Data Protection Policy

Be Clean Services Limited

Company number: 15045016
Director: Ludiata Wasansua
Registered office: Flat 3, 44a Cavendish Street, Manchester, M15 6BQ

Policy owner: Director
Effective date: 14 October 2026
Review date: 14 October 2027
Version: 1.0

1. Policy Statement

Be Clean Services Limited (“the Company”) is committed to protecting the privacy, confidentiality and security of personal information that it collects, holds, uses and shares in the course of its business.

The Company recognises its responsibilities under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, as amended, and other applicable data protection and privacy legislation.

This policy establishes the Company's approach to handling personal data fairly, lawfully, transparently and securely. It applies to the Director, employees, temporary workers, contractors and any other individuals authorised to process personal data on behalf of the Company.

2. Purpose of the Policy

The purpose of this policy is to:

Protect the personal information of customers, employees, job applicants, contractors, suppliers and other individuals.
Ensure personal data is collected and used only for legitimate business purposes.
Prevent unauthorised access, disclosure, loss, alteration or destruction of personal data.
Explain the responsibilities of individuals who handle personal information.
Establish procedures for responding to data protection requests and personal data breaches.
Demonstrate the Company's commitment to complying with applicable data protection legislation.

3. Scope

This policy applies to all personal data processed by the Company, whether held electronically, in paper files, in photographs, in messages or in any other format.

Depending on the Company's operations, personal data may include:

Customer names, telephone numbers, email addresses and service addresses.
Information relating to cleaning appointments, service agreements and customer enquiries.
Employee and job applicant details, including recruitment, payroll, attendance and employment records.
Contractor and supplier contact details.
Invoices, payment records and relevant business correspondence.
Photographs or CCTV footage where individuals can be identified.
Health, accessibility or other sensitive information where legitimately required for a specific purpose.

4. Data Protection Principles

The Company will follow the applicable data protection principles. Personal data must be:

Lawful, fair and transparent: processed on a valid legal basis, fairly and with appropriate privacy information provided.
Purpose-limited: collected for specified, explicit and legitimate purposes.
Adequate and minimised: limited to what is necessary for the intended purpose.
Accurate: kept accurate and updated where necessary.
Stored appropriately: retained only for as long as necessary, subject to applicable legal obligations.
Secure: protected against unauthorised or unlawful processing, accidental loss, destruction or damage.
Accountable: managed in a way that enables the Company to demonstrate compliance.

5. Lawful Processing of Personal Data

The Company will identify and document an appropriate lawful basis for each relevant processing activity.

Depending on the circumstances, these bases may include:

Contract: where processing is necessary to enter into or perform a contract, such as arranging cleaning services.
Legal obligation: where processing is necessary to comply with applicable employment, tax, accounting or other legal requirements.
Legitimate interests: where processing is necessary for the Company's legitimate business interests and those interests are not overridden by the individual's rights and interests.
Consent: where an individual has freely given specific, informed and unambiguous consent and consent is the appropriate legal basis.
Vital interests or public task: only where the relevant legal conditions apply.

The Company will not assume that consent is always required or appropriate. The lawful basis will depend on the particular purpose and circumstances of the processing.

Where special-category personal data is processed, the Company will identify both an appropriate lawful basis and an applicable additional condition required by law.

6. Collection and Use of Personal Information

The Company will collect personal data only where it is reasonably necessary for a legitimate business purpose.

Personal information may be used to:

Respond to enquiries and provide cleaning services.
Arrange appointments and communicate with customers.
Manage customer accounts, invoices and payments.
Recruit, employ, train and manage workers.
Administer contracts with suppliers and contractors.
Maintain business, financial and employment records.
Address complaints, disputes, insurance claims or legal matters.
Meet regulatory and statutory obligations.
Protect the safety and security of people, premises and Company property where appropriate.

Personal data will not be used for unrelated purposes unless the proposed use is legally permitted and appropriate transparency information is provided.

