Privacy Policy - Carpetcleaning Waterloo

This Privacy Policy explains how Carpetcleaning Waterloo collects, uses, stores, shares, and protects personal data when providing carpet cleaning and related services. It applies to all Carpetcleaning Waterloo customers in the area, including prospective customers, residential clients, and commercial clients who interact with us by phone, email, online enquiry, or in person.

We are committed to handling personal data in a lawful, fair, and transparent way in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws. We only collect information that is necessary for delivering our services, managing our operations, and meeting legal obligations.

1. Personal Data We Collect

We may collect and process different types of personal data depending on the services requested and the way you interact with us. The data collected may include:

Identity information such as your name, title, and business name if applicable.
Contact information such as address, email address, telephone number, and service location details.
Service information including details of the cleaning work requested, property access instructions, appointment preferences, and customer notes.
Payment-related information such as invoice details, payment status, and transaction references. We do not store unnecessary payment card data if it is handled by secure payment processors.
Communication records including emails, messages, complaint details, and service feedback.
Technical data where applicable, such as basic device or browser information if you submit enquiries through digital systems that collect such information.

We do not intentionally collect special category personal data unless it is strictly necessary and you choose to provide it, for example if it relates to an access arrangement or service issue. If such data is received, it is handled with additional care and only where a lawful basis applies.

2. How We Use Your Data

We use personal data only for clear and legitimate purposes, including:

Providing carpet cleaning and related services.
Arranging quotations, bookings, and service visits.
Communicating with you about your appointment, property access, or service changes.
Processing payments, issuing invoices, and maintaining financial records.
Handling customer support, complaints, and service quality matters.
Maintaining internal records, administration, and audit trails.
Meeting legal, tax, accounting, and regulatory requirements.
Protecting the business, staff, customers, and property from fraud, misuse, or security incidents.

We do not use your personal data for unrelated purposes without ensuring that a lawful basis exists and, where necessary, that you have been properly informed.

3. Lawful Basis for Processing

Under GDPR, we must have a lawful basis to process personal data. Depending on the situation, Carpetcleaning Waterloo relies on one or more of the following lawful bases:

Contract

We process your data when it is necessary to enter into or perform a contract with you. This includes managing bookings, delivering cleaning services, confirming instructions, and issuing invoices.

Legitimate Interests

We may process data where it is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. Examples include service administration, business record keeping, quality control, responding to enquiries, preventing misuse, and improving our services.

Legal Obligation

Some data must be retained or processed to comply with legal obligations, including accounting, tax, insurance, and record-keeping requirements. Where the law requires us to keep records for a specific period, we do so.

Consent

In limited cases, we may rely on your consent, such as where optional communications or specific non-essential processing is involved. If we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

4. Data Sharing and Processors

We may share personal data with trusted third parties who assist us in operating our business. These recipients act either as processors or as independent controllers, depending on the nature of the service.

Examples of processors may include:

IT and hosting providers that support email, data storage, or business systems.
Accounting and bookkeeping providers that help with invoicing, tax records, and financial administration.
Payment service providers that process transactions securely on our behalf.
Customer service or scheduling tools used to manage appointments and communications.
Professional advisers such as legal, tax, or insurance advisers where necessary.

We require processors to handle personal data securely, to use it only on our instructions, and to comply with applicable data protection obligations. We do not sell personal data. We also do not disclose personal data to third parties for their own marketing purposes.

In rare situations, we may be required to share information with public authorities, regulators, law enforcement, or courts where required by law or where necessary to protect legal rights.

5. Data Retention

We keep personal data only for as long as necessary for the purpose for which it was collected, and then delete or anonymise it securely. Retention periods depend on the type of data and the reason it is held.

Customer service records are normally retained for the period needed to complete the service and deal with any follow-up issues.
Financial and invoice records are retained for the time required by tax and accounting laws.
Communication records may be kept for a reasonable period to manage complaints, disputes, and service history.
Legal and compliance records are kept where necessary to meet statutory or insurance obligations.

When data is no longer required, we take appropriate steps to delete, destroy, or anonymise it securely. Retention is reviewed periodically to ensure that we do not keep data longer than necessary.

6. Data Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures may include access controls, secure storage, restricted staff access, and careful handling of paper and electronic records.

While no system is completely risk-free, we take reasonable steps to protect the information entrusted to us and to limit access to those who need it for legitimate business purposes.

7. Your Rights Under GDPR

You have a number of rights regarding your personal data. Depending on the legal basis for processing and the circumstances of the request, these rights may include:

Right of access — you may request a copy of the personal data we hold about you.
Right to rectification — you may ask us to correct inaccurate or incomplete data.
Right to erasure — you may request deletion of your data in certain circumstances.
Right to restriction — you may ask us to limit the processing of your data in certain situations.
Right to object — you may object to processing based on legitimate interests in certain cases.
Right to data portability — where applicable, you may request that certain data be provided in a structured, commonly used format.
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.

These rights are not absolute and may be limited where we must retain information for legal, contractual, or security reasons. We will respond to rights requests in accordance with GDPR requirements.

8. Children’s Data

Our services are intended for adult customers or for adults acting on behalf of a household or business. We do not knowingly collect personal data from children except where it is incidentally included in service arrangements communicated by an adult customer. If we become aware that child data has been collected unnecessarily, we will take appropriate steps to delete it.

9. International Transfers

Where a processor or service provider stores or accesses data outside the United Kingdom or European Economic Area, we ensure that appropriate safeguards are in place. These may include standard contractual protections or other lawful transfer mechanisms recognised under data protection law.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data handling practices. Any updated version will apply from the date it is published or otherwise communicated. We encourage customers to review this policy periodically to remain informed about how their data is handled.

11. Summary of Our Commitment

Carpetcleaning Waterloo respects your privacy and handles personal data responsibly. We collect only what is necessary, use it for clear and lawful purposes, retain it for the required period, and share it only with trusted processors or where legally required. We also recognise and support your rights under GDPR.

This policy applies to all Carpetcleaning Waterloo customers in the area.