Privacy Policy - Hainault Carpet Cleaners

This Privacy Policy explains how Hainault Carpet Cleaners collects, uses, stores, shares, and protects personal data. It applies to all Hainault Carpet Cleaners customers in the area, including prospective customers, current customers, and anyone who interacts with us for booking, enquiries, quotations, and aftercare. We are committed to handling personal data in a lawful, fair, and transparent manner in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Hainault Carpet Cleaners provides carpet cleaning and related cleaning services to residential and commercial customers in the Hainault area. For the purposes of data protection law, we act as the data controller for the personal data we collect and use in connection with our services. This means we decide why and how personal data is processed.

2. Personal data we collect

We only collect personal data that is necessary for providing our services, managing our business, and meeting our legal obligations. The type of information we may collect includes:

Identity data such as your name, title, and any business name you provide.
Contact data such as your phone number, email address, and service address.
Service and booking data such as appointment details, property access notes, cleaning instructions, service history, and quoted services.
Payment data such as payment status and limited transaction records. We do not store unnecessary payment card details where avoidable.
Communication data such as messages, feedback, complaints, and records of correspondence.
Technical data such as basic device or browser information if you interact with us through digital systems, where applicable.
Marketing preferences such as whether you want to receive service updates or promotional messages.

We do not intentionally collect special category data unless it is strictly necessary and you have provided it voluntarily, or unless required for a specific lawful reason. If you choose to share sensitive information with us, we will only use it where permitted by law and where there is a clear reason to do so.

3. How we use your personal data

We use personal data for the following purposes:

to respond to enquiries and provide quotations;
to arrange and deliver carpet cleaning services;
to manage bookings, scheduling, and customer accounts where relevant;
to communicate with you before, during, and after service delivery;
to process payments, invoices, and records of transactions;
to handle complaints, refunds, and service issues;
to maintain internal records and improve our services;
to comply with legal, tax, insurance, and regulatory obligations;
to send marketing communications only where allowed and appropriate.

We only use your data where we have a valid reason to do so, and we make sure our use is limited to what is necessary.

4. Lawful basis for processing

Under UK GDPR, we must have a lawful basis for processing personal data. Depending on the activity, Hainault Carpet Cleaners may rely on one or more of the following lawful bases:

Contract – where processing is needed to provide a quote, book a service, or carry out cleaning work you have requested.
Legal obligation – where we must keep records or share information to comply with tax, accounting, safety, or other legal duties.
Legitimate interests – where processing is necessary for our business operations, such as managing customer records, improving services, preventing fraud, or handling basic communications, provided your rights do not override those interests.
Consent – where we need your permission, for example for certain marketing activities or optional communications. You can withdraw consent at any time.

Where we rely on legitimate interests, we make sure to assess the impact on your privacy and only process data in a way that is proportionate and reasonable.

5. How we share personal data

We may share personal data with trusted third parties who help us operate our business and deliver services. These may include:

Payment processors who help us take and process payments securely;
IT and cloud service providers who store or support our business systems;
Administrative and accounting providers who assist with invoicing, bookkeeping, and tax-related tasks;
Subcontractors or service partners where needed to fulfil a booking;
Professional advisers such as insurers, legal advisers, or accountants;
Regulators, law enforcement, or public authorities where disclosure is required by law.

We only use processors that can provide appropriate security, confidentiality, and GDPR-compliant handling of data. Our processors are only permitted to use your information on our instructions and for the agreed purpose. We do not sell your personal data.

Processor safeguards

Where we appoint a processor, we take reasonable steps to ensure that:

they process data only for specified purposes;
they maintain appropriate technical and organisational security measures;
they keep personal data confidential;
they notify us of personal data breaches where required;
they delete or return data when it is no longer needed.

6. Data retention

We keep personal data only for as long as necessary for the purpose for which it was collected, unless a longer retention period is required by law. Retention periods may vary depending on the type of data and the legal or business reason for holding it.

Customer and booking records may be retained for a reasonable period to manage service history, queries, and disputes.
Financial records are usually retained for the period required by tax and accounting rules.
Complaints and correspondence may be kept for as long as needed to resolve issues and maintain accurate business records.
Marketing preferences are kept until you opt out or the information is no longer useful.

When personal data is no longer required, we will securely delete, anonymise, or archive it in line with our retention practices. We review retained data regularly to make sure it is not kept for longer than necessary.

7. Data security

We take the security of personal data seriously and use appropriate measures to protect it from unauthorised access, accidental loss, misuse, or disclosure. These measures may include restricted access, secure storage, password protection, staff awareness, and careful supplier selection. While no system is completely risk-free, we work to keep security measures proportionate to the type of information we hold.

8. Your rights

Under data protection law, you may have the following rights in relation to your personal data:

Right of access – to request a copy of the personal data we hold about you.
Right to rectification – to ask us to correct inaccurate or incomplete information.
Right to erasure – to request deletion of your personal data in certain circumstances.
Right to restriction – to ask us to limit the way we use your data in certain situations.
Right to object – to object to processing based on legitimate interests or to direct marketing.
Right to data portability – to receive certain information in a structured, commonly used format, where applicable.
Right to withdraw consent – where processing is based on consent, you can withdraw it at any time.

These rights are not absolute and may be subject to legal or practical limitations. If you make a request, we will respond in accordance with applicable law and within the required timeframes.

9. Marketing communications

We will only send marketing communications where it is lawful to do so. You can opt out of marketing at any time, and we will respect your choice. If you opt out, we may still send essential service-related communications where necessary, such as appointment updates, invoices, or important notices.

10. Children’s data

Our services are intended for adult customers and property owners or authorised occupants. We do not knowingly collect personal data from children for marketing or service purposes. If we become aware that we have collected such data without a valid reason, we will take appropriate steps to delete it.

11. International transfers

If any personal data is transferred outside the UK, we will ensure that appropriate safeguards are in place. This may include using providers in jurisdictions with adequate data protection standards or relying on approved contractual protections. We only permit transfers where they are lawful and appropriately protected.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data handling practices. Any updated version will apply from the date it is published or otherwise communicated. We encourage customers to review this policy periodically to stay informed about how we use personal data.

13. Complaints

If you have concerns about how we use your personal data, you have the right to raise them with us and, if unresolved, to complain to the relevant data protection authority. We encourage you to contact us first so we can try to address your concern promptly and fairly. Protecting your privacy is important to us, and we aim to handle all requests with care and respect.

By using our services, you acknowledge that you have read and understood this Privacy Policy.