Privacy Policy - Surrey Carpetcleaning

This Privacy Policy explains how Surrey Carpetcleaning collects, uses, stores, and protects personal data in connection with our carpet cleaning services. It applies to all Surrey Carpetcleaning customers in the area, including prospective customers, current customers, former customers, and anyone who communicates with us about our services. We are committed to handling personal data in a lawful, fair, and transparent way in accordance with the UK GDPR and the Data Protection Act 2018.

1. Who we are

Surrey Carpetcleaning is a provider of carpet cleaning and related cleaning services. In this policy, references to we, us, and our mean Surrey Carpetcleaning. For the purposes of data protection law, we are the data controller for the personal data we collect and process about our customers and service users.

2. Personal data we collect

We collect only the personal data that is necessary to provide our services, manage our business, and comply with legal obligations. The types of data we may collect include:

Identity data such as your name and title
Contact data such as address, email address, and phone number
Service data such as details of the cleaning service requested, property access notes, and service preferences
Payment data such as payment confirmation, transaction details, and billing records
Communication data such as messages, enquiries, complaints, and feedback
Technical data such as limited information collected through our digital systems, if applicable
Special category data only where you voluntarily provide it and it is necessary for service delivery, for example information relating to allergies, mobility needs, or health-related access considerations

We do not intentionally collect more information than we need. Where possible, we encourage you to avoid sharing unnecessary personal details.

3. How we collect personal data

We may collect personal data directly from you when you:

request a quotation or make a booking
communicate with us by phone, email, text, or other messaging methods
provide feedback, make a complaint, or ask a question
complete a form or otherwise share your details with us
use our services at your property or business premises

We may also receive data from third parties where necessary to deliver our services, such as payment providers, referral partners, or subcontracted service providers acting on our behalf. If someone else provides your details to us, we will process them in line with this policy.

4. Lawful basis for processing

We only process personal data when we have a valid lawful basis under the UK GDPR. Depending on the context, our lawful bases may include:

Contract - processing is necessary to take steps before entering into a contract or to perform our contract with you, such as booking and delivering a cleaning service
Legitimate interests - processing is necessary for our legitimate business interests, provided those interests do not override your rights and freedoms, such as managing customer relationships, improving services, and maintaining business records
Legal obligation - processing is necessary to comply with legal and regulatory requirements, including accounting, tax, or record-keeping obligations
Consent - where required, we may rely on your consent, for example for certain marketing communications or for processing special category data where no other lawful basis applies
Vital interests - in rare situations, we may process information if necessary to protect someone’s life or physical safety

Important: where we rely on consent, you may withdraw it at any time, although this will not affect processing that has already taken place lawfully.

5. How we use your data

We use personal data for the following purposes:

to provide quotations, arrange appointments, and deliver cleaning services
to contact you about bookings, service updates, or changes
to issue invoices, process payments, and maintain financial records
to respond to enquiries, complaints, and feedback
to improve our services, business operations, and customer experience
to comply with legal and regulatory requirements
to protect our business, customers, and staff from fraud, misuse, or security risks
to keep records of consent where applicable

We will not use personal data for purposes that are incompatible with those described in this policy unless we have a lawful basis to do so and, where needed, we notify you.

6. Data retention

We keep personal data only for as long as necessary for the purpose for which it was collected, including for any legal, accounting, or reporting requirements. Retention periods may vary depending on the type of data and the reason it is held.

Typical retention approach

Customer and service records are generally kept for the period needed to complete the service and deal with any follow-up issues
Financial records are kept for the period required by tax and accounting law
Complaints and correspondence may be kept for a reasonable period to resolve disputes and maintain service quality
Consent records may be retained to demonstrate compliance with data protection obligations

When data is no longer required, we will securely delete it or anonymise it so that it can no longer identify you. We regularly review the data we hold to ensure we do not keep it longer than necessary.

7. Processors and third parties

We may share personal data with trusted third parties who act as data processors or, in some cases, independent data controllers. These parties are only involved where necessary and only for legitimate business purposes. Examples may include:

payment processing providers
booking and administrative software providers
IT and cloud storage service providers
accounting, tax, and bookkeeping providers
subcontractors or cleaning operatives assisting with service delivery
professional advisers such as legal or insurance advisers
regulatory, law enforcement, or public authorities where required by law

Where a third party acts as a processor, we require them to process personal data only on our instructions, to keep it secure, and to use it only for the agreed purpose. We do not sell personal data.

8. Data security

We take appropriate technical and organisational measures to protect personal data from loss, misuse, unauthorised access, alteration, or disclosure. These measures may include access controls, secure storage, staff confidentiality obligations, and regular review of our data handling practices. While no system can be guaranteed as completely secure, we work hard to maintain an appropriate level of protection for the data we process.

9. International transfers

Where personal data is transferred outside the UK, we will ensure that suitable safeguards are in place so that your data remains protected to an appropriate standard. Such safeguards may include adequacy regulations, approved contractual clauses, or other lawful transfer mechanisms recognised under data protection law.

10. Your rights

Under data protection law, you have a number of rights in relation to your personal data. These rights are not absolute and may be subject to legal exceptions. Subject to those limitations, you may have the right to:

Access - request a copy of the personal data we hold about you
Rectification - ask us to correct inaccurate or incomplete data
Erasure - request deletion of your data in certain circumstances
Restriction - ask us to limit how we use your data in certain situations
Objection - object to processing based on legitimate interests or direct marketing
Data portability - request transfer of certain data in a structured, commonly used format
Withdraw consent - withdraw consent where we rely on it

To exercise your rights, you can contact us using the usual communication channels you have used with us. We may need to verify your identity before responding to your request. We will aim to respond within the time limits set by law.

11. Marketing preferences

If we send marketing communications, we will do so only where permitted by law. You may opt out of marketing at any time. We respect your choice and will stop marketing communications when you tell us to do so, though we may still send essential service or transactional messages.

12. Children’s data

Our services are intended for adults and businesses. We do not knowingly collect personal data from children in the ordinary course of business. If we become aware that we have collected such data without appropriate authority, we will take steps to delete it where required.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in law, our services, or our data processing practices. Any updated version will apply from the date it is issued. We encourage you to review this policy periodically so that you remain informed about how we protect your personal data.

14. Summary of our approach

In short: we only collect the personal data needed to provide our services, we use it for clear and lawful purposes, we keep it only for as long as necessary, we limit access to trusted processors and third parties, and we respect your rights under data protection law. This policy applies to all Surrey Carpetcleaning customers in the area and is designed to ensure that your personal data is handled with care, transparency, and appropriate legal safeguards.