Privacy Notice (UK GDPR)

🔒 [Business Name] 👤 [Your Name] 📅 Last updated: [Date]

1. Who We Are

[Your Name], trading as [Business Name], is a sole trader providing domestic and commercial cleaning services based in [Your Town]. For the purposes of UK data protection law, I am the data controller of the personal information I hold about my clients.

Contact: [Your Email Address] | [Your Phone Number]

I am not required to register with the Information Commissioner's Office (ICO) as a sole trader providing cleaning services directly to individual clients, unless I process data beyond the household exemption threshold. This notice explains how I handle your personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What Personal Data I Collect

Category	Examples	Why collected
Identity data	Full name	To identify you, address correspondence, and issue invoices
Contact data	Home address, email address, telephone number	To schedule visits, send invoices, and communicate changes
Access data	Door key, alarm code, keysafe code, gate codes	To gain access to the property on agreed visit days
Financial data	Bank account name (for payments you make), payment records, invoice history	To record and confirm payments received; to meet HMRC obligations
Property notes	Special instructions, pets, hazards, areas to avoid	To carry out the cleaning service safely and to your preferences

      Special note on access data: Key and alarm code information is particularly sensitive. I take extra precautions with this data — see Section 5 below. I do not store alarm codes digitally; they are held only in a secured physical record.
    

3. Legal Basis for Processing

I rely on the following legal bases under UK GDPR:

Performance of a contract (Article 6(1)(b)): Most data processing is necessary to provide cleaning services under our agreement — scheduling visits, managing access, and handling payments.
Legal obligation (Article 6(1)(c)): I retain financial records (invoices and payment records) for 6 years to comply with HMRC self-assessment requirements.
Legitimate interests (Article 6(1)(f)): I may retain basic contact information for a short period after our agreement ends in case of late payment queries or damage claims.

4. How I Store and Protect Your Data

Your personal data is stored:

Digitally: on my personal phone and/or computer, protected by a password or PIN. Any cloud services used (e.g. Google Drive, accounting apps) are password-protected and access-restricted to me only.
Physically: in a locked folder or notebook at my home address. I do not leave client records in my car or accessible to third parties.

I do not share your personal data with third parties except where required by law (e.g. HMRC on audit) or where you have explicitly consented (e.g. providing a reference to another cleaner covering your property).

5. Key and Access Code Data

Physical keys to your property are stored securely at my home in a locked key box or drawer, labelled only with a reference code — not your name or address — so that if stolen they cannot be linked to your property. Alarm codes and access codes are recorded separately in a physically secured notebook, not stored on my phone.

Keys and access codes will only ever be used to access your property on agreed visit days. They will never be copied, passed to a third party, or used for any other purpose. On termination of our agreement, keys are returned to you within 7 days, and all access code records are permanently destroyed.

6. Data Retention

Financial records (invoices, payment logs): retained for 6 years from the date of the last transaction, to comply with HMRC requirements.
Contact details and property notes: retained for up to 12 months after the last visit, in case of late queries or disputes, then securely deleted.
Key and access code records: destroyed immediately on termination of the cleaning agreement and return of keys.

7. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right of access: You can ask to see the personal data I hold about you.
Right to rectification: You can ask me to correct inaccurate data.
Right to erasure: You can ask me to delete your data. Note that I may need to retain financial records to comply with HMRC obligations even if you request erasure — I will explain what can and cannot be deleted.
Right to restriction: You can ask me to limit how I use your data in certain circumstances.
Right to object: You can object to processing based on legitimate interests.

To exercise any of these rights, please contact me at: [Your Email Address]. I will respond within one calendar month.

If you are unhappy with how I have handled your data, you may also complain to the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113.

8. Changes to This Notice

I may update this privacy notice from time to time. The current version will always be provided to new clients and is available on request. Significant changes will be notified to active clients in writing.