Privacy notice

ECET Solutions Ltd · last changed 8 September 2026

ScrapLog is a record-keeping service for scrap metal dealers, run by ECET Solutions Ltd (ECET). This notice says what personal information the service holds, why, for how long, and how to raise a question or a complaint about it.

The yard and ECET

A yard that uses the service decides what it records and why. In data protection terms the yard is the controller of its sellers’ details, and ECET is its processor. ECET holds that information on the yard’s instructions.

ECET is the controller of the accounts used to sign in: the email addresses, names and roles of the people the yard adds, and the record of what they did in the service.

If you sold metal to a yard, the yard is responsible for telling you how it uses your details. This notice explains ECET’s part.

The law behind the record

The Scrap Metal Dealers Act 2013 requires a dealer to verify the full name and address of every person it buys metal from, to keep a copy of the document used, and to record every payment. The service records these because the law requires the yard to hold them. The legal basis is a legal obligation on the yard, under Article 6(1)(c) of the UK GDPR.

Where a yard holds an environmental permit and has turned waste tracking on in its settings, the law also requires a record of each load of waste it receives, and the service sends that record to Defra on the yard’s behalf. The record names the yard, its site and permit, who brought the waste and what it was; it carries no identity document, photograph or bank details. A yard that has not turned it on sends nothing to Defra.

What the service holds

Each row names one kind of information, who it is about, why it is held, and how long it is kept.

Full name, address, postcode and vehicle registration
About
a person selling metal to the yard
Why
the Scrap Metal Dealers Act 2013 requires the yard to verify and record them
Kept for
three years from the last sale, at least
The type of ID document shown, its dates, and a photograph of it
About
a person selling metal to the yard
Why
the Act requires the yard to keep a copy of the document
Kept for
three years from the sale it was checked for
A VAT number, where the seller is VAT registered
About
a business selling metal to the yard
Why
self-billing under the VAT rules
Kept for
six years
The metal, the weights, the prices, and each payment: its method, amount, reference and the name of the person who made it
About
a sale
Why
the Act, the VAT rules and the yard’s own accounts
Kept for
six years
A sort code, an account number and the name on the account, where a seller gives them, with every change and who made it
About
a person selling metal to the yard
Why
so the yard can pay them by bank transfer on every visit; the money itself moves from the yard’s own bank
Kept for
as long as the payment records they were used for, six years
A copy of a cheque, where a cheque is used
About
a payment
Why
the Act requires the yard to keep it
Kept for
three years
The name and address of a business the yard sells metal to
About
a buyer
Why
the Act’s record of where metal went
Kept for
three years
Photographs of a load, or of one metal in it
About
a load
Why
the yard’s own record of what came in
Kept for
as long as the sale record
Name, email address, role, and the record of what each person did in the service
About
the people who work at the yard
Why
running the service, and the law’s rule that a record names who made it
Kept for
while the account exists, then with the records it signed
A gate PIN, stored so it cannot be read back
About
a person who works the gate
Why
naming who recorded a load on a shared phone or tablet
Kept for
while the account is active
Which phones or tablets are set up for the gate, and when each was last used
About
the yard’s gate devices
Why
only a device the owner set up can unlock the gate
Kept for
while the device is set up, then as a record that it was
Site notes: incidents, refused loads, complaints, machine checks and shifts
About
the yard’s working day
Why
the yard’s own site log
Kept for
as long as the yard keeps its log
Technical logs: the IP address of the device and the time of each request
About
every visit to the service
Why
keeping the service secure and finding faults
Kept for
a short period, by the hosting providers under their own terms

A seller’s bank details are seen only by the yard’s office and owner, never at the gate, and are never sent to Defra. A payment is recorded as a method, an amount, a reference and the name of the person who made it; the service never moves money.

Where it is kept

The yard’s records are stored in the United Kingdom, in the London region of Supabase, which provides the database, the file storage and the sign-in. The service runs on Vercel, with its server code in London.

Photographs of ID documents and cheques are kept in private storage. A link to one lasts sixty seconds and is issued only to a signed-in person the yard has given that role.

