Privacy Policy

A note on this policy: this has been written to reflect what Seawolf Facilities Services Ltd actually collects and does today, not a generic template. As with any legal document, we'd still recommend a solicitor gives it a final check before you rely on it in a dispute — particularly the retention periods and international transfer sections, which should be revisited whenever a new supplier or tool is added.

Seawolf Facilities Services Ltd (company no. 15028189, registered office 10a Dragoon House, Hussar Court, Westside View, Waterlooville, PO7 7SF) is the data controller for personal data collected through this website and in the course of providing cleaning services. This policy explains what we collect, why, and what rights you have. It applies to visitors to this website, people who enquire about our services, and our clients and their staff.

1. The personal data we collect

Enquiries. When you contact us by form, phone, email or WhatsApp: your name, company or property name, email address, phone number, site postcode, property details (such as its size, rooms and how often you'd like it cleaned), how you found us, and anything else you choose to tell us about the job. If you tell us who recommended us, we keep their name with your enquiry so we can thank them, and only mention your enquiry to them if you tick the box allowing it.

Site walkthroughs and quotes. Property address and access details, and any photos or notes taken during a walkthrough, used to prepare your written specification and price.

Clients. If you become a client: billing contact details, the written specification and contract, site access instructions, invoicing and payment records, and compliance paperwork (RAMS, COSHH, insurance certificates) relevant to your contract. If you use our client portal, we also hold your login details and, for quality assurance, records of when a visit to your site took place (date, time, and GPS-verified location of the cleaner), which are made available to you inside the portal.

Website visitors. If you accept analytics in the cookie banner, we record first-party analytics so we can understand whether the site is working, which pages lead to enquiries, and whether traffic is human or automated. This includes the pages you visit and when, how long each page was open (while a page is on screen it sends a short signal every 15 seconds, so we can see that someone is on the site right now), whether you tap our phone number, WhatsApp or email link (so a call or message counts as an enquiry), how quickly each page loaded and responded on your device, which step of our contact form or quote chat you reached (never what you typed unless you send it), the referring site and any campaign tags in the link, your browser, operating system, device type and language, a random visitor ID stored in your browser, your IP address and its network provider, and the approximate location our hosting provider derives from it (country, region, town and postcode area, which is often your internet provider's location rather than yours). We use it to see how visits develop over time, to link an enquiry to the pages viewed before it was sent, to see which visits look most interested in our services (for example a return visit that opens the contact page; this is a simple score that is never used to contact you or to make any decision about you), to see which organisation a visit comes from when the network belongs to a business, school or public body (from the network provider's name; we never try to identify a person this way), and to block IP addresses that send spam or attack the site. If you decline analytics, none of this is recorded about you; our hosting provider still counts page views in aggregate, without a visitor ID. We do not record what you type into forms unless you submit the form, and we do not use session replay, heatmaps, advertising pixels or cross-site tracking.

Form submissions. When you send our contact form or quote chat, we also record the IP address it came from, so we can stop repeated spam, and keep a copy of the enquiry in our website admin system alongside the email we receive. If our spam checks hold back a form you sent, we keep what you typed and the IP address in a review list for 30 days, so a genuine enquiry caught by mistake can still be found and answered.

Live chat. When someone from our team is available, the quote chat offers a live chat. If you start one, we keep the name you give, your messages and our replies, the page you started on, your IP address and approximate town, and (if you accepted analytics) your visitor ID, so we can reply and stop abuse. Your messages are sent as alerts to our own staff's phones. While a chat is going, the page tells us every few seconds (every 20 seconds when the chat box is closed) that it is still open, and tells us when you leave, so we can see whether you are still there to read a reply; this stops when the chat ends or you close the site.

AI chat assistant. The live chat may be answered by Kai, our AI assistant, until someone from our team joins, and the chat tells you when it is. To stop automated abuse, starting a chat runs the same Cloudflare Turnstile check as our forms, and a device that repeatedly misuses the assistant is not offered it again for a day. The assistant only answers questions about our services from the content of this website, and asks the questions we need for a quote (such as the type and size of your site, how often you'd like it cleaned, your name, business and how to contact you). Your messages and the earlier messages in that chat are sent to Google's Gemini service to write each reply; Google processes them on our behalf under its paid API terms and does not use them to train its models. What you tell the assistant is saved with the chat and, once you've given a way to contact you, sent to us as an enquiry in the same way as our quote form. The assistant can't give prices, make bookings or decide anything about you: a person at Seawolf reads every chat and does all of that. If you ask for a person, or the assistant can't help, it passes the chat to our team.

We do not collect payment card details directly on this website — any card payments are processed by a separate, dedicated payment provider that never shares full card numbers with us.

2. Why we use it, and our legal basis

Responding to enquiries and preparing quotes — necessary to take steps at your request before entering into a contract with you (UK GDPR Art. 6(1)(b)).

Delivering and managing a cleaning contract — performance of that contract (Art. 6(1)(b)).

Accounting, invoicing and tax records — a legal obligation we're subject to (Art. 6(1)(c)).

