Privacy Policy
Last Updated: November 5, 2026
This Privacy Policy (“Policy”) describes how the WM group, which includes Stericycle, Inc. and its affiliates, (referred to as "we", "us" or "our"), including Waste Management Service Center, Inc. and its affiliates (collectively, “we,” “our,” or “us”) collects, uses, discloses and otherwise processes “personal data” related to uses of our websites, mobile applications, services and other interactions with us by our business contacts, suppliers, representatives/officers and directors of current and prospective customers (together, “you” or “your”).
The following entities are included in the affiliates of Stericycle, Inc. as part of the WM group:
Belgium
Shred-it Belgium – Rue Bollinckx 310, Bruxelles, Belgium 1190, Belgium
France
Shred-it France – 12 rue Edmond Michelet, ZA La Fontaine du Vaisseau, Neuilly Plaisance, France 93360
Germany
Shred-it GmbH - Klausnerring 3, 85551 Kirchkeim, Germany 85551, Germany
Ireland
SRCL Limited – 6A Westgate Business Park, Upper Ballymount Road, Ballymount, Dublin, Ireland D24 WFK5, Ireland
SRCL Ireland Limited - 6A Westgate Business Park, Upper Ballymount Road, Ballymount, Dublin, Ireland D24 WFK5, Ireland
Shred-it ROI Limited - A Westgate Business Park, Upper Ballymount Road, Ballymount, Dublin, Ireland D24 WFK5, Ireland
Luxembourg
Mobile Shredding Luxembourg - 22, rue de l'Industrie, L-8399 Windhof, Luxembourg, Luxembourg
Netherlands
Shred-it Netherlands BV - De Hemmen 50, 9206AG,Drachten, Friesland, Netherlands
Stericycle BV - Basisweg 10,Amsterdam, Netherlands 1043 AP, Netherlands
United Kingdom
Shred-it Limited - Ground Floor, 177 Cross Street, Sale, Manchester, United Kingdom M33 7JQ, United Kingdom
SRCL Limited – Indigo House, Sussex Avenue, Leeds, West Yorkshire, United Kingdom LS10 2LF, United Kingdom
Stericycle Environmental Services Group Limited – Indigo House, Sussex Avenue, Leeds, West Yorkshire, United Kingdom LS10 2LF, United Kingdom
Stericycle International Limited - Indigo House, Sussex Avenue, Leeds, West Yorkshire, United Kingdom LS10 2LF, United Kingdom
Stericycle International Holdings Limited - Indigo House, Sussex Avenue, Leeds, West Yorkshire, United Kingdom LS10 2LF, United Kingdom
Shred-it Limited - Ground Floor, 177 Cross Street, Sale, Manchester, United Kingdom M33 7JQ, United Kingdom
This Policy applies to those websites, domains and URLs (collectively, the “Sites”), and when we process your personal data for the purposes set out in Section 3.
This Policy is intended to provide information relevant to visitors and individuals in the European Union, European Economic Area and United Kingdom. Please review it carefully to understand how we process your personal data and the rights available to you.
In addition to reading this Policy, please review our Terms and Conditions, which governs your use of the Sites.
Depending on the services we are providing, we may collect and process personal data on behalf of our business customers. We process such personal data in the context of the provision of services to a customer. Please note that in such situations, our customer is the controller of your personal data and you should refer to the customer’s privacy notice to understand how your personal data is handled.
For the purposes of this Policy, Stericycle Inc. and/or the relevant affiliate that operates the website you are currently visiting and/or with whom you are interacting otherwise acts as the controller of your personal data. For information on how to contact us, please see Section 11. In this Policy, you can find out more about each of the following (as applicable to you):
Contents of this Policy
2. How We Collect Personal Data
3. Purposes and Legal Basis for Processing Personal Data
4. Recipients of Personal Data
9. International Transfers of Personal Data
12. Contact Us
We may collect information that alone or in combination with other information could be used to identify you, which we refer to as “personal data.” We limit collection, use, disclosure and retention of personal data to what is reasonable and necessary for the purposes described in this Policy and as otherwise permitted by applicable law.
