Privacy Policy | Brolly’s Exterior Cleaning

1. ABOUT THIS POLICY

This Privacy Policy explains how Brollys Group Ltd collects, uses, stores, shares and protects personal data in connection with Brolly’s Exterior Cleaning. It applies when you visit our website, contact us, request a quotation, book a consultation, become a customer, interact with our advertising or otherwise deal with us. It also explains your rights and how to exercise them.

For the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, Brollys Group Ltd is the controller of the personal data described in this policy, except where another organisation independently determines how and why personal data is processed.

Brollys Group Ltd

Trading as Brolly’s Exterior Cleaning

Company number: 15394623 · Registered in England and Wales

Registered office: The Old Diary, Pisley Farm Road, Ockley, Dorking, England, RH5 5PD

Email: info@usebrollys.com · Telephone: 0330 133 4945

In this policy, “Brolly’s”, “we”, “us” and “our” mean Brollys Group Ltd.

2. WHO THIS POLICY COVERS

This policy applies to personal data relating to: people who make an enquiry or request a quotation; current and former customers; property owners, occupants and other people connected with a project; people who contact us by telephone, email, text message, social media or website form; visitors to our website; people who interact with our advertising or social media content; suppliers, contractors, advisers and other business contacts; and individuals who may be identifiable in photographs, video or drone imagery that we capture.

Different privacy information may apply to employees, workers and recruitment activities where appropriate.

3. WHAT PERSONAL DATA MEANS

Personal data is information relating to an identified or identifiable living person. This includes obvious identifiers such as your name, telephone number and email address, but can also include information which identifies you when combined with other information, such as a property address, photographs or a correspondence history. Certain information, including information about health, is classed as special category personal data and receives additional protection under data protection law.

4. THE PERSONAL DATA WE COLLECT

What we collect depends on how you interact with us. It may include:

Identity and contact information, including your name, telephone number, email address, property address, correspondence address and social media profile details where you contact us through a social platform.

Property and service information, including the property address, exterior surfaces, services you are interested in, access arrangements, areas you want cleaned or left alone and information used to establish the scope of work.

Consultation and survey information, including survey notes, photographs, drone imagery, roof and surface condition, recommendations, access considerations and risks identified.

Customer and contractual information, including quotations, accepted proposals, bookings, deposits, payment status, project dates, service history, warranty records, instructions and agreed changes to the work.

Financial and transaction information, including invoice amounts, payments, transaction references, refunds and accounting records. Where card payments are used, payment information is handled by the relevant payment provider and we do not intentionally store full card details.

Communications, including emails, text messages, social media messages, call notes, appointment notes, complaints, aftercare and warranty correspondence.

Call recordings and transcripts, where calls are recorded or transcribed and you have been informed that this is taking place.

Photographs, video and drone imagery, including property photographs, before-and-after imagery, work-in-progress footage, aerial footage and testimonial footage. These may constitute personal data where a person, vehicle, address or other identifying feature can be recognised.

Marketing information, including your marketing preferences, the services you have shown an interest in, how you found us and information concerning your interaction with our marketing.

Website and technical information, which may include IP address, browser and device information, operating system, referring website, security information and technical logs generated by our website and hosting infrastructure.

Health information, where you voluntarily tell us about an allergy, sensitivity, medical condition or similar issue that is relevant to the products or cleaning methods used at your property.

5. WHERE WE OBTAIN PERSONAL DATA

Most personal data comes directly from you. This may happen when you: complete a form on our website; complete a Facebook or Instagram lead form; book a consultation; telephone, email, text or message us; request or accept a quotation; book a service; communicate with us while work is being carried out; or provide feedback or participate in a testimonial.

We may also receive information from: Meta, including Facebook and Instagram; someone referring you to us or acting on your behalf; property owners, landlords, tenants or occupants connected with a project; suppliers and contractors; and legitimate publicly available sources where appropriate.

