AES Maintenance: Privacy Notice

DRAFT: not for publication. Not legal advice. AES's solicitor must review before go-live (Gate D). Items in [square brackets] are placeholders to be completed.

Solicitor checklist: (1) ICO data protection fee exemption or registration; (2) confirm Stripe's data transfer position (Stripe may transfer card data to the US; this needs documenting in full); (3) actual retention periods for each data type (current draft says 6 years for tax records and 'only as long as needed' elsewhere); (4) data protection impact assessment if Stripe transfers become material to risk; (5) DPO contact if one is appointed; (6) review of all photos and before-after documentation practices on cleaners' devices before rollout; (7) Stage 1 scope note: photo storage table does not yet exist, so confirm where 1.5 images are stored.

1. Who we are

AES Maintenance is a trading name of Absolute Environmental Solutions LTD, a company registered in England and Wales (company number 12258371), registered office Norton Canes, Cannock, Staffordshire. We are registered with the Environment Agency as a waste broker and dealer, registration CBDU309472. Our contact details are set out in section 9 below.

Data controller: Absolute Environmental Solutions LTD.

Data subject rights: you have the right to request access to, rectification of, erasure of, or objection to the processing of your personal data, and to complain to the Information Commissioner's Office (ICO) at ico.org.uk. You can exercise these rights by contacting us using the details in section 9.

2. The personal data we collect and process

We process the following personal data to deliver cleaning and household waste services:

On booking

• Your name, email address, phone number (for contact and booking confirmation)
• Your service address and postcode district (to serve the booking and calculate charges)
• Access notes (for example, keys, codes, alarm settings; to enable the cleaner to access your property safely)
• Your booking history, service preferences and frequency (for recurring bookings and to offer relevant services)
• Marketing opt-in choice (recorded as 'yes' or 'no', not assumed)
• Waiting-list opt-in if you are outside our service area (a separate choice from marketing)

Saved payment details

• Your name and the last 4 digits of your card (you always see this)
• Your card is stored securely by our payment provider, Stripe, not on our servers. See section 5 for details. Your full card details never touch our servers.

Cleaner and contractor interaction

• For a scheduled cleaning job assigned to you, we share your name, address, access notes and phone number with the cleaner only for that job
• For a partner-delivered service (skip hire, window cleaning, drain cleaning), we share your name, address and what you have booked with the contractor
• The cleaner or contractor may take before-and-after photos of the work area as a record of the service (see section 1.5 below)

Communication and calendar

• Every booking creates an email record on our systems: booking confirmation, payment receipt, reminder (sent 24 hours before), rescheduling notification, cancellation with refund amount, or payment failure notices (including a payment link)
• Notifications are logged by type, recipient, and delivery status; failed emails are retried
• Admin and owner calendars show: your surname, postcode district, service type, payment status, and job status

Audit and compliance

• Every change to your booking (reschedule, reassignment, cancellation, refund) is recorded in an audit log, showing who made the change and when
• Waste transfer receipts and contractor carrier licence numbers are retained to comply with duty of care under waste law

Our business operations

• For cleaners and contractors, we hold availability, working hours, time off, pay records and employment and engagement status
• Partner contractors' carrier licence numbers and expiry dates are retained to verify they are licensed waste carriers
• We record which customer last booked each cleaner (to improve auto-assignment on future bookings)

3. Why we collect and use your data

Our legal bases for processing your data are:

Contract performance

• Your name, address, phone and access notes: to deliver the service you booked and to contact you about it
• Payment details: to charge you for the service on Stripe's systems
• Booking history and cleaner assignment records: to fulfil your booking and manage recurring charges

Your consent

• Marketing emails and offers: only if you have ticked the opt-in box at booking
• Waiting-list registration: only if you chose that option outside the service area
• Cleaner and contractor photos (section 1.5): on the basis that you have engaged the service

Legitimate interest

• Postcode data and location of your booking: to check our service area and manage supply and demand
• Audit records: to detect and prevent fraud, to resolve disputes, and to maintain accurate records of what work has been done
• Cleaner assignment records: to balance load across available cleaners and prevent double-booking
• Payment failure records: to manage risk and prevent non-payment

Legal obligation

• Waste transfer receipts and contractor licence checks: required under Environmental Protection Act 1990 (Section 34) as part of our registered waste broker duty of care
• Financial and payment records: retained for 6 years to comply with UK tax law (Income Tax Act 2007 Section 12AA)
• Booking and payment records: retained for up to 6 years in case of disputes or complaints (Consumer Rights Act 2015)

