Privacy Policy - Cleaner Paddington

This Privacy Policy explains how Cleaner Paddington collects, uses, stores, shares, and protects personal data in connection with its cleaning services. It applies to all Cleaner Paddington customers in the area, including prospective customers, current customers, former customers, and anyone who communicates with us or receives our services. We are committed to handling personal data in a lawful, fair, and transparent manner in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

Cleaner Paddington provides domestic and commercial cleaning services. In the course of providing these services, we may collect and process personal data about customers, property occupants, service users, and other relevant individuals. For the purposes of data protection law, Cleaner Paddington acts as the data controller in relation to the personal data described in this policy.

2. Personal Data We Collect

We only collect personal data that is necessary for business, legal, and operational purposes. The categories of information we may collect include:

Identity details: name, title, and, where needed, job title or business role.
Contact details: address, email address, telephone number, and any preferred communication details.
Service details: booking history, cleaning preferences, service instructions, appointment notes, and feedback.
Payment information: billing records, payment status, transaction references, and invoicing details. We do not knowingly retain full card details where a secure payment processor handles them.
Property and access information: entry instructions, alarm or security notes, parking information, and other service-related access arrangements.
Communication data: emails, messages, phone call notes, complaint records, and correspondence.
Technical data: basic information such as IP address or device data if collected through digital systems used to manage enquiries or bookings.
Special category data: we do not usually seek to collect special category data. However, such information may be inadvertently included in communications, for example where a customer explains a medical or accessibility need. If this occurs, we will only process it where a lawful basis exists and where necessary to provide services or meet legal obligations.

3. How We Use Personal Data

We use personal data only for legitimate business purposes connected to our services. These purposes include:

managing enquiries and quotations;
providing cleaning services and fulfilling bookings;
processing payments, invoices, and refunds where applicable;
communicating with customers about appointments, changes, or service issues;
maintaining records of service history and customer preferences;
handling complaints, disputes, and quality assurance;
meeting legal, accounting, insurance, and tax obligations;
protecting our business, staff, and customers from fraud, misuse, or security risks;
improving our services and operational efficiency.

We do not use personal data for purposes that are incompatible with the reasons it was collected, unless we have a lawful basis to do so and we have informed you where required.

4. Lawful Basis for Processing

Under data protection law, we must have a lawful basis to process personal data. Depending on the circumstances, Cleaner Paddington may rely on one or more of the following bases:

4.1 Contract

We process personal data when it is necessary to enter into or perform a contract with you. This includes managing bookings, delivering cleaning services, issuing invoices, and communicating about service delivery.

4.2 Legal Obligation

We may process personal data where this is required to comply with legal obligations, such as tax rules, accounting requirements, health and safety obligations, or lawful requests from public authorities.

4.3 Legitimate Interests

We may process personal data where it is necessary for our legitimate business interests, provided your rights and freedoms do not override those interests. Examples include service administration, customer support, record keeping, fraud prevention, internal operations, and service improvement. We consider the impact on individuals before relying on this basis.

4.4 Consent

In limited situations, we may rely on your consent, for example where the law requires consent or where you choose to provide information beyond what is needed for the service. Where consent is used, you may withdraw it at any time.

5. Sharing and Processors

We may share personal data with trusted third parties where necessary to operate our services and business. These third parties may act as data processors or separate controllers, depending on their role.

Processors are organisations that handle personal data on our behalf and under our instructions. They may include:

booking and scheduling software providers;
accounting, invoicing, and payment service providers;
IT hosting, cloud storage, and email service providers;
customer communication tools and administrative platforms;
professional advisers such as accountants or lawyers, where needed;
insurance providers and claims handlers;
maintenance or subcontracted service partners, where required to complete a booking.

We require processors to keep personal data secure, process it only on our instructions, and comply with applicable data protection law. We may also disclose personal data to regulators, law enforcement, or public bodies when legally required or where necessary to protect rights, safety, or property.

Where personal data is shared with a separate controller, that party will determine its own purposes and means of processing. In such cases, their own privacy notice may apply.

6. Data Retention

We retain personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, reporting, and operational requirements. Retention periods may vary depending on the type of data and the context in which it was collected.

Customer and booking records: kept for the duration of the customer relationship and for a reasonable period afterward to manage queries, disputes, and service history.
Financial and tax records: retained for the period required by applicable law.
Correspondence and complaint records: retained long enough to resolve the issue and demonstrate compliance.
Security and access notes: kept only while needed for service provision and then reviewed or deleted.

When personal data is no longer needed, it will be securely deleted, anonymised, or archived in line with our retention practices and legal obligations.

7. Data Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, misuse, alteration, or disclosure. These measures may include access controls, secure storage, staff confidentiality obligations, and careful review of third-party systems. Although we work hard to protect data, no system can be guaranteed completely secure.

8. Your Rights

As a data subject, you have rights under data protection law. Subject to legal limitations, these include:

Right of access: you can request a copy of the personal data we hold about you.
Right to rectification: you can ask us to correct inaccurate or incomplete data.
Right to erasure: you may request deletion of your data in certain circumstances.
Right to restrict processing: you can ask us to limit use of your data in some situations.
Right to data portability: you may request a copy of certain data in a structured, commonly used format.
Right to object: you can object to processing based on legitimate interests or direct marketing, where applicable.
Right to withdraw consent: if we rely on consent, you may withdraw it at any time.

If you wish to exercise any of these rights, we may need to verify your identity before responding. We aim to respond within the time limits set by law. You also have the right to lodge a complaint with the UK Information Commissioner’s Office if you believe your data protection rights have been infringed.

9. Children’s Data

Our services are not directed at children, and we do not knowingly collect personal data from children except where it is necessary in connection with a service arrangement involving a household or where a parent, guardian, or responsible adult provides the information. If we become aware that we have collected data unlawfully, we will take appropriate steps to delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data protection practices. Any updated version will apply from the date it is issued. We encourage customers to review this policy periodically to stay informed about how personal data is handled.

11. Summary of Our Approach

Cleaner Paddington only processes personal data where it is necessary, lawful, and relevant to providing cleaning services and running our business. We use trusted processors, retain data only as long as needed, and respect your rights under data protection law. Our approach is based on transparency, minimisation, and accountability, so customers in the Paddington area can understand how their information is handled.