Privacy Policy - Bromley Carpetcleaning

This Privacy Policy explains how Bromley Carpetcleaning collects, uses, stores, shares, and protects personal data when providing carpet cleaning and related services. It applies to all Bromley Carpetcleaning customers in the area, including enquiries, quotations, bookings, completed services, follow-up communications, and any other interaction with us connected to our services.

We are committed to handling personal data in a lawful, fair, and transparent manner in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy is intended to help you understand what information we process, why we process it, how long we keep it, and what rights you have.

1. Data We Collect

We may collect and process the following categories of personal data:

Identity details: name, title, and, where relevant, company or property name.
Contact details: address, telephone number, and email address.
Service information: property access notes, cleaning requirements, appointment preferences, service history, and details of items or areas to be cleaned.
Billing information: invoicing details, payment status, and records of transactions. We do not normally store full card details where payments are processed by a third-party payment provider.
Communication records: emails, messages, call notes, complaint records, and correspondence related to bookings or service delivery.
Technical and usage data: limited website or device data such as IP address, browser type, and basic analytics if you interact with our digital services. This data is used only where applicable and in line with applicable cookie and privacy requirements.
Special category data: we do not normally collect special category data. However, if you provide information that may indirectly reveal health, access, or vulnerability needs, we will process it only where necessary and with appropriate safeguards.

We generally collect personal data directly from you when you request a quote, book a service, communicate with us, complete a transaction, or provide feedback. In some cases, we may receive data from third parties such as landlords, managing agents, family members, or referral partners where they arrange services on your behalf and are authorised to share your information.

2. How We Use Personal Data

We use personal data for the following purposes:

to respond to enquiries and provide quotations;
to manage bookings and deliver carpet cleaning services;
to communicate about scheduling, changes, and service updates;
to issue invoices, process payments, and manage accounts;
to keep records of services provided;
to handle complaints, disputes, and insurance-related matters;
to maintain the safety, security, and quality of our services;
to meet legal, tax, accounting, and regulatory obligations;
to improve our customer service and business operations;
to send limited follow-up communications where appropriate and permitted.

We only process personal data where there is a valid reason to do so, and we do not use your information in ways that are unexpected or incompatible with the purpose for which it was collected.

3. Lawful Basis for Processing

Under UK GDPR, we must have a lawful basis for processing personal data. Bromley Carpetcleaning relies on the following lawful bases, depending on the situation:

Contract: where processing is necessary to provide a quote, book a service, complete a cleaning job, issue an invoice, or otherwise perform our agreement with you.
Legitimate interests: where processing is needed to run and improve our business, manage customer communications, prevent fraud, maintain records, and ensure service quality, provided those interests are not overridden by your rights and freedoms.
Legal obligation: where processing is required to comply with tax, accounting, consumer, employment, or other legal obligations.
Consent: where we rely on your consent for any optional activity, such as certain forms of marketing or non-essential communications. You may withdraw consent at any time.
Vital interests: in rare cases, where processing is necessary to protect someone’s life.

Where we rely on legitimate interests, we will ensure that the processing is proportionate, necessary, and respectful of your privacy.

4. Sharing and Processors

We may share personal data with trusted third parties who act as processors on our behalf or as independent controllers where appropriate. These may include:

IT and cloud storage providers that securely host business records;
email and communication service providers;
accounting, bookkeeping, or tax service providers;
payment processing providers;
customer relationship or scheduling systems;
professional advisers such as accountants, insurers, or legal advisers;
subcontractors or service partners who help deliver the requested service;
regulators, law enforcement bodies, or public authorities where required by law.

Where a third party acts as a processor, they may only process personal data on our documented instructions and must protect it with appropriate technical and organisational measures. We require processors to handle data securely and not to use it for their own purposes unless they are acting as an independent controller and have their own lawful basis.

We do not sell personal data. We do not share personal data for unrelated commercial exploitation.

5. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including legal, accounting, and reporting requirements. Retention periods may vary depending on the type of record and the reason it is held.

Customer and service records: retained for a period needed to manage the relationship, respond to queries, and support any follow-up service.
Financial and tax records: retained for the period required by law, typically at least six years for accounting purposes.
Complaints and dispute records: retained for as long as needed to resolve issues and defend legal claims.
Marketing preferences: retained until you opt out or we no longer need the information.

When data is no longer required, we will delete it securely or anonymise it so that it can no longer identify you.

6. Data Security

We take appropriate security measures to protect personal data against loss, misuse, unauthorised access, alteration, or disclosure. These measures may include access controls, secure storage, password protection, staff confidentiality duties, and careful selection of suppliers. While no system can be guaranteed completely secure, we work to reduce risks and respond appropriately to any suspected personal data incident.

7. International Transfers

In some cases, service providers may process data outside the United Kingdom. If this happens, we will make sure appropriate safeguards are in place, such as adequacy regulations or approved contractual protections, so that your personal data remains protected to UK GDPR standards.

8. Your Rights

Under data protection law, you may have the following rights in relation to your personal data:

Right of access: to request a copy of the data we hold about you.
Right to rectification: to ask us to correct inaccurate or incomplete information.
Right to erasure: to request deletion of your data in certain circumstances.
Right to restriction: to ask us to limit processing in certain situations.
Right to object: to object to processing based on legitimate interests or direct marketing.
Right to data portability: to request a copy of certain data in a structured, commonly used format where applicable.
Right to withdraw consent: where processing is based on consent, you can withdraw it at any time.

These rights are not absolute and may be subject to legal limitations. For example, we may need to retain certain records to comply with legal obligations or to establish, exercise, or defend legal claims.

9. Children’s Data

Our services are generally intended for adult customers, property owners, tenants, landlords, or their authorised representatives. We do not knowingly collect personal data from children unless it is provided by an adult in connection with a service request and only where necessary.

10. Complaints

If you are concerned about how we handle your personal data, you may raise the issue with us so that we can review and address it. You also have the right to lodge a complaint with the UK data protection authority if you believe your rights have been infringed.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the law, our services, or our data handling practices. Any updated version will apply from the date it is published.

Summary of Key Points

We collect only the data needed to provide and manage carpet cleaning services.
We process data on lawful bases such as contract, legitimate interests, consent, and legal obligation.
We keep data only as long as necessary and then securely delete or anonymise it.
We use trusted processors who must protect your information.
You have important rights over your personal data, including access, correction, erasure, and objection.

Bromley Carpetcleaning is committed to treating your personal data with care, transparency, and respect. We recognise that privacy is important, and we work to ensure our handling of personal information remains lawful, secure, and proportionate at all times.