Depending on how you interact with us, such as if you are a Site visitor, customer (including a business customer representative), service provider, business contact, supplier, we or our service providers may collect the following categories of personal data:
- Identifiers and Contact Information. Such information may include your name, telephone number, e-mail address, date of birth, driver's license numbers, where necessary, user or account identifiers, and home, business or mailing address.
- Payment Information. Information such as credit or debit card details, expiration date, bank account or routing information, and related transaction details.
- Commercial Information. This includes information about products and services considered or purchased, primary usage, amounts of products ordered, reseller or promotional codes, auto-delivery selection and marketing preferences.
- Business Information. Information such as your employer, job title, work email, professional memberships and other business contact details.
- Device Information. This includes information collected from your use of our Sites, such as your device model, operating system, unique device identifiers, mobile network information, server logs, IP address and MAC address.
- Digital or Technical Information. Such information may include visits to our Sites, pages visited, system activity, hardware settings, browser type and language, the date and time of your request, referral URL, broad geographical information and navigation patterns. We use tracking pixels in customer emails as default to support reporting open and click through rate reporting. Both support open tracking consent.
- Communication Logs. Such information may include phone number, calling-party number, forwarding numbers, time and date of calls, duration of calls and SMS routing information, where allowed by applicable law.
- Certain Specialised Information. If you use certain Sites, we may collect and store information locally on your device, such as browser web storage (including HTML5) and application data caches.
- Images or Videos. Such information may include photos and videos from cameras on our trucks to analyse the use and delivery of our services, for example to determine whether containers have been overfilled or damaged or whether there is contamination, and to enforce our terms of service. We also use CCTV at our buildings and facilities.
- Other Information You Share With Us. This includes information you provide through your communications with us or customer support, including the nature of an enquiry or other information shared.
We collect personal data from or about you in connection with the products and services we provide to you. We may collect it directly from you, automatically through your interactions with us, or from other sources described below.
Information You Provide to Us
We, or our service providers, may collect personal data directly from you, when you:
- Visit and use our Sites.
- Purchase our products or services.
- Register for an account on one of our Sites.
- Participate in one of our promotions.
- Sign up to receive communications from us.
- Contact us directly (via phone, email, etc.) or engage with us through an available chat feature on a Site
- Visit our social media pages.
- Interact with us in-person (e.g., visit one of our physical locations, engage with us at an in-person event, etc.).
Information We Collect Automatically
When you access and engage with our Sites or interact with our online media and content (including advertisements), we automatically collect information about your browser, device and activity. We and our service providers may use tracking technologies, such as cookies, pixel tags, web beacons and similar technologies, to collect information automatically. Where required by applicable law, we will obtain consent before using non-essential tracking technologies.
To learn more about our use of Cookies and other similar tracking technologies and how you can control them, please see our Cookie Policy.
Information From Other Sources
We may receive your personal data from other sources, as permitted by law, including the following categories of parties:
- Our group companies and affiliates, including their employees and representatives.
- Our service providers and vendors, including waste vendors, employment-related vendors, payment processors, information technology vendors and financial institutions.
- Our customers, clients, business contacts, suppliers and co-sponsors of promotions or events, including companies with which we work.
- Our analytics and advertising providers, including online advertising networks and analytics providers.
- Social media platforms and third-party websites, including platforms that allow you to integrate third-party account data with us. The data we receive depends on the platform’s policies and your settings.
- Publicly available information from credit reference agencies, data brokers and data aggregators that supplement information we already hold about you (e.g., CreditSafe).
- Cities, municipalities and other governmental entities and agencies to which we provide services or from which we receive information.
We process personal data only where we have an appropriate lawful basis under Art. 6(1) of the GDPR or UK GDPR. The table below sets out the purposes of our processing, the relevant categories of personal data and the applicable legal basis. Where processing is based on consent, you may withdraw your consent at any time, although this will not affect the lawfulness of processing carried out before withdrawal.
Please note that the provision of your personal data may, at times, be necessary for us to comply with law, to enter into a contract or other arrangement with us or to receive our services and products as requested by you. If you choose not to provide your personal data in such circumstances, some features and services may not be possible or fully functional.
