Privacy Policy - Hampstead Carpet Cleaners

Effective date: This Privacy Policy applies to all Hampstead Carpet Cleaners customers in the area we serve.

Hampstead Carpet Cleaners is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It also explains your rights and how we handle personal data relating to customers, prospective customers, and other individuals who interact with us.

1. Who this policy applies to

This policy applies to all customers of Hampstead Carpet Cleaners in the area we serve, including individuals who request quotes, book services, receive cleaning services, or otherwise communicate with us in connection with our business. It also applies to people whose data we may receive when a booking is made on their behalf, such as property managers, landlords, tenants, or household members.

2. Information we collect

We collect only the personal data that is necessary for legitimate business purposes. The categories of information we may collect include:

Identity information: name, title, and any relevant customer reference or booking identifier.
Contact information: address, email address, and telephone number.
Service information: details about the cleaning services requested, property type, preferred dates and times, access notes, and service history.
Payment information: limited billing details and transaction records. We do not intentionally store full card details where payment processing is handled securely by a third-party processor.
Communication records: emails, messages, booking notes, complaint details, and records of customer support interactions.
Technical information: limited data such as device or browser details if you interact with us electronically, where required for security, troubleshooting, or service administration.
Special category data: we do not routinely collect special category personal data. If such information is voluntarily provided and is necessary to deliver a service safely, we will treat it with extra care and only process it where a lawful basis applies.

We may collect information directly from you, from third parties who arrange services on your behalf, or from publicly available sources where appropriate and lawful.

3. How we use your personal data

We use your personal data for the following purposes:

to provide quotes and manage bookings;
to deliver cleaning services and related customer support;
to communicate about appointments, changes, and service updates;
to process payments, refunds, and account-related matters;
to respond to enquiries, complaints, and feedback;
to maintain business records and service history;
to improve our services, administration, and customer experience;
to comply with legal obligations, accounting requirements, and regulatory requests;
to protect against fraud, misuse, or security incidents.

We only use personal data in ways that are necessary, proportionate, and compatible with the reasons it was collected.

4. Lawful basis for processing

Under UK GDPR, we must have a lawful basis to process your personal data. Depending on the circumstances, we rely on one or more of the following bases:

a) Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes providing quotes at your request, confirming bookings, delivering services, processing payments, and managing after-service issues.

b) Legitimate interests

We may process personal data where it is necessary for our legitimate business interests and those interests are not overridden by your rights and freedoms. Examples include maintaining business records, preventing fraud, improving services, handling routine customer communications, and managing internal administration.

c) Legal obligation

We may process personal data where necessary to comply with legal obligations, such as tax, accounting, insurance, or regulatory requirements.

d) Consent

In limited cases, we may rely on your consent, for example if we need permission for certain optional communications or if special category data is provided and consent is the appropriate lawful basis. Where we rely on consent, you may withdraw it at any time.

e) Vital interests or public task

These bases are unlikely to apply in normal day-to-day operations, but we may rely on them if required in exceptional circumstances.

5. Sharing your information with processors and others

We may share your personal data with trusted third parties where necessary to operate our business and deliver services. Some of these third parties act as data processors, meaning they process data on our behalf and under our instructions. Others may act as independent controllers where they determine their own purposes for processing.

Processors may include:

IT and cloud service providers: for secure data storage, email, scheduling, and business administration;
payment processors: for handling secure payments and financial transactions;
accounting and bookkeeping providers: for financial recordkeeping and compliance;
customer communication tools: for sending service-related messages and managing enquiries;
professional advisers: such as accountants, insurers, or legal advisers where needed;
service subcontractors or operational partners: if required to complete a booking or support service delivery.

We require processors to protect personal data, use it only for the agreed purpose, and implement appropriate technical and organisational security measures. We do not sell your personal data.

We may also disclose information where required by law, court order, regulatory request, or to protect our rights, customers, staff, or the public.

6. Data retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting, insurance, and reporting requirements. Retention periods depend on the type of information and the reason we hold it.

Booking and service records: kept for as long as needed to manage the customer relationship and for a reasonable period afterwards for administration, dispute resolution, and business records.
Financial records: kept for the period required by tax and accounting laws.
Communication records: retained for a period appropriate to the nature of the query or complaint.
Security and audit records: retained only as long as necessary for monitoring, protection, and investigation purposes.

When data is no longer needed, we will securely delete, anonymise, or archive it in accordance with our retention practices.

7. International transfers

If any of our processors or service providers store or access data outside the UK, we will take appropriate steps to ensure your information is protected to a standard consistent with UK data protection law. This may include approved contractual safeguards or ensuring the destination country is recognised as providing adequate protection.

8. Security of your data

We use appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, misuse, alteration, or disclosure. These measures may include access controls, secure systems, staff confidentiality obligations, and regular review of data handling practices. While no system can be guaranteed completely secure, we work to reduce risk and respond promptly to any suspected incident.

9. Your rights under UK GDPR

You have a number of rights in relation to your personal data. Subject to certain conditions and exemptions, these include:

Right of access: you can ask for a copy of the personal data we hold about you;
Right to rectification: you can ask us to correct inaccurate or incomplete information;
Right to erasure: you can ask us to delete personal data where it is no longer needed or where deletion is otherwise permitted;
Right to restriction: you can ask us to limit how we use your data in certain circumstances;
Right to object: you can object to processing based on legitimate interests or direct marketing;
Right to data portability: you can ask for certain data to be provided in a structured, commonly used format;
Right to withdraw consent: where we rely on consent, you may withdraw it at any time;
Rights related to automated decision-making: we do not normally make decisions about you based solely on automated processing in a way that produces legal or similarly significant effects.

If you wish to exercise any of these rights, we may need to verify your identity before responding. We aim to respond within one month, although this may be extended where requests are complex or numerous.

10. Children’s data

Our services are not directed to children, and we do not knowingly collect personal data from children except where it is incidental to providing household services and necessary for legitimate operational reasons. If we become aware that we have collected personal data from a child inappropriately, we will take steps to delete it where required.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or data handling practices. Any updated version will apply from the date it is published or otherwise communicated. We encourage customers to review this policy periodically so they remain informed about how we process personal data.

12. Complaints and your right to complain

If you have concerns about how we handle your personal data, you can raise them with us so we can try to resolve the issue. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe your data protection rights have been infringed.

By using Hampstead Carpet Cleaners’ services, you acknowledge that your personal data may be processed as described in this Privacy Policy.