of any automated decision making or profiling, and to request such is restricted

If you wish to object or to withdraw previously given consent, you may contact us through one of the methods detailed below in the ‘Contact us’ section. In addition, where we have sent you a marketing email, we will have provided an ‘unsubscribe’ or ‘set your preferences’ or ‘opt-out’ link which you can use to stop any future marketing communications.

Concerns or complaints

Please call (+44) (0)20 8973 1607 and ask for the Data Protection Officer, or email dataprotect@routeware.com.

Last Updated: 28th October 2024