Privacy Policy

In accordance with the data minimisation principle (Article 5(1)(c) GDPR), we only collect personal data that is adequate, relevant, and limited to what is necessary. This includes:

• Identity & Contact Data: Full name, email address, phone number, and postal address provided directly by you.
• Payment & Billing Information: Payment details processed securely via PCI-DSS compliant third-party processors. We do not store raw card data.
• Service Preferences & Booking Details: Information related to the services you request, scheduling preferences, and booking history.
• Technical & Usage Data: IP address, browser and device information, website usage data, and cookie identifiers — collected automatically and only where consent has been obtained for non-essential purposes.

We do not intentionally collect or process special categories of personal data as defined in Article 9 GDPR (e.g., health data, racial or ethnic origin). If such data is incidentally shared with us, it will be deleted promptly.

Your personal data is processed for the following specific and explicit purposes (Article 5(1)(b) GDPR). We will not process your data for any incompatible purpose without prior notice and, where required, your consent.

• Service Delivery (Art. 6(1)(b)): To provide, manage, and deliver our cleaning services, including processing and confirming bookings.
• Payments (Art. 6(1)(b)): To process transactions, issue invoices, and manage billing securely.
• Communications (Art. 6(1)(b)): To send booking confirmations, receipts, service updates, and respond to your enquiries.
• Legal Compliance (Art. 6(1)(c)): To fulfil our obligations under applicable tax, accounting, employment, and regulatory law.
• Marketing (Art. 6(1)(a)): To send promotional communications — only where you have provided prior, freely given, and specific consent. You may withdraw consent at any time.

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, in accordance with Article 32 GDPR.

• TLS/SSL encryption for all data transmitted over the internet, and encryption of personal data at rest using industry-standard algorithms.
• Role-based access control, limiting data access to authorised personnel only, supported by regular staff training on data protection.
• Incident response procedures compliant with Article 33 GDPR — in the event of a personal data breach posing a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay.

We do not sell, rent, or trade your personal data. We may share it only in the following circumstances:

• Authorised Data Processors (Art. 28 GDPR): Third-party service providers (e.g., payment processors, cloud hosting, email platforms, analytics) acting under written Data Processing Agreements with strict confidentiality and security obligations.
• Legal Disclosures (Art. 6(1)(c)): When required by applicable law, court order, or to establish, exercise, or defend legal claims.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, we will notify you before any transfer occurs and you will retain the right to object.

As a data subject, you have the following rights. We will honour all requests without undue delay and within one month of receipt (extendable to three months for complex requests). Requests are handled free of charge unless manifestly unfounded or excessive.

• Right of Access (Art. 15): Request a copy of all personal data we hold about you, along with details of how it is processed.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal data without undue delay.
• Right to Erasure / Right to be Forgotten (Art. 17): Request deletion of your data where it is no longer necessary, consent is withdrawn, or processing is unlawful — subject to legal retention obligations.
• Right to Restriction & Right to Object (Arts. 18 & 21): Request temporary restriction of processing, or object at any time to processing based on legitimate interests, including profiling.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, machine-readable format (e.g., JSON/CSV) and request its transfer to another controller where technically feasible.
• Right to Withdraw Consent (Art. 7(3)): Withdraw consent at any time without affecting the lawfulness of prior processing, via the unsubscribe link in emails or by contacting us directly.
• Right to Lodge a Complaint: If you believe your rights have been violated, you may lodge a complaint with your national supervisory authority (e.g., ICO in the UK). We encourage you to contact us first so we may address your concern directly.

To exercise any of these rights, please submit a written request to privacy@finnoys.com. We may request proof of identity to verify your request.

Where our services involve geolocation tracking (e.g., for service routing or field staff management), such data is collected only where explicit consent has been obtained or where it is strictly necessary for the performance of your service agreement. Geolocation data is processed with the same security standards as other personal data and is not used for any purpose beyond that for which it was collected. You may withdraw consent for geolocation tracking at any time by contacting us at privacy@finnoys.com.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, in accordance with the storage limitation principle (Article 5(1)(e) GDPR). Default retention periods are:

• Service and contract data: up to 6 years after the end of the contract to comply with legal obligations.
• Accounting and invoicing records: a minimum of 7 years under applicable financial regulations.
• Marketing data: until you withdraw consent or object to processing.
• Cookie and analytics data: up to 13 months, or in line with your consent preferences.

Once the applicable retention period expires, personal data is securely deleted or anonymised in a manner that prevents re-identification.

We use cookies and similar tracking technologies in accordance with the ePrivacy Directive and GDPR. Upon your first visit, you will be presented with a Cookie Consent Banner. Non-essential cookies are only stored with your prior consent, which you may update at any time via our Cookie Settings page.

• Strictly Necessary Cookies: Essential for site operation — no consent required.
• Functional Cookies: Enhance usability and remember your preferences — consent required.
• Analytics Cookies: Help us understand site usage — consent required.
• Marketing Cookies: Deliver relevant communications — explicit prior consent required.

We primarily store and process data within the European Economic Area (EEA). Where transfers to third countries are necessary, we ensure an adequate level of protection through the following safeguards (Chapter V GDPR):

• Adequacy Decision (Art. 45): Transfer to a country recognised by the European Commission as providing adequate data protection.
• Standard Contractual Clauses (Art. 46(2)(c)): We enter into EU Commission-approved Standard Contractual Clauses (SCCs) with all third-country recipients.
• Contractual Necessity (Art. 6(1)(b)): Processing necessary to perform your service agreement.
• Legal Obligation (Art. 6(1)(c)): Processing required to comply with applicable law.
• Legitimate Interests (Art. 6(1)(f)): Processing for fraud prevention, security, and service improvement, subject to a Legitimate Interest Assessment (LIA) — available upon request.
• Consent (Art. 6(1)(a)): For marketing, non-essential cookies, and any processing not otherwise covered, we rely on your freely given, informed, and unambiguous consent.
• Data Protection by Design & Default (Art. 25): Privacy principles are embedded into our systems from the outset. Data Protection Impact Assessments (DPIAs) are conducted for high-risk processing activities.

You may request a copy of the specific safeguards applicable to your data by contacting privacy@finnoys.com.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by email or via a prominent notice on our website at least 30 days before the changes take effect. Where required by law, we will seek renewed consent for any significant change in processing purposes. The date at the top of this policy reflects the date of the most recent revision.

For any questions, concerns, or to exercise your data subject rights, please contact us:

We aim to respond to all data subject requests within 30 days. If your request is complex, we may extend this by a further two months and will inform you accordingly.