6. HOW WE USE PERSONAL DATA AND OUR LAWFUL BASES

We only process personal data where we have a lawful basis to do so. Depending on the circumstances, we rely on: Contract, where processing is necessary to take steps at your request before entering into a contract or to perform a contract with you; Legal obligation, where processing is necessary to comply with a legal requirement; Legitimate interests, where processing is necessary for our legitimate interests or those of a third party and those interests are not overridden by your rights and freedoms; and Consent, where you have given us a clear and specific indication that you agree to particular processing.

Enquiries, consultations and quotations — To respond to enquiries, arrange consultations, assess properties, make recommendations and prepare quotations. Lawful basis: steps at your request before entering into a contract and, where appropriate, our legitimate interests in operating an efficient enquiry and quotation process.

Delivering our services — To schedule work, arrange access, record instructions, manage changes and carry out the agreed service. Lawful basis: contract.

Property assessment and project records — To use photographs, notes, video and drone imagery to inspect surfaces, assess safe access, plan work, document property condition and evidence work completed. Lawful basis: contract or steps before entering into a contract, together with our legitimate interests in documenting our work, managing risk and protecting our legal position.

Customer service and aftercare — To answer questions, provide updates and deal with complaints, aftercare and warranties. Lawful basis: contract and legitimate interests.

Payments, accounting and administration — To invoice customers, collect and reconcile payments, issue refunds, manage balances and maintain accounting and tax records. Lawful basis: contract, legal obligation and legitimate interests.

Legal claims, insurance and disputes — To investigate alleged damage, manage insurance matters, recover debts and establish, exercise or defend legal claims. Lawful basis: legitimate interests and legal obligation where applicable.

Operating and improving Brolly’s — To manage our operations, maintain service quality, train our team, understand demand and improve our business processes. Lawful basis: legitimate interests.

Advertising measurement — Where we use services such as Meta’s Conversions API, to understand whether advertising results in enquiries, consultations or customers and to improve the effectiveness of our advertising. Lawful basis: legitimate interests where appropriate and subject to our assessment of those interests against individuals’ rights. Any separate consent requirements applying to cookies, pixels or other technologies accessing information on a user’s device are dealt with separately.

Direct marketing — To communicate with you about relevant Brolly’s services where permitted by law. Lawful basis: consent or legitimate interests, depending on the circumstances and subject to the requirements of the Privacy and Electronic Communications Regulations 2003 (“PECR”).

Testimonials and promotional content — To use identifiable testimonial footage, comments, photographs, voice recordings and related project information for promotional purposes where appropriate permission has been obtained. Lawful basis: consent.

Corporate transactions — To disclose appropriate information to prospective investors, lenders, purchasers and professional advisers in connection with financing, due diligence, investment, restructuring, merger, acquisition or sale of all or part of the business. Lawful basis: legitimate interests and, where applicable, legal obligation.

7. OUR LEGITIMATE INTERESTS

Where we rely on legitimate interests, these may include: operating Brolly’s efficiently; responding to enquiries; maintaining customer relationships; delivering and improving our services; documenting the work we perform; protecting customers, properties and our team; maintaining the security of our systems; preventing fraud and misuse; dealing with complaints, warranty issues, insurance matters and legal claims; improving our advertising and business processes; marketing our services where permitted by law; and carrying out legitimate corporate and financing transactions.

Before relying on legitimate interests, we consider the purpose of the processing, whether the processing is necessary and the impact on the people concerned. We do not rely on legitimate interests where the individual’s interests, rights or freedoms override our interests.

8. OUR SYSTEMS AND SERVICE PROVIDERS

We use third-party systems and service providers to operate Brolly’s. These currently include: Framer, which hosts our website and supports website forms; Make, which may transfer information between our systems, including moving website and Meta enquiries into our CRM; Close, our customer relationship management system, which we use for enquiries, contact information, communications, appointments, follow-ups and customer records; Calendly, where used to manage consultation bookings; Better Proposals, which we use to prepare and send quotations; and providers of email, telecommunications, cloud storage, accounting, banking and related business services.

