Data Processing Schedule

These Data Processing Terms apply where Myagen Ltd trading as Recycle IT 4 Free processes personal data on behalf of a customer as part of an IT asset disposal, data erasure or data destruction service. They form part of our Terms & Conditions of Service where applicable.

Data Processing Schedule

Last updated: 12 November 2026

1. About This Schedule

This Data Processing Schedule (“Schedule”) forms part of the Terms & Conditions of Service between:

Myagen Ltd trading as Recycle IT 4 Free
Company Number: 08538033
Registered Office: 152 Chosen Way, Hucclecote, Gloucester, England, GL3 3DA

(“Recycle IT 4 Free”, “we”, “us” or the Processor)

and the customer receiving the relevant services (the Customer or Controller).

This Schedule applies where Recycle IT 4 Free processes personal data on behalf of the Customer in circumstances where the Customer is the controller and Recycle IT 4 Free acts as a processor for the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

It is intended to satisfy the requirements of Article 28 UK GDPR.

Where the parties enter into a separate written Data Processing Agreement covering the same processing, that agreement will take precedence to the extent of any conflict.

2. Roles of the Parties

The Customer determines the purposes for which personal data stored on its equipment is processed and is normally the data controller for that information.

Where Recycle IT 4 Free receives, stores, transports, erases, destroys or otherwise handles data-bearing equipment on the Customer’s instructions, we may act as the data processor in relation to personal data stored on that equipment.

Recycle IT 4 Free also processes certain information as an independent data controller for its own legitimate business and legal purposes.

This includes information such as:

  • customer and business contact details;

  • collection records;

  • Asset Transfer Notes;

  • contracts and purchase agreements;

  • invoices and accounting records;

  • compliance records;

  • service correspondence; and

  • records necessary to establish, exercise or defend legal claims.

Such controller processing is governed by our Privacy Notice and does not fall within this Schedule merely because it relates to the same customer or collection.

3. Customer Instructions

Recycle IT 4 Free will process Customer Personal Data only:

  • on documented instructions from the Customer;

  • as reasonably necessary to provide the agreed service; or

  • where processing is required by applicable law.

The agreed service request, quotation, booking, collection documentation, Asset Transfer Note, purchase documentation, email instructions and these Terms may together constitute the Customer’s documented instructions.

If we are legally required to process Customer Personal Data other than in accordance with the Customer’s instructions, we will inform the Customer before doing so unless the applicable law prohibits us from providing that information.

If we reasonably believe that an instruction infringes applicable data-protection law, we will inform the Customer without undue delay and may suspend the affected processing until the matter is resolved.

4. Subject Matter and Purpose of Processing

The subject matter of the processing is the secure handling and sanitisation or destruction of data-bearing IT equipment supplied to Recycle IT 4 Free.

Processing may include:

  • collection of data-bearing devices;

  • transportation;

  • receipt and secure storage;

  • recording equipment and storage-media identifiers;

  • temporary possession of personal data stored on devices;

  • technical processing required to perform data erasure;

  • physical destruction of storage media;

  • verification of erasure or destruction;

  • creation of data-destruction records and certificates;

  • uploading appropriate device and erasure information to Blancco where Level Two services are selected; and

  • use of an authorised specialist shredding provider where an agreed Level Four service is requested.

The purpose of this processing is to securely erase, sanitise or destroy personal information contained on customer equipment in accordance with the Customer’s documented instructions.

Recycle IT 4 Free does not process personal data contained on customer equipment for its own marketing, profiling, analytics or commercial exploitation.

5. Duration of Processing

Processing generally begins when Recycle IT 4 Free takes custody of the relevant data-bearing equipment and continues until the data has been successfully erased or the relevant storage media has been securely destroyed.

Personal information stored on customer devices is not intentionally retained once the agreed erasure or destruction process has been completed.

Service, audit and compliance records created in connection with the processing may be retained separately by Myagen Ltd as an independent controller where necessary for legal, contractual, regulatory or evidential purposes.

Such records will normally be retained for up to six years, subject to the retention provisions in our Privacy Notice.

