Privacy Policy

1Who we are and how to contact us

1.1 Emergency Clean UK Ltd ("we", "us", "our") is a specialist and emergency cleaning company operating across England, Scotland and Wales. For the purposes of the UK GDPR and the Data Protection Act 2018, we are the data controller of the personal data described in this policy.

1.2 Our details are:

1.3 We are not required by law to appoint a statutory Data Protection Officer. Data protection matters are handled directly by our management team. Please address any privacy query, request or complaint to info@emergencycleanuk.co.uk, marking it "Data protection".

2Who this policy applies to

2.1 This policy applies to you if you are:

• a customer or potential customer of ours, whether an individual or a representative of a business;
• an occupant, owner, landlord, tenant, executor or family member connected to a property we are asked to attend;
• a visitor to our website, emergencycleanuk.co.uk; or
• anyone else outside our organisation who contacts us or whose data we receive in connection with a job.

2.2 This policy does not apply to our employees, to people applying to work for us, or to our suppliers and subcontractors in their capacity as such. If you fall into one of those groups, a separate privacy notice applies and we will provide it to you directly.

3The personal data we collect

3.1 "Personal data" means any information that identifies you, directly or indirectly — your name, address, phone number, email address, or the IP address of your device.

3.2 Data you give us

When you request a quote, book a job, or correspond with us by phone, email or through our website:

• Your name, phone number and email address, and your company name if you are enquiring on behalf of a business
• The address of the property, and how to gain access to it
• A description of the incident and the work required — which may include details of a fire, flood, death, illness, injury, infestation or contamination
• Photographs or videos you send us so we can assess the job before attending
• Your relationship to the property (owner, tenant, landlord, executor, agent, family member)
• Insurance details — your insurer, policy or claim number, and your loss adjuster's contact details
• Billing details and payment records

3.3 Data we create or collect when carrying out the work

• Site records and photographs taken before, during and after works. These form our job record. They are routinely required by insurers, and are our evidence that the work met the required standard.
• Test, inspection and clearance readings — for example moisture readings during a drying programme, or verification checks after a biohazard decontamination.
• Health and safety records — including risk assessments and any record of exposure to hazardous substances.
• Waste transfer notes and hazardous waste consignment notes, which by law must record the address the waste was collected from.
• Notes of conversations, including where you make a complaint, so that we can properly investigate and resolve it.

3.4 Call records and call recording

Call records. Our telephone system generates a record of every call — the number you called from, the number you called, the date, time and duration of the call, and how it was routed. We use these to make sure calls are answered and returned, and to understand demand across our service lines.

Call recording. We record incoming and outgoing telephone calls for training and quality monitoring purposes. You will hear an announcement telling you this at the start of the call.

• Recordings are used to train our team, to check the quality and accuracy of the information we give, and to resolve any dispute about what was agreed.
• Access to recordings is restricted to management and is not routine — we do not listen to calls as a matter of course.
• Recordings are held for 6 months and then automatically deleted, unless a recording is relevant to a complaint, dispute or legal claim, in which case it is retained until that matter is resolved.
• Because of the nature of our work, a call may capture sensitive information — a caller describing a death, an illness, an injury or a crime. Where it does, we treat the recording as special category data under clause 4 and apply the same restrictions.
• We do not use call recordings for marketing, and we do not share them with anyone outside the business except where clause 7 applies.

3.5 Data we collect automatically from our website

• Technical data: IP address, browser type and version, device type, operating system, screen size
• Usage data: the pages you visit, how long you spend on them, how you arrived at the site, what you click and where you leave
• Cookies and similar identifiers, including data held in your browser's local storage

Analytics and advertising data is collected only where you have consented through our cookie banner. See clause 14.

3.6 Data we receive from other people

We often receive information about you from someone other than you. This may include:

• Insurers, loss adjusters and claims handlers who instruct us on your behalf
• Letting agents, landlords, housing associations and local authorities who instruct us in relation to a property you occupy or own
• Solicitors, executors and family members acting in relation to a property following a death
• Police forces, coroners and emergency services where they refer or coordinate a job
• Publicly available sources, such as Companies House or a company's own website, where we are dealing with a business customer

Where we obtain your data this way, we will tell you within one month of receiving it, or at the point we first communicate with you — whichever is sooner — unless doing so would be impossible or involve disproportionate effort.

