Privacy Policy - Kingston Upon Thames Carpet Cleaners

This Privacy Policy explains how Kingston Upon Thames Carpet Cleaners collects, uses, stores, shares, and protects personal data when providing carpet cleaning and related services. It applies to all Kingston Upon Thames Carpet Cleaners customers in the area, including residential and commercial clients who enquire about, book, receive, or pay for our services.

We are committed to handling personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We aim to process information fairly, lawfully, transparently, and only for legitimate business purposes.

1. Information We Collect

We collect only the information needed to provide our services, manage customer relationships, and meet our legal obligations. The type of data collected may include:

• Identity information such as your name.
• Contact details such as your address, email address, and telephone number.
• Service details such as property access instructions, cleaning requirements, and booking preferences.
• Payment information such as billing details and transaction records. We do not retain full card details where payment processors handle them securely.
• Communication records including messages, complaints, service feedback, and notes relating to your booking.
• Technical information that may be generated when you interact with us digitally, such as device identifiers or basic usage data, where applicable.
• Special category data only where strictly necessary and if you voluntarily provide it, for example access needs or health-related information that affects service delivery. We minimise use of this information and process it only when required.

We do not intentionally collect more data than is needed. If you provide information about another person, you should ensure you have their permission to do so.

2. How We Use Your Data

We use personal data for the following purposes:

• To respond to enquiries and provide quotations.
• To schedule, confirm, and deliver carpet cleaning services.
• To manage payments, invoices, receipts, and account records.
• To communicate about appointments, service changes, or follow-up matters.
• To resolve complaints, disputes, and service issues.
• To maintain internal records and improve service quality.
• To comply with tax, accounting, insurance, and other legal requirements.
• To prevent fraud, misuse, or unlawful activity.

We process data only where it is relevant to a legitimate business purpose and avoid using it for unrelated activities without a proper lawful basis.

3. Lawful Basis for Processing

Under UK GDPR, we must have a lawful basis to use your personal data. Depending on the purpose, Kingston Upon Thames Carpet Cleaners relies on one or more of the following bases:

Contract

We process personal data where it is necessary to enter into or perform a contract with you, such as managing bookings, delivering services, and processing payments.

Legal Obligation

We may process certain information to meet legal requirements, including accounting, tax, record-keeping, and compliance with applicable regulations.

Legitimate Interests

We may process data where it is necessary for our legitimate business interests, provided your rights and freedoms do not override those interests. This may include service administration, internal record management, fraud prevention, and improving our operations.

Consent

Where required, we rely on your consent. For example, if we ever need to use your data for a purpose that requires permission, we will explain this clearly and you may withdraw consent at any time.

Vital Interests

In exceptional circumstances, we may process data to protect someone’s life or wellbeing, though this is unlikely to be a regular basis for our services.

4. Retention of Personal Data

We keep personal data only for as long as necessary for the purpose for which it was collected, or as required by law. Retention periods depend on the type of information and the reason for processing.

• Customer and booking records are retained for a reasonable period after service completion to manage queries, complaints, and follow-up issues.
• Financial and tax records are retained for the period required by law and accounting rules.
• Communication records may be kept for as long as necessary to evidence agreements, resolve disputes, or improve service delivery.
• General enquiry data may be deleted once it is no longer needed and there is no ongoing business reason to keep it.

When data is no longer required, it is securely deleted, anonymised, or otherwise disposed of in a safe manner. We use data minimisation principles to ensure that unnecessary information is not retained.

5. Data Sharing and Processors

We may share personal data with trusted third parties that help us deliver our services. These organisations act as processors or, in some cases, independent controllers. We only share data where necessary and only with appropriate safeguards in place.

Examples of processors may include:

• Booking and scheduling providers used to manage appointments.
• Payment processors that handle card or online payment transactions securely.
• IT and cloud storage providers that support secure data storage and communications.
• Accounting or invoicing systems used to maintain financial records.
• Customer service tools that help us manage enquiries and service records.

Where we use processors, they are required to process personal data only on our instructions, protect it appropriately, and comply with data protection law. We do not sell personal data to third parties.

We may also disclose personal data if required by law, regulation, court order, or to protect our rights, property, staff, or customers.

6. International Transfers

Some service providers may store or process data outside the UK. If this happens, we ensure that appropriate safeguards are in place, such as adequacy regulations, standard contractual clauses, or equivalent legal protections, to keep your information secure and compliant with data protection law.

7. Security of Your Data

We take reasonable technical and organisational measures to protect personal data from unauthorised access, loss, misuse, alteration, or disclosure. These measures may include access controls, secure storage, staff training, and limiting access to data on a need-to-know basis.

Although we work hard to protect information, no system can be completely secure. If a data breach were to occur, we would respond in line with legal requirements and, where appropriate, notify affected individuals and the relevant authority.

8. Your Rights Under UK GDPR

You have a number of rights regarding your personal data. These rights may apply depending on the circumstances and legal basis for processing.

• Right of access – you can request a copy of the personal data we hold about you.
• Right to rectification – you can ask us to correct inaccurate or incomplete information.
• Right to erasure – you can request deletion of your data in certain situations.
• Right to restrict processing – you can ask us to limit how we use your data in specific circumstances.
• Right to data portability – you may request transfer of certain data in a machine-readable format where applicable.
• Right to object – you can object to processing based on legitimate interests or direct marketing, where relevant.
• Right to withdraw consent – if we rely on your consent, you may withdraw it at any time.

These rights are not absolute. In some cases, we may be allowed or required to continue processing data despite a request, for example where legal obligations apply.

9. How We Handle Requests

If you wish to exercise any of your rights, we will assess your request and respond within the timeframe required by law. We may need to verify your identity before taking action to protect your privacy and prevent unauthorised access.

There is usually no charge for making a request, unless it is manifestly unfounded or excessive. If we cannot comply fully with a request, we will explain the reasons where permitted.

10. Children’s Data

Our services are intended for adult customers and business clients. We do not knowingly collect personal data from children unless it is necessary for service delivery and provided by a parent, guardian, or authorised adult. If we become aware that we have collected data inappropriately, we will take steps to delete it where appropriate.

11. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or data protection practices. Any revised version will apply from the date it is published or otherwise communicated. We encourage customers to review this policy periodically so they remain informed about how their data is handled.

12. Summary of Our Commitments

Kingston Upon Thames Carpet Cleaners is committed to treating personal data responsibly and fairly. In particular, we will:

• collect only the information needed to provide our services;
• use data only for lawful, specified purposes;
• retain data for no longer than necessary;
• share information only with trusted processors or where legally required;
• respect the rights of all customers in the Kingston upon Thames area;
• maintain appropriate safeguards to protect personal information.

By using our services, you acknowledge that your personal data may be processed as described in this Privacy Policy and in accordance with applicable law.