The precise role of a provider depends on the service involved. Some providers process information on our instructions. Others may determine certain processing purposes themselves and act as independent controllers. Where required, we put appropriate contractual and data-protection arrangements in place with providers that process personal data for us.

9. META, FACEBOOK, INSTAGRAM AND ADVERTISING MEASUREMENT

We advertise and operate accounts on Facebook and Instagram, which are services provided by Meta. If you submit a Meta lead form, send us a message or interact with our advertising, Meta may process information about that interaction under its own privacy terms. Where Meta passes enquiry information to Brolly’s, we process that information under this Privacy Policy.

Where we use Meta’s Conversions API, we may send Meta limited information relating to events following an enquiry, for example whether an appointment was booked or a job was confirmed. This allows us to measure the effectiveness of our advertising and improve advertising performance.

Information used to match an event may include details such as an email address or telephone number. Where Meta’s systems require those identifiers to be hashed before transmission, hashing converts the information into a coded representation before it is transmitted for matching purposes. Hashing does not necessarily make information anonymous, and we continue to treat the processing as involving personal data where applicable.

Where we rely on legitimate interests for this processing, you have the right to object. You can contact us at info@usebrollys.com. Meta may have its own independent responsibilities for personal data it processes within its platforms and advertising systems.

10. COOKIES, EMBEDDED CONTENT AND SIMILAR TECHNOLOGIES

Websites can use cookies, pixels, scripts, tags, local storage and similar technologies to store information on, or access information from, a user’s device. We do not currently intentionally deploy Meta Pixel, Google Analytics or similar non-essential browser-based advertising or analytics tracking on the Brolly’s website.

Our website may contain third-party content, including videos hosted by YouTube. Where we use YouTube’s privacy-enhanced embedding mode, Google states that a view of the embedded video is not used to personalise the viewer’s subsequent YouTube browsing experience or advertising. Privacy-enhanced mode does not mean that no information is processed by Google.

Where cookies or similar technologies are not strictly necessary and consent is legally required, they should not be activated before the required consent has been obtained. ICO guidance states that non-essential cookies cannot be set before consent. If we introduce additional analytics, advertising or tracking technologies, we will update the information provided to website visitors and obtain consent where required.

11. DIRECT MARKETING

We may contact you about Brolly’s services where the law allows us to do so. For marketing sent to individuals by email, text message or similar electronic communication, we comply with PECR.

We may send this type of marketing where: you have specifically consented to receiving it; or the legal “soft opt-in” applies. The soft opt-in may apply where you have bought, or genuinely negotiated to buy, services from us, the marketing concerns our own similar services, and we gave you a clear opportunity to opt out when your details were collected and in every subsequent marketing message. This reflects current ICO guidance.

A message that is genuinely concerned with administering your enquiry, consultation, quotation, booking or existing project is a service communication rather than direct marketing. You can opt out of marketing at any time without charge by: using the unsubscribe option provided; replying STOP where that facility is offered; or emailing info@usebrollys.com.

When you opt out, we may retain a limited suppression record so that we can respect your preference and avoid contacting you again for marketing purposes.

12. PHOTOGRAPHS, VIDEO AND DRONE IMAGERY

Photography, video and drone imagery form part of how we inspect, plan, document and carry out exterior cleaning work. We may use imagery to: inspect roofs and exterior surfaces; assess safe access; prepare recommendations and quotations; document the condition of a property; record work before, during and after cleaning; investigate complaints, warranties, disputes or insurance matters; train our team; and monitor the quality of our work.

We aim to capture only what is reasonably needed. Exterior and aerial imagery can incidentally include neighbouring properties, people, vehicles or other identifying information. We take reasonable steps to avoid unnecessary capture and to minimise irrelevant personal data.

The fact that we capture operational project imagery does not automatically mean we may use identifiable imagery for public advertising. Where we want to use a person’s identifiable image, voice or testimonial publicly for promotional purposes, we obtain appropriate permission. Where an identifiable child is deliberately included in promotional material, we obtain appropriate permission from a parent or person with parental responsibility.