Where the provision of personal data is necessary to enter into or perform a contract with you, or to comply with a legal obligation, failure to provide the requested data may mean that we are unable to provide the relevant products or services, process your enquiry, or fulfil our legal obligations. Where consent is the legal basis, you are free to refuse or withdraw consent without any consequence for the provision of our services, except that certain features reliant on that processing may not be available.
Purpose of Processing | Categories of Personal Data | Lawful Basis |
Contact You – contact and communicate with you, respond to enquiries, provide customer service and provide information about our products and services. | Identifiers and Contact Information; Business Information; Communication Logs; Other Information You Share With Us. | Art. 6(1)(b) GDPR/UK GDPR – where processing is necessary to take steps at your request prior to entering into a contract or to perform a contract with you; otherwise, Art. 6(1)(f) GDPR/UK GDPR – our legitimate interests in managing relationships, responding to enquiries and providing customer service. |
Provide Our Products, Services and Customer Support – provide the products and services you request, service accounts, fulfil orders and process transactions and returns. | Payment Information; Commercial Information; Identifiers and Contact Information; Business Information; Other Information You Share With Us. | Art. 6(1)(b) GDPR/UK GDPR – where processing is necessary to take steps at your request prior to entering into a contract or to perform a contract with you; otherwise, Art. 6(1)(b) GDPR/UK GDPR – where processing is necessary to administer our agreement with you or the company that you work for; and otherwise Art. 6(1)(f) GDPR/UK GDPR - our legitimate interests for delivering our services, customer support and account management. |
Maintain Our Services – provide, administer, manage, troubleshoot and improve our Sites and services. | Identifiers and Contact Information; Device Information; Digital or Technical Information; Communication Logs; Certain Specialized Information; Cookies and similar tracking technologies. | Art. 6(1)(f) GDPR/UK GDPR – our legitimate interests in administering, securing and improving the Sites and services; Art. 6(1)(a) where consent is required for non-essential cookies or analytics. |
Protect Our Company and Interests – protect our Sites, systems, personnel, customers and service providers and prevent, detect and investigate fraud, misuse and other unlawful activity. | Identifiers and Contact Information; Device Information; Digital or Technical Information; Communication Logs; Images or Videos; Other Information You Share With Us. | Art. 6(1)(c) GDPR/UK GDPR where processing is required by law (i.e. for regulatory and / or corporate governance requirements) otherwise Art. 6(1)(f) GDPR/UK GDPR – our legitimate interests in security, fraud prevention and protecting people, property and systems, including through CCTV;. |
Comply with Law – comply with applicable legal, regulatory, reporting, accounting and other obligations. | Identifiers and Contact Information; Payment Information; Business Information; Communication Logs; Device Information; Digital or Technical Information; Other Information You Share With Us. | Art. 6(1)(c) GDPR/UK GDPR – compliance with a legal obligation e.g., tax, accounting, record-keeping, regulatory or corporate governance requirements); otherwise Art. 6(1)(f) GDPR/UK GDPR where processing is otherwise necessary to protect legal interests or demonstrate compliance. |
Business Operations – support troubleshooting, operational support, data analysis, testing, audits, assessments, events management, research and development and related internal operations. | Identifiers and Contact Information; Business Information; Commercial Information; Device Information; Digital or Technical Information; Communication Logs; Other Information You Share With Us. | Art. 6(1)(f) GDPR/UK GDPR – our legitimate interests in operating and improving our business. |
Establishment, Exercise or Defence of Legal Claims – establish, exercise or defend legal claims and support internal or external investigations. | The categories may vary case by case and may include Identifiers and Contact Information; Business Information; Communication Logs; Payment Information; Device Information; Digital or Technical Information; Cookies and similar tracking technologies; and Other Information You Share With Us. | Art. 6(1)(f) GDPR/UK GDPR – our legitimate interests in establishing, exercising or defending legal claims. |
Marketing and Promotions – market and promote our products and services, issue newsletters and manage advertising or campaign activity. | Identifiers and Contact Information; Business Information; Communication Logs; Marketing preferences; Device Information; Digital or Technical Information; Cookies and similar tracking technologies. | Art. 6(1)(f) GDPR/UK GDPR – our legitimate interests in marketing to existing customers where permitted; for electronic marketing messages to existing customers in the European Economic Area: Local law implementing Art. 13 ePrivacy Directive for the processing of personal data related to electronic direct marketing activities; otherwise Art. 6(1)(a) where consent is required by law for use of tracking technologies and marketing. |
