Gleaming Spaces ("we", "us") is a home cleaning and family celebration decor business based in Basildon, Essex. This notice explains what personal data we collect through this website, why we collect it, how long we keep it and what rights you have. Questions about anything here — or any request about your data — can go straight to us at hello@gleamingspaces.com.
Booking enquiries
When you submit the booking form, we collect the details you give us: your name, email address, phone number, postcode and venue address, your preferred date, and the service details you describe. We use these only to reply to your enquiry, prepare a quote and arrange the work. We do not use them for unrelated marketing, and we never sell or share them with advertisers.
The lawful basis for handling booking-enquiry data is our legitimate interest in answering and managing requests for our services — in practice, a pre-contractual enquiry you asked us to respond to. You are always free to type as much or as little detail as you like; only what is needed to quote and schedule is asked for.
Quote records
When we prepare and send you a quote, we keep a record of it: your contact details (name, email address, phone number and the address the work is for), the service discussed and the amounts quoted. The quote record also stores a snapshot of the business and customer details as they appeared when the quote was sent, so the document matches what you received. Quote records are used only to manage that enquiry and any work that follows.
Appointment records
When a booking becomes a scheduled job we keep a record of the appointment: the job's date, time and duration, the assigned staff member, where the work is and who it is for (name, phone number, email address if we have it), the service and quoted or charged price, and any notes. Completing a repeating appointment generates the next visit automatically from this record. Appointments are used only to run your booking.
Expense records
When we buy something for your job — supplies, travel, hire equipment, or a second pair of hands — we log the expense: the date, what it was for, a category, the amount, and whether it passes through to your invoice as a billable item. These are our business records, not yours; the only personal detail is where a description names a person or a company (for example the supplier). Expense records are used only for accounting and for preparing invoices.
Invoice records
Your invoice is a document we keep a copy of: its number, your name, address and phone number, the work and pass-through items on it, VAT where it applies, the amounts and dates, and how you asked us to take payment. Once it is issued the printed copy is frozen — exactly what was on the page when it was sent. We do not take card payments or store payment cards, and the sender emails or messages the PDF from their own account. Invoice records are used only for accounting and tax.
Staff and admin accounts
Staff use named accounts to sign in to the admin area. For each account we store the person's name, email address and a password hash — passwords are scrambled with a one-way cryptographic hash and are never stored in a readable form, not even by us. When a staff member signs in, the system records the session's IP address and browser user-agent string. The lawful basis is legitimate interest: keeping the business's site, booking data and admin area secure, with IP capture needed for rate limiting (to blunt automated sign-in guessing) and security investigations.
Audit logging
To keep an accountable trail, the system writes an audit log of staff account actions (creating, changing or removing accounts), booking-form submissions, and sign-in events. Each entry may include the people and IP addresses involved, plus a short description of the action. The lawful basis is legitimate interest: security and forensics — if an account is misused or data is altered unexpectedly, the log tells us when, what and who. The log records actions and route paths only; it never stores passwords, payment data or the text of form payloads.
How long we keep data
- Booking enquiries: kept for 24 months from your enquiry, after which they are reviewed and deleted. This is a manual review by the owner — a documented policy we follow.
- Quote records: kept the same way as booking enquiries — for 24 months from your enquiry, then reviewed and deleted on the same cadence.
- Appointments: kept the same way as bookings and quotes — 24 months from the date of the visit, then reviewed and deleted on the same cadence.
- Expense records: kept the same way as bookings — 24 months from the date the expense relates to, then reviewed and deleted. This is a manual review by the owner — the same documented policy we follow for bookings.
- Invoices: kept the same way as bookings — 24 months from the invoice date, then reviewed and deleted on the same documented cadence.
- Expired sign-in sessions and verification records: deleted after 90 days.
- Password-reset tokens: expire after 1 hour.
- Audit events: kept for 24 months.
- Staff accounts: deleted for good on request or when someone leaves — this removes their credentials and sign-in history along with the account itself.
Cookies
This site uses exactly one cookie: a strictly necessary session cookie used when a named staff member signs in to the admin area. It holds no personal data beyond what is needed to keep that person signed in, and it disappears once signed out or expired. There are no tracking cookies, no analytics and no advertising pixels, so there is no cookie banner — UK rules only require consent for cookies that are not strictly necessary.
Your rights
Under UK GDPR you have rights over your personal data, including the right of access (a copy of what we hold about you), the right of erasure (having it deleted), and the right of portability (taking your data elsewhere in a common format). Email hello@gleamingspaces.com and we will help — we keep these records at a personal, manageable scale, so requests are straightforward. You also have the right to complain to the Information Commissioner's Office (ico.org.uk) if you are unhappy with how we handle your data.
Where your data lives
All data for this website — booking enquiries, account details, session and audit records — is hosted on our own hosting with Hostinger, in EU/UK regions available under their data processing agreement. Hostinger is our only processor. There are no third-country transfers and no other processors, subscriptions or third-party services involved in running this site.