Running and improving the business (for example, understanding which services and areas are most requested, or keeping records of past enquiries) — our legitimate interests, balanced against your rights (Art. 6(1)(f)).

Measuring website performance, spotting likely bots, and understanding which pages lead to genuine enquiries — our legitimate interests in operating and improving the website, balanced against your rights (Art. 6(1)(f)). The analytics storage on your device only happens with your consent, given in the cookie banner.

Recording IP addresses to block spam and attacks on our forms and website — our legitimate interest in keeping the site secure and our inbox usable (Art. 6(1)(f)).

Answering live chat messages with an AI assistant, and passing on what you tell it as an enquiry — steps taken at your request before a contract (Art. 6(1)(b)) and our legitimate interest in replying to people quickly (Art. 6(1)(f)).

Marketing emails, where you've opted in — your consent (Art. 6(1)(a)), which you can withdraw at any time by using the unsubscribe link or emailing us.

3. Who we share it with

We do not sell personal data. We share it only where necessary, with:

• staff and vetted subcontractors directly involved in delivering your contract;
• the software providers we use to run the business — our client and scheduling management platform (which powers the client portal), accounting/bookkeeping software, and email provider — each under a contract that requires them to protect your data and use it only for the service they provide us;
• our website hosting provider, Cloudflare, which hosts the site, provides security/bot signals (including Cloudflare Turnstile, the automated bot check on our enquiry forms, which sees your IP address and browser details when a form loads), and processes first-party analytics events for us;
• Google (Gemini API), which writes the AI chat assistant's replies from your chat messages and our website content, and does not use them to train its models;
• OpenStreetMap, which serves the map tiles on our homepage and will see the IP address of your device when that map loads;
• Google (Firebase Cloud Messaging), which delivers alerts to our own staff's phones when an enquiry arrives (with the sender's name, the service asked about and the postcode), when a live chat message arrives (with your name, town and the start of your message) or when someone visits the site (with the town and page);
• professional advisers such as our accountant, solicitor or insurer, where reasonably necessary; and
• a regulator, HMRC, or a court, where we're legally required to.

Some of these providers may process data on servers outside the UK and European Economic Area (for example, on US-based cloud infrastructure). Where that happens, we rely on legally recognised safeguards — such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses — to make sure your data stays protected to UK GDPR standards wherever it's processed.

4. How long we keep it

• Enquiry data that doesn't turn into a contract: up to 24 months, then deleted.
• Client contract, invoicing and payment records: 6 years from the end of the relevant financial year, as required by UK tax law.
• Compliance and visit records (RAMS, COSHH, DBS confirmations, GPS visit logs): for the duration of your contract, plus 6 years afterwards.
• First-party website analytics, including IP addresses and visit history: 30 days after your last visit, then automatically deleted.
• A recent copy of that analytics on our own admin phone, so it can be read without signal: encrypted on the phone, replaced each time the app is used, deleted after 3 days or on sign-out.
• The copy of an enquiry kept in our website admin system, with the IP address it was sent from: 90 days, then automatically deleted (the enquiry itself is kept as above).
• Sign-in attempts to our website's admin area, with the IP address and approximate location each came from: 90 days, then automatically deleted. We keep these to protect the account from password guessing.
• Live chat conversations, with the IP address and town: 30 days after the last message, then automatically deleted.
• Form sends held back by our spam checks: 30 days, then automatically deleted.
• IP addresses we have blocked for spam or abuse: until we unblock them.
• Your cookie preference: up to 12 months, after which we'll ask again.

These are our default retention periods; we may keep data for longer where we reasonably believe the law requires it, or delete it sooner on request where we're not required to keep it.

5. Your rights

Under UK GDPR you have the right to: access a copy of your personal data; have inaccurate data corrected; request erasure; restrict or object to certain processing; receive your data in a portable format; and withdraw consent at any time where we rely on it. We don't use your data to make decisions about you by automated means alone. To exercise any of these rights, email [email protected] — we'll respond within one month.

If you're unhappy with how we've handled your data, we'd appreciate the chance to put it right directly — but you also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

6. Cookies and similar technology

This site uses browser storage to remember your cookie preference and, if you accept analytics, to keep a random visitor ID for first-party analytics. We use that analytics to count visits and repeat visits, understand location and device patterns, see which pages lead to enquiries, and separate likely bots from genuine visitors. We do not use advertising cookies, marketing pixels, cross-site tracking, session replay or heatmaps. Full details, and a way to change your preference at any time, are in our Cookie Policy and via the "Cookie settings" link in the footer.

7. Children

Our services and this website are directed at businesses and adults, not children. We don't knowingly collect personal data from children.

8. Security

We use appropriate technical and organisational measures to protect your data, including encrypted transmission (HTTPS) for this website and access limits so only staff who need your data to do their job can see it.

9. Changes to this policy

We may update this policy from time to time. We'll update the "last updated" date above, and for material changes affecting existing clients, we'll take reasonable steps to let you know directly.

10. Contact

Questions about this policy, or to exercise your rights: [email protected] or 023 9355 3254.