4Sensitive and criminal offence data

4.1 Because of the nature of our work, information about a job can reveal sensitive facts — that someone was seriously ill or self-neglecting, that a person died at the property, that a crime took place there, or that a property was used to produce drugs. Under the UK GDPR, some of this is special category data (which includes data concerning health) and some is criminal offence data. Both attract stronger legal protection, and we treat them accordingly.

4.2 We collect this data only where we need it to carry out the work safely, lawfully and to the correct standard. Knowing that a property is contaminated with blood, for example, determines the PPE our technicians wear, the decontamination method we use, and the waste route we are legally obliged to follow. We do not collect it out of curiosity, and we never use it for marketing.

4.3 Where we process special category data, we rely on one or more of the following conditions under Article 9 of the UK GDPR and Schedule 1 of the Data Protection Act 2018:

• Explicit consent, where you have given it;
• Substantial public interest — specifically the conditions relating to the protection of the public and to health and safety at work;
• Establishing, exercising or defending legal claims — for example where our records are needed to support or resist an insurance claim; or
• Vital interests, where processing is necessary to protect someone's life and consent cannot be obtained.

4.4 Where we process criminal offence data, we do so under Schedule 1 of the Data Protection Act 2018 and maintain an appropriate policy document, as the law requires.

5Why we use your data, and our lawful basis

5.1 The law requires us to have a "lawful basis" for everything we do with your personal data. Ours are set out below.

5.2 Where we rely on legitimate interests, we have considered whether our interest is overridden by your interests, rights and freedoms, and concluded that it is not. You can object to processing on this basis at any time — see clause 13. You can ask us for details of that assessment.

5.3 Where we rely on consent, you may withdraw it at any time. Withdrawing consent does not affect the lawfulness of anything we did before you withdrew it, and we may continue to process your data on a different lawful basis where one applies — we will tell you if that is the case.

6Do you have to give us your data?

6.1 You do not have to give us any personal data. But some of it is necessary in order for us to enter into a contract with you, and some of it we are required by law to collect.

6.2 If you do not provide it, the practical consequences are:

• Without a name, contact number and property address, we cannot quote for or attend a job.
• Without an accurate description of the hazard, we cannot assess the job safely, and may have to decline it or abort on arrival.
• Without the address the waste was collected from, we cannot lawfully complete a waste transfer or hazardous waste consignment note, which means we cannot legally remove the waste.
• Without billing details, we cannot invoice you or take payment.

6.3 Providing marketing consent, or consenting to analytics and advertising cookies, is entirely optional. Declining will not affect the service you receive.

7Who receives your data

7.1 We do not sell, rent or trade your personal data. We share it only where there is a clear reason to, and only with:

• Our technicians and subcontractors — the people attending the job. Subcontractors are bound by written confidentiality and data protection terms.
• Your insurer, loss adjuster or claims handler — where the work is the subject of an insurance claim, we share the reports, photographs and invoices needed to progress it.
• Licensed waste carriers and permitted disposal facilities — waste transfer and hazardous waste consignment notes must, by law, record the address the waste came from.
• Our accountants, auditors and bank — for invoicing, payment and statutory accounts.
• Debt recovery agents — only where an invoice remains unpaid after we have chased it.
• Our professional advisers and our own insurers — where we need legal advice or must notify a claim. They are under duties of confidentiality.
• Police, coroners, courts, regulators, HMRC and other public authorities — where we are legally required to disclose, or where disclosure is necessary to prevent serious harm or to establish, exercise or defend legal rights.
• A prospective buyer or successor — if the business is sold, reorganised or dissolved, your data would transfer as part of it, subject to the same protections.

7.2 Categories of third-party processor

We use third-party providers who process personal data on our instructions only, under written contracts that require them to keep it secure and to retain it only for as long as we tell them to. The categories are:

• Website hosting and content delivery (our site is built and hosted on Squarespace)
• Email, cloud storage and document management
• Job management and scheduling software
• Telephony and call handling
• Payment processing
• Accounting and bookkeeping software
• Website analytics and advertising measurement
• Review and feedback platforms

8International transfers

8.1 We aim to keep personal data within the UK and the European Economic Area. However, some of the technology providers we rely on — including our website host and our analytics and advertising providers — are based in, or store data in, the United States.

