Privacy Policy - Westminster Carpet Cleaners

This Privacy Policy explains how Westminster Carpet Cleaners collects, uses, stores, shares, and protects personal data when providing carpet cleaning and related services. It applies to all Westminster Carpet Cleaners customers in the area, including prospective customers, residential clients, commercial clients, and anyone who communicates with us in relation to a service request, booking, quotation, complaint, or general enquiry.

We are committed to handling personal data in a lawful, fair, and transparent way, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy sets out what data we collect, why we collect it, the lawful basis we rely on, how long we keep it, who may process it on our behalf, and the rights available to you.

1. Data We Collect

We only collect personal data that is relevant and necessary for providing our services, managing our business operations, and meeting legal obligations. Depending on how you interact with us, we may collect the following categories of information:

Identity details such as your name, title, and account or customer reference numbers.
Contact details such as address, email address, and telephone number.
Service details such as property access instructions, booking preferences, type of cleaning requested, and information about the items or areas to be cleaned.
Payment information such as payment status, transaction records, and billing details. Where payments are handled by a third party, we may not store full payment card details ourselves.
Communication records such as emails, messages, complaint notes, call summaries, and customer feedback.
Technical information such as device or browser data if you use digital booking or enquiry methods, where applicable.
Special category data only where necessary and supplied by you, for example if access arrangements or service conditions reveal health-related or vulnerability-related needs. We do not seek this data unless it is relevant to the service and proportionate to the purpose.

We usually collect personal data directly from you when you request a quote, make a booking, communicate with us, or use our services. In some cases, we may receive data from a third party acting on your behalf, such as a landlord, letting agent, property manager, insurer, or business customer.

2. How We Use Personal Data

We use personal data only for specific and legitimate purposes. These may include:

processing enquiries and providing quotations;
booking and delivering carpet cleaning services;
confirming appointments and service details;
managing payments, invoices, and account administration;
responding to complaints, service issues, or refund requests;
maintaining records for internal business management;
meeting legal, tax, and insurance obligations;
preventing fraud, misuse, or security incidents;
improving service quality and customer experience.

We do not use personal data for unrelated purposes unless we have a lawful basis to do so and the use is compatible with the original purpose.

3. Lawful Basis for Processing

Under the UK GDPR, we must have a lawful basis to process personal data. We rely on the following lawful bases depending on the context:

Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes arranging services, confirming appointments, delivering cleaning work, processing payments, and handling account administration.

Legal Obligation

We may process and retain data where required to comply with tax law, accounting rules, insurance requirements, consumer law, or other legal obligations.

Legitimate Interests

We may process personal data where it is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. This may include managing customer records, improving operations, preventing fraud, responding to enquiries, and maintaining security. When we rely on legitimate interests, we consider whether the processing is proportionate and necessary.

Consent

In limited circumstances, we may rely on your consent, for example where specific optional marketing or non-essential communications are involved. If consent is used, you may withdraw it at any time.

Vital Interests

In rare cases, we may process personal data where it is necessary to protect someone’s vital interests, such as in an emergency involving safety or serious risk.

4. Data Sharing and Processors

We may share personal data with trusted third parties who assist us in running our business. These third parties act as processors or independent controllers depending on the service they provide. We ensure that appropriate contractual and security measures are in place before sharing data.

Examples of processors or service providers may include:

Booking and scheduling providers used to manage appointments and service records.
Payment processors used to handle financial transactions securely.
IT and cloud service providers used for data storage, email, document management, and business systems.
Accountants and professional advisers where necessary for financial, legal, or compliance purposes.
Subcontractors or technicians who may need limited customer information to carry out a booked service.
Insurers or legal advisers in relation to claims, disputes, or risk management.

We do not sell personal data. We only disclose data when necessary for service delivery, legal compliance, or legitimate business operation. Where a third party acts on our instructions, they are required to keep data confidential and use it only for the agreed purpose.

5. International Transfers

If any processor or service provider stores or accesses personal data outside the UK, we will take appropriate steps to ensure that the transfer is lawful and that the data remains protected to a standard essentially equivalent to UK requirements. This may include approved transfer safeguards and contractual protections.

6. Data Retention

We keep personal data only for as long as necessary for the purpose for which it was collected, and no longer than required by law or business need. Retention periods may vary depending on the type of data and the reason it was collected.

Customer and booking records are usually kept for the period needed to complete the service and handle any follow-up matters.
Invoices, payment records, and tax-related data are kept for the period required by applicable accounting and tax laws.
Complaint and correspondence records may be retained for a reasonable period to resolve disputes and maintain service history.
Marketing consent records, where applicable, are kept until consent is withdrawn or the record is no longer needed.

When personal data is no longer required, we will delete it securely or anonymise it so that it no longer identifies you. Retention is reviewed regularly to ensure we do not keep data for longer than necessary.

7. Security of Personal Data

We take appropriate technical and organisational measures to protect personal data against accidental loss, unlawful access, alteration, disclosure, or destruction. These measures may include access controls, password protection, secure storage, staff confidentiality obligations, and limited access to personal information on a need-to-know basis.

Although no system can be completely secure, we work to maintain a reasonable and proportionate level of security based on the nature of the data we process.

8. Your Rights

Depending on the circumstances and the legal basis used, you may have the following rights under data protection law:

Right of access – to request a copy of the personal data we hold about you.
Right to rectification – to ask us to correct inaccurate or incomplete data.
Right to erasure – to request deletion of your data in certain situations.
Right to restriction – to ask us to limit how we use your data in certain circumstances.
Right to object – to object to processing based on legitimate interests or direct marketing.
Right to data portability – to request transfer of certain data in a structured, commonly used format, where applicable.
Right to withdraw consent – where processing is based on consent, you may withdraw it at any time.

Exercising these rights will not usually affect the lawfulness of processing carried out before your request was received. Some rights may be limited where we must retain data to comply with a legal obligation or defend a legal claim.

9. Complaints and Supervisory Authority

If you are concerned about how we have handled your personal data, you may raise the issue with us so that we can review and address your concern. You also have the right to contact the UK data protection supervisory authority if you believe your rights have been infringed.

Westminster Carpet Cleaners aims to respond to data protection requests promptly and in line with legal requirements. We may need to verify your identity before responding to certain requests to protect your privacy and security.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or operational practices. Any updated version will apply from the date it is published or otherwise communicated. We encourage customers to review this policy periodically so they remain informed about how their data is handled.

11. Summary of Our Commitment

Westminster Carpet Cleaners is committed to processing personal data responsibly, transparently, and only where necessary. We collect only the information needed to deliver our services, rely on appropriate lawful bases, share data only with suitable processors, retain data for no longer than necessary, and respect your rights under data protection law. This policy applies to all customers in the area and is intended to provide a clear and fair explanation of how personal information is managed.