Technical and security data
IP-derived rate-limit identifiers, timestamps, request data, session identifiers and security logs may be processed to operate the service, prevent abuse and protect reports and administration.
Data protection
GDPR and Privacy Notice
This notice explains how personal data may be processed when a visitor uses WasteSpot, reports illegal dumping, suggests a collection place, requests symbol identification from a photo, contacts the operator, consents to optional analytics or is shown advertising through Google AdSense.
1. Who is responsible for processing
WasteSpot is an independently operated informational website. The person operating WasteSpot determines why and how personal data submitted through the service is processed and is responsible for those processing activities. WasteSpot is not a company, public authority, recycling operator or collection service.
Website: wastespot.com
Privacy contact: privacy@wastespot.com
2. Data processed and why
Current map location
When a visitor presses Show my location, the browser supplies coordinates and an accuracy estimate. WasteSpot uses them to place the You are here marker and search the visible map area. Map bounds are sent to WasteSpot search endpoints and may appear in ordinary hosting logs. Device coordinates are not published as a report or collection place unless the visitor separately submits that information. Coordinates written to the shareable page URL are reduced in precision.
Illegal-dumping reports
A report may contain coordinates, category, description, optional location note, optional photograph and optional contact email. Approved report content may become public, but the contact email is not published.
Collection-place suggestions
A suggestion may contain coordinates, place name and type, accepted materials, description, address, provider, opening information, supporting links, optional photograph and optional contact email. Approved place information may become public, but the contact email is not published.
Symbol photo identification
When the optional scanner is enabled, a visitor can submit a JPEG, PNG or WebP image of a waste or packaging symbol. WasteSpot re-encodes it as a temporary JPEG, removes embedded metadata, sends it server-side to the OpenAI Responses API for comparison with the WasteSpot Symbols catalogue, and deletes the WasteSpot copy immediately after the request. The API key remains server-side.
Contact
Messages sent to the listed contact addresses are processed to answer the request and maintain relevant correspondence.
Optional analytics
Google Analytics is loaded only when it is configured by the operator and the visitor has actively consented to analytics in the cookie controls.
Advertising and consent signals
When Google AdSense is enabled, Google and participating ad technology providers may process browser and device information, IP-derived location information, ad interactions, cookies or local storage, and regional consent or privacy signals to deliver and measure ads, prevent invalid traffic and personalize advertising where permitted by the visitor's choices and applicable law.
3. Legal bases
- Legitimate interests: service security, fraud and abuse prevention, basic diagnostics and operation of the public-interest waste information service, balanced against visitor rights.
- Steps requested by the user: responding to contact or processing a report or collection-place suggestion the user chooses to submit.
- Consent: optional analytics, advertising storage and personalization where consent is required, and any optional data whose processing is expressly presented as consent-based. WasteSpot analytics consent may be withdrawn through Cookie settings; Google advertising choices can be changed through the Google privacy controls shown on eligible AdSense pages.
- Legal obligation: where records must be retained or disclosed under applicable law.
4. Recipients and external services
Data may be processed by the hosting provider and authorised administrators. WasteSpot also uses technical and public-data services:
- OpenStreetMap tile servers for the map displayed in the browser;
- Nominatim and Overpass through WasteSpot server-side proxy endpoints for location and waste-place search;
- official open-data portals, Eurostat, World Bank and national publishers for mapped places and country indicators;
- OpenAI Responses API, only when photo identification is enabled and a visitor actively submits a photo; WasteSpot sends the request with
store=falseand does not create an OpenAI file object; - Google Analytics only when enabled and accepted;
- Google AdSense and participating Google ad technology providers when advertising is enabled, subject to regional consent and privacy choices.
External links lead to third-party websites governed by their own privacy notices. For advertising, see Google advertising technologies and the Google Privacy Policy.
5. International transfers
OpenAI and Google, where optional services are enabled, may process data outside the European Economic Area. Applicable provider settings, contractual safeguards and transfer mechanisms are reviewed for the services that are actually enabled. For Google advertising, processing and transfers are also governed by the visitor's regional privacy choices and Google's applicable terms and privacy documentation.
6. Retention
- Session cookies expire when the browser session ends.
- The consent preference is retained for up to 180 days unless deleted earlier.
- Advertising cookies, consent strings and advertising-related data are retained according to the applicable Google services, regional settings and the visitor's choices. WasteSpot does not set the retention periods used inside Google's advertising systems.
- Rate-limit records are kept for the configured security window and are automatically filtered as they expire.
- Illegal-dumping reports, collection-place suggestions, photographs and optional contact emails are retained for moderation, publication, correction and audit needs until deleted under the operator's retention procedure.
- A symbol-identification photo is deleted from WasteSpot storage immediately after the API request and is not added to reports or suggestions. OpenAI states that API data is not used for model training by default; standard abuse-monitoring retention may still apply for up to 30 days unless the API organisation has approved data-retention controls. See OpenAI data controls.
- Correspondence is retained only as long as necessary for the request and applicable legal obligations.
7. Your rights
Depending on the circumstances, a person may request access, rectification, erasure, restriction, portability, objection and withdrawal of consent. A complaint may also be lodged with the competent supervisory authority. Requests should identify the relevant report, place suggestion or interaction without sending unnecessary personal data.
8. Automated decisions and children
WasteSpot does not use submitted personal data for automated decisions producing legal or similarly significant effects. The service is not designed to collect personal data from children. Reports and place suggestions should never include faces, vehicle registrations or unnecessary identifying details.
9. Changes
This notice may be updated when the service, providers or legal requirements change. The date at the top identifies the current version.