Privacy Notice

1. The controller

The data controller is the individual sole trader operating under the Kim Kitch Care trading name. The correspondence address is 10 Grainger Park Road, Newcastle Upon Tyne. Privacy questions and rights requests can be sent through our contact form or by post.

2. Information we may hold

• your name, email address, service address and any telephone number you choose to supply;
• appliance category, make, model, serial number, approximate age, condition, fault and access details;
• enquiry, eligibility, order, membership, appointment, maintenance, quote, repair and complaint records;
• messages, instructions and recorded preferences;
• limited Bacs mandate and payment information received from Stripe, such as status, mandate reference and restricted bank-identifying details; and
• essential technical and security data needed to deliver and defend the website.

3. Purposes and lawful bases

Enquiries and eligibility

We use information to answer a request and take steps towards a possible contract.

Membership and service delivery

Contract performance allows us to register appliances, arrange visits, supply maintenance and administer any separately accepted repair.

Payment and business records

We use records to perform the contract and meet tax, accounting, consumer and other legal duties.

Safety, fraud prevention and improvement

We rely on legitimate interests in protecting customers, engineers, systems and the business where those interests do not override individual rights.

Legal claims and official requests

Information may be used to comply with law or to establish, exercise or defend a legal claim.

Marketing

We do not currently use personal information for electronic marketing. Any future activity will use a valid legal route and provide an easy opt-out.

4. Information needed to provide the service

Core contact, address, appliance and payment details are necessary to assess eligibility and perform a membership. If they are not supplied, we may be unable to accept or fulfil the contract. Information that is not essential will be identified as optional.

5. Who may receive information

We disclose information only where it is reasonably needed. Recipients may include:

• Stripe for Bacs payment, mandate communication, fraud prevention and payment records;
• Hostinger for website hosting, infrastructure and related security;
• providers that deliver website enquiries and business email;
• appropriately skilled engineers and subcontractors who need limited appointment information;
• professional advisers, accountants, insurers and technical support where necessary; and
• courts, regulators, law-enforcement bodies and public authorities where disclosure is lawfully required.

Independent subcontractor engineers work under appropriate data-protection requirements. We do not sell personal information.

6. Processing outside the United Kingdom

A supplier may process information in another country. Where UK law treats that activity as a restricted transfer, we require a recognised safeguard, such as an adequacy regulation or approved contractual protection. You may ask what safeguard applies in a particular case.

7. Retention

• Unsuccessful membership enquiries are normally kept for no more than 12 months after the last meaningful contact.
• Membership, service, payment, repair and complaint records are normally kept for six years after the relationship ends when required for tax, contract or legal records.
• Security information is retained only as long as reasonably needed to investigate and protect the service.
• Minimal suppression data may be retained to honour a marketing opt-out.

An active dispute, safeguarding need or legal obligation may require a longer period. We record the reason when that happens.

8. Security

Proportionate safeguards include encrypted connections, access controls, supported systems, secure hosted payments, backups and restricted engineer access. No internet system can guarantee absolute security, so we also maintain processes for incidents, rights requests and supplier access.

9. Your rights

Depending on the situation, you may ask for access, correction, erasure, restriction, objection or data portability. Consent can be withdrawn where it is the basis for processing, without changing the lawfulness of earlier use. You also have protections relating to certain solely automated decisions; Kim Kitch Care does not make solely automated decisions.

Use the contact form and select “Privacy request”, or write to our correspondence address. We may request proportionate information to confirm identity.

10. Raising a data concern

Please contact us first so we can investigate. You may also complain to the UK Information Commissioner’s Office through ico.org.uk/make-a-complaint.

11. Updates to this notice

Material changes are published clearly with a revised effective date. Where an update materially affects an existing customer, we provide an appropriate direct notice.