Customisation and Personalisation – tailor content, Site functionality, communications, promotions and other interactions to your preferences and interests. | Commercial Information; Marketing preferences; Device Information; Digital or Technical Information; Cookies and similar tracking technologies. | Art. 6(1)(f) GDPR/UK GDPR – our legitimate interests in improving relevance and user experience; Art. 6(1)(a) where consent is required for non-essential tracking or profiling. |
Research and Development – conduct research, testing and development relating to our Sites, products, services and operations. | Commercial Information; Device Information; Digital or Technical Information; Other Information You Share With Us. | Art. 6(1)(f) GDPR/UK GDPR – our legitimate interests in research, development and improving our services; otherwise Art. 6(1)(a) where consent is required. |
Surveys and Feedback – invite you to participate in surveys, request feedback and assess satisfaction with our products and services. | Identifiers and Contact Information; Business Information; Communication Logs; Commercial Information; Other Information You Share With Us. | Art. 6(1)(f) GDPR/UK GDPR – our legitimate interests in evaluating and improving our services; otherwise Art. 6(1)(a) where consent is required. |
Promotions and Contests – administer promotions, contests, prize draws and related communications. | Identifiers and Contact Information; Commercial Information; Marketing preferences; Other Information You Share With Us. | Art. 6(1)(b) GDPR/UK GDPR where processing is necessary to administer the terms of the promotion or contest; Art. 6(1)(a) where consent is required; otherwise Art. 6(1)(f) as our legitimate interests for related business administration. |
Planning and Managing Events – plan, organise and manage events, meetings and other in-person or online activities. | Identifiers and Contact Information; Business Information; Communication Logs; Images or Videos; Other Information You Share With Us. | Art. 6(1)(b) GDPR/UK GDPR where processing is necessary to manage the terms of registration or participation; Art. 6(1)(f) for event administration; Art. 6(1)(a) for optional marketing or images where required. |
Audits and Assessments – conduct internal and external audits, assessments, reviews and certifications of our business, Sites, services and suppliers. | Identifiers and Contact Information; Business Information; Payment Information; Communication Logs; Device Information; Digital or Technical Information. | Art. 6(1)(c) GDPR/UK GDPR where required to comply with a legal obligation; otherwise Art. 6(1)(f) as our legitimate interests to process personal data for governance, assurance and risk-management interests. |
Compliance and Legal Process – respond to legal process, regulatory enquiries, investigations, audits, inspections and requests from competent authorities. | Identifiers and Contact Information; Business Information; Payment Information; Communication Logs; Device Information; Digital or Technical Information; Other Information You Share With Us. | Art. 6(1)(c) GDPR/UK GDPR – compliance with legal obligations; otherwise Art. 6(1)(f) for establishing, exercising or defending legal rights. |
Business Arrangements, KYC and AML – assess suitability for a business arrangement or service-provider relationship, conduct credit and fraud checks, perform know-your-customer and anti-money-laundering screening and meet contractual obligations. | Identifiers and Contact Information; Business Information; Professional information; Payment Information; information from credit reference agencies; Other Information You Share With Us. | Art. 6(1)(c) GDPR/UK GDPR – where processing is necessary to comply with legal obligations relating to know-your-customer and anti-money-laundering checks; otherwise Art. 6(1)(f) as our legitimate interests to process personal data for fraud prevention and assessing business relationships. |
Corporate Transactions and Business Transfers – assess, plan and carry out mergers, acquisitions, restructurings, financings, sales or other transactions involving our business or assets, including due diligence. | The categories may vary depending on the transaction and may include Identifiers and Contact Information; Business Information; Commercial Information; Communication Logs; Device Information; Digital or Technical Information; Cookies and similar tracking technologies; and Other Information You Share With Us. | Art. 6(1)(f) GDPR/UK GDPR – our legitimate interests in evaluating and completing corporate transactions and managing related operations. |
