Privacy Policy

1. Introduction

Rena ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, mobile application, and services (collectively, the "Platform"). Please read this policy carefully. By using the Platform, you consent to the practices described in this Privacy Policy.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, phone number, and password when you create an account.
• Profile Information: Profile photo, bio, specialisations, and hourly rates (for cleaners).
• Address Information: Postal addresses for service delivery.
• Payment Information: Credit/debit card details processed securely through our payment provider (Stripe). We do not store full card numbers on our servers.
• Communications: Messages sent through the Platform, support requests, and feedback.
• Verification Documents: Identity documents, background check information, and insurance certificates (for cleaners).
• Right to Work Documents: Passport, Biometric Residence Permit, Home Office share code, visa, or EU settlement status documentation to verify legal eligibility to work in the UK (for cleaners).
• DBS Certificates: Disclosure and Barring Service certificates voluntarily provided by cleaners to enhance trust.

2.2 Information Collected Automatically

• Device Information: Browser type, operating system, device identifiers, and screen resolution.
• Usage Data: Pages viewed, features used, search queries, booking patterns, and time spent on the Platform.
• Location Data: Approximate location based on IP address or postcode for matching you with local cleaners.
• Cookies and Similar Technologies: We use cookies and similar tracking technologies to enhance your experience. See Section 7 for more details.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Platform
• Process bookings and facilitate payments
• Match customers with cleaners in their area
• Verify cleaner identities and conduct background checks
• Send booking confirmations, reminders, and updates
• Respond to support requests and resolve disputes
• Send marketing communications (with your consent, which you can withdraw at any time)
• Detect, prevent, and address fraud and security issues
• Comply with legal obligations
• Analyse usage patterns to improve our services

4. How We Share Your Information

We may share your information with:

• Cleaners/Customers: When you make a booking, we share relevant details (name, address, contact information) with the cleaner or customer as needed to fulfil the service.
• Payment Processors: We share payment details with Stripe to process transactions securely.
• Background Check Providers: Cleaner information is shared with our vetted background check partners.
• Service Providers: We may use third-party services for hosting, analytics, email delivery, and customer support.
• Legal Requirements: We may disclose information if required by law, regulation, or legal process.

We do not sell your personal information to third parties.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with services. Specific retention periods are as follows:

• Account data: Retained while your account is active and for 6 years after account closure (to comply with HMRC requirements and for legal claims).
• Booking and payment records: Retained for 6 years after the booking date for tax and legal compliance.
• Right to work documents: Retained for the duration of the cleaner's engagement plus 2 years after, in line with Home Office guidance.
• DBS certificates: Used only for verification purposes. The certificate itself is securely destroyed within 6 months of verification. We retain only the date of issue, certificate number, and verification outcome — not the certificate content.
• Identity documents (Photo ID): Retained for the duration of the cleaner's active account. Securely deleted within 30 days of account closure or upon a valid deletion request.
• Messages and communications: Retained for 2 years after the last message, then anonymised.
• Analytics data: IP addresses and user identifiers are anonymised after 2 years. Aggregated, non-identifiable analytics data may be retained indefinitely.
• Audit logs: Retained for 7 years for regulatory compliance and fraud prevention.

When information is no longer needed, we securely delete or anonymise it. You may request early deletion of your data at any time (see Section 6), though some data may need to be retained where we have a legal obligation to do so.

6. Your Rights

Under UK data protection law (UK GDPR), you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete personal data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Restriction: Request restriction of processing of your personal data.
• Portability: Request transfer of your data in a structured, commonly used format.
• Objection: Object to processing of your personal data for certain purposes.
• Withdraw Consent: Where processing is based on consent, withdraw your consent at any time.

To exercise any of these rights, please contact us at privacy@rena.com. We will respond within 30 days.

7. Cookies

We use cookies and similar technologies on the Platform. When you first visit, you will be shown a cookie consent banner where you can choose which types of cookies to accept.

7.1 Essential Cookies

These are necessary for the Platform to function and cannot be disabled. They include session cookies to keep you signed in and security cookies to prevent fraud.

7.2 Analytics Cookies

With your consent, we use analytics cookies to understand how you use the Platform, which pages you visit, and where you experience difficulties. This data helps us improve the booking experience. Analytics data is anonymised after 2 years.

7.3 Marketing Cookies

With your consent, we may use marketing cookies to show you relevant content and measure the effectiveness of our communications. You can withdraw consent at any time.

You can change your cookie preferences at any time by clicking "Cookie Settings" in the footer of any page, or through your browser settings. Disabling essential cookies may affect the functionality of the Platform.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal information, including encryption of data in transit (TLS/SSL), secure storage of credentials, regular security assessments, and access controls. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

9. International Transfers

Your data is primarily stored and processed in the United Kingdom. Where we use third-party services that process data outside the UK, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.

10. Children's Privacy

The Platform is not intended for children under 18. We do not knowingly collect personal information from children under 18. If you believe we have inadvertently collected information from a child, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Platform and updating the "Last updated" date. Your continued use of the Platform after changes constitutes acceptance of the updated policy.

12. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contract: Processing necessary to perform our contract with you (e.g. processing bookings, payments, managing your account).
• Legal obligation: Processing required to comply with the law (e.g. right to work checks, tax records, fraud prevention).
• Legitimate interests: Processing necessary for our legitimate interests where these are not overridden by your rights (e.g. platform security, service improvement, dispute resolution).
• Consent: Where you have given explicit consent (e.g. marketing emails, analytics cookies). You may withdraw consent at any time.

13. Data Protection Impact Assessments

We conduct Data Protection Impact Assessments (DPIAs) for processing activities that are likely to result in a high risk to individuals' rights and freedoms. This includes our handling of location data, home access information, identity documents, and right to work verification. DPIAs are reviewed annually and whenever we introduce significant changes to our data processing activities.