Privacy Policy - Hoxton Carpet Cleaners

This Privacy Policy explains how Hoxton Carpet Cleaners collects, uses, stores, shares, and protects personal data in line with the UK GDPR and the Data Protection Act 2018. It applies to all Hoxton Carpet Cleaners customers in the area, including current, former, and prospective customers who request carpet cleaning, upholstery cleaning, rug cleaning, stain treatment, or related services.

1. Who We Are

Hoxton Carpet Cleaners is a professional cleaning service provider operating locally. For the purposes of data protection law, we act as the data controller when we decide how and why personal data is processed. This means we are responsible for making sure your information is handled lawfully, fairly, and transparently.

2. Information We Collect

We may collect and process different types of personal data depending on the service requested and how you interact with us. The data we collect may include:

Identity information such as your name.
Contact information such as your address, email address, and telephone number.
Service information such as property access details, preferred appointment times, service notes, and cleaning preferences.
Payment information such as billing records and payment status. We do not keep unnecessary payment card details if a secure third-party processor handles the transaction.
Communication data such as messages, enquiries, complaints, feedback, and records of correspondence.
Technical data if you contact us through digital channels, including basic device or browser information where relevant for security and performance.
Special category data only where strictly necessary and usually only if you choose to provide it, for example if cleaning instructions reveal allergies, sensitivities, or health-related access needs.

We aim to collect only the minimum amount of data needed to provide and manage our services effectively.

3. How We Collect Your Data

We may obtain personal data directly from you when you:

request a quote or booking;
communicate with us by phone, email, text, or online enquiry;
provide details during service delivery;
submit feedback or a complaint;
make a payment or request an invoice.

We may also receive information from third parties where necessary to deliver our services, such as building managers, landlords, letting agents, or payment service providers. In all cases, we limit use of the data to what is necessary and appropriate.

4. Lawful Basis for Processing

We process personal data only when we have a valid lawful basis under GDPR. Depending on the context, our lawful bases include:

Contract

Processing is necessary to perform a contract with you or to take steps at your request before entering into a contract. This includes handling bookings, providing cleaning services, confirming appointments, issuing invoices, and managing customer accounts.

Legal Obligation

We may process data where required to meet a legal obligation, such as maintaining accounting records, complying with tax rules, or responding to lawful requests from authorities.

Legitimate Interests

We may process some personal data where it is necessary for our legitimate interests and where those interests are not overridden by your rights and freedoms. This may include managing customer relationships, improving service quality, preventing fraud, maintaining records, and handling service disputes.

Consent

Where we rely on consent, we will ask for it clearly and separately. For example, consent may be used for optional marketing communications or for processing sensitive information that is not otherwise necessary. You can withdraw consent at any time, and this will not affect the lawfulness of processing carried out before withdrawal.

Vital Interests and Public Interest

These bases are unlikely to apply in most routine cleaning services, but we may rely on them if necessary to protect someone’s life or in other exceptional legal circumstances.

5. How We Use Your Data

We use personal data to:

arrange, deliver, and manage cleaning services;
confirm appointments and service details;
respond to enquiries and provide customer support;
issue quotes, invoices, and receipts;
manage payments and account records;
improve our services and customer experience;
maintain security and prevent misuse;
comply with legal and regulatory obligations.

We will not use your data for purposes that are incompatible with the original reason it was collected unless we have a lawful basis to do so and, where required, we tell you about it.

6. Sharing and Processors

We may share personal data with trusted third parties who act as processors on our behalf. These processors only handle data under our instructions and must protect it appropriately. They may include:

payment processors;
booking or scheduling service providers;
IT, cloud storage, and system maintenance providers;
accounting or invoicing software providers;
customer communication platforms;
professional advisers such as accountants or legal advisers;
service partners assisting with delivery when necessary.

We may also disclose data to independent controllers where required, such as banks, insurers, tax authorities, regulators, or law enforcement agencies. We will only share the minimum information necessary and only when a lawful basis exists.

7. International Transfers

If any processor stores or accesses data outside the UK, we will ensure appropriate safeguards are in place. This may include adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms designed to keep your data protected.

8. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including meeting legal, accounting, insurance, and reporting requirements. Retention periods may vary depending on the type of data and the reason it is held.

In general:

customer service and booking records are kept for a reasonable period after the last service;
financial and invoice records are kept for the period required by tax and accounting law;
complaints, disputes, or claims may be retained longer if needed to defend legal rights;
marketing preferences are retained until you withdraw consent or object where applicable.

When data is no longer needed, we will delete it securely or anonymise it so it can no longer identify you. Retention is reviewed regularly to ensure we do not keep data longer than necessary.

9. Data Security

We use appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration, or disclosure. These measures may include access controls, secure storage, password protection, staff training, and limited access on a need-to-know basis.

Although no system can be guaranteed completely secure, we work to maintain a level of protection that is appropriate to the nature of the data and the risks involved.

10. Your Rights

Under data protection law, you have a number of rights in relation to your personal data. These rights may apply in different circumstances and may be subject to legal exceptions. Your rights include:

Right of access — to request a copy of the personal data we hold about you.
Right to rectification — to ask us to correct inaccurate or incomplete data.
Right to erasure — to request deletion of your data in certain situations.
Right to restriction — to ask us to limit how we use your data in certain circumstances.
Right to object — to object to processing based on legitimate interests or direct marketing.
Right to data portability — to request your data in a structured, commonly used format where applicable.
Right to withdraw consent — where processing is based on consent.
Right to complain — to raise concerns with the relevant data protection authority if you believe your rights have been breached.

We may need to verify your identity before responding to a rights request. This helps us protect your information from unauthorised access.

11. Marketing Preferences

If we send optional marketing messages, we will do so only where permitted by law and, where required, with your consent. You may opt out of such communications at any time. Service-related communications, such as appointment confirmations, invoices, or important updates, are not marketing and may still be necessary for us to provide the service.

12. Children’s Data

Our services are intended for adults and property-related customers. We do not knowingly collect personal data from children except where it is incidentally provided in the course of household service arrangements and only when necessary. If we become aware that we have collected such data inappropriately, we will take steps to remove it.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, our services, or how we process personal data. Any updated version will replace the previous one from the date it takes effect. We encourage you to review this policy periodically so you remain informed about how we handle your information.

14. Summary of Key Principles

We are committed to the following principles when handling personal data:

lawfulness, fairness, and transparency;
purpose limitation;
data minimisation;
accuracy;
storage limitation;
integrity and confidentiality;
accountability.

By using our services, you acknowledge that personal data may be processed in accordance with this Privacy Policy and applicable data protection laws. We are committed to treating your information with care, respect, and responsibility.