Privacy Policy - Crystalpalace Removals

This Privacy Policy explains how Crystalpalace Removals collects, uses, stores, shares, and protects personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It applies to all Crystalpalace Removals customers in our service area, including individuals who request quotations, book removals, use our moving services, or otherwise interact with us in connection with our business.

1. Who We Are

Crystalpalace Removals is a removals and related services provider. For the purposes of data protection law, we act as a data controller when we determine the purpose and means of processing personal data. In some cases, we may also act as a data processor where we handle data on behalf of another controller under their instructions.

2. Information We Collect

We collect only the information necessary to provide our services, manage our business, and meet legal obligations. The types of personal data we may collect include:

Identity details such as name, title, and preferred form of address.
Contact details such as telephone number, email address, and moving address.
Service information including property access details, moving dates, inventory lists, and service preferences.
Payment and billing details such as invoice records, payment status, and transaction references.
Communication records including messages, call notes, complaint correspondence, and service updates.
Technical data such as IP address, device information, and basic website usage data if you interact with our digital services.
Special category data only where strictly necessary and where you choose to provide it, for example if access arrangements or health-related requirements must be considered for safe service delivery.

We do not intentionally collect more data than is needed. Where we ask for information, you may choose not to provide it, but this may affect our ability to deliver services or respond to your request.

3. How We Use Personal Data

We use personal data for the following purposes:

To provide quotations, schedule removals, and carry out moving services.
To communicate with customers before, during, and after service delivery.
To manage payments, invoices, refunds, and account records.
To maintain records of services, complaints, and customer preferences.
To improve service quality, train staff, and manage operational planning.
To comply with legal, accounting, insurance, and regulatory obligations.
To protect our business, staff, customers, and property from fraud, misuse, or security incidents.

We will only process personal data in ways that are lawful, fair, and transparent. We will not use your data for unrelated purposes without a valid legal basis.

4. Lawful Basis for Processing

We rely on the following lawful bases under UK GDPR:

4.1 Performance of a Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes providing quotes, arranging your move, handling service logistics, and processing payments.

4.2 Legal Obligation

We may process personal data where required to comply with legal obligations, including tax, accounting, insurance, record-keeping, and regulatory requirements.

4.3 Legitimate Interests

We may process data where it is necessary for our legitimate business interests, provided those interests do not override your rights and freedoms. Examples include business administration, service improvement, customer support, fraud prevention, and internal record management. We balance our interests against your privacy rights before relying on this basis.

4.4 Consent

In limited cases, we may rely on your consent, particularly for optional communications or where special category data is provided and consent is the most appropriate basis. Where consent is used, you may withdraw it at any time. Withdrawal will not affect processing carried out before consent was withdrawn.

5. Sharing Data and Processors

We may share personal data with trusted third parties where necessary for service delivery, administration, or compliance. These third parties act as processors when they process data on our behalf and under our instructions, or as independent controllers where they determine their own purposes.

Typical processors and service partners may include:

Payment providers for processing card or bank transactions.
Accounting and bookkeeping providers for financial administration and tax compliance.
IT and cloud service providers for secure storage, email, and business systems.
Customer communication tools for sending service-related messages and notifications.
Insurance providers and claims handlers where claims or incidents must be assessed.
Professional advisers such as legal or financial advisers where necessary.
Subcontracted service providers assisting with delivery of removals or related operational tasks.

We require processors to handle personal data securely, lawfully, and only for the specific purposes we instruct. We do not sell personal data. Where data is shared outside the UK or EEA, we will ensure appropriate safeguards are in place.

6. Data Retention

We keep personal data only for as long as necessary for the purpose for which it was collected, unless a longer retention period is required by law. Retention periods depend on the type of data and the purpose for which it is used.

Quotation and enquiry records are typically kept for a limited period to manage follow-up and service history.
Contract and service records are retained for the duration of the service relationship and for a reasonable period afterwards.
Financial and tax records are retained for the period required by law.
Complaint and claims records may be retained longer where needed to resolve disputes or defend legal claims.
Security and audit logs are kept only as long as necessary for operational and security purposes.

When data is no longer needed, we will delete it securely or anonymise it so that it can no longer identify you.

7. Data Security

We use appropriate technical and organisational measures to protect personal data from unauthorised access, loss, misuse, alteration, or disclosure. These measures may include access controls, secure storage, staff confidentiality requirements, and regular review of our systems and procedures. While no system can be guaranteed to be completely secure, we take privacy and security seriously and work to reduce risks wherever possible.

8. Your Rights Under GDPR

You have a number of rights in relation to your personal data, subject to certain legal limits. These rights include:

Right of access – to request a copy of the personal data we hold about you.
Right to rectification – to ask us to correct inaccurate or incomplete data.
Right to erasure – to ask us to delete your data in certain circumstances.
Right to restriction – to request that we limit how we use your data in certain situations.
Right to data portability – to receive certain information in a structured, commonly used format.
Right to object – to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent – where processing is based on consent.

You also have the right to raise concerns with the Information Commissioner’s Office (ICO) if you believe your data protection rights have been violated. We encourage you to contact us first so we can try to resolve any issue promptly and fairly.

9. Special Category Data

We do not routinely seek special category data. If such information is provided to help us make a move safer or more suitable, we will only process it where necessary and with appropriate safeguards. This may include information relating to health or mobility where relevant to access arrangements or safe handling. We will limit this processing to what is strictly necessary and retain it only for as long as needed.

10. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects about you. Any important service, pricing, or operational decision is reviewed by a person where appropriate.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, our services, or our internal practices. The most current version will apply to the personal data we process. We recommend reviewing it periodically to stay informed about how we protect your information.

12. Contact and Queries

If you have questions about this Privacy Policy, your rights, or how your data is handled, you can ask for clarification through our usual customer service channels. We will respond appropriately and in line with our legal obligations.

By using Crystalpalace Removals services, you acknowledge that personal data may be processed as described in this Privacy Policy.