Records are append-only. Once a load is posted, its figures cannot be edited or deleted. A mistake is corrected by a new record that says what changed.

Supabase Pte. Ltd is based in Singapore and Vercel Inc. in the United States. Both providers’ terms include a data processing addendum carrying the UK Information Commissioner’s addendum for transfers out of the United Kingdom, and their staff reach the systems only for support under those terms.

When the software itself fails, a fault report goes to Sentry (Functional Software, Inc., United States), stored in the European Union. A fault report holds what the software was doing when it stopped — the screen or route, the error’s name and its first line, the yard’s reference number and the moment. It holds nothing about a load, a person or a document. The name, the address, the photograph, the sign-in cookie and the email address stay in the yard’s records, in London. Sentry’s terms include the same data processing addendum and the UK addendum, and the reports are kept for thirty days.

Who can see it

Inside the yard, access follows the role the owner gives each person. The gate sees today’s loads and the names it needs. The office sees the register, prices and payments. The owner sees everything, including the record of changes.

ECET reaches a yard’s records only to fix a fault or at the yard’s request, and every action in the service is logged.

Defra receives a record of a load only where the yard has turned waste tracking on. That record names the yard, the waste, its weight and who carried it. It never includes an ID document or a photograph.

Where the yard connects its own Xero, the loads it bought become bills in that Xero, as the yard chooses: the customer’s name and address as a contact, and the load’s number, date, metals, weights, prices and deductions. It never includes an ID document or a photograph. A customer’s bank details — their sort code and account number — go to the yard’s Xero only when the yard adds that customer to Xero from ScrapLog, so the yard can pay them there. The keys to the yard’s Xero are kept sealed, and the yard can disconnect it at any time.

The Act gives constables and council officers a right to inspect a dealer’s records on the site. The yard may also give its records to the police or the Environment Agency where the law requires it.

ECET does not sell personal information. ECET does not use it for advertising.

How long it is kept

The Scrap Metal Dealers Act requires the yard to keep its records, including the copy of the ID document, for three years. The VAT rules require the money side of a sale to be kept for six years. Hazardous waste records on a permitted site are kept for five years.

The service keeps a yard’s records for as long as the yard uses it, and for those periods after.

Deleting the copy of an ID document at the end of its three years is not yet automatic. The service will change when that is built, and this notice with it.

Account details are kept while the account exists. The record of what a person did stays with the yard’s records, because the law requires each record to name who made it.

Your rights

You can ask for a copy of the information held about you, ask for a mistake to be corrected, and ask for information to be deleted or its use restricted.

Some of those rights are limited by the Act. A yard cannot delete a seller’s record inside the three years the law requires it to be kept. A request in that period is answered with the reason.

For a seller’s record, ask the yard you sold to. For an account, or anything about ECET’s own use of information, contact ECET using the details at the end of this notice.

Cookies and the device

The service sets a cookie to keep a signed-in person signed in, and a second one on a gate device (a phone or tablet) the owner has set up. Both are needed for the service to work. There are no advertising cookies. There is no analytics service.

A gate device keeps loads recorded with no signal until it has one, together with the name and address of a first-time seller recorded in the same way. Photographs go straight to private storage; the service does not keep them on the device, though a browser may hold a copy in its own cache as it does for any picture, until it is cleared.

The service keeps the gate’s own pages on the device so the gate opens with no signal. The office’s pages are not kept on the device.

Complaints

A complaint about how personal information has been handled can be made to ECET by post or by email. ECET acknowledges a complaint within 30 days of receiving it, and then says what it found and what it did.

Post: ECET Solutions Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
Email: the company’s email address is being set up and will be shown here

Print this page and post the form below, or copy its headings into an email.

Complaint form

Name

How to reach you

The yard involved

What happened

When it happened

What you want done

Date

You can also complain to the Information Commissioner’s Office at ico.org.uk, or by calling 0303 123 1113.

The company

Name: ECET Solutions Ltd
Registered in: England and Wales
Company number: 17415915
Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
ICO registration: ZC240149. The entry is public: it names ECET Solutions Ltd, this address and the trading name ScrapLog.

This notice changes when the service changes. The date at the top is the date of the last change.