For the purposes described above, personal data may be shared among Stericycle, Inc. and its affiliated companies worldwide, where necessary to support, administer and carry out the relevant processing activities. | All data categories, as applicable in the specific case. | Art. 6(1)(a) GDPR/UK GDPR – where the relevant processing activity listed above relies on consent; Art. 6(1)(b) GDPR/UK GDPR where the transfer is necessary to perform a contract with you or to take steps at your request prior to entering into a contract; Art. 6(1)(c) GDPR/UK GDPR where required to comply with a legal obligation; otherwise, Art. 6(1)(f) GDPR/UK GDPR as our legitimate interests in operating and managing our group-wide business, providing shared services and administering intra-group relationships. |
We share personal data with recipients where necessary for the purposes described in Section 3 and only where permitted by applicable law. Where we engage a service provider to process your personal data on our behalf, we require it to process personal data only on our documented instructions, maintain confidentiality and implement appropriate security measures. Where appropriate, we may anonymise your personal information before disclosing it to third parties.
a) Group Companies/Affiliates
We may share personal data with our group companies and affiliates, including Waste Management Service Center, Inc. and its affiliates, where necessary to provide products and services, operate the Sites, administer relationships, comply with law or support group functions. Depending on the processing, an affiliate may act as a controller of its own processing, a joint controller or a processor on behalf of another group company.
b) Service Providers
We may share personal data with service providers that support our business and deliver services, including legal services, website service providers, marketing service providers, IT and HR support service providers, fulfilment providers, delivery service providers, email administrators, payment processors and customer service providers. We take reasonable steps to require these providers to protect personal data, use it only for the services they provide to us and not use it for their own marketing purposes.
c) Legal, Regulatory and Safety Disclosures
We may disclose personal data to courts, law enforcement agencies, governmental authorities, regulators and other public authorities where required or permitted by law, including in response to a subpoena, court order or other legal process. We may also disclose personal data where necessary to establish, exercise or defend legal rights, investigate suspected fraud or unlawful activity, protect the rights, property or safety of our company, personnel, customers, suppliers or other persons, or support internal or external investigations.
d) Corporate Transactions
We may disclose personal data in connection with a merger, acquisition, financing, restructuring, sale or other transfer involving all or part of our business or assets, including during due diligence and in connection with implementing the transaction.
e) At Your Direction or With Your Consent
We may also disclose personal data when you direct us to do so or where we have obtained your consent, where consent is required by applicable law.
We retain personal data only for as long as reasonably necessary to fulfil the purposes described in this Policy and in accordance with timeframes specified under applicable local law. This includes maintaining business records, meeting legal, accounting and reporting obligations, resolving disputes and enforcing agreements. The retention period depends on the amount, nature and sensitivity of the personal data; the potential risk of harm from unauthorised use or disclosure; whether the purposes can be achieved through other means; applicable legal requirements; and applicable statutory limitation periods. We may retain personal data for longer where required or permitted by law, to establish, exercise or defend legal claims, or in backup and archival systems subject to appropriate safeguards. When personal data is no longer required, we will securely delete it or anonymise it where appropriate
We implement appropriate technical, administrative, and organizational measures to protect personal data both online and offline from loss, misuse, and unauthorised access, disclosure, alteration or destruction. However, no Internet or e-mail transmission is ever fully secure or error free. In particular, e-mail sent to or from us may not be secure. Therefore, you should take special care in deciding what information you send to us. Please keep this in mind when disclosing any personal data to us via the Internet. In addition, we are not responsible for circumvention of any privacy settings or security measures contained on the Site or third-party websites.
Our Sites are general audience websites. Our Sites’ content is not directed toward children. We do not knowingly collect personal data from children. If we become aware that a child has provided personal data without appropriate parental or guardian consent, we will take reasonable steps to delete that information from our systems. If you have questions about personal data that may have been submitted by a child, please email us at StericycleDataProtection@wm.com.
