Cardiff Contract Cleaning Ltd, Unit 4, Ocean Park, Cardiff Bay CF24 5HF, is the data controller. Our data protection policy is in the tender pack. Last reviewed October 2026.

What we collect

When you use the site-survey form we collect your name and organisation, phone number, email address and the site postcode, the kind of site, roughly where it is, and anything you write in the message box. The form also records the time it was sent and your IP address, used only to block automated submissions.

When we clean for you we keep a client and site record: your contact details and those of your facilities lead, the specification, the alarm and key-holding procedure, the induction record for each operative on your site, the app timesheets showing who signed in and when, the monthly audit reports with their photographs, and the invoices. Keys are held in a coded safe labelled with a site number, never an address. Audit photographs are of areas and surfaces; we do not photograph your staff, your screens or your documents.

Why we use it

To reply to your enquiry, carry out the survey and run the contract (the steps needed before and under a contract).
To clean your site safely to the specification, which includes inducting operatives, holding keys and responding out of hours (contract and legitimate interest).
To invoice you and keep accounting and employment records (contract and legal obligation).
To send the monthly audit report and timesheets to the people you name (contract).

How long we keep it

Enquiries that do not become contracts are deleted after twelve months. Site records, specifications, timesheets and audit reports are kept for the life of the contract and three years after it ends; invoices for seven years. Keys are returned within two working days of a contract ending and the register entry deleted. Alarm codes are deleted when the contract ends.

Who sees it

The operatives and supervisor on your site, the office, our accountant, our insurer if a claim is made, and our accreditation auditors, who see redacted samples. The form is delivered by email to the office; we do not use third-party form services or marketing platforms. We do not share client details between clients, publish audit scores with a site identified, or sell data for marketing.

Cookies

This site sets a single session cookie to limit repeat form submissions. It contains no personal data and expires when you close the browser. The embedded map on the booking and areas pages is served by Google and may set cookies under Google's own policy. The estimate builder runs in your browser and sends nothing to us.

Your rights

You can ask for a copy of what we hold, ask us to correct or delete it, or object to how we use it. Email hello@cardiffcontractcleaning.co.uk or write to the address above. You can also complain to the Information Commissioner's Office at ico.org.uk.