Privacy notice
Last updated 14 October 2026.
Who we are
We're Handpicked Home Services Ltd, a domestic cleaning introduction agency for Winchester and Hampshire, registered in England and Wales (company number 17380383, registered office 33 Boston Road South, Holbeach, Spalding, Lincolnshire, PE12 7LR). We're the "controller" of the personal information described here, which means we decide how and why it's used, and we're responsible for looking after it.
Questions about this notice, or about your information, go to hello@handpickedhs.co.uk. We don't have a Data Protection Officer, and at our size the law doesn't require one - those questions come to the same address.
Who this notice covers
- Clients - the householders, and the named contacts at small business clients (a school or office), who use, or enquire about, our cleaning service.
- Cleaners - self-employed cleaners in our network, and people who apply to join it.
- Visitors and enquirers - anyone who uses our website or contacts us.
- People who recommended us - if a new client names you as the person who sent them, we hold your name. You did not give it to us, so there is a section below about exactly that.
What information do we hold, and why?
If you're a client
| What we hold | Why |
|---|---|
| Your name, email and phone number | To run your service and stay in touch. Your cleaner sees your name and phone number in their app, so they can call or message you about a visit |
| Your address and postcode | To match you with a local cleaner and arrange cleans |
| Notes about your home and preferences - the priorities and the notes for your cleaner on your page in the app | So your cleaner knows what matters to you. Shared with your cleaner, and deleted with your access details when your service ends |
| Access details - key arrangements, alarm codes, entry notes | So your cleaner can get in. Stored encrypted, visible only to your cleaner, and deleted when your service ends |
| What you tell us at your home visit | So your cleaner's brief gets the details right. With your OK at the door, we record the conversation, turn it into text on our own computer, and keep both in our Google Workspace with your record, under the windows below |
| Messages, photos and voice notes in your household's chat | So you, your cleaner and Handpicked can sort things out in one place. Stored encrypted, and seen only by the people in the chat: you, your cleaner (and a cover cleaner, for the days she covers), and Handpicked. Photos and voice notes never go into an email, a phone notification or an AI |
| A photo of your home, and of your vacuum and mop if you add one | So your page shows your home, and your cleaner knows the kit before she arrives |
| The phones you turn notifications on for | So a chat message reaches you straight away. We hold the address your phone's notification service gives us for the app, and nothing else about the phone |
| Payment details | Held by our payment providers (GoCardless for Direct Debit, Stripe for cards) - we never see or store your full bank or card numbers |
| Your clean history and our correspondence with you | To run the service, handle any complaint, and keep the records the law requires |
| How you heard about us, and who recommended us | Optional, and asked once on the booking form. It tells us what is working, and lets us thank the person who sent you |
Our lawful basis for almost all of this is our contract with you - we can't provide the service without it. Financial records are kept under legal obligation (tax law). We rely on legitimate interests for three purposes only: keeping introduction and placement records so we can apply the Direct Hire Fee terms, improving how the service runs, and thanking whoever recommended us to you. For each we've checked that our interest doesn't override your rights, and you can object at any time (see “What are your rights?”).
Do you have to give it to us? The details in the table above are what a cleaning service needs to run - your address, your access arrangements, a way to reach you. You don't have to give them, but without them we can't provide the service, and we'd have to say so rather than start. The two exceptions are the optional ones: how you heard about us, and who recommended us. Leave both blank and nothing changes about your booking.
