Privacy Policy - Oven Cleaning Highbury

This Privacy Policy explains how personal data is collected, used, stored, shared, and protected by Oven Cleaning Highbury. It applies to all Oven Cleaning Highbury customers in the area, including prospective customers, existing customers, and individuals who enquire about our services. We are committed to handling personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We value privacy and aim to process personal data in a fair, transparent, and lawful way. This policy sets out what information we collect, why we collect it, the lawful bases we rely on, how long we keep it, who may process it on our behalf, and the rights individuals have over their data.

1. Data We Collect

We collect only the personal data that is necessary to provide our oven cleaning services, manage business operations, and meet legal obligations. The information we may collect includes:

Identity details such as your name and title.
Contact details such as your address, email address, and telephone number.
Service information such as the type of cleaning requested, property access details, booking preferences, and service history.
Payment information such as payment status, billing records, and transaction references. We do not store card security details unless securely handled by a payment processor.
Communication records such as enquiries, complaints, feedback, and messages exchanged by phone, email, or other channels.
Technical information if you interact with our digital systems, such as basic device or usage data where relevant for security and operational purposes.

We do not intentionally collect special category data unless you voluntarily provide it and it is necessary for a specific lawful purpose. If such information is provided, it will be handled with additional care and only where permitted by law.

2. How We Use Personal Data

We use personal data to operate our services and maintain our relationship with customers. The main purposes include:

Managing bookings and scheduling appointments.
Providing oven cleaning and related services.
Confirming service details and responding to enquiries.
Processing payments and keeping accounting records.
Handling customer support, complaints, and aftercare.
Maintaining records for operational, training, and quality purposes.
Meeting legal, tax, insurance, and regulatory obligations.
Protecting our business against fraud, misuse, and security incidents.

We only use personal data for the purposes for which it was collected, unless we reasonably consider that we need to use it for a compatible reason and the law allows us to do so.

3. Lawful Basis for Processing

Under the GDPR, we must have a lawful basis before processing personal data. Depending on the situation, we may rely on one or more of the following:

Contract

We process personal data when it is necessary to enter into or perform a contract with you. This includes taking bookings, delivering services, issuing invoices, and managing service communications.

Legal obligation

We process data where needed to comply with legal requirements, including tax, accounting, insurance, and record-keeping obligations.

Legitimate interests

We may process data where it is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. Examples include service improvement, fraud prevention, maintaining business records, and internal administration. Where we rely on legitimate interests, we consider the impact on your privacy and take appropriate safeguards.

Consent

In limited cases, we may rely on your consent, for example where you agree to receive certain types of marketing or optional communications. If we rely on consent, you can withdraw it at any time.

Vital interests and public task

These bases are unlikely to apply in ordinary oven cleaning services, but we will use them if required by law in exceptional circumstances.

4. Retention of Personal Data

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, or reporting requirements. Retention periods depend on the type of data and the reason it is held.

Customer and booking records are normally kept for a reasonable period after the last service to manage queries, service history, and business administration.
Financial and tax records are kept for the period required by law, typically in line with UK accounting and tax obligations.
Complaint and communication records may be retained for longer where needed to resolve disputes or protect legal rights.
Marketing preferences are kept until you change your preferences or withdraw consent where applicable.

When personal data is no longer required, we will securely delete it, anonymise it, or otherwise ensure it is no longer identifiable.

5. Processors and Sharing of Data

We may share personal data with trusted third parties who act as processors or independent controllers, only where necessary and lawful. Processors are organisations that process data on our behalf and under our instructions.

Examples of processors may include:

Booking and scheduling providers used to manage appointments and service records.
Payment processors used to handle transactions securely.
IT and cloud service providers used for secure storage, email, and business administration.
Accounting and invoicing providers used to maintain financial records.
Customer communication tools used to manage messages and service updates.

We require processors to keep personal data secure, to use it only for the agreed purpose, and to comply with applicable data protection laws. We do not sell personal data.

We may also disclose personal data if required by law, court order, or regulatory authority, or if necessary to protect our rights, customers, staff, or the public.

6. Data Security

We take appropriate technical and organisational measures to protect personal data from loss, misuse, unauthorised access, alteration, or disclosure. These measures may include access controls, secure systems, staff confidentiality obligations, and regular review of data handling practices.

While no system can be guaranteed completely secure, we work to ensure personal data is treated with care and protected to a standard appropriate to the risk.

7. Your Rights

Under data protection law, individuals have important rights regarding their personal data. Depending on the circumstances, these may include:

The right to be informed about how your data is used.
The right of access to request a copy of the personal data we hold about you.
The right to rectification if information is inaccurate or incomplete.
The right to erasure in certain circumstances, also known as the right to be forgotten.
The right to restrict processing in certain situations.
The right to data portability for data processed on the basis of consent or contract, where technically feasible.
The right to object to processing based on legitimate interests or direct marketing.
Rights related to automated decision-making where applicable, although we do not ordinarily use automated decisions that produce legal or similarly significant effects.

If we process your data on the basis of consent, you may withdraw that consent at any time. This will not affect the lawfulness of processing carried out before withdrawal.

8. Children’s Data

Our services are intended for adult customers and household arrangements. We do not knowingly collect personal data from children unless it is necessary in a service context and provided by a parent, guardian, or responsible adult.

9. International Transfers

If any personal data is transferred outside the UK, we will ensure that appropriate safeguards are in place to protect it in accordance with applicable data protection law. This may include using approved contractual protections or other lawful transfer mechanisms.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, business practices, or service arrangements. The updated version will apply from the date it is made available. We encourage customers to review it periodically to remain informed about how we protect personal data.

11. Additional Information

This Privacy Policy is intended to be clear and accessible while reflecting the main requirements of GDPR compliance. Where the law requires us to do so, we will provide further information about specific processing activities, retention periods, or data-sharing arrangements. We will always seek to process personal data in a way that is fair, necessary, and proportionate.

By using our services, making an enquiry, or entering into a customer relationship with us, you acknowledge that your personal data may be processed as described in this Privacy Policy, subject always to your legal rights and the safeguards outlined above. We are committed to respecting privacy and handling all data with care, transparency, and accountability.