Privacy Policy - Man And Van Crystal Palace

This Privacy Policy explains how Man And Van Crystal Palace collects, uses, stores, shares, and protects personal data when providing moving, delivery, collection, transportation, and related services. It applies to all Man And Van Crystal Palace customers in the area, including individuals who request quotes, make bookings, receive services, or otherwise interact with us in connection with our operations.

We are committed to handling personal data in accordance with the UK GDPR and the Data Protection Act 2018. We value privacy and aim to ensure that any personal information processed in the course of our business is lawful, fair, transparent, accurate, and secure.

1. Information We Collect

We collect only the information necessary to provide and manage our services effectively. Depending on how you interact with us, we may collect the following categories of personal data:

Identity information: name, title, and any relevant identification details required to arrange or carry out a service.
Contact information: address, email address, telephone number, and moving locations.
Service information: details about the items to be moved, property access, preferred dates and times, and any special instructions.
Payment information: billing details and transaction records, where applicable.
Communication records: messages, phone call notes, and correspondence relating to quotes, bookings, complaints, or service updates.
Technical information: basic data such as device type, browser details, and usage patterns if you interact with us online.

We do not intentionally collect special category personal data unless it is necessary and you choose to provide it, for example where it is relevant to access needs or service arrangements. If such information is provided, we handle it with extra care and only where there is a valid legal basis.

2. How We Use Personal Data

We use personal data for the following purposes:

to provide quotes, confirm bookings, and deliver moving or transport services;
to communicate about schedules, access requirements, changes, and service updates;
to process payments, invoices, refunds, or account-related matters;
to manage customer relationships and respond to enquiries or complaints;
to maintain business records, support internal administration, and improve service quality;
to comply with legal, regulatory, tax, insurance, and contractual obligations;
to prevent fraud, misuse, theft, or other unlawful activity;
to protect the rights, property, and safety of our customers, staff, and business.

We only process personal data for purposes that are compatible with the original reason for collection or where another lawful basis applies.

3. Lawful Basis for Processing

We rely on the following lawful bases under the UK GDPR:

Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes preparing quotations, confirming bookings, arranging collection and delivery, and carrying out the service you requested.

Legal Obligation

We may process personal data where necessary to comply with legal obligations, including accounting rules, tax requirements, insurance obligations, and record-keeping duties.

Legitimate Interests

We may process data for our legitimate interests where those interests are not overridden by your rights and freedoms. This may include managing operations, handling customer service issues, improving our services, securing our business, and maintaining accurate internal records. Where legitimate interests are relied upon, we consider the impact on your privacy and limit processing to what is necessary.

Consent

In limited cases, we may rely on your consent, for example if we need to process optional information you provide for a specific purpose. Where consent is used, you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal.

4. Sharing Your Data and Processors

We may share personal data only when necessary and only with trusted third parties who support our business operations. These third parties act as processors or, in some cases, independent controllers. They are required to protect your information and use it only for authorised purposes.

Examples of processors or service providers may include:

Payment service providers that process card or electronic payments;
Accounting and bookkeeping providers that help manage financial records;
IT and hosting providers that support data storage, email, or system maintenance;
Administrative support services that assist with scheduling, record management, or customer communication;
Insurance or professional advisers where required for claims, compliance, or legal matters;
Regulatory, law enforcement, or public authorities when disclosure is required by law.

We do not sell your personal data. Where data is shared, we only disclose the minimum necessary information and take steps to ensure appropriate safeguards are in place.

5. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Retention periods may vary depending on the type of information and the reason for processing.

Customer and booking records: retained for the duration of the service relationship and for a reasonable period afterwards to handle queries, disputes, or follow-up matters.
Financial and tax records: kept for the period required by law and accounting practice.
Communication records: retained for operational and evidential purposes for a limited period.
Complaint or claim records: kept for as long as needed to resolve the issue and meet legal obligations.

When personal data is no longer needed, it is securely deleted, anonymised, or otherwise disposed of in a safe manner. We review retention practices regularly to ensure data is not kept longer than necessary.

6. Data Security

We use appropriate technical and organisational measures to protect personal data from unauthorised access, loss, misuse, alteration, or disclosure. These measures may include access controls, secure storage, password protection, staff confidentiality obligations, and limited data access on a need-to-know basis.

Although no system can be guaranteed completely secure, we take reasonable steps to reduce risk and maintain the confidentiality and integrity of the information we hold.

7. Your Rights Under GDPR

As a data subject, you have rights in relation to your personal data. These rights may be subject to legal conditions and exceptions, but we will always consider any request carefully.

Right of access: you may request a copy of the personal data we hold about you.
Right to rectification: you may ask us to correct inaccurate or incomplete information.
Right to erasure: in some cases, you may request deletion of your personal data.
Right to restrict processing: you may ask us to limit how we use your data in certain circumstances.
Right to data portability: you may request that data you provided to us be transferred to you or another controller in a structured format, where applicable.
Right to object: you may object to processing based on legitimate interests or direct marketing, where relevant.
Right to withdraw consent: if we rely on consent, you may withdraw it at any time.
Right to complain: you may raise a concern with the UK Information Commissioner's Office if you believe your data has been handled incorrectly.

If you exercise any of these rights, we may need to verify your identity before responding. We aim to respond within the time limits set by law.

8. International Transfers

Where personal data is processed or stored outside the UK, we will take appropriate steps to ensure that it is protected to a standard that is essentially equivalent to UK GDPR requirements. This may include the use of approved safeguards or contractual protections.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or data processing practices. Any revised version will apply from the date it is made available. We encourage customers to review this policy periodically to stay informed about how personal data is handled.

10. Scope of This Policy

This Privacy Policy applies to all customers of Man And Van Crystal Palace in the area, including residential and business customers, individuals requesting quotes, and anyone receiving related moving or transport services. By using our services, you acknowledge that personal data may be processed as described in this policy and in line with applicable data protection law.

Summary of our approach: we collect only necessary data, process it lawfully, keep it secure, retain it for limited periods, share it only with trusted processors or where legally required, and respect your rights under GDPR.