If you're a cleaner (or applying to be one)
| What we hold | Why |
|---|---|
| Your name, email, phone and area | To run the network and introduce you to clients |
| Your availability, and what you can't work around (pets, smoking, stairs) | So we only offer you work you can take |
| Your photo | Shown to the households you clean for, so they know who's at the door |
| Your CV, if you choose to attach one | Background for the screening call. Optional - the application is complete without it |
| Identity and vetting records | Because we promise clients that every cleaner is identity-checked, DBS-checked, interviewed, reference-checked and insured |
| Your references | The referees you give us when you join - we take up your references before your first introduction. We also hold a little about your referees themselves (name, contact details, what they told us), used only to take up the reference |
| Your DBS status | We record the outcome we need, its date and the certificate number, not the certificate's contents, under the DBS code of practice - stored securely, seen only by the people who run vetting. If you send a photo of your certificate instead of the number, we delete it as soon as we've checked it. For placements in schools or other premises where children are present, the check is an enhanced DBS check, arranged and paid for by us - we still record only the outcome and its date |
| Your public liability insurance certificate | To verify it at joining and each renewal |
| Your bank details or payment link, if you add them | So the households you clean for can pay you direct. Stored encrypted, shown only to your households in their account, and never emailed |
| Your car's registration and make, if you add them | So we can pass them to a household that needs a parking permit for you |
| Your birthday (the day and month, never the year) | So we can wish you a happy birthday |
| Messages, photos and voice notes you send in a household's chat | Seen by that household, Handpicked, and a cleaner covering for you on her cover days. Stored encrypted |
| Your clean history and our correspondence | To run the service and, on your request, produce verified statements of your work and income |
Our lawful basis, purpose by purpose: introducing you to clients - including sharing your name and contact details with them - and running the service is our agreement with you. Holding your vetting records and verifying your insurance rests on legitimate interests: running a vetted network, and telling clients the truth about vetting - and you can object to anything resting on that basis (see “What are your rights?”). DBS information is criminal-records data, which UK law protects further - we process it only as the vetting the service is built on. We never share it beyond the vetting team, and never with clients. Clients are told that you're DBS checked, and nothing more.
If you apply to join the network and don't, we keep your application for 6 months and then delete it.
If someone named you as the person who recommended us
Our booking form asks new clients how they heard about us, and if the answer is a recommendation, who to thank. So we may hold your name without you having given it to us - we got it from the person you recommended, and from nowhere else. We hold it to thank you, and to work out any reward we owe you. It is a name and nothing more, only the people running the agency see it, and it is kept with the booking it arrived on, under the retention windows below. You can ask us what we hold, or tell us to delete it, at hello@handpickedhs.co.uk - and because we rely on legitimate interests here, you can object and we will stop.
If you enquire or just visit the website
We hold what you send us (your enquiry and contact details) so we can reply, under legitimate interests before you're a client and our contract once you are. Our website host keeps a short technical log of requests, including your IP address, to keep the site working and secure. The booking form and this app count visits without cookies. Our website uses Google Analytics, but only if you press Accept on its banner - see "What about cookies?" below.
Who do we share your information with?
Only who the service needs, and never by selling it:
- Between you and your cleaner. Clients: we share your details, home notes and (encrypted) access details with your cleaner - that's the introduction. Cleaners: we share your name and contact details with the clients we introduce you to.
- The software we run on. Our booking and scheduling software is built and operated for us by Makappen Ltd, which stores and processes data on our instructions using vetted providers: Supabase (database and storage, London), Vercel (hosting, London), Resend (email), Twilio (SMS, where used), Sentry (error monitoring, minimised so personal data stays out of error reports), postcodes.io (postcode lookup only), Ideal Postcodes (finding your address from your postcode), and the public register of Energy Performance Certificates, which we ask for a home's floor area so the booking form can suggest how long a clean takes - it receives the postcode and nothing else.
- Google. Our email, calendar and working documents run on Google Workspace, so Google processes what's in them on our behalf - a home visit in our calendar, for example, carries the address.
- Phone notifications. When you turn notifications on, your phone's own notification service delivers them: Apple, Google or Mozilla, depending on your phone and browser. A notification says who sent something, never the words, and it's encrypted on the way.
- An AI assistant. We use Claude, made by Anthropic, to help run the agency. On our instructions it reads and updates records - for example turning the notes from a home visit into the brief your cleaner reads, or proposing the details from a message you've sent us. A person at Handpicked checks what it writes before anything affects you, it never sees the photos or voice notes in your chat, and we've set it so Anthropic doesn't use our information to train its models.
- Our bank. Starling Bank holds our business account, and the app reads its statement each night so payments to us are matched to the right record.
- Messaging. If you message us on WhatsApp or through our Facebook page, Meta (Meta Platforms Ireland) carries the message, as it does for anyone using those services. So that your messages reach your record without us retyping them, our WhatsApp number is also connected to Meta's business messaging platform through Kapso, Inc., which passes each message, and our reply, to our software. What you send us that way - your words, and any photo or document - is then held on your record under the retention windows below, the same as an email would be.