6. Nature of Processing

Depending on the service selected, processing may involve:

  • collection;

  • transportation;

  • possession;

  • temporary storage;

  • organisation and recording of device information;

  • automated or manual initiation of secure erasure processes;

  • verification of erasure results;

  • recording serial numbers and identifiers;

  • generation of certificates;

  • uploading limited erasure-report information to an approved cloud platform;

  • physical crushing;

  • physical shredding through an authorised sub-processor; and

  • permanent deletion or destruction.

Our processes are intended to erase or destroy customer data rather than access, read or review its contents.

Recycle IT 4 Free personnel must not deliberately access customer files unless expressly instructed and authorised to do so as part of an agreed service.

7. Types of Personal Data

Because Recycle IT 4 Free receives complete storage devices and IT equipment without inspecting their contents, the precise categories of personal data stored on those devices may not be known to us.

Customer equipment may potentially contain:

  • names;

  • addresses;

  • telephone numbers;

  • email addresses;

  • employee information;

  • customer records;

  • supplier information;

  • account information;

  • documents;

  • photographs;

  • communications;

  • user profiles;

  • system records;

  • financial information; and

  • other personal information stored by the Customer.

Customer equipment may also contain special category personal data, criminal-offence data or other confidential or sensitive information, depending on the Customer’s activities.

Recycle IT 4 Free does not routinely inspect devices to determine whether such information is present.

The Customer is responsible for selecting a service level appropriate to the sensitivity of its information and informing Recycle IT 4 Free of any specific security or regulatory requirements relevant to the processing.

8. Categories of Data Subjects

Personal information stored on Customer equipment may relate to individuals including:

  • employees and former employees;

  • workers and contractors;

  • directors and officers;

  • customers and prospective customers;

  • suppliers;

  • business contacts;

  • service users;

  • members of the public; and

  • any other individuals whose personal information the Customer has stored on the relevant equipment.

The precise categories will depend upon the Customer’s organisation and use of the devices.

9. Data Destruction Services

9.1 Level One – Off-Site Data Erasure

For Level One services, data-bearing equipment is transported to our operating premises and erased by our staff using our approved standard erasure procedures, including KillDisk software where appropriate.

Level One is intended for non-sensitive or appropriately encrypted data where the standard service is suitable for the Customer’s requirements.

A generic Certificate of Data Destruction is issued in relation to the collection.

Where a storage device cannot be successfully erased, it is removed from the reuse process and securely physically destroyed.

9.2 Level Two – Blancco Data Erasure

Level Two is performed by Recycle IT 4 Free personnel using Blancco data-erasure software.

Following successful erasure, relevant erasure information is uploaded to the Blancco Management Portal/cloud platform in order to generate and retain the individual Blancco Certificate of Erasure.

Information intentionally supplied to Blancco is limited to information necessary for the erasure reporting and certification process.

This generally includes:

  • customer company name;

  • equipment information;

  • serial numbers or device identifiers;

  • erasure details; and

  • erasure results.

Recycle IT 4 Free does not intentionally provide individual customer contact names, telephone numbers, email addresses or the contents of files stored on erased devices to Blancco.

9.3 Level Three – On-Site Physical Destruction

Under Level Three, storage media is physically crushed at the Customer’s premises.

Relevant serial numbers and device information may be recorded before destruction for audit and certification purposes.

The destruction process is carried out by Recycle IT 4 Free personnel and may be witnessed by the Customer.

9.4 Specialist Third-Party Shredding

Where specifically requested and agreed, Recycle IT 4 Free may arrange physical shredding of storage media through an appropriately selected specialist third-party provider.

Because the specialist provider may receive data-bearing storage media before physical destruction, that provider will be treated as a sub-processor where applicable.

The identity of the specialist provider will be communicated to the Customer as part of the relevant quotation, booking or service arrangements.

This is not part of our normal standard processing route and is only used where specifically agreed.

10. WEEE and Downstream Recycling

Recycle IT 4 Free does not knowingly send data-bearing equipment containing unerased customer data to SWEEEP or another downstream WEEE processor.

Before data-bearing devices are transferred for end-of-life recycling, the relevant storage media is:

  • successfully erased;

  • removed; or

  • securely destroyed.

Accordingly, downstream WEEE processors are not normally acting as sub-processors in relation to Customer Personal Data.

