Privacy Policy

Last Updated: 26 July 2026

1. Introduction

Endpoint Works (“we”, “our” or “us”) is committed to protecting your privacy and handling your personal information responsibly. This Privacy Policy explains how we collect, use, store and protect personal data when you visit our website, request a quote, or use our IT asset collection and data destruction services. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable UK data protection laws.

This Privacy Policy describes our practices when we act as the controller of your personal data. Section 3 explains what that means, and how it differs from our role when we destroy data held on equipment submitted to us by our clients.

2.Who We Are

Endpoint Works Ltd is a company registered in England and Wales under company number 17258216. Our registered office is at Capital Office, 124–128 City Road, London, EC1V 2NX.

We are registered with the Information Commissioner’s Office under registration reference ZC213698, and with the Environment Agency as an upper tier waste carrier, broker and dealer under registration number CBDU652771.

We may collect, use, store and transfer different kinds of personal data about you, which we have grouped together as follows: Identity Data, Contact Data, Technical Data and Usage Data. Because of the nature of our services, we and our clients also handle data contained on the equipment we collect for reuse or destruction — see Section 3.

3.Our Role: Controller and Processor

When you contact us, request a quote, or book a collection as a customer or a customer’s representative, we are the controller of the personal data you give us — for example, your name, contact details and collection information. This is the data this Privacy Policy is about.

Separately, where a client purchases our data destruction service, that client remains the controller of any personal data held on the equipment they submit to us (for example, data on hard drives, laptops or mobile devices), and we act only as their processor, under a data processing agreement (Schedule 3 to our Master Services Agreement). In that role:

We process that data only on our client’s documented instructions;
We do not access, read, copy or extract data from any device except as necessary to carry out sanitisation or destruction; and
We do not retain any copy of the data itself — only records confirming that it was securely destroyed (see Section 4).

If you are an individual whose personal data may be held on equipment submitted to us by your employer or another organisation, that organisation — not Endpoint Works — is the controller responsible for that data, and you should direct any request to them in the first instance. This does not affect any right you may separately have to contact us.

4.Information We Collect

Depending on how you interact with us, we may collect the following.

Information you provide

When you request a quote, submit a booking, or otherwise interact with us — including via our online booking form — we may collect:

Contact name, company name, email address and telephone number
Collection address and postcode
Preferred collection date and the urgency of your request
Site access information (for example, how our team should gain access to your premises) and any other instructions relevant to the collection
Details of the equipment involved — category, manufacturer, model, quantity, condition, and whether it is data-bearing
Photographs of the equipment, taken by you or by our team, to help us assess and document the job
Documents generated in connection with your job

In the course of providing our services we generate documents that include your contact and transaction details, including quotations, service agreements and terms, Waste Transfer Notes (and a photograph of the signed Waste Transfer Note taken at collection), invoices and, where you purchase data destruction, a Certificate of Sanitisation. These are stored securely as described in Section 10.

Payment information

Where you pay via a payment link, your payment is handled by our payment processor; we do not store your full card details.

Information collected automatically

When you visit our website, we may automatically collect:

IP address
Browser type and version
Device information
Operating system
Pages viewed
Date and time of your visit
Referring website
Cookie information

This information helps us improve our website, maintain security and understand how visitors use our services.

5.How We Use Your Information

We use your personal data to:

Respond to enquiries and provide quotations
Arrange and schedule collections
Deliver our collection and data destruction services, and generate the related documentation (manifests, chain of custody records, Waste Transfer Notes, Certificates of Sanitisation)
Process payments and issue invoices
Manage our customer relationships and communicate with you about your booking or job
Meet our record-keeping obligations to the Environment Agency and other regulators
Improve our website and customer experience
Maintain website and system security and prevent fraud and misuse
Comply with our other legal and regulatory obligations

We do not sell your personal information.

6. Our Lawful Basis for Processing

Under UK GDPR, we process personal data using one or more of the following lawful bases:

Performance of a contract — to provide the collection and/or data destruction services you have requested
Legal obligation — for example, our waste duty of care record-keeping under the Environmental Protection Act 1990, and our obligations under data protection law
Legitimate interests — for example, arranging logistics, maintaining business records, and preventing fraud
Consent — where you have opted in to marketing communications

The lawful basis depends on the nature of your interaction with Endpoint Works.

7. Marketing Communications

If you choose to receive marketing communications from us, we may send updates regarding our services, company news or industry information.

You may unsubscribe at any time by following the instructions within our communications or by contacting us directly.

We do not send unsolicited marketing communications.

8. Sharing Your Information

We only share personal data where necessary, and we will not name you as a client without your consent other than where necessary to operate the Services or comply with the law.

We use reputable UK/EU-based service providers to operate our booking, workflow, hosting and payment systems. These fall into the following categories:

A form and booking platform, to operate our online quote and booking form
A workflow automation system, to route and process bookings within our business
A cloud database and secure file-storage provider, to host job records and documents
A payment processor, to process payments made via payment link
Our disposal and downstream processing partners, for equipment assessed as unsuitable for reuse
Professional advisers, such as our accountants and insurers
Government authorities or regulators, where required by law — for example, the Environment Agency and the Information Commissioner’s Office

Full detail of the specific providers within each category is available on request. Where a third party processes personal data on our behalf, they are required to keep it secure and to only process it under our instructions.

We may also list equipment we have acquired for resale on third-party marketplaces. These listings describe the equipment only and do not include your personal data.

0203 916 6527

9. International Transfer

Where any of the service providers listed in Section 8 process personal data outside the United Kingdom, we ensure appropriate safeguards required under UK data protection law are in place. Details of these safeguards are available on request.

10. Data Security

We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, alteration, disclosure and misuse.

This includes restricted access to our systems, secure hosting of our database and document storage, and — for equipment in our physical custody — a documented, sealed and tracked chain of custody from collection to final disposition.

While no online system can be guaranteed completely secure, we continually work to protect the information entrusted to us.

11. Data Retention

We retain personal data only for as long as necessary to provide our services, meet our legal and regulatory obligations, resolve disputes, and maintain business records.

Retention periods vary by the type of record and the legal or regulatory requirement that applies to it — for example, our waste duty of care record-keeping obligations under the Environmental Protection Act 1990, and UK tax law for financial records.

We do not commit to a shorter retention period than these requirements allow. Full detail of our data retention schedule is available on request.

When information is no longer required, it is securely deleted or anonymised.

12. Your Rights

Under UK GDPR, you have the right to:

Access your personal information
Request correction of inaccurate information
Request deletion of your personal information where applicable
Restrict processing
Object to processing
Request data portability where applicable
Withdraw consent where processing relies on consent

To exercise your rights, please contact us using the details in Section 18.

Our website uses cookies to improve functionality, enhance user experience and analyse website performance. Further information can be found in our Cookie Policy.

13. Cookies

14. Third-Party Services

Our website may contain links to third-party websites, or use third-party services such as analytics, mapping or embedded content, in addition to the service providers named in Section 8. These third parties operate under their own privacy policies, and we encourage you to review them before providing personal information.

15.Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations or business operations. Any updates will be published on this page together with the revised “Last Updated” date

16.Complaints

If you are unhappy with how we have handled your personal information, we encourage you to contact us first so that we can attempt to resolve your concerns.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), with whom we are registered under reference ZC213698. The ICO can be contacted at ico.org.uk.

17.Contact Us

Endpoint Works Ltd

Capital Office, 124–128 City Road, London, EC1V 2NX

Company number: 17258216