- Payment providers. GoCardless (Direct Debit, UK/EU) and Stripe (cards, US/EU). They handle your payment details directly; we never hold full bank or card numbers.
- Professional advisers and, if it comes to it, debt recovery. Our accountant, solicitor or insurer where genuinely needed, and the courts service if we ever have to recover a debt (the client terms explain when that can happen).
Where is your information stored?
In the UK and EEA: the database and files live in London (Supabase), and hosting runs in London too (Vercel). Error reports go to Sentry in Frankfurt, which UK law treats as adequate. Where a provider is US-based or US-parented (Stripe, Resend, Twilio, Google, Apple, Anthropic, Kapso, and the platform providers' parents), each transfer has its own named safeguard: Stripe, Twilio, Resend, Google and Apple are certified under the UK-US Data Bridge (the UK extension to the EU-US Data Privacy Framework), and for any provider not certified under it (Anthropic, Kapso, or a platform-provider parent, for example) we rely on the UK Addendum to the EU Standard Contractual Clauses, signed with that provider. Meta processes our messaging through its Irish company under its own published safeguards. The mechanism for each provider is recorded in our records of processing.
How long do we keep it?
While you're a client or a cleaner with us, we keep what the service needs.
- Access details (keys, alarm codes, entry notes), and the priorities and notes written for your cleaner: deleted when your service ends.
- Chat messages, photos and voice notes: kept with your record, under the windows below.
- Financial and transaction records: 6 years, because tax law requires it.
- Your signed agreement and the record of how you signed it: 6 years from the day the agreement ends. That record is the wording you were shown, the order it was shown in, and the moment you agreed. Either of us can bring a claim on an agreement for 6 years, so we keep the proof of it for as long as that lasts. It survives the deletion of the rest of your records.
- After your service or network membership ends: we keep basic records for 2 years - long enough to handle any follow-up, complaint, insurance claim, or the Direct Hire Fee's 12-month restricted period - then delete them. Four things we keep longer: the financial records above (6 years), your signed agreement and its signing record (6 years from the day the agreement ends), our record of which cleaners we introduced to which clients (6 years from the last clean, in case of a legal claim), and DBS outcomes, which we delete 6 months after a cleaner leaves the network.
- Vetting and placement records: employment-agency law requires us to keep records of our checks and introductions for at least 1 year after we last provide you a service - covered by the windows above.
- Unsuccessful network applications: 6 months.
What are your rights?
UK data-protection law gives you the right to:
- see the information we hold about you (a "subject access request");
- correct anything that's wrong;
- delete information we no longer need to keep;
- object to processing based on legitimate interests, or ask us to restrict it while we check something;
- take your data with you (portability) where it's data you gave us under a contract; and
- withdraw consent at any time, where consent is the basis (it rarely is - almost everything here runs on contract or legal obligation).
No decisions by computer alone. Matching, vetting and every other decision that affects you is made by a person. We don't carry out solely automated decision-making or profiling.
Your right to object. Where we process your information under legitimate interests, you can object at any time - just email hello@handpickedhs.co.uk. We'll stop unless we can show compelling legitimate grounds that override your rights, and we'll always stop for direct marketing.
Email hello@handpickedhs.co.uk and we'll acknowledge it within 30 days and respond within a month. If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk - though we'd appreciate the chance to sort it first.
Do we send marketing?
Almost none. We may tell existing clients about our own service (for example a change to what we offer), and you can opt out any time with one click or one reply. We never share your details with anyone else for marketing, and we never buy marketing lists.
What about cookies?
This app and its booking form use only what's strictly necessary to work, and count visits without cookies, so there's nothing optional to consent to and no banner. Your own page uses one essential cookie to keep you signed in on the device you use, for a year from your last visit. Sign out from your profile, on that device or on every device at once. If you sign in with Face ID or a fingerprint, that stays on your phone: we hold a key that lets your phone prove it's you, which can't be turned back into your face or fingerprint. Our website, handpickedhomeservices.co.uk, is different: it uses Google Analytics, but only after you press Accept on its banner, and its cookie policy lists exactly what's set and how to change your mind.
Can this notice change?
Yes - when the service or the law changes. We'll post the new version at this address with its date, and if a change genuinely matters to you (a new purpose, a new kind of sharing), we'll tell clients and cleaners directly before it takes effect.