13. CALL RECORDINGS AND TRANSCRIPTS

Some telephone calls may be recorded or transcribed. Where this happens, we inform callers. We may use recordings and transcripts to: maintain an accurate record of enquiries and instructions; monitor and improve customer service; train our team; investigate complaints or disagreements; resolve disputes; and protect our legal position.

We do not retain call recordings indefinitely. Our usual retention period is set out in section 18.

14. HEALTH AND OTHER SPECIAL CATEGORY INFORMATION

We do not routinely request health information. Occasionally, a customer may tell us about an allergy, chemical sensitivity, medical condition or other health-related issue because it is relevant to products or cleaning methods used at their property. We only record health information where it is necessary for us to take the relevant issue into account.

For the purposes of Article 6 UK GDPR, our lawful basis will normally be the performance of a contract or taking steps at your request before entering into a contract, depending on when the information is provided. Because health information is special category data, we also require a separate Article 9 condition. Where we intentionally record health information supplied by a customer for this purpose, we rely on their explicit consent.

We use this information only for the relevant operational or safety purpose. We do not use it for marketing. You can withdraw your consent at any time. Withdrawal does not make previous processing unlawful. In limited circumstances, we may also need to retain a minimal record where this is necessary for a legal claim, insurance matter or another lawful requirement. UK data-protection law requires organisations processing special-category information to identify both an Article 6 lawful basis and an Article 9 condition.

15. WHO WE SHARE PERSONAL DATA WITH

We do not sell personal data. We may share personal data where reasonably necessary with: the technology and business-service providers described in section 8; Meta and other advertising platforms in the circumstances described above; accountants, bookkeepers, solicitors, insurers, insurance brokers, tax advisers and other professional advisers; banks and payment providers; suppliers and contractors involved in delivering an agreed service; HM Revenue & Customs, courts, regulators, law-enforcement bodies and other public authorities where disclosure is required or permitted by law; debt-recovery providers where reasonably necessary to recover money owed; and prospective investors, lenders, purchasers and their advisers in connection with a genuine financing or corporate transaction, subject to appropriate confidentiality arrangements.

We limit information shared to what is reasonably necessary for the relevant purpose.

16. INTERNATIONAL TRANSFERS

Some of the organisations that provide technology or other services to us operate internationally. As a result, personal data may in some circumstances be stored in, accessed from or transferred to countries outside the United Kingdom. Where a transfer is a restricted transfer under UK data-protection law, we take steps to ensure an appropriate lawful transfer mechanism is available.

Depending on the recipient and circumstances, this may include: UK adequacy regulations; the UK Extension to the EU-US Data Privacy Framework, where the US recipient is eligible and actively certified for the relevant type of information; the UK International Data Transfer Agreement; the UK Addendum to the EU Standard Contractual Clauses; or another mechanism permitted by UK data-protection law.

The UK Extension only applies to eligible US organisations that participate in the relevant framework; it is not a blanket mechanism covering every transfer to the United States. Where appropriate safeguards rather than adequacy are relied upon, additional transfer-risk requirements may also apply.

17. HOW WE PROTECT PERSONAL DATA

We use technical and organisational measures designed to protect the personal data we hold. Depending on the system and data involved, these may include: access controls; restricting information to people who need it for their role; passwords and account-security measures; device security; confidentiality obligations; appropriate agreements with service providers; backup and recovery arrangements; and reviewing the risks associated with the systems and information we use.

No method of storage or transmission can guarantee absolute security. We therefore review our arrangements and take proportionate steps to reduce the risk of unauthorised access, loss, misuse, alteration or disclosure.

18. HOW LONG WE KEEP PERSONAL DATA

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, taking account of contractual, legal, tax, accounting, warranty, insurance and limitation requirements. Our normal retention approach is:

Enquiries that do not become customers: up to 24 months after the last meaningful contact. Quotation and consultation records for customers: normally 7 years after the relevant project or customer relationship ends. Customer and project records: normally 7 years after the relevant project or customer relationship ends. Invoices and accounting records: normally 7 years, or longer where required by law.