Depending on how we process your personal data, and subject to exemptions and limitations under the GDPR, the UK GDPR and applicable national law, you may have the rights described below. These rights are not absolute and may be limited in particular circumstances. We will explain any applicable limitation when responding to your request.
Access
You may request confirmation as to whether we process your personal data and, if so, a copy of that data insofar as in particular such copy does not adversely affect the rights and freedoms of others. You may also request information about the purposes of processing, the categories of personal data, the recipients or categories of recipients, the expected retention period or the criteria used to determine it, the source of the data where it was not collected from you, and the existence of automated decision-making, including profiling, where applicable.
Rectification
You may ask us to correct inaccurate personal data and to complete personal data that is incomplete. We may need to verify the information before making a correction and, where required by law, will communicate the correction to recipients to whom the data was disclosed.
Erasure
You may ask us to erase your personal data where, for example, it is no longer necessary for the purposes for which it was collected, you withdraw consent and there is no other legal basis, where you deat to processing and there are no overriding legitimate grounds for continued processing, the processing is unlawful, or erasure is required by law. This right is subject to exceptions, including where retention is necessary to comply with a legal obligation or to establish, exercise or defend legal claims.
Restriction
You may ask us to restrict processing of your personal data where you contest its accuracy for the period in which we verify the accuracy of your personal data, the processing is unlawful but you prefer restriction to erasure, we no longer need the data but you need it for legal claims, or you have objected to processing and we are considering your objection. Where processing has been restricted, we may only, besides storing the data, process your personal data with your consent, in order to establish, exercise or defend legal claims or to defend rights of others.
Data Portability
You may have the right to receive your personal data, which you have provided to us, in a structured, commonly used and machine-readable format and transmit this data to another controller, where the processing: (i) is based on your consent or a contract; and (ii) is carried out by automated means.
Object
You may object to processing based on our or a third party’s legitimate interests where you have grounds relating to your particular situation. We will stop processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims.
Where we process your personal data for direct marketing purposes, you have the right to object at any time to processing of your Personal Data for such direct marketing. We will then no longer process your Personal Data for direct marketing purposes.
Withdraw Consent
Where we process your personal data on the basis of consent, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before withdrawal. It may mean that we cannot continue to provide a particular feature, product or service that depends on the consent.
Automated Decision-Making
You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects you, except where permitted by applicable law. Where such processing applies, you may be entitled to obtain human intervention, express your point of view and contest the decision.
Post-mortem instructions (Specifically for France)
You have the right to provide us with specific instructions regarding the retention, deletion and disclosure of your personal data after your death. You may also establish general directives concerning the handling of your personal data after your death with a certified trusted third party responsible for ensuring that your wishes are respected, in accordance with applicable French regulations.
Lodge a Complaint
We ask that you raise any complaints with us first. In the UK you have the right to lodge a complaint with us about our processing of your personal data if you consider that it infringes applicable law. You can submit any complaints to StericycleDataProtection@wm.com.
You may also lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work or the place of the alleged infringement.
A list of the EEA and supervisory authorities can be found here. The following information can be utilised for the UK supervisory authority:
ICO Head Office
4th Floor
No.3 Circle Square
5 Hawkshaw Street
Manchester
M1 7BL
0303 123 1113
Verification
Before responding to a request, we may need to verify your identity using personal data you have provided, such as your full name, email address or account details. We may request additional information where necessary to confirm your identity or process the request. If we cannot verify your identity after a reasonable attempt, we may decline the request and will explain the basis for doing so.
Authorised Agents
You may designate an authorised agent to submit a request and act on your behalf. We may require the agent to provide written evidence of that authority and may require you to verify your identity or confirm the agent’s authority directly. We may reject an agent who does not satisfy these requirements.
How to Exercise Your Rights
To exercise your rights, – with the exception of the right to lodge a complaint with a supervisory authority –, contact us and include “Data Subject Request” in the subject line. Please identify the right you wish to exercise and provide enough information for us to understand and locate your request. We will respond without undue delay and generally within one month, although we may extend the response period by up to two further months where permitted by law because of the complexity or number of requests. If we extend the period, we will tell you within the first month.