11. Confidentiality

Recycle IT 4 Free will ensure that persons authorised to process Customer Personal Data:

  • are subject to appropriate confidentiality obligations;

  • receive appropriate instructions concerning the secure handling of customer information;

  • only access personal data where required for legitimate operational purposes; and

  • are made aware of their responsibilities under company data-protection and security procedures.

Unauthorised access to information stored on customer devices is prohibited.

12. Security Measures

Recycle IT 4 Free will maintain appropriate technical and organisational measures having regard to the nature of the processing and the risks involved.

Measures include, as appropriate:

  • documented chain-of-custody procedures;

  • controlled access to company premises;

  • restricted operational areas;

  • locked storage and quarantine areas;

  • secure storage of customer devices and media;

  • access limited to authorised personnel;

  • appropriate equipment and asset logging;

  • employee confidentiality requirements;

  • secure company IT systems;

  • password and access-control requirements;

  • multi-factor authentication where supported and implemented;

  • restrictions on unauthorised personal devices and external storage;

  • approved cloud-storage environments;

  • incident-reporting procedures;

  • personal-data breach procedures;

  • secure erasure procedures;

  • physical destruction procedures; and

  • documented processes for equipment that cannot be successfully erased.

Recycle IT 4 Free will review its security measures periodically and update them where reasonably necessary in response to changes in technology, risk, regulation or its operations.

13. Sub-Processors

The Customer gives Recycle IT 4 Free general written authorisation to appoint sub-processors where reasonably necessary to provide the agreed services.

Where a sub-processor processes Customer Personal Data on our behalf, we will ensure that a written agreement imposes appropriate data-protection obligations consistent with the requirements applicable to us under this Schedule.

Recycle IT 4 Free remains responsible for the performance of its sub-processors’ relevant data-protection obligations to the extent required by applicable law.

Current service providers that may act as sub-processors in relevant circumstances include:

Microsoft 365 / OneDrive

Used for secure business document storage, service records and related documentation where such material contains Customer Personal Data.

FastField / Quickbase

Used for field-service and collection documentation, which may include customer-supplied information, signatures, photographs, asset information, serial numbers and collection notes.

FastField is operated within the Quickbase group and its current contractual terms provide for processing of customer data on documented instructions.

Blancco

Used in connection with Level Two certified data erasure and the storage or generation of erasure reports and certificates.

Blancco’s management platform itself uses further infrastructure and service sub-processors, including cloud infrastructure providers.

Specialist Physical Shredding Provider

Used only where the Customer specifically requests an agreed Level Four shredding service.

The specific provider will be identified to the Customer as part of the relevant service arrangements.

14. Changes to Sub-Processors

Where we propose to add or replace a sub-processor that will process Customer Personal Data, we will provide the Customer with reasonable notice of the proposed change.

Notice may be provided to the Customer’s nominated business contact or other contact associated with the relevant agreement.

Where reasonably practicable, we will provide at least 14 days’ notice before the new sub-processor begins processing Customer Personal Data.

The Customer may object to the appointment during that period where it has reasonable data-protection grounds for doing so.

The parties will work in good faith to resolve any reasonable objection.

Where an objection cannot reasonably be resolved, either party may terminate the affected processing service without affecting unrelated services.

Where an urgent change is necessary to protect security, comply with law or maintain essential service continuity, we may implement the change sooner but will notify the Customer as soon as reasonably practicable.

15. International Transfers

Recycle IT 4 Free will not knowingly make a restricted transfer of Customer Personal Data outside the United Kingdom unless:

  • the transfer is made in accordance with the Customer’s documented instructions; and

  • an appropriate lawful transfer mechanism is in place.

Where applicable, safeguards may include:

  • UK adequacy regulations;

  • the UK International Data Transfer Agreement;

  • the UK Addendum to approved Standard Contractual Clauses; or

  • another transfer mechanism permitted by applicable UK data-protection law.

Some cloud providers or their authorised sub-processors may process data internationally subject to such safeguards.

16. Data Subject Rights

Taking into account the nature of the processing, Recycle IT 4 Free will provide reasonable assistance to the Customer, where technically and operationally possible, to enable the Customer to respond to requests from individuals exercising their data-protection rights.