Project photographs, video and drone imagery: normally retained with the project record for up to 7 years where there is a legitimate operational, warranty, insurance or evidential reason for doing so. Enquiry imagery where no project proceeds: normally up to 24 months after the last meaningful contact. Call recordings and transcripts: normally up to 12 months, unless required for longer because of a complaint, dispute, insurance matter, contractual issue or legal claim.

Health information: retained only for as long as reasonably necessary for the relevant project, safety requirement, warranty, complaint or legal purpose and deleted sooner where it is no longer needed. Marketing consent and preference records: for as long as necessary to evidence and respect the relevant preference. Marketing suppression records: for as long as reasonably necessary to ensure an opt-out continues to be respected. Published testimonials and promotional material: while the material remains in use, together with an appropriate record of the permission on which we rely. Technical and security logs: normally up to 12 months unless there is a security, fraud or legal reason to retain them for longer.

These are standard retention periods rather than absolute rules. We may retain specific information for longer where reasonably necessary in connection with a complaint, legal claim, insurance matter, investigation or legal obligation. When information is no longer required, we delete it, securely dispose of it or anonymise it where appropriate.

19. YOUR DATA-PROTECTION RIGHTS

Depending on the circumstances, you may have the right to: Access personal data we hold about you. Rectification of inaccurate or incomplete personal data. Erasure of your personal data in certain circumstances. Restriction of processing in certain circumstances. Object to processing based on legitimate interests. Object to direct marketing at any time. Data portability for certain information you have provided to us where the legal requirements are met. Withdraw consent where processing relies on consent. Challenge certain solely automated decisions which produce legal or similarly significant effects.

These rights are not all absolute. For example, we may be entitled or required to retain information despite an erasure request where it is needed for tax records, an insurance matter or the establishment, exercise or defence of legal claims.

20. EXERCISING YOUR RIGHTS

To exercise a data-protection right, contact: info@usebrollys.com or write to: Brollys Group Ltd, The Old Diary, Pisley Farm Road, Ockley, Dorking, England, RH5 5PD.

We may need to ask for information sufficient to confirm your identity before responding. There is normally no charge for exercising your rights. We normally respond within one month once we have the information reasonably necessary to deal with your request. Where the law permits additional time because a request is complex or multiple requests have been made, we will tell you. If we cannot fully comply with a request, we will explain the reason where the law requires us to do so.

21. AUTOMATED DECISION-MAKING

Brolly’s does not currently make decisions about customers based solely on automated processing that produce legal or similarly significant effects. Advertising platforms such as Meta may independently use automated processing and profiling when selecting or delivering advertising. Their processing is governed by their own privacy arrangements.

22. CHILDREN

Our exterior-cleaning services and website are not directed at children and we do not intentionally market our services to children. Children may occasionally appear incidentally in project imagery. Where we deliberately want to use identifiable imagery of a child in promotional material, we obtain appropriate permission as described in section 12.

23. THIRD-PARTY WEBSITES AND PLATFORMS

Our website, emails and social media accounts may contain links to websites or platforms operated by third parties. Those organisations determine their own privacy practices. This Privacy Policy does not govern information they collect independently, and you should review their privacy information where appropriate.

24. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes to: our services; our systems and suppliers; our marketing activities; the way we process personal data; or applicable law and regulatory guidance. The current version will be published on this page and will show the date it was last updated. Where a material change affects how we use personal data already held, we will take appropriate steps to inform affected individuals where required.

25. COMPLAINTS

If you are unhappy with how we have handled your personal data, please contact us so that we can investigate. Email: info@usebrollys.com. Telephone: 0330 133 4945.

You also have the right to make a complaint to the UK supervisory authority: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Telephone: 0303 123 1113. Website: ico.org.uk.

26. CONTACT US

Brollys Group Ltd · Trading as Brolly’s Exterior Cleaning · Company number: 15394623