Privacy Policy - Chinatown Carpet Cleaners

This Privacy Policy explains how Chinatown Carpet Cleaners collects, uses, stores, shares, and protects personal data when providing carpet cleaning and related services. It applies to all Chinatown Carpet Cleaners customers in area, including prospective customers, current customers, and individuals who interact with us in connection with our services. We are committed to handling personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

By using our services, you acknowledge that your personal data may be processed as described in this Privacy Policy. We aim to process data fairly, transparently, and securely, and only where there is a valid lawful basis to do so.

1. Personal Data We Collect

We collect only the data necessary to provide our services effectively and to meet our legal and operational obligations. The categories of personal data we may collect include:

Identity data: name and, where relevant, business name.
Contact data: address, telephone number, and email address.
Service data: details about the cleaning services requested, property type, preferred appointment times, service instructions, and service history.
Payment data: billing details and transaction records, though full card details are generally handled by our payment processors rather than stored by us.
Communication data: information contained in messages, enquiries, feedback, complaints, and notes from customer support interactions.
Technical data: basic device or usage information if you interact with us through digital systems, such as IP address or browser type, where applicable.
Marketing preferences: whether you have agreed to receive promotional communications.

We do not intentionally collect special category personal data unless it is strictly necessary and permitted by law. We ask that you avoid sharing sensitive information unless it is relevant to the service and necessary for us to process your request.

2. How We Use Personal Data

We use personal data for the following purposes:

to respond to enquiries and provide quotations;
to schedule, deliver, and manage cleaning services;
to process payments and issue invoices or receipts;
to maintain service records and customer history;
to handle complaints, follow-up requests, and customer support;
to improve service quality, operational planning, and internal administration;
to comply with legal, tax, accounting, and regulatory requirements;
to send service-related updates and, where permitted, marketing communications;
to protect our business, staff, and customers from fraud, misuse, or security risks.

We process personal data only for specified and legitimate purposes. We do not use it in a way that is incompatible with those purposes.

3. Lawful Basis for Processing

Under GDPR, we must have a lawful basis for processing personal data. Depending on the context, we rely on one or more of the following:

Performance of a Contract

We process personal data when it is necessary to provide a quotation, arrange an appointment, carry out cleaning services, take payment, or manage customer accounts and related service matters.

Legitimate Interests

We may process personal data where it is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. This may include improving services, managing business operations, preventing fraud, securing our systems, and retaining basic customer records.

Legal Obligation

We may process and retain certain information where required to comply with laws, such as tax, accounting, or record-keeping obligations, or to respond to lawful requests from authorities.

Consent

Where required, we rely on your consent, for example for certain marketing communications. If we rely on consent, you may withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

4. Sharing Personal Data and Processors

We may share personal data with trusted third parties that help us operate our business. These parties act as processors or independent controllers, depending on the nature of the service. We only share the minimum data necessary for the relevant purpose.

Examples of processors may include:

Payment service providers: to process card or electronic payments securely.
Accounting and bookkeeping providers: to support invoicing, financial administration, and tax compliance.
IT and cloud service providers: to store data, manage communications, and maintain systems.
Customer management software providers: to organise bookings, service records, and customer communications.
Professional advisers: such as auditors, insurers, or legal advisers where necessary.

Where we use processors, we ensure appropriate data processing terms are in place. These processors are required to handle personal data securely, only on our instructions, and in compliance with GDPR requirements. We do not sell personal data.

We may also disclose personal data if required to do so by law, to protect our rights or property, to prevent fraud, or to respond to lawful requests by public authorities.

5. International Transfers

If any processor or service provider stores or accesses personal data outside the UK or European Economic Area, we will take appropriate steps to ensure that the transfer is lawful and that your data remains protected. This may include using approved contractual safeguards or relying on an adequacy decision where available.

6. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting, tax, and reporting obligations. Retention periods may vary depending on the type of information and the reason for processing.

In general:

customer and service records are retained for a reasonable period after the last interaction;
financial and transaction records are retained for the period required by law;
marketing data is kept until you opt out or withdraw consent, where consent applies;
correspondence and complaints may be retained for as long as needed to resolve issues and demonstrate compliance.

When personal data is no longer needed, we will securely delete, anonymise, or otherwise dispose of it in accordance with our retention procedures. We regularly review the data we hold to ensure it is not kept longer than necessary.

7. Data Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. These measures may include access controls, secure storage, encryption where appropriate, and staff confidentiality obligations.

While we take data security seriously, no method of transmission or storage can be guaranteed completely secure. In the event of a personal data breach, we will take steps to investigate, contain, and, where required by law, report the breach to the relevant supervisory authority and affected individuals.

8. Your Rights Under GDPR

You have a number of rights regarding your personal data. Subject to legal limitations, these may include:

Right of access: you can request confirmation of whether we process your personal data and obtain a copy of it.
Right to rectification: you can ask us to correct inaccurate or incomplete information.
Right to erasure: in some circumstances, you can ask us to delete your data.
Right to restriction: you can request that we limit how we use your data in certain situations.
Right to object: you can object to processing based on legitimate interests or to direct marketing.
Right to data portability: you may request certain data in a structured, commonly used, machine-readable format.
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.

If you wish to exercise any of these rights, we will respond in accordance with GDPR and applicable law. We may need to verify your identity before responding to protect your privacy and prevent unauthorised access.

9. Children’s Data

Our services are intended for adults or those authorised to arrange services on behalf of a property owner or occupier. We do not knowingly collect personal data from children for marketing or service purposes. If we become aware that we have collected such data without appropriate authority, we will take steps to remove it where required.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Any updated version will apply from the date it is published or otherwise communicated. We encourage customers to review this Privacy Policy periodically to stay informed about how we process personal data.

Summary of our approach: we collect only necessary data, process it on a valid lawful basis, retain it for limited periods, use trusted processors under contractual safeguards, and respect your GDPR rights at all times.