The Company will not collect excessive information or ask individuals to provide sensitive information unless there is a justified need.

7. Privacy Information

The Company will provide individuals with clear and accessible privacy information explaining, as applicable:

The identity and contact details of the Company.
The types of personal data collected.
The purposes and lawful bases for processing.
The recipients or categories of recipients with whom information may be shared.
The applicable retention periods or the criteria used to determine them.
The individual's data protection rights.
How to raise a concern or complain to the Information Commissioner's Office (ICO).
Any other information required by applicable law.

Privacy information will be provided at the appropriate time, including through customer-facing privacy notices, recruitment information, employment documentation or other suitable communications.

8. Data Security and Confidentiality

The Company will implement technical and organisational measures appropriate to the risks associated with the personal data it processes.

These measures may include:

Password protection and access restrictions for electronic systems.
Secure storage of paper files and business records.
Limiting access to personal information to authorised individuals who need it for their duties.
Keeping devices and software updated and protected against malware.
Using secure methods to transmit confidential information.
Maintaining appropriate backups and recovery arrangements.
Securely disposing of paper records and electronic devices when no longer required.
Providing appropriate guidance or training to workers who handle personal information.

Individuals working for or on behalf of the Company must not disclose personal information to unauthorised persons, leave confidential records unsecured or use personal data for private purposes.

Where employees or contractors access customer premises or information while delivering cleaning services, they must respect the privacy of customers, residents, visitors and other occupants. They must not photograph, copy, discuss or disclose customer information unless authorised and necessary for a legitimate purpose.

9. Sharing Personal Data

The Company may share personal information with third parties where necessary, lawful and proportionate.

Recipients may include:

Accountants, payroll providers and professional advisers.
Banks and payment service providers.
Insurers and legal advisers.
IT, cloud storage and business software providers.
Relevant regulators, public authorities or law enforcement agencies where legally required or permitted.
Customers, contractors or suppliers where necessary to fulfil an agreed service or contractual obligation.

The Company will share only the information necessary for the relevant purpose and will take reasonable steps to ensure that third parties handling personal data on its behalf provide appropriate safeguards.

Where required by law, written data processing agreements or other appropriate contractual safeguards will be put in place.

Personal data will not be sold to third parties.

10. Data Retention and Disposal

The Company will retain personal data only for as long as necessary for the purpose for which it was collected, taking account of legal, accounting, tax, employment, contractual and other applicable requirements.

Retention periods will be determined according to the type of record, its purpose and any relevant legal obligations. The Company will maintain or develop a retention schedule identifying the applicable periods or review criteria.

When personal data is no longer required, it will be securely deleted, destroyed or anonymised, unless there is a lawful reason to retain it.

Paper records will be disposed of securely. Electronic records will be deleted or securely erased using appropriate methods, including from devices and storage media when they are retired or transferred.

11. Individual Rights

Subject to the conditions and exemptions provided by law, individuals may have the right to:

Access: obtain a copy of their personal data and related information.
Rectification: correct inaccurate or incomplete personal data.
Erasure: request deletion of personal data in circumstances where the right applies.
Restriction: request that processing be restricted in certain circumstances.
Data portability: receive certain personal data in a commonly used, machine-readable format where the right applies.
Object: object to processing based on legitimate interests or public task and to direct marketing.
Withdraw consent: withdraw consent at any time where processing is based on consent.
Challenge certain automated decisions: exercise rights relating to qualifying solely automated decisions where applicable.

Requests should be sent to the Company at its registered office or through another official Company contact channel.

The Company will verify the identity of the requester where reasonably necessary, assess the request and respond within the applicable statutory time limit. Requests will normally be handled within one month, subject to any lawful extension or other applicable rule.

The Company will not charge a fee unless permitted by law.

12. Personal Data Breaches

A personal data breach may include the loss of a device containing personal data, an email sent to the wrong recipient, unauthorised access to records, accidental disclosure of customer information, or the loss or theft of paper files.