8.2 Where personal data is transferred outside the UK, we make sure it is protected by an appropriate safeguard recognised under UK law. In practice this means either:

• the receiving country or organisation is covered by UK adequacy regulations — including the UK Extension to the EU–US Data Privacy Framework, for certified US organisations; or
• we rely on the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment where one is required.

8.3 You can ask us for details of the safeguard applying to any particular transfer.

9How long we keep your data

9.1 We do not keep personal data for longer than we need it. Our standard retention periods are:

9.2 Where a job is, or may become, the subject of a legal claim, complaint or insurance dispute, we retain the relevant records until that matter is finally resolved, even if the periods above have expired.

9.3 At the end of a retention period, records are securely deleted or destroyed. Paper records are shredded.

10How we keep your data secure

10.1 We take appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration and disclosure. These include:

• Restricting access to job records to those who need it to do their job
• Password protection and multi-factor authentication on our accounts and devices
• Storing data in reputable cloud services with encryption in transit and at rest
• Encrypting our website connection (HTTPS/TLS)
• Binding staff and subcontractors to confidentiality obligations, and briefing them on the sensitivity of the environments we work in
• Transferring paper records taken on site into secure storage, and shredding them once no longer needed

10.2 No system is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it and, where the risk is high, notify you directly without undue delay.

11Automated decision-making

11.1 We do not make decisions about you based solely on automated processing, and we do not carry out profiling that produces legal effects concerning you or similarly significantly affects you. Every quote we issue and every job we accept or decline is decided by a person.

12Marketing and your preferences

12.1 We do not send unsolicited marketing to consumers.

12.2 If you have used our services, we may occasionally contact you about similar services we offer. Every message will include a simple way to opt out.

12.3 Where you have given consent, we may contact you by email, phone or post about our services and any news we think will be relevant to you.

12.4 You can opt out at any time — by using the unsubscribe link in any email, by telling the person you speak to, or by emailing info@emergencycleanuk.co.uk. Opting out of marketing will not stop us sending you messages about a job you have booked, because we need those to deliver the service.

13Your rights

13.1 Under UK data protection law you have the right to:

• Be informed — to know how we use your data, which is what this policy is for
• Access — to obtain a copy of the personal data we hold about you (a "subject access request")
• Rectification — to have inaccurate data corrected and incomplete data completed
• Erasure — to have your data deleted, where we no longer have a good reason to keep it
• Restriction — to have us pause our use of your data while a concern is investigated
• Object — to processing based on our legitimate interests, and to direct marketing at any time and for any reason
• Data portability — to receive certain data in a structured, commonly used, machine-readable format
• Withdraw consent — at any time, where we rely on it

13.2 To exercise any of these rights, email info@emergencycleanuk.co.uk. There is no charge. We will respond within one month; if your request is complex, we may extend this by up to two further months, and will tell you if we do.

13.3 We may ask you to confirm your identity before releasing information. This is to protect you.

13.4 These rights are not absolute. We cannot, for example, delete a hazardous waste consignment note we are legally required to retain, or destroy job records we need in order to defend a claim. Where we cannot fully meet a request, we will explain why and tell you what you can do about it.

14Cookies

14.1 Our website uses cookies. Strictly necessary cookies are always on, because the site cannot function securely without them. Analytics and advertising cookies are set only if you consent via our cookie banner, and you can withdraw that consent at any time.

14.2 Every cookie we use, what it does and how long it lasts, is listed in our Cookie Policy.

15Links to other websites

15.1 Our website contains links to other sites — for example accreditation bodies, review platforms and industry resources. This policy applies only to our own site. We are not responsible for how other operators handle your data, and we encourage you to read their privacy policies before providing them with any personal information.

16Children

16.1 Our services are contracted with adults and our website is not directed at children. We do not knowingly collect personal data from anyone under 16 through our website.

16.2 Information about a child may occasionally be relevant to a job — for example where a family occupies an affected property. We treat it with the same care as any other sensitive information, use it only where necessary, and do not use it for marketing.

17Changes to this policy

17.1 We review this policy regularly and will update it when our practices or the law change. The version number and date at the top of the page show when it was last revised.

17.2 Where a change materially affects how we use your personal data, we will take reasonable steps to bring it to your attention rather than relying on you to notice it.

18Complaints

18.1 If you are unhappy with how we have handled your personal data, please tell us first. Email info@emergencycleanuk.co.uk and we will investigate properly and come back to you.

18.2 You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office, at any time. You do not have to come to us first, though we would prefer the chance to put things right.