If we receive a request directly from an individual concerning Customer Personal Data that we process solely on behalf of the Customer, we will normally:

  • not respond substantively without the Customer’s instructions unless legally required to do so; and

  • forward or notify the Customer of the request without undue delay where reasonably possible.

The Customer remains responsible for determining how to respond to the request.

17. Personal Data Breaches

Recycle IT 4 Free maintains procedures for identifying, investigating, recording and responding to personal-data breaches.

Where we become aware of a personal-data breach involving Customer Personal Data processed on behalf of the Customer, we will notify the Customer without undue delay.

Where available and relevant, the notification will include information concerning:

  • the nature of the breach;

  • the data or equipment affected;

  • the likely consequences;

  • measures taken or proposed to contain or mitigate the breach; and

  • information reasonably available to assist the Customer with its own regulatory obligations.

Where all information is not immediately available, it may be provided in stages as the investigation progresses.

Recycle IT 4 Free will reasonably cooperate with the Customer in relation to the Customer’s obligations to assess and, where necessary, report the breach.

The obligation on Recycle IT 4 Free as processor is to notify the Controller without undue delay; responsibility for determining whether notification to the ICO or affected individuals is required normally remains with the Controller.

18. Assistance With Compliance

Taking into account the nature of the processing and information available to us, Recycle IT 4 Free will provide reasonable assistance to the Customer where required in connection with:

  • security of processing;

  • personal-data breach assessment;

  • regulatory breach notifications;

  • notification of affected individuals;

  • data protection impact assessments; and

  • prior consultation with the Information Commissioner’s Office where required.

The Customer remains responsible for its own compliance obligations as controller.

19. Deletion or Return of Customer Personal Data

At the end of the relevant processing, Recycle IT 4 Free will, at the Customer’s choice and where applicable, delete or return Customer Personal Data processed solely on the Customer’s behalf, unless applicable law requires continued retention.

The Customer acknowledges that the principal purpose of our data-erasure and destruction services is the permanent deletion or destruction of information.

Where the Customer has instructed us to securely erase or physically destroy data, that instruction constitutes the Customer’s instruction to delete the relevant Customer Personal Data and it will not be possible to return that data after the process has been completed.

Recycle IT 4 Free will not retain copies of files contained on erased or destroyed customer storage media.

This provision does not require deletion of separate records that Myagen Ltd is entitled or required to retain as an independent controller, such as contractual, regulatory, financial, asset-transfer, certification or evidential records.

20. Records and Evidence of Compliance

Recycle IT 4 Free will maintain appropriate records concerning its processing activities to the extent required by applicable law.

We will make available to the Customer information reasonably necessary to demonstrate compliance with the processor obligations contained in this Schedule and Article 28 UK GDPR.

This may include relevant policies, registration information, security information, certificates, service documentation or other reasonable compliance evidence.

21. Audits and Inspections

The Customer may request information reasonably necessary to verify our compliance with this Schedule.

Where possible, the parties will first seek to satisfy the Customer’s requirements through:

  • documentation;

  • questionnaires;

  • policy information;

  • certificates;

  • remote meetings; or

  • other proportionate compliance evidence.

Where an on-site audit is reasonably necessary, Recycle IT 4 Free will permit and contribute to an appropriate audit or inspection by the Customer or an independent auditor appointed by the Customer.

Unless urgent circumstances reasonably require otherwise:

  • reasonable prior written notice must be provided;

  • audits will take place during normal business hours;

  • the audit must not unnecessarily disrupt our operations;

  • the auditor must comply with appropriate confidentiality and security requirements;

  • access will be limited to information and areas relevant to the processing; and

  • the Customer will bear its own audit costs.

We may restrict access where necessary to protect other customers’ confidential information, security arrangements or legal obligations, provided that doing so does not prevent the Customer from reasonably verifying our compliance.

These restrictions do not limit the lawful powers of the Information Commissioner’s Office or another competent regulator.

