DEVELOPMENT DRAFT — OPERATOR REVIEW REQUIRED

Privacy Policy

This is a test website. Use synthetic details only. Unconfirmed business details appear in square brackets. These documents must be completed and reviewed before public launch.

Version 2026-10-13.2 · 13 October 2026

Who is responsible

Pick A Cleaner is operated by [CONTROLLER LEGAL NAME — TO BE CONFIRMED BEFORE LAUNCH]. Postal address: [CONTROLLER POSTAL ADDRESS — TO BE CONFIRMED BEFORE LAUNCH]. Privacy contact: [VERIFIED PRIVACY EMAIL — TO BE CONFIRMED BEFORE LAUNCH].

What this service currently does

This development site accepts private pre-launch registrations from cleaning professionals. It does not take customer cleaning enquiries, create public profiles, accept bookings or process payments. Approval changes an internal application status only. Customer matching or disclosure of applicant details requires a separate notice and review before that service is introduced.

Information and purposes

Business and contact names, email, UK telephone number, postcode, services and service radius are required to review and administer an application. Website and additional coverage information are optional.
We record submission and update times, application status, the terms/privacy wording and version, separate contact acknowledgement and terms acceptance, and an optional email marketing choice with the exact wording, version and recorded time. We also save main service and shared subcategory identifiers. Existing applications retain their original records; we do not infer marketing consent from registration.
If registration emails are enabled, the existing WordPress mail transport attempts an acknowledgement to the applicant and a notification linking the administrator to the private application. It records transport acceptance or failure, which is not proof of inbox delivery.
The registration IP address is recorded for security and registration evidence and is automatically cleared after 30 days by a daily task. We only read Cloudflare visitor-IP headers when the connecting address is in the verified Cloudflare network ranges. Otherwise we use the server-provided remote address, or record that the visitor address could not be securely established. A keyed hash is used for anti-spam counters that expire 15 minutes after the latest counted attempt. Hosting and Cloudflare may separately process IP addresses, request information and security logs. Their logging and retention require operator confirmation.
Your browser stores cookie preferences as described in the Cookie Policy. Optional analytics runs only after consent and only when configured, on information pages. Registration and confirmation pages do not load Google Analytics.

Lawful bases

For an individual registering their own business, necessary application administration is intended to rely on taking requested steps towards a service contract. Where a person represents a company, administration is intended to rely on legitimate interests in handling the company's application. Security processing is intended to rely on legitimate interests in protecting the service. The operator must document and confirm those assessments before launch. Optional analytics and optional promotional email communications rely on separate consent. The required contact acknowledgement covers only registration administration and relevant customer enquiries; it does not authorise unrelated marketing. The current optional box covers email updates only, not SMS or telephone marketing; historic channel-specific choices retain their original scope. Agreeing to professional terms is not consent to unrelated processing.

Access, recipients and international processing

Authorised WordPress administrators can review and edit applications. They are not exposed as public profiles or a public application API. The operator hosts this website and its database on its own servers. Any enabled external email provider processes messages to deliver the service; this is necessary service processing, not permission for that provider’s own marketing. We will never sell your personal details or share them with third parties for their own marketing purposes. Cloudflare is present in the website delivery path. External service provider details (including Cloudflare and any external email provider): [LEGAL PROVIDER NAMES, PURPOSES AND LOCATIONS — TO BE CONFIRMED BEFORE LAUNCH].

If enabled and consented to, Google Analytics receives information such as an IP address during transmission, browser/device information, an analytics identifier and a sanitised page URL and title. We do not send registration fields or URL query values to Analytics. International transfers and applicable safeguards: [COUNTRIES AND TRANSFER SAFEGUARDS — TO BE CONFIRMED BEFORE LAUNCH]. No advertising or marketing campaign provider is connected in this implementation.

Retention

Approved retention schedule: [APPLICATION, EMAIL, REQUEST, LOG AND BACKUP RETENTION — TO BE CONFIRMED BEFORE LAUNCH]. New applications are flagged for a retention review 12 months after registration; older applications remain subject to manual review. Administrators must document any justified continued retention and permanently delete applications no longer needed, including processor and backup copies. Applications are not silently erased by this upgrade. Raw registration IPs are automatically cleared after 30 days. The daily task depends on WordPress cron running when the site receives traffic. Preference storage lasts up to 180 days; analytics cookies are configured for a maximum of 180 days without automatic renewal. GA4 event retention must be separately set and verified in the Analytics property.

Your choices and rights

You can ask for access, correction or deletion, object to processing based on legitimate interests, or request restriction and, where applicable, portability. Rights have conditions and exceptions. You can withdraw optional marketing consent without affecting your application, and ask us to stop enquiry contact or close your registration and change analytics choices using Cookie Settings. Withdrawal does not undo lawful processing already undertaken.

Use our data protection requests and complaints page. We normally respond to rights requests within one month, subject to permitted extensions and any necessary identity clarification. You can also complain to the Information Commissioner’s Office. We do not use this registration system for automated decisions with legal or similarly significant effects.

Customer quote enquiries

We collect your name, email, telephone, postcode, selected service, job answers and notes to handle your request for quotes. Before submission, you acknowledge that your job and contact details may be shared with suitable cleaning businesses. Administrators review matches and approve each recipient before sending. We do not guarantee quotes and do not publish your details. Optional email marketing is a separate, unchecked choice.

We send postcodes only to postcodes.io to validate and locate them; your name, email, phone and job notes are not sent to that service. Postcode coordinates are cached for 30 days and stored with the enquiry for matching. Matching uses postcode-centre distances and registered service radii; it is not a measure of driving distance. Explicit outward postcode coverage areas are matched exactly. API failures and unrecognised place names are reviewed manually.

Enquiry acknowledgements and administrative notifications use our configured WordPress email transport when enabled. Recipient cleaners receive data only for responding to the quote request, not their own marketing. We record the notice wording, acceptance time, optional marketing choice and administrator sharing decisions. Security IP information is kept for up to 30 days; forwarded visitor headers are accepted only from a verified Cloudflare network peer. If proxy identity cannot be verified we do not assume the supplied header is a visitor IP.

Enquiries are flagged for review after 365 days. Administrators review and delete records no longer needed; the system does not silently delete open requests. Email and backup copies need separate retention handling. Contact the operator through the data protection page to exercise your rights or withdraw optional marketing. The operator must confirm the lawful bases and retention schedule before collecting real enquiries.