We will not ordinarily charge a fee. However, where permitted by law, we may charge a reasonable fee or refuse to act on a request that is manifestly unfounded or excessive, including because of its repetitive nature. We may not be able to fully fulfil a request where doing so would adversely affect the rights or freedoms of others, breach a duty of confidentiality or be prohibited by law, and we will explain any such decision.
As a result of our global operations and network of service providers, personal data may be transferred to, stored in or accessed by recipients outside the European Economic Area or the UK, including in countries whose laws may not provide a level of protection equivalent to that in the country where you are located. For example, as a US headquartered organisation, personal data may be transferred to the US. We also use several customer experience services which results in transfers of personal data to India for support purposes. We will manage such transfers in accordance with applicable data protection law and will put appropriate safeguards in place before making a restricted transfer.
Depending on the transfer, we may rely on: the EU Standard Contractual Clauses (the “SCCs”) together with the UK International Data Transfer Addendum or the International Data Transfer Agreement (IDTA); an adequacy decision adopted by the European Commission or the UK Government; or the EU-U.S. Data Privacy Framework (including the UK Extension thereto) where the recipient is appropriately certified. We may also use encryption, access controls and other technical and organisational measures to supplement these safeguards, where appropriate.
Where we rely on SCCs published by the EU Commission, insofar as the transfer is made to a service provider (including affiliates in our group acting as such) processing personal data on our behalf, Module Two (transfer from controllers to processors) of the SCCs is relevant; insofar as the transfer is made to recipients which do not process personal data on our behalf but for their own purposes, Module One (transfer from controllers to controllers) is relevant.
We have established an intra-group data transfer agreement to regulate cross-border transfers of personal data within our group companies.
For information about the safeguards applicable to a particular transfer, or to request a copy where required by law, please contact us using the details in Section 11. Please note that such copy may be redacted to the extent necessary to protect business secrets or other confidential information. Any data transfer agreement made available to you may be redacted for reasons of commercial sensitivity.
We may use your personal data to inform you about products or services that we believe will be of interest to you and to provide you with our newsletter. We may contact you by email, post, telephone or through other communication channels where you have consented to receive such communications or where otherwise permitted by applicable law. In all cases, we will respect your preferences regarding how you would like us to manage marketing activity with you and will only process your data or contact you where permitted by applicable law or where you gave us your consent..
You can manage your marketing preferences in several ways:
Direct Marketing. You can ask us to stop direct marketing at any time. You can ask us to stop sending email marketing by clicking the “unsubscribe” link in the email marketing messages we send you. Alternatively, you can contact StericycleDataProtection@wm.com. Please specify whether you would like us to stop all forms of marketing or only a particular type, such as email.
Cookies and Online Tracking. You can change the way your browser manages Cookies, which may be used to deliver online advertising, by following the settings on your browser as explained the Cookie Policy.
Where we rely on your consent for electronic direct marketing, you may withdraw your consent at any time. In addition, each commercial email that we send will provide you with the opportunity to opt out of receiving future marketing communications. We may take up to 10 business days to process an opt-out request and therefore you may briefly continue to receive email after opting out. We may continue to send transactional, service or relationship communications where permitted by applicable law; these are not marketing communications and may not be capable of being opted out of.
We reserve the right to update this Policy from time to time. Unless another form of notice is required by applicable law, we will notify you of changes by changing the “Last Updated” date at the beginning of this Policy. You should review this Policy each time you visit or use one of our Sites.
If you have questions or comments about our efforts to protect your personal privacy, or if you require additional information about our privacy commitments, please contact us at:
Privacy team:
Email: Contact at StericycleDataProtection@wm.com
Data Protection Officer: StericycleDPO@wm.com
Phone: (+1) 855-782-6445
Mail: Stericycle, Inc. | Attn: Data Privacy / Protection Office | 800 Capitol Street, Suite 3000 | Houston | TX | 77002 USA
For questions or comments, please contact us at: StericycleDataProtection@wm.com