Privacy Policy - Waterloo Carpet Cleaners

This Privacy Policy explains how Waterloo Carpet Cleaners collects, uses, stores, shares, and protects personal data in compliance with the General Data Protection Regulation (GDPR). It applies to all Waterloo Carpet Cleaners customers in the area, including prospective customers, active customers, and individuals who interact with our services, enquiries, quotations, or communications.

We are committed to handling personal information lawfully, fairly, and transparently. We only collect data that is necessary for the purposes described in this policy and we take appropriate technical and organisational measures to safeguard it.

1. Information We Collect

We may collect and process the following categories of personal data:

Identity details such as name and title.
Contact details such as address, email address, and telephone number.
Service information such as property details, cleaning preferences, booking records, and service instructions.
Payment-related information such as transaction records and billing details, where applicable.
Communication data such as messages, enquiries, complaints, and feedback.
Technical and usage data if you interact with our digital systems, including device or browser information and basic interaction logs.

We do not intentionally collect special category data unless it is strictly necessary and permitted by law. If such information is provided by you, we will only process it where a valid legal basis applies and where appropriate safeguards are in place.

2. How We Use Personal Data

We use personal data for the following purposes:

To respond to enquiries and provide quotes.
To arrange, deliver, and manage carpet cleaning services.
To handle payments, invoices, and service administration.
To communicate about appointments, updates, and service changes.
To manage customer relationships and maintain accurate records.
To resolve complaints, disputes, and service issues.
To comply with legal, regulatory, accounting, and tax obligations.
To protect our business, customers, and staff from fraud, misuse, or security incidents.

We will only process data for legitimate purposes and will not use personal information in ways that are incompatible with the original reason it was collected unless we have a lawful basis to do so.

3. Lawful Basis for Processing

Under GDPR, we rely on one or more lawful bases to process personal data. These include:

Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes taking bookings, delivering services, processing payments, and managing related service administration.

Legitimate Interests

We may process personal data where it is necessary for our legitimate business interests, provided these interests are not overridden by your rights and freedoms. Examples include maintaining service records, improving operations, preventing fraud, and responding to customer enquiries.

Legal Obligation

We may process personal data when required to meet legal obligations, including accounting, tax, consumer law, record-keeping, and lawful disclosure requests from authorities.

Consent

In limited circumstances, we may rely on your consent, for example where it is required for certain optional communications or specific forms of processing. Where consent is used, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

4. Data Retention

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, or reporting requirements. Retention periods may vary depending on the type of data and the reason for processing.

In general:

Customer service and booking records are retained for the period needed to manage the service relationship and any follow-up matters.
Financial and transaction records are retained for the period required by tax and accounting laws.
Communication records may be retained for a reasonable period to deal with queries, disputes, or service quality issues.
Security and technical logs are retained only as long as necessary for monitoring, troubleshooting, and safeguarding systems.

When personal data is no longer required, we will delete it securely or anonymise it so that it can no longer identify you.

5. Data Sharing and Processors

We may share personal data with trusted third parties, but only where necessary and in a controlled manner. These third parties act as processors or independent controllers depending on the context.

Processors may include:

Payment providers who help process transactions.
IT and hosting providers who support systems, storage, or data security.
Administrative service providers who assist with scheduling, record management, or customer communications.
Professional advisers such as accountants, auditors, or legal advisers where necessary.
Regulatory, law enforcement, or public authorities where disclosure is required by law.

All processors are required to handle personal data in accordance with GDPR and only on our documented instructions, with appropriate confidentiality and security measures in place. We do not sell personal data.

6. Data Security

We take appropriate steps to protect personal data from accidental loss, unauthorised access, misuse, disclosure, alteration, or destruction. Measures may include access controls, secure storage, staff awareness, limited permissions, and protective technical safeguards.

However, no system can be guaranteed to be completely secure. We regularly review our practices to reduce risks and improve the protection of personal data.

7. Your Rights Under GDPR

Depending on the circumstances, you may have the following rights regarding your personal data:

Right of access – to request a copy of the personal data we hold about you.
Right to rectification – to ask us to correct inaccurate or incomplete information.
Right to erasure – to request deletion of your personal data in certain situations.
Right to restriction – to ask us to limit how we use your data in certain cases.
Right to data portability – to receive certain data in a structured, commonly used format where applicable.
Right to object – to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent – where consent is the basis for processing, you may withdraw it at any time.

You also have the right to lodge a complaint with the relevant data protection authority if you believe your rights have been infringed. We encourage you to raise concerns with us first so we can try to resolve them promptly.

8. Automated Decision-Making

We do not rely on solely automated decision-making that produces legal or similarly significant effects on individuals. If this changes in the future, we will provide clear information and appropriate safeguards in line with GDPR.

9. International Transfers

If personal data is transferred outside the United Kingdom or European Economic Area, we will ensure that appropriate safeguards are in place to protect that data. These safeguards may include adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, our services, or our data practices. Any updated version will apply from the date it is made available. We encourage customers to review this policy periodically to stay informed about how personal data is handled.

11. Our Commitment

Waterloo Carpet Cleaners is committed to respecting privacy and processing personal data responsibly. We aim to keep information accurate, secure, and used only for legitimate business and legal purposes. We will always seek to process data in a way that is fair, transparent, and proportionate.

By using our services, making an enquiry, or otherwise interacting with Waterloo Carpet Cleaners, you acknowledge that your personal data may be processed in accordance with this Privacy Policy and applicable data protection law.