Privacy Policy - Elephantandcastle Carpet Cleaners

This Privacy Policy explains how Elephantandcastle Carpet Cleaners collects, uses, stores, shares, and protects personal data when providing carpet cleaning and related services. It applies to all Elephantandcastle Carpet Cleaners customers in the area, including individuals who make enquiries, request quotations, book services, or otherwise interact with us in connection with our cleaning services.

We are committed to handling personal information responsibly, transparently, and in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable privacy laws. This policy is intended to help customers understand what information we collect, why we collect it, the lawful basis we rely on, how long we keep it, who may process it on our behalf, and what rights individuals have in relation to their data.

1. Information We Collect

We only collect personal data that is relevant and necessary for providing our services, managing our business, and meeting legal obligations. Depending on the nature of your interaction with us, the information we may collect includes:

Identity details such as your name and title.
Contact details such as telephone number, email address, and service address.
Booking and service information such as preferred appointment times, cleaning requirements, and notes about the condition of carpets or upholstery.
Payment information such as transaction records, invoice details, and payment status. We do not normally store full card details when payments are processed securely by third-party payment providers.
Communication records including emails, messages, complaint details, and customer service history.
Technical data such as website usage information, device data, or IP address if you visit any online service connected with us.
Photographs or visual records where these are necessary to assess a job before or after cleaning, subject to appropriate handling and consent where required.

We do not seek to collect unnecessary personal data. We also do not intentionally collect special category data unless it is provided by you and is necessary for a specific purpose, such as making reasonable adjustments or handling a health-related access issue. Where special category data is processed, we do so only where permitted by law and with additional safeguards.

2. How We Use Your Data

We use personal data for the following purposes:

To respond to enquiries and provide quotations.
To schedule, deliver, and manage cleaning services.
To communicate with you about appointments, service changes, or aftercare.
To process payments, issue invoices, and maintain financial records.
To handle complaints, disputes, and customer support requests.
To improve our services, maintain quality, and train staff.
To meet legal and regulatory requirements, including accounting and tax obligations.
To prevent fraud, misuse, and security incidents.

We may also use limited information for internal record-keeping and service analysis. Where possible, we use aggregated or anonymised information for improvement and reporting purposes.

3. Lawful Basis for Processing

Under data protection law, we must have a lawful basis for processing your personal data. Elephantandcastle Carpet Cleaners relies on one or more of the following lawful bases depending on the context:

Contract

We process personal data when it is necessary to enter into or perform a contract with you. This includes handling bookings, carrying out carpet cleaning services, issuing invoices, and communicating about your job.

Legitimate Interests

We may process data where it is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. Examples include managing customer relationships, improving service quality, securing our systems, and keeping internal service records.

Legal Obligation

We process certain data to comply with legal obligations, such as tax law, accounting requirements, record retention duties, and responding to lawful requests from authorities.

Consent

Where consent is required, such as for certain optional marketing communications or for processing specific categories of data, we will ask for it clearly and you may withdraw it at any time. Withdrawal of consent does not affect processing already carried out before it was withdrawn.

Vital Interests and Other Limited Bases

In rare situations, we may process data to protect someone’s vital interests, for example where there is an emergency during service delivery. If special category data is involved, we will only process it where a lawful condition applies.

4. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, and reporting requirements. Retention periods may vary depending on the type of information and the purpose of processing.

Typical retention practices may include:

Customer service and booking records: retained for as long as needed to manage the service relationship and resolve queries.
Invoice and payment records: retained for the period required by tax and accounting laws.
Complaint and dispute records: retained for a reasonable period after resolution to evidence handling and defend legal claims where necessary.
Marketing preferences: retained until you opt out or we no longer need the record.
Technical logs: retained for a limited period for security, troubleshooting, and performance monitoring.

When data is no longer required, we will securely delete it or anonymise it so that it can no longer identify you. We do not keep personal information indefinitely.

5. Processors and Third Parties

We may share personal data with trusted third parties who act as data processors on our behalf. These processors are only permitted to use your data according to our instructions and under appropriate contractual safeguards.

Examples of processors or service providers may include:

Payment processors that handle card or online payments securely.
Booking or scheduling systems used to manage appointments and service calendars.
IT and cloud storage providers that host data and support business operations.
Communication service providers used for sending messages, invoices, or service updates.
Accountants or bookkeeping services that assist with financial compliance.
Professional advisers such as legal or insurance advisers where necessary.

We may also disclose information to third parties where required by law, such as to law enforcement, regulators, courts, or other public authorities. If our business is restructured, sold, or transferred, personal data may be shared with relevant parties as part of that transaction, subject to legal protections.

6. International Transfers

If any processor stores or accesses data outside the UK, we will ensure appropriate safeguards are in place. These may include adequacy regulations, standard contractual clauses, or other lawful transfer mechanisms designed to protect personal data to the standard required by law.

7. Data Security

We use appropriate technical and organisational measures to safeguard personal data against accidental loss, unauthorised access, alteration, disclosure, or destruction. These measures may include access controls, secure systems, staff confidentiality obligations, and limiting access to people who need it for business purposes.

Although we take data security seriously, no system can be guaranteed to be completely secure. If a data breach occurs that poses a risk to your rights and freedoms, we will respond in line with legal requirements.

8. Your Rights

As a data subject, you have a number of rights under data protection law. These rights may apply depending on the circumstances and the legal basis for processing:

Right of access: you may request a copy of the personal data we hold about you.
Right to rectification: you may ask us to correct inaccurate or incomplete information.
Right to erasure: you may request deletion of your data in certain situations.
Right to restriction: you may ask us to limit how we use your data in certain cases.
Right to object: you may object to processing based on legitimate interests or direct marketing.
Right to data portability: in some cases, you may request your data in a portable format.
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.

You also have the right to raise concerns about how your data is handled. If you believe your rights have been breached, you may also have the right to lodge a complaint with the relevant data protection authority.

9. Marketing Preferences

We will only send marketing communications where permitted by law. You may opt out of marketing at any time. If you no longer wish to receive promotional messages, we will respect your preference and update our records accordingly.

10. Children’s Data

Our services are intended for adults and business or household customers arranging cleaning services. We do not knowingly collect data from children unless it is necessary and lawful in a particular situation, such as when a customer provides details relevant to access or household arrangements. Where children’s data is involved, we apply heightened care and process only what is required.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, technology, or business practices. Any updated version will apply from the time it is published or otherwise made available. We encourage customers to review this policy periodically to stay informed about how we protect personal data.

12. Summary of Our Commitments

Elephantandcastle Carpet Cleaners is committed to using personal data fairly, lawfully, and transparently. We collect only what we need, process it for clear purposes, retain it only as long as necessary, and work with processors under proper safeguards. We also respect the rights of all customers in the area and aim to make privacy a core part of our service.

This policy is designed to provide clear information about our data protection practices and to support a trustworthy customer relationship.