4. How long we keep your data

• Booking and payment records: kept for 6 years after the last visit or payment, to comply with tax law
• Waste transfer receipts: kept for 3 years under waste regulation duty of care obligations
• Contractor carrier licence records: kept for the duration of the contract plus 1 year
• Email logs: kept for [period to be confirmed] unless needed for complaints or disputes
• Cleaner and contractor availability, hours and pay: kept for [period to be confirmed]; you can request deletion if your contract ends, subject to legal hold obligations
• Slot hold records (15-minute booking holds): deleted after 24 hours if not converted to a booking
• Audit events and session records: kept for [period to be confirmed], only as long as needed for the purpose
• Keys and access codes: deleted on your request or when your last booking ends; a record that a code was used is retained in audit logs

Where a period is marked [to be confirmed], AES will set a retention schedule and the solicitor will confirm the legal basis before go-live.

5. Who we share your data with

Payment provider: Stripe processes your card data under its own data processing agreement and privacy policy (stripe.com/gb/privacy). Stripe may transfer your card data to the United States and other countries for payment processing; this is necessary to process your payment. [Solicitor to confirm Stripe's current transfer adequacy; if material, add a clause confirming the transfer and your rights.]

Cleaner or contractor: for the job you have booked, we share only the name, address, access notes, phone number and service details they need to do the work. They can never access your other bookings, payment history or phone number unless you provide it to them directly.

Admin and owner: internal AES staff (owner and admin user accounts) can see your booking details on the master calendar to manage the schedule, answer queries and process refunds. Admin staff are under confidentiality obligations and trained in data protection.

Service area and postcode lookup: we send your postcode to postcodes.io (a free postcode validation service) only to check if you are in our service area. postcodes.io does not share your address beyond that lookup.

No sale of your data: we do not sell, trade or transfer your personal data to third parties for marketing or other purposes.

Law enforcement: we may disclose your data if required by law (for example, a court order or police investigation), and we will notify you if legal process allows us to do so.

6. International data transfers

AES Maintenance does not transfer your data outside the United Kingdom except as follows:

• Stripe: your card data is transferred to Stripe, which may process it in the United States under its data protection safeguards. This is necessary to process your payment. [Solicitor to confirm Stripe's current safeguards and certifications.]
• Postcodes.io: your postcode only is transmitted to postcodes.io (UK-hosted) to validate your service area.

All other personal data is held and processed in the UK. If Stripe's transfer terms or adequacy status changes, we will notify you.

7. Photos and documentation

Cleaners and contractors may take photographs of your property before and after their work as a record of the work completed and for use in complaints or insurance claims. These photos are:

• Stored securely on the cleaner or contractor's device or our systems [location to be confirmed at Phase 5 when photo storage is implemented]
• Not published or shared with anyone except you (if you request them), AES staff, and anyone involved in a complaint or claim
• Deleted [timeframe to be confirmed] after the job unless needed for a dispute

Note: photo storage and management in Stage 1 is limited. Before rollout, AES must confirm where photos are held, who can access them, and retention timescales.

8. Data protection measures

We protect your personal data using:

• Encrypted transmission (HTTPS) on our website
• Secure payment processing through Stripe (PCI DSS compliant)
• Restricted access controls: you can only see your own bookings; cleaners can only see their own jobs; admin staff have role-based permissions
• Encrypted storage of keys and access codes
• Regular backups stored securely away from the primary server
• Staff training in data protection and confidentiality

We are not responsible for the security of email in transit or data held by third parties (such as Stripe) beyond our contractual requirements.

9. Your rights and how to contact us

You can request access to, correction of, or deletion of your personal data, or exercise other rights, by contacting us:

• Email: [complaints email] (data subject requests)
• Phone: +44 7432 607493
• Post: Absolute Environmental Solutions LTD, Norton Canes, Cannock, Staffordshire

You can also contact:

• Information Commissioner's Office: ico.org.uk or 0303 123 1113

Your right to lodge a complaint with the ICO does not affect any other remedies you have under law.

10. Changes to this notice

We may update this privacy notice if our data processing changes, and we will notify you of material changes. This notice was last updated [date]. For the current version, please visit aes-maintenance.co.uk/privacy.