Privacy Policy - Elephant And Castle Man And Van

This Privacy Policy explains how Elephant And Castle Man And Van collects, uses, shares, stores, and protects personal data when providing moving, transport, and related services. It applies to all Elephant And Castle Man And Van customers in the area, including individuals, households, landlords, tenants, and businesses that arrange or receive our services.

We are committed to handling personal data in a lawful, fair, and transparent way in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy describes what information we collect, why we collect it, the legal bases we rely on, how long we keep it, who may process it on our behalf, and the rights available to you.

1. Information We Collect

We collect only the information we need to provide and manage our services, meet our legal obligations, and improve customer experience. Depending on the service requested, this may include:

Identity details such as your name and title.
Contact details such as phone number, email address, and service address.
Booking and service details including move dates, collection and delivery locations, access conditions, item inventories, and special handling requirements.
Payment and billing information such as invoice details, transaction references, and records of payments received or refunded.
Communication records including messages, call notes, quotes, complaints, feedback, and confirmations.
Site and property information relevant to carrying out the move safely, such as floor level, parking considerations, or building access instructions.
Technical information if you interact with our digital systems, such as basic device or browser data, where collected by our systems for security, operational, or troubleshooting purposes.

We do not intentionally collect special category data unless it is necessary for a specific request and you choose to provide it. If you share sensitive information with us, we will only process it where permitted by law and where there is a clear service-related reason to do so.

2. How We Use Personal Data

We use personal data to deliver our services and manage our business operations. Typical uses include:

Responding to enquiries and providing quotations.
Managing bookings and scheduling removals or deliveries.
Completing payments, issuing invoices, and handling refunds where applicable.
Planning safe and efficient transport arrangements.
Keeping customers informed about service updates or changes.
Handling complaints, disputes, and after-service support.
Meeting tax, accounting, insurance, and record-keeping obligations.
Protecting against fraud, misuse, damage, or unlawful activity.
Improving service quality, training, and internal administration.

We only use personal data for purposes that are compatible with the reasons it was collected, unless we have a valid legal basis for a new purpose.

3. Lawful Basis for Processing

We process personal data under one or more lawful bases permitted by the UK GDPR. These include:

Contract

We process data where it is necessary to enter into or perform a contract with you. This includes managing quotes, booking services, carrying out moves, and taking payment for services requested.

Legal Obligation

We may process and retain information where required to comply with legal duties such as tax, accounting, insurance, dispute handling, and record retention obligations.

Legitimate Interests

We may process personal data where it is necessary for our legitimate interests and where those interests are not overridden by your rights. This may include business administration, service improvement, fraud prevention, internal record keeping, and protecting our staff, customers, and property. Where we rely on this basis, we assess the impact on your privacy and only use the minimum data necessary.

Consent

In limited situations, we may rely on your consent, for example where you voluntarily agree to receive certain types of non-essential communications. If consent is used, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

Vital Interests

In rare cases, personal data may be processed to protect someone’s vital interests, such as in an emergency involving health or safety.

4. Data Sharing and Processors

We do not sell your personal data. We may share information with trusted third parties only when necessary and appropriate for the operation of our services, compliance with the law, or protection of our business and customers.

These third parties may act as processors on our behalf or, in some cases, as independent controllers. Examples include:

Payment service providers for processing card or electronic payments.
Accounting and bookkeeping providers for financial administration and tax compliance.
IT, cloud storage, and software providers for secure data storage, scheduling, communication, and operational systems.
Insurance providers and claims-related service providers where a claim must be assessed or defended.
Professional advisers such as legal, financial, or compliance advisers.
Public authorities where disclosure is required by law or necessary to protect rights, safety, or lawful interests.

Where a third party processes data on our behalf, we require appropriate contractual protections, confidentiality obligations, and security measures. We only provide access to the information needed for the specific task.

5. Data Retention

We keep personal data only for as long as necessary for the purpose it was collected, including any legal, accounting, tax, or insurance requirements. The retention period depends on the type of data and the reason for holding it.

Booking and service records are typically retained for a period needed to manage the service and resolve any related issues.
Invoice and payment records are kept in line with statutory accounting and tax obligations.
Complaints, claims, and dispute records may be retained for longer where needed to defend or establish legal claims.
Technical and security logs are retained for a limited period necessary for system maintenance, fraud prevention, and incident investigation.

When data is no longer required, we will delete it securely or anonymise it so that it can no longer identify you. Retention periods may vary depending on the nature of the relationship, applicable legal requirements, and any ongoing dispute or regulatory matter.

6. Security of Your Data

We take the security of personal data seriously and use reasonable technical and organisational measures to protect it from unauthorised access, loss, alteration, or disclosure. These measures may include access controls, secure systems, data minimisation, confidentiality practices, and staff training.

Although we work to protect your information, no system can be guaranteed to be completely secure. If we become aware of a personal data breach that is likely to present a risk to your rights and freedoms, we will act in accordance with legal requirements, which may include notifying the relevant authority and affected individuals where appropriate.

7. Your Rights

Under data protection law, you have a number of rights in relation to your personal data. These rights may be subject to conditions or exemptions in certain circumstances. They include:

Right of access – to request a copy of the personal data we hold about you.
Right to rectification – to ask us to correct inaccurate or incomplete information.
Right to erasure – to request deletion of your personal data in certain situations.
Right to restriction – to ask us to limit how we use your data in specific circumstances.
Right to object – to object to processing based on legitimate interests or direct marketing.
Right to data portability – to receive certain data in a structured, commonly used format where applicable.
Right to withdraw consent – where processing is based on consent, you may withdraw it at any time.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe your data protection rights have been infringed. We encourage you to raise concerns with us first so we can try to resolve them promptly.

8. Children’s Data

Our services are generally intended for adults arranging moving and transport services. We do not knowingly collect personal data from children unless it is necessary in connection with a service arrangement and appropriate legal grounds exist. If we become aware that we have collected data from a child without a valid basis, we will take steps to delete it where required.

9. International Transfers

Where personal data is transferred outside the UK, we will ensure appropriate safeguards are in place to protect it, such as approved contractual protections or transfers to countries recognised as providing an adequate level of protection. We only make such transfers where necessary for service operations or the use of trusted processors.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, our services, or the way we process personal data. Any revised version will apply from the date it is published or otherwise made available. We encourage customers to review this policy periodically so they remain informed about how their data is used.

11. Summary of Our Commitment

Elephant And Castle Man And Van is committed to treating personal data with care, respect, and transparency. We collect only the information needed to deliver our services effectively, use it under a lawful basis, keep it only as long as necessary, and protect it through appropriate safeguards. Where we use processors, we require them to handle data responsibly and securely. You remain in control of your rights, and we will respond to requests in line with data protection law.

This Privacy Policy applies to all Elephant And Castle Man And Van customers in the area.