Privacy Policy - Keston Carpet Cleaners

Effective Date: This Privacy Policy applies to all Keston Carpet Cleaners customers in our service area.

At Keston Carpet Cleaners, we are committed to protecting your privacy and handling your personal data in a lawful, fair, and transparent manner. This Privacy Policy explains how we collect, use, share, store, and protect personal data when you contact us, request a quotation, book a service, or use our carpet cleaning and related services. It also explains your rights under the UK GDPR and the Data Protection Act 2018.

1. Who We Are

Keston Carpet Cleaners is the data controller for the personal data described in this Privacy Policy. This means we decide why and how your personal data is processed for our business operations and service delivery. We only process personal data where we have a valid legal basis and only for the purposes set out below.

2. Personal Data We Collect

We may collect and process different categories of personal data depending on how you interact with us. The information we collect may include:

Identity data such as your name and title.
Contact data such as your address, telephone number, and email address.
Service details such as the type of cleaning requested, property access notes, appointment preferences, and information relevant to the work to be carried out.
Billing and payment information such as invoices, payment status, and transaction records. We do not knowingly store full card details unless required by a secure payment processor.
Communication data such as messages, enquiries, complaints, reviews, and any correspondence we have with you.
Technical and usage data where applicable, such as records of how you interact with our digital systems, bookings, or online forms.
Marketing preferences if you choose to receive updates, promotions, or service reminders.

We usually collect this information directly from you. In some cases, we may receive personal data from third parties, for example from a person making a booking on your behalf, a property manager, or a payment provider.

3. How We Use Your Data

We use personal data for the following purposes:

to provide quotations and manage bookings;
to deliver our carpet cleaning and related services;
to communicate with you about appointments, service updates, or issues relating to the work;
to process payments and maintain accurate accounting records;
to respond to enquiries, feedback, and complaints;
to improve our services, operations, and customer experience;
to meet our legal, tax, and regulatory obligations;
to send marketing communications where permitted by law and where you have not opted out.

We will only use your personal data for the purposes for which it was collected, unless we reasonably consider that we need to use it for another compatible purpose. If we need to use your personal data for an unrelated purpose, we will tell you and explain the legal basis that allows us to do so.

4. Lawful Basis for Processing

Under data protection law, we must have a lawful basis for processing your personal data. Depending on the activity, we rely on one or more of the following:

Contract - where processing is necessary to take steps at your request before entering into a contract or to perform a contract with you, such as managing bookings and providing cleaning services.
Legal obligation - where processing is necessary to comply with legal requirements, such as tax, accounting, record-keeping, or fraud prevention obligations.
Legitimate interests - where processing is necessary for our legitimate business interests and your interests and fundamental rights do not override those interests. This may include service administration, customer support, business improvement, and maintaining security.
Consent - where we rely on your consent, for example for certain direct marketing communications. You may withdraw consent at any time.

We do not use your personal data in ways that are incompatible with these lawful bases.

5. Sharing Your Data and Processors

We may share personal data with trusted third parties who act as processors or independent controllers depending on the service they provide. These parties are only allowed to process your data on our instructions or where they have their own lawful basis to do so. We require appropriate contractual and security safeguards.

Examples of processors and third parties

Payment processors that securely handle card or electronic payments.
Booking and scheduling providers that help us manage appointments and service records.
IT and cloud service providers that store email, files, customer records, or operational data.
Accountants and professional advisers who support our business compliance and financial administration.
Delivery, subcontractor, or field service partners where necessary to complete a service you requested.
Regulators, insurers, law enforcement, or legal advisers where required by law or necessary to protect our rights and interests.

We do not sell your personal data. We will not share it with third parties for their own marketing purposes unless you have explicitly agreed or we are otherwise permitted by law to do so.

6. Data Retention

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including meeting legal, accounting, or reporting requirements. The length of time we retain data depends on the type of data and the reason we hold it.

Service and booking records are usually retained for a reasonable period to support customer service, dispute handling, and business administration.
Financial and tax records are retained for the period required by law.
Communication records are retained as long as needed to manage enquiries, complaints, and follow-up matters.
Marketing preferences are kept until you unsubscribe, object, or your details are no longer needed.

When personal data is no longer required, we will delete it securely or anonymise it so that it can no longer identify you.

7. Data Security

We use appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, misuse, alteration, or disclosure. These measures may include access controls, secure storage, staff confidentiality obligations, and limited access to records on a need-to-know basis.

However, no method of transmission or storage is completely secure. While we take reasonable steps to protect your information, we cannot guarantee absolute security.

8. International Transfers

Where personal data is transferred outside the United Kingdom, we will ensure appropriate safeguards are in place, such as adequacy regulations, standard contractual clauses, or other lawful transfer mechanisms required by applicable data protection law.

9. Your Rights

Under UK data protection law, you have a number of rights in relation to your personal data. These rights may be limited in some circumstances, for example where we must keep certain information for legal reasons.

Right of access - you can ask for a copy of the personal data we hold about you.
Right to rectification - you can ask us to correct inaccurate or incomplete data.
Right to erasure - you can ask us to delete your data in certain circumstances.
Right to restriction - you can ask us to limit how we use your data in certain situations.
Right to object - you can object to processing based on legitimate interests or direct marketing.
Right to data portability - you can ask for certain data to be provided to you or another organisation in a machine-readable format.
Right to withdraw consent - where we rely on consent, you may withdraw it at any time.

If you wish to exercise any of these rights, we will respond in accordance with applicable law and within the required timeframes.

10. Marketing Choices

Where permitted, we may send you occasional marketing communications about our services, special offers, or reminders. You can choose not to receive marketing at any time. If you object to direct marketing, we will stop using your data for that purpose.

11. Children’s Data

Our services are intended for adults. We do not knowingly collect personal data from children unless it is provided by a parent, guardian, or authorised adult for the purpose of arranging a service. If we learn that we have collected child data without appropriate authority, we will take steps to delete it where required.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or operational needs. Any revised version will apply from the date it is published or otherwise communicated to you.

13. Complaints

If you have concerns about how we handle your personal data, you have the right to raise them with the relevant data protection authority. We encourage you to contact us first so we can try to resolve your concern quickly and fairly.

This Privacy Policy is intended to provide a clear and lawful explanation of how Keston Carpet Cleaners processes personal data for customers in our area.