This policy explains what personal data Malpas Exterior Cleaning collects when you use this website, why we collect it, how long we keep it, who we share it with, and the rights you have over it. Plain English, no jargon where we can help it.

Who we are

Malpas Exterior Cleaning is the data controller for this website. That means we decide why and how your data is used.

Trading name: Malpas Exterior Cleaning
Address: Malpas, Cheshire
Contact for privacy enquiries: malpasexteriorcleaning@outlook.com

What data we collect, and why

1. When you request a quote through our form

We ask for the minimum we need to give you a useful quote:

Your name — so we know who we're talking to.
Your phone number — so we can text you back with a quote (this is the fastest way).
Your email (optional) — as a backup if we can't reach you by phone.
Your postcode — to check you're in our service area and estimate travel.
The service you want (roof, driveway, etc.) and urgency — so we can prioritise and give a relevant price.

Legal basis: Contract (UK GDPR Article 6(1)(b)) — we need this data to give you the quote you asked for.

How long we keep it: Up to 24 months after your last contact with us, unless you become a customer (in which case we keep invoicing records for 7 years to meet HMRC requirements).

2. When you visit the site

IP address and browser information — collected automatically by our hosting provider for security, fraud prevention, and to keep the site working. We don't link this to your personal identity.
Referral source and marketing parameters (like utm_source, fbclid, gclid) — if you clicked an ad, these tell us which ad. Stored only if you accept marketing cookies.

Legal basis: Legitimate interests (UK GDPR Article 6(1)(f)) for security and fraud prevention. Consent (Article 6(1)(a)) for marketing attribution.

How long we keep it: Server logs: 30 days. Marketing cookies: up to 90 days (or until you clear them).

3. When you accept marketing cookies

If you click Accept on our cookie banner, we also enable the following third-party tools to measure which of our ads are working:

Meta Pixel (Facebook/Instagram ads). Sends a record of pages you view and forms you submit to Meta, along with a hashed (one-way scrambled) copy of your contact details so Meta can match you to an ad click without seeing your plain email or phone.
Google Analytics 4 + Google Ads Conversion Tracking. Same purpose but for Google's ad platforms.
Microsoft Clarity. Session replay and heatmaps to understand how visitors use the site. Does not record form input values.

Legal basis: Consent (UK GDPR Article 6(1)(a); PECR Regulation 6). We only enable these if you click Accept.

How long we keep it: Meta and Google retain event data for up to 2 years per their retention policies. You can ask us to request deletion at any time (see "Your rights" below).

Who we share your data with

We use a small number of trusted processors to run the site. We never sell your data to anyone for any reason.

Supabase (database hosting, data stored in EU region) — stores your lead record.
Resend (transactional email, US-based with UK Data Protection Addendum) — sends your quote confirmation and notifies us of your request.
Cloudflare (UK/EU edge hosting) — delivers this website and protects against abuse.
Meta Platforms Inc. (US) — receives marketing attribution data if you consented to marketing cookies.
Google LLC (US) — same, for Google Analytics and Google Ads.
Microsoft Corporation (US) — Clarity session analytics, if you consented.

International transfers

Some of our processors (Meta, Google, Microsoft, Resend) are based in the United States. Transfers to the US rely on the UK Extension to the EU-US Data Privacy Framework, which the UK Government has confirmed provides an adequate level of protection under UK GDPR Article 45. Where a vendor is not certified under the Framework, we rely on Standard Contractual Clauses (the UK International Data Transfer Addendum) as an appropriate safeguard.

Cookies

For the specific cookies we set, what they do, and how to control them, see our Cookie Policy. You can change your choice at any time by clearing the cookie_consent_v1entry in your browser and reloading the page (we're working on a proper "Cookie Settings" link in the footer).

Your rights

Under UK GDPR you have the right to:

Access a copy of the personal data we hold about you.
Rectification — correct data that's wrong.
Erasure ("right to be forgotten") — ask us to delete your data.
Restriction — ask us to pause processing while we check something.
Portability — get your data in a machine-readable format.
Object to processing, including for direct marketing (this is absolute — we must comply).
Withdraw consent for anything we're doing on a consent basis. Withdrawal doesn't affect processing that happened before you withdrew.
Complain to the ICO if you think we've got this wrong. ICO helpline: 0303 123 1113. Website: ico.org.uk/make-a-complaint.

How to exercise your rights

Email malpasexteriorcleaning@outlook.com with the subject line "Privacy request" and tell us what you want us to do. We will respond within 30 days (the UK GDPR deadline). If we can't complete your request in 30 days we'll tell you why and give you a realistic date.

If you want your data removed from Meta's servers in addition to ours, we'll raise a deletion request with Meta's Data Deletion API on your behalf within the same 30 days.

Or use our quick objection form →

Automated decisions and profiling

We do not make any automated decisions about you that have legal or significant effects. Meta and Google use your ad interaction data to decide which ads to show you — that is automated but it does not have legal effects on you. You can opt out of ad personalisation in your Meta Account Centre or Google Ads Settings independently of anything we do.

Children

This site is not directed at children and we do not knowingly collect data from anyone under 18. If you believe we hold data about a child, please email us and we will delete it.

Changes to this policy

We will update this policy whenever our processing changes. Material changes will be highlighted at the top of the page. The "Last updated" date at the top of this policy is always current.

Privacy Policy