Privacy Policy - Coulsdon Carpet Cleaners

This Privacy Policy explains how Coulsdon Carpet Cleaners collects, uses, stores, shares, and protects personal data. It applies to all Coulsdon Carpet Cleaners customers in the area, including prospective customers, existing customers, and any individuals who interact with us in connection with our carpet cleaning services, upholstery cleaning, stain treatment, and related domestic or commercial cleaning services.

We are committed to handling personal information lawfully, fairly, and transparently in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy sets out what information we collect, why we collect it, the legal bases we rely on, how long we keep it, and the rights available to you.

1. Information We Collect

We collect only the personal data needed to provide our services effectively, manage our business, and meet legal obligations. The information we collect may include:

Identity details such as your name and title.
Contact details such as your address, telephone number, and email address.
Service details such as the type of cleaning requested, property access notes, preferred appointment times, and service history.
Billing and payment information such as transaction records, invoice details, and payment status.
Communication records such as messages, enquiries, complaints, feedback, and correspondence relating to our services.
Technical data where applicable, such as basic website or device information if you contact us through digital channels.
Special category data only where absolutely necessary and usually only if you volunteer it, for example information relevant to allergies, mobility access, or specific property sensitivities that affect service delivery. We do not intentionally seek unnecessary sensitive data.

We do not collect more information than we need, and we aim to keep all personal data accurate and up to date.

2. How We Use Your Data

We use personal data for clear and limited purposes. These include:

Providing carpet cleaning and related services.
Managing bookings, scheduling appointments, and confirming attendance.
Processing payments, issuing invoices, and maintaining financial records.
Responding to enquiries, complaints, and follow-up requests.
Keeping service records so we can deliver consistent and efficient support.
Meeting tax, accounting, insurance, and other legal requirements.
Preventing fraud, misuse, or unlawful activity.
Improving our services, staff training, and operational efficiency.

We will only use your data for the purposes set out in this policy or for closely related purposes that you would reasonably expect.

3. Lawful Basis for Processing

We process personal data only where we have a lawful basis under data protection law. Depending on the context, we rely on the following bases:

Contract

We process your personal data when it is necessary to enter into or perform a contract with you. This includes arranging appointments, delivering cleaning services, issuing invoices, and managing service-related communication.

Legal Obligation

We process certain information to comply with legal requirements, such as accounting obligations, tax records, and record keeping required by law.

Legitimate Interests

We may process data where it is necessary for our legitimate business interests and where your rights do not override those interests. This may include maintaining business records, handling service issues, improving our operations, preventing fraud, and managing customer communications. We always consider the impact of this processing and ensure it is proportionate.

Consent

In limited circumstances, we may rely on your consent, particularly where processing is not covered by another lawful basis. If we ask for consent, you may withdraw it at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.

Vital Interests and Public Task

These bases are unlikely to apply to our normal services. However, in rare situations involving serious risk to health or safety, we may process data if necessary to protect vital interests.

4. Sharing Your Information and Processors

We do not sell your personal data. We may share it only when necessary and only with trusted third parties acting as processors or independent controllers where required by law.

Processors may include:

Payment service providers that help us process card or bank transactions securely.
Accounting and bookkeeping providers that assist with invoicing, tax reporting, and financial administration.
IT and cloud storage providers that host data, email services, or business systems used to manage bookings and records.
Customer relationship or scheduling tools used to organise appointments and service notes.
Professional advisers such as accountants, insurers, legal advisers, or auditors where necessary.

Where processors handle personal data on our behalf, they are required to follow our instructions, keep data secure, and use it only for the agreed purposes. We ensure appropriate contracts are in place to protect your information.

We may also disclose information if required by law, court order, regulatory request, or to prevent or investigate suspected illegal activity.

5. Data Retention

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, and reporting requirements. Retention periods vary depending on the type of information and the reason we hold it.

Customer and service records are generally retained for as long as needed to manage the customer relationship and address any follow-up issues.
Financial and tax records are retained for the period required by law, typically several years after the end of the relevant financial year.
Communication records may be kept for a reasonable period to resolve queries, handle complaints, or demonstrate service history.
Consent-based information is kept until consent is withdrawn or the data is no longer needed.

When personal data is no longer required, we will securely delete, anonymise, or archive it in line with our retention procedures.

6. Data Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, misuse, alteration, or disclosure. These measures may include access controls, secure storage, staff awareness, restricted permissions, and careful handling of records.

Although we take security seriously, no system can be guaranteed to be completely secure. If a data breach occurs that affects your rights and freedoms, we will act promptly in accordance with legal obligations.

7. Your Rights

Under data protection law, you have several rights in relation to your personal data. These rights may be subject to conditions and exemptions, but we will always respond appropriately.

Right of access – you can request a copy of the personal data we hold about you.
Right to rectification – you can ask us to correct inaccurate or incomplete information.
Right to erasure – you can request deletion of your data in certain circumstances.
Right to restrict processing – you can ask us to limit how we use your data in some situations.
Right to data portability – where applicable, you can request that certain information be provided in a structured, commonly used format.
Right to object – you may object to processing based on legitimate interests or direct marketing.
Right to withdraw consent – where processing is based on consent, you may withdraw it at any time.

If you exercise any of these rights, we may need to verify your identity before responding. We will aim to handle requests within the time limits set by law.

8. International Transfers

Where personal data is transferred outside the United Kingdom, we will ensure suitable safeguards are in place to protect it. These may include approved transfer mechanisms and contractual protections to preserve your rights and the security of your information.

9. Children’s Data

Our services are intended for adults. We do not knowingly collect personal data from children unless it is necessary in a family or household context and provided by a parent or guardian for a legitimate service-related reason. If we become aware that we have collected data inappropriately, we will take steps to delete it.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the law, our services, or the way we process personal data. Any updates will take effect when published. We encourage you to review this policy periodically to stay informed about how we protect your information.

11. Contact and Complaints

If you have concerns about how your personal data is handled, you may raise them with us so we can investigate and respond. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe your data protection rights have been infringed.

This policy is designed to be clear, fair, and transparent. By using our services, you acknowledge that your personal data may be processed as described here, in line with applicable data protection law and the legitimate needs of delivering carpet cleaning services across the Coulsdon area.