Privacy Policy - Cleaner Elephantandcastle

This Privacy Policy explains how Cleaner Elephantandcastle collects, uses, stores, shares, and protects personal data when providing cleaning services. It applies to all Cleaner Elephantandcastle customers in the area, including prospective customers, current customers, and anyone who communicates with us about our services. We are committed to handling personal data in a lawful, fair, and transparent manner in accordance with the UK GDPR and the Data Protection Act 2018.

1. Who We Are

Cleaner Elephantandcastle provides residential and commercial cleaning services. In the course of delivering these services, we may process personal data relating to customers, household members, property occupiers, payment contacts, and service recipients. For the purposes of data protection law, we act as the data controller for the personal data we determine the purposes and means of processing.

2. Personal Data We Collect

We collect only the information that is necessary to provide and manage our services, comply with legal obligations, and maintain service quality. The types of data we may collect include:

Identity details such as name, title, and service user reference numbers.
Contact details such as address, phone number, and email address.
Service information such as property access instructions, cleaning preferences, appointment details, and service history.
Billing and payment information such as invoice details, transaction references, and payment status.
Communication records such as emails, messages, call notes, feedback, complaints, and service confirmations.
Technical information if you interact with our digital systems, including device information, log data, and basic usage records.
Special category data only where strictly necessary and with appropriate safeguards, for example information relevant to health or access needs that affect service delivery.

We do not seek to collect unnecessary personal data. We will only request data that is relevant to the service being provided.

3. How We Use Personal Data

We use personal data for the following purposes:

To register and manage customer accounts and service requests.
To provide cleaning services at agreed times and locations.
To communicate about bookings, changes, service updates, and customer support.
To process payments, issue invoices, and maintain financial records.
To personalise service delivery based on preferences and access requirements.
To handle complaints, disputes, and quality assurance.
To comply with legal, tax, accounting, and regulatory obligations.
To improve our operations, service standards, and customer experience.
To protect our business, staff, customers, and property from fraud, misuse, or security incidents.

We process personal data only where there is a valid reason to do so and always seek to respect your privacy.

4. Lawful Basis for Processing

Under data protection law, we must have a lawful basis to process personal data. Cleaner Elephantandcastle relies on the following lawful bases, depending on the context:

Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes arranging cleaning services, confirming appointments, and managing payments.

Legal Obligation

We process certain information to comply with legal obligations, including record keeping, tax requirements, accounting duties, and responses to lawful requests.

Legitimate Interests

We may process personal data where it is necessary for our legitimate interests, provided that your rights and freedoms do not override those interests. Examples include service improvement, internal administration, fraud prevention, and responding to customer enquiries. We always assess these interests carefully and only use this basis where appropriate.

Consent

In limited cases, we rely on your consent, for example where we process optional information not required for service delivery or where special category data is involved and no other lawful basis applies. You may withdraw consent at any time, and doing so will not affect the lawfulness of processing carried out before withdrawal.

5. Retention of Personal Data

We keep personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, and reporting requirements. Retention periods vary depending on the type of data and the reason for processing.

Customer and service records are retained for the duration of the service relationship and for a reasonable period afterwards.
Financial and invoicing records are kept for the period required by tax and accounting law.
Communication records are retained for as long as needed to manage the service, resolve disputes, and maintain evidence of instructions or complaints.
Complaint and incident records may be kept longer where needed to establish, exercise, or defend legal claims.

When personal data is no longer required, it is securely deleted, anonymised, or otherwise disposed of in a safe and appropriate manner. We aim to ensure that data is not kept longer than necessary.

6. Processors and Third Parties

We may share personal data with trusted third-party service providers who act as processors on our behalf. These processors only handle data under our instructions and are required to protect it appropriately. Categories of processors may include:

Payment processors who handle transactions and payment verification.
Booking and scheduling providers who support appointment management and service coordination.
IT and cloud service providers who store data securely and maintain systems.
Communication service providers who help deliver messages, emails, or service notifications.
Accounting and bookkeeping providers who support financial administration.
Professional advisers such as legal or insurance advisers where necessary.

We may also disclose personal data where required by law, court order, regulatory authority, or to protect the rights, property, or safety of Cleaner Elephantandcastle, our customers, staff, or others. We do not sell personal data.

7. International Transfers

If any processor or service provider stores or accesses data outside the United Kingdom, we ensure that appropriate safeguards are in place before the transfer occurs. These may include adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms recognised under applicable data protection law.

8. Data Security

We use reasonable technical and organisational measures to protect personal data from unauthorised access, loss, alteration, disclosure, or destruction. These measures may include access controls, secure storage, staff confidentiality obligations, and regular review of data-handling practices. While no system can be completely secure, we take data protection seriously and work to reduce risks wherever possible.

9. Your Rights

As a data subject, you have rights in relation to your personal data. Depending on the legal basis and circumstances, you may have the right to:

Access the personal data we hold about you.
Rectify inaccurate or incomplete data.
Erase your data in certain situations.
Restrict processing in specific circumstances.
Object to processing based on legitimate interests or direct marketing.
Data portability where processing is based on consent or contract and carried out by automated means.
Withdraw consent where we rely on consent.

You also have the right to lodge a complaint with the Information Commissioner's Office if you believe your data protection rights have been infringed. We encourage you to raise any concerns with us first so we can address them promptly and fairly.

10. Children’s Data

Our services are intended for adults or authorised representatives acting on their behalf. We do not knowingly collect personal data from children unless it is necessary for service delivery and is provided by an adult with authority to do so. Where children’s data is involved, we apply extra care and only process the minimum necessary information.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data-processing practices. Any revised version will apply from the date it is issued. We encourage customers to review this policy periodically to stay informed about how we protect personal data.

12. Summary of Our Commitment

Cleaner Elephantandcastle is committed to lawful, transparent, and secure handling of personal data. We collect only what we need, use it for clear and legitimate purposes, retain it only as long as necessary, and protect the rights of every customer in the area. Privacy is an essential part of the trust we build with our customers. If personal data is processed, it will always be done with care, responsibility, and respect for the principles of data protection law.