Privacy Policy

Last updated: 10 October 2026

1. Who we are

The Valleys Handyman is the trading name of Giuliano Pinocci, a sole trader based in Blaina, Blaenau Gwent, in the South Wales Valleys. We are the data controller for the personal information described in this policy.

We are a small business and do not have a Data Protection Officer. Please contact us using the details above with any questions about your information.

If there is a conflict between our Terms and Conditions and this Privacy Policy about how we handle your personal information, this Privacy Policy applies.

2. What information we collect and where it comes from

Information Where it comes from
Contact details — name, phone number, email address, postal address of the property Our website quote/contact form, phone calls, WhatsApp, texts, email, Google Business Profile messages, or in person
Job details — description of the work, the town/area, access arrangements, preferred dates, and anything you tell us about the property (e.g. pets, parking, known hazards) You (or your landlord/letting agent if they book on your behalf)
Photos and videos — of the work area that you send us, or that we take before, during and after the job You and us
Quotes, invoices and payment records — amounts, dates, how you paid, and bank transfer references Us and our bank/payment provider. We do not store full card details.
Payment details — when you pay online by card through our secure payment link, your card details are entered directly with the payment provider; we receive confirmation of payment but not your full card number The payment provider
Messages and call records — the content of WhatsApp/text/email conversations, and call logs You and us
Complaint and guarantee records You and us
Reviews — if you leave us a review on Google or elsewhere The review platform
Website data — IP address, browser and device information, other unique identifiers, pages visited, how you navigate the site, and cookie data Our website, run on Shopify (see section 9)

If you're a tenant, we may receive your name, phone number and address from your landlord or letting agent so we can arrange access.

We don't need, and ask you not to send us, special category information (such as health details). If you choose to tell us something like a health condition or disability so we can adapt how we work (for example, extra time or keeping noise down), we'll only use it for that purpose, with your explicit consent, and delete it when the job is finished.

3. Why we use your information and our lawful basis

Purpose Lawful basis (UK GDPR Art. 6)
Responding to enquiries and preparing quotes Steps at your request before entering into a contract
Booking, carrying out and following up the work; guarantee visits Performance of our contract with you
Invoicing, taking payment and keeping accounts Contract; and legal obligation (tax records for HMRC)
Chasing overdue payments, and bringing or defending legal claims Legitimate interests (getting paid and protecting our legal position)
Contacting a tenant to arrange access for a job booked by a landlord/agent Legitimate interests (carrying out the work requested)
Before/after photos kept for our own job records Legitimate interests (evidence of the condition of the work area and work done)
Using photos of your job on our website, social media, Google profile or adverts Consent — only if you agree, and you can withdraw at any time
Asking you for a review after the job Legitimate interests — you can tell us not to ask
Sending occasional reminders or offers (e.g. seasonal maintenance) Consent, or for past customers our legitimate interests under the "soft opt-in" rules — every message lets you opt out
Handling complaints Legitimate interests and legal obligation
Notifying our insurer of a potential claim Legitimate interests; legal claims
Keeping our website, accounts and payments secure and preventing fraud or misuse Legitimate interests
Website security, analytics and cookies Legitimate interests / consent (see section 9)

We do not sell your information, and we do not use automated decision-making or profiling.

4. Who we share your information with

Only where necessary:

  • Service providers who help us run the business: Shopify (website and contact forms), Google (Gmail email and Google Business Profile), WhatsApp / Meta (messaging), our bank, any card payment provider we use to take card payments, and our accountant or accounting software (if used).
  • Our insurer and professional advisers (e.g. accountant, solicitor), where needed.
  • Debt-collection agencies, solicitors and the courts, if an invoice remains unpaid (see our Payment & Late Payment Policy).
  • HMRC, the police or other authorities, where the law requires us to.
  • A helper or subcontractor working on your job (if one is ever used), only the information they need.
  • Your landlord or letting agent, if they booked the work, about the job and access arrangements.
  • If the business is sold, transferred or restructured, to the new owner, so they can continue to provide the service (they'll be bound by this policy or tell you of changes).
  • Shopify as an independent controller: our website runs on Shopify. Shopify may use information about your visit, together with information from other Shopify stores, for its own purposes such as security, fraud prevention and improving its services. Shopify is responsible for that use. See the Shopify Consumer Privacy Policy and Shopify Privacy Portal to learn more or exercise your rights over that data.

