Privacy Policy - Stepney Carpet Cleaners

This Privacy Policy explains how Stepney Carpet Cleaners collects, uses, stores, shares, and protects personal data. It applies to all Stepney Carpet Cleaners customers in the area, including prospective customers, current customers, and anyone who communicates with us about our services. We are committed to handling personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

Stepney Carpet Cleaners provides carpet, upholstery, and related cleaning services to customers in the area. In the course of delivering these services, we may process personal information about individuals, households, property occupants, business representatives, and service recipients. We act as a data controller for the personal data we collect and use for our own business purposes.

2. Personal Data We Collect

We only collect data that is relevant and necessary for providing our services, managing our business, and meeting legal obligations. The types of personal data we may collect include:

Identity details such as name and title.
Contact details such as address, email address, and telephone number.
Service details such as the type of cleaning requested, booking information, property access instructions, and service preferences.
Payment information such as billing records, payment status, and transaction references.
Communication records such as emails, messages, complaints, feedback, and notes from phone conversations.
Technical and usage data where applicable, such as basic website or device information if you interact with any online service we use.
Photographs or condition notes relating to cleaning work, where needed to document the condition of carpets or upholstery before or after a service.

We do not intentionally collect special category data unless it is strictly necessary and we have a lawful basis to do so. If such information is shared with us accidentally, we will handle it carefully and in accordance with data protection law.

3. How We Use Personal Data

We use personal data for the following purposes:

To respond to enquiries and provide quotations.
To schedule and deliver cleaning services.
To confirm appointments and manage bookings.
To process payments, invoices, refunds, and records of transactions.
To communicate about service updates, follow-up matters, or complaints.
To maintain business records and improve our services.
To comply with legal, tax, and regulatory requirements.
To protect our business from fraud, misuse, or unlawful activity.

We will only use personal data in ways that are compatible with the original purpose for which it was collected, unless we are legally permitted or required to use it otherwise.

4. Lawful Basis for Processing

Under the UK GDPR, we must have a lawful basis for processing personal data. Depending on the situation, Stepney Carpet Cleaners may rely on one or more of the following lawful bases:

Contract

We process personal data when it is necessary to enter into or perform a contract with you. This includes booking services, carrying out cleaning work, taking payment, and managing service-related communication.

Legal Obligation

We may process data where we need to comply with legal requirements, such as tax, accounting, or record-keeping obligations.

Legitimate Interests

We may process data where it is necessary for our legitimate business interests, provided your rights and freedoms do not override those interests. This may include managing our operations, keeping internal records, preventing fraud, and improving service quality.

Consent

In limited circumstances, we may rely on your consent, for example where you have clearly agreed to receive certain communications or where consent is required for specific optional processing. You can withdraw consent at any time where processing is based on consent.

5. Data Sharing and Processors

We may share personal data with trusted third parties that help us run our business. These parties act as processors when they process data on our behalf and only under our instructions. We require such processors to handle personal data securely and in line with applicable data protection laws.

Examples of processors or service providers may include:

Payment processing providers.
Booking and scheduling software providers.
IT, hosting, and cloud storage providers.
Accountants or bookkeeping services.
Customer communication tools, such as email or messaging platforms.
Professional advisers and legal advisers where necessary.

We may also disclose data where required by law, court order, or lawful request from a public authority. If business operations are restructured, transferred, or sold, personal data may be shared with relevant parties as part of that process, subject to legal safeguards.

We do not sell personal data. Any sharing is limited to what is necessary for service delivery, legal compliance, or legitimate business operations.

6. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting, and reporting requirements. Retention periods depend on the type of data and the reason it is held.

Service and booking records are generally kept for as long as needed to manage the customer relationship and resolve any disputes.
Payment and invoicing records are typically retained for the period required under tax and financial laws.
Communication records may be kept for a reasonable period to deal with complaints, service issues, or follow-up questions.
Photographs or service notes are retained only as long as necessary for documentation, quality control, or dispute handling.

When data is no longer needed, we will securely delete, destroy, or anonymise it. We retain data only for legitimate business or legal purposes.

7. Data Security

We use appropriate technical and organisational measures to protect personal data from unauthorised access, loss, alteration, or disclosure. These measures may include access controls, secure storage, password protection, and limiting access to data on a need-to-know basis.

Although we take reasonable steps to protect your information, no system can be completely secure. If a data breach occurs and we are required to do so, we will notify the relevant supervisory authority and affected individuals in accordance with legal obligations.

8. Your Rights

As a data subject, you have several rights under data protection law. These rights may be exercised in relation to the personal data we hold about you, subject to certain legal restrictions and exemptions.

Right of access – you can request a copy of the personal data we hold about you.
Right to rectification – you can ask us to correct inaccurate or incomplete data.
Right to erasure – you can ask us to delete your data in certain circumstances.
Right to restrict processing – you can ask us to limit the way we use your data in certain cases.
Right to object – you can object to processing based on legitimate interests or direct marketing.
Right to data portability – you can request transfer of data you provided to us where applicable.
Right to withdraw consent – where processing is based on consent, you may withdraw it at any time.

If you wish to exercise any of these rights, we will respond in accordance with applicable legal timeframes. We may need to verify your identity before dealing with your request. In some cases, we may not be able to fully comply where legal obligations require us to keep certain information.

9. Children’s Data

Our services are not directed at children, and we do not knowingly collect personal data from children as part of normal business operations. If we become aware that we have collected such data without appropriate authority, we will take reasonable steps to delete it.

10. International Transfers

Where any processor or service provider stores or processes data outside the UK, we will take appropriate safeguards to protect your personal data. These safeguards may include adequacy regulations, standard contractual clauses, or other legally approved transfer mechanisms.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or data handling practices. The updated version will apply from the date it is published or otherwise made available. We encourage customers to review this policy periodically.

12. Summary of Key Principles

This policy is based on the following principles:

We collect only what we need.
We use data fairly and lawfully.
We keep data secure and accurate.
We retain data only as long as necessary.
We respect your rights under UK GDPR.

Stepney Carpet Cleaners is committed to respecting privacy and maintaining trust. If you are a customer in the area, this policy explains how we handle your personal data whenever you use our services or contact us for assistance.