Any suspected or actual breach must be reported to the Director as soon as possible.

The Company will:

Take reasonable steps to contain the incident and prevent further unauthorised access or disclosure.
Assess the nature of the breach, the information involved and the potential impact on affected individuals.
Record the incident, its consequences and the action taken.
Notify the ICO without undue delay and, where required, within 72 hours of becoming aware of a breach that is reportable.
Inform affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms, as required by law.
Take corrective action to reduce the likelihood of recurrence.

All breaches will be documented, including those that do not require notification to the ICO.

13. Employees, Contractors and Confidentiality

All employees, temporary workers and contractors who handle personal data on behalf of the Company must:

Comply with this policy and any relevant procedures.
Access only the information necessary for their duties.
Keep personal data confidential.
Follow instructions for the secure storage, transfer and disposal of information.
Report suspected data breaches or inappropriate disclosures promptly.
Complete relevant data protection guidance or training where required.

Where appropriate, confidentiality obligations will be included in employment contracts, contractor agreements or other relevant arrangements.

Failure to comply with this policy may result in appropriate disciplinary or contractual action.

14. CCTV, Photography and Monitoring

Where the Company uses CCTV, photographs or other monitoring systems involving identifiable individuals, it will assess whether the use is lawful, necessary and proportionate.

The Company will provide appropriate privacy information, restrict access to recordings, establish suitable retention periods and apply additional safeguards where necessary.

Photographs of customers, private premises, employees or identifiable individuals will not be taken or used for publicity, marketing or social media without an appropriate lawful basis and any necessary permissions.

If the Company does not use CCTV or such photography, this section applies only if those activities are introduced in the future.

15. International Transfers

The Company will not transfer personal data outside the United Kingdom unless the transfer is lawful and any required safeguards are in place.

Where relevant, the Company will assess the arrangements used by cloud service providers, software platforms and other third parties that may store or access personal data internationally.

16. Data Protection by Design and Risk Assessment

The Company will consider data protection requirements when introducing new services, systems, technologies or processes that involve personal data.

Where processing is likely to result in a high risk to individuals, the Company will assess whether a Data Protection Impact Assessment is required and implement appropriate measures to reduce identified risks.

The Company will maintain appropriate records of its processing activities, lawful bases, data-sharing arrangements, retention practices and security measures, taking account of its legal obligations and the nature and scale of its processing.

17. Responsibilities

The Director

The Director, Ludiata Wasansua, is responsible for overseeing the implementation of this policy, promoting compliance, addressing reported incidents and ensuring that appropriate procedures are maintained.

Employees and contractors

All individuals authorised to handle personal data are responsible for following this policy, maintaining confidentiality and reporting any concerns promptly.

Third-party service providers

Third parties processing personal data on behalf of the Company must comply with the applicable contractual and legal requirements and maintain appropriate security safeguards.

The Company will determine whether it is required to appoint a Data Protection Officer or whether a designated data protection contact is sufficient under the circumstances.

18. Complaints and Concerns

Anyone who has concerns about how the Company handles their personal data may contact the Company using the registered office address stated in this policy.

The Company will investigate concerns promptly and seek to resolve them fairly.

Individuals also have the right to complain to the Information Commissioner's Office:

Information Commissioner's Office (ICO)
Website: https://ico.org.uk/
Telephone: 0303 123 1113

19. Policy Review

This policy will be reviewed at least annually and whenever there is a significant change to the Company's operations, systems, legal obligations or data protection risks.

The Company will update this policy where necessary to ensure that it remains accurate, effective and appropriate to its business activities.

20. Approval and Adoption

This policy is intended to take effect once reviewed and approved by the Director of Be Clean Services Limited.

For and on behalf of Be Clean Services Limited

Director: Ludiata Wasansua

Signature: __________________________________

Date of approval: ____________________________

View all policies · Contact us

News