Privacy Policy - Crayford Carpet Cleaners

This Privacy Policy explains how Crayford Carpet Cleaners collects, uses, stores, shares, and protects personal data. It applies to all Crayford Carpet Cleaners customers in the area, including people who request quotations, book services, make enquiries, or otherwise interact with us. We are committed to handling personal data in a fair, transparent, and secure manner in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

Crayford Carpet Cleaners provides carpet cleaning and related domestic and commercial cleaning services. For the purposes of data protection law, we act as the data controller for personal data we collect and use in the course of providing our services, managing customer relationships, and administering our business operations.

2. Personal Data We Collect

We collect only the personal data that is necessary for the purposes described in this policy. The information we may collect includes:

• Identity details, such as your name.
• Contact details, such as your address, telephone number, and email address.
• Service details, such as property type, service preferences, cleaning requirements, and appointment information.
• Payment and billing information, where relevant, such as payment status, invoices, and transaction records.
• Communication records, including messages, notes from calls, complaints, feedback, and correspondence.
• Technical information, where collected through our systems, such as basic device or usage data linked to online enquiries.

We do not intentionally collect sensitive personal data unless it is provided voluntarily and is necessary for a specific service need. If you choose to share special category data with us, we will handle it carefully and only where a lawful basis permits.

3. How We Collect Personal Data

We may collect personal data directly from you when you:

• submit an enquiry or request a quotation;
• book or amend a service;
• communicate with us by phone, email, or other methods;
• provide feedback or make a complaint;
• make a payment or request an invoice;
• interact with our business in the course of receiving our services.

We may also receive data from third parties where necessary for service delivery, for example from payment processors, referral partners, or subcontracted service providers acting on our behalf.

4. Lawful Basis for Processing

We process personal data only where we have a lawful basis under UK GDPR. Depending on the circumstance, our lawful bases may include:

Contract

We process your personal data where it is necessary to enter into or perform a contract with you. This includes providing quotations, arranging appointments, delivering cleaning services, and managing payment or service administration.

Legitimate Interests

We may process data where it is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. This may include improving our services, responding to customer queries, keeping internal records, preventing fraud, maintaining security, and managing business operations.

Legal Obligation

We may process data where necessary to comply with legal obligations, such as accounting, tax, record-keeping, or responding to lawful requests from authorities.

Consent

In limited situations, we may rely on your consent, for example for optional communications or where special category data is involved and no other lawful basis applies. Where consent is used, you may withdraw it at any time.

5. How We Use Personal Data

We use personal data for the following purposes:

• to provide quotes and manage bookings;
• to deliver carpet cleaning and related services;
• to communicate about appointments, service changes, and customer support;
• to process payments and issue invoices;
• to maintain business, tax, and accounting records;
• to resolve complaints and handle disputes;
• to improve our services and customer experience;
• to comply with legal and regulatory obligations.

We will only use your data for the purposes for which it was collected unless we reasonably consider that we need to use it for a compatible purpose.

6. Data Sharing and Processors

We may share personal data with trusted third-party service providers who act as processors on our behalf. These processors only handle data according to our instructions and are required to protect it appropriately.

Examples of processors may include:

• IT and hosting providers that support our data storage or communications systems;
• payment service providers that process transactions securely;
• accounting or bookkeeping providers that assist with financial administration;
• customer management or scheduling tools used to organise service delivery;
• professional advisers, where needed for legal, financial, or insurance matters.

We may also disclose data where required by law, court order, or regulatory authority, or where necessary to protect our legal rights, prevent fraud, or safeguard the safety of our staff, customers, or business.

We do not sell personal data.

7. International Transfers

Where a processor stores or accesses data outside the UK, we will ensure appropriate safeguards are in place to protect your personal data. These may include approved contractual protections or other lawful transfer mechanisms required under data protection law.

8. Data Retention

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, insurance, or reporting requirements. The retention period depends on the type of data and the reason for holding it.

• Customer and service records are usually retained for the duration of the customer relationship and for a reasonable period afterwards.
• Financial records are retained for the period required by tax and accounting law.
• Communication records may be retained for a period needed to resolve queries, maintain evidence of transactions, or improve service quality.

When personal data is no longer needed, we will delete it securely or anonymise it so that it can no longer identify you.

9. Data Security

We take appropriate technical and organisational measures to protect personal data from unauthorised access, accidental loss, misuse, alteration, or disclosure. These measures may include access controls, secure storage, staff awareness, and restricted handling of personal information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Your Rights

Under data protection law, you have several rights in relation to your personal data. Subject to legal conditions, these may include:

• Right of access – you can request a copy of the personal data we hold about you.
• Right to rectification – you can ask us to correct inaccurate or incomplete data.
• Right to erasure – you can request deletion of your personal data in certain circumstances.
• Right to restriction – you can ask us to limit how we use your data in some situations.
• Right to object – you can object to processing based on legitimate interests or direct marketing.
• Right to data portability – you can request certain data in a structured, commonly used format where applicable.
• Right to withdraw consent – where we rely on consent, you may withdraw it at any time.

If you wish to exercise any of these rights, we may need to verify your identity before responding. We will respond within the time limits required by law.

11. Automated Decision-Making

We do not use personal data for automated decision-making that produces legal or similarly significant effects on you. If this changes, we will update this policy and provide the information required by law.

12. Complaints and Supervisory Authority

If you have concerns about how we handle your personal data, you have the right to raise the matter with us first so we can try to resolve it. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) if you believe your data protection rights have been breached.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal obligations. Any updated version will apply from the date it is published or otherwise made available. We encourage you to review this policy periodically so that you remain informed about how we use personal data.

Summary of our approach: we collect only the data needed to provide and manage services, process it on lawful grounds, keep it only for as long as necessary, share it only with trusted processors or where required by law, and respect your data protection rights.