22. Customer Responsibilities

The Customer is responsible for:

  • ensuring that it has a lawful basis for processing the personal data contained on equipment;

  • ensuring that it has authority to instruct us to erase or destroy that data;

  • providing lawful documented instructions;

  • selecting a data-destruction service appropriate to the nature and sensitivity of the information;

  • informing us of any unusual or enhanced security requirements before collection;

  • maintaining any backups that the Customer wishes to retain;

  • ensuring its own compliance with transparency and data-subject rights requirements; and

  • complying with its own obligations as controller under applicable data-protection law.

The Customer acknowledges that data erasure and physical destruction are intended to be irreversible.

23. Processing Outside Instructions

Recycle IT 4 Free will immediately inform the Customer if, in our reasonable opinion, an instruction infringes applicable data-protection law.

If Recycle IT 4 Free determines the purposes and means of processing Customer Personal Data outside the Customer’s instructions, it may become a controller in relation to that processing and will be responsible for complying with the obligations applicable to that role.

24. Liability

Liability arising under this Schedule will be governed by the applicable liability provisions of the main agreement or Terms & Conditions of Service between the parties, subject always to any liability that cannot lawfully be excluded or limited.

Nothing in this Schedule limits any statutory liability or regulatory responsibility imposed directly upon either party by applicable data-protection law.

25. Order of Precedence

If there is a conflict concerning the processing of Customer Personal Data, the following order will apply:

  1. any specifically agreed and signed Data Processing Agreement;

  2. this Data Processing Schedule;

  3. any transaction-specific written agreement;

  4. the Terms & Conditions of Service.

Other provisions of the main agreement continue to apply where they do not conflict with this Schedule.

26. Governing Law

This Schedule is governed by the laws of England and Wales.

The courts of England and Wales will have jurisdiction in accordance with the provisions of the main agreement between the parties.

Schedule 1 – Processing Details

Subject matter:
Secure collection, custody, erasure and/or destruction of personal data contained on customer IT equipment and storage media.

Duration:
From receipt or collection of the relevant data-bearing equipment until successful data erasure or physical destruction, together with any limited period reasonably required to complete verification and certification.

Nature of processing:
Collection, transportation, storage, technical processing, erasure, deletion, destruction, verification and certification.

Purpose:
Secure sanitisation or destruction of data-bearing equipment in accordance with the Customer’s instructions.

Types of personal data:
Potentially any personal data stored by the Customer on the relevant equipment. The contents are not normally inspected or known to Recycle IT 4 Free.

Special-category/criminal-offence data:
May potentially be present depending on the Customer’s activities. Recycle IT 4 Free does not routinely inspect equipment to identify such data.

Categories of data subjects:
Employees, former employees, customers, service users, suppliers, contractors, business contacts and other individuals whose information has been stored by the Customer.

Frequency:
As required for individual collections, projects or ongoing IT asset disposal arrangements.

Schedule 2 – Principal Security Measures

Recycle IT 4 Free’s security measures include, where relevant:

  • documented chain of custody;

  • restricted access to customer equipment;

  • secure operational and storage areas;

  • locked cages and quarantine/storage areas;

  • authorised personnel controls;

  • employee confidentiality requirements;

  • secure company IT systems;

  • role-based access and authentication controls;

  • controlled handling of storage media;

  • prohibition on unauthorised access to customer files;

  • standardised erasure procedures;

  • verified data-erasure software;

  • secure physical destruction procedures;

  • escalation and destruction of failed storage devices;

  • security-incident reporting;

  • personal-data breach procedures;

  • controlled onward transfer of sanitised equipment; and

  • no intentional transfer of unerased data-bearing equipment to downstream WEEE processors.

Schedule 3 – Relevant Service Providers and Sub-Processors

Microsoft 365 / OneDrive
Purpose: Business document and service-record storage where Processor Personal Data is included.

FastField / Quickbase
Purpose: Collection and field-service records, including forms, signatures, photographs, asset information and collection notes.

Blancco
Purpose: Level Two erasure reporting, certificate generation and storage of relevant device and erasure information.

Specialist shredding provider
Purpose: Physical destruction of data-bearing media where a Level Four service is expressly requested. The provider will be identified to the Customer before the relevant service is carried out.

Downstream WEEE processors are not normally included because data-bearing media is erased, removed or destroyed before equipment is transferred to those organisations.