5. International transfers

Some of our service providers (for example Google, Meta/WhatsApp and Shopify) may store or access information outside the UK, including in the United States, Canada and the EEA. Where this happens, the transfer is protected by UK adequacy regulations (including the UK–US "data bridge" for certified US companies) or by the provider's approved contractual safeguards (such as the UK International Data Transfer Addendum).

6. How long we keep your information

Information How long
Enquiries and quotes that don't go ahead 12 months from the last contact, then deleted
Customer, job, invoice and payment records 6 years after the end of the tax year in which the job was completed (needed for HMRC and for any legal claim)
Before/after photos kept for our records 6 years after the job (in case of a guarantee or legal claim)
Photos used for marketing with your consent Until you withdraw consent (we'll remove them from our own channels within 30 days of you asking)
Complaint records 6 years after the complaint is closed
Marketing preferences / "do not contact" list As long as needed to respect your choice
WhatsApp and text messages Deleted or archived along with the job record above

7. Your rights

You have the right to:

  • access a copy of the information we hold about you;
  • ask us to correct inaccurate information;
  • ask us to delete your information (we may need to keep some, e.g. invoices for HMRC);
  • ask us to restrict how we use your information;
  • object to us using your information based on legitimate interests, and to stop all marketing at any time;
  • withdraw consent (for example for photos), without affecting anything done before; and
  • data portability — receive information you gave us in a usable format, where applicable.

Someone you authorise (for example a family member) can make a request for you; we'll ask for proof they're authorised and may need to confirm your identity.

We won't treat you any differently for using your rights.

To use any of these rights, contact us using the details in section 1. We'll respond within one month (this can be extended in limited cases, and we'll tell you if so). We may ask for proof of identity. There's usually no charge.

8. Complaints about how we use your information

Please contact us first and we'll try to put things right — we will acknowledge your complaint within 30 days and tell you the outcome without undue delay. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, 0303 123 1113. The ICO also has an office in Wales (Cardiff).

9. Our website and cookies

Our website is hosted by Shopify. When you visit it, Shopify sets strictly necessary cookies so the site works (for example security and remembering your cookie choice), and — only if you agree via the cookie banner — analytics and marketing cookies (for example Shopify's own analytics and any advertising or analytics tools we add).

You can change your choice at any time using the cookie banner or "Cookie preferences" link where shown, or by blocking or deleting cookies in your browser settings. Blocking strictly necessary cookies may stop parts of the site (such as the contact form) working. Shopify's own privacy policy explains how it handles data: https://www.shopify.com/legal/privacy. Our separate Cookie Policy gives more detail.

When you use our quote/contact form, the details you enter are sent to us by email through Shopify and stored in our email account.

10. Security

We keep your information secure using password-protected and two-factor-protected accounts and devices, and we only share it where necessary. If something goes wrong that puts your information at risk, we'll follow the legal rules on reporting it.

No method of sending information over the internet is completely secure, so please don't send bank details or other sensitive information by unencrypted email or text.

11. Links to other websites

Our site and messages may link to other websites or platforms (for example Google, Facebook or WhatsApp). We're not responsible for their privacy practices. Anything you post publicly (for example a review or a social media comment) can be seen by others.

12. Children

Our services are for adults. We don't knowingly collect information about children, except incidentally (for example a child's name mentioned in a message about access).

13. Changes

We'll update this policy when our practices change. The latest version is always on our website, with the date it was last updated, and, where the changes are significant, let you know as the law requires.