Privacy notice

Who we are and how to contact us

Pro Steam Machines is operated by Cleaning Equipment Services Ltd, company number 04784777, registered in England and Wales. Our registered office and contact address is Unit D, 16 Peter Road, Lancing, BN15 8TH. VAT number: GB780891982.

For orders, cancellations, complaints and privacy requests, email sales@cleanes.co.uk, telephone 01903 755128, or write to the contact address above. Please do not send card numbers or security codes.

Information we collect

Cleaning Equipment Services Ltd is the controller for personal information used to operate this store. You give us your name, email, telephone number, enquiry text and, when ordering, billing and delivery addresses. We record your products, configurations, hose and independent-extra choices, quantities, prices, VAT, delivery choice, payment status and order references.

If you sign in, Replit Auth supplies account identifiers and profile information, such as your name and email. Technical records support sign-in, secure checkout, fraud prevention and service operation; these can include request information and short-lived hashed abuse-prevention identifiers. Operational application logs are designed to exclude customer message bodies, addresses and payment details.

Stripe collects card and payment details directly in its payment interface. This website does not receive or store full card numbers or card security codes. Do not put sensitive information or card details in an enquiry.

Why we use information and our proposed lawful bases

Contract and steps requested before a contract: responding to purchase enquiries, taking and supplying orders, arranging delivery or collection, and dealing with cancellations, returns and warranty requests. For a business customer's staff contact, our proposed basis is legitimate interests in managing that business relationship.

Legal obligations: keeping necessary tax and accounting records and responding to legally required disclosures. Legitimate interests: securing the store, preventing misuse and fraud, resolving disputes, supporting customers and diagnosing service failures. We must assess those interests against your rights before launch.

Required order fields are needed to process and supply your order; without them we cannot provide online checkout. Optional enquiry information is voluntary. An enquiry is not consent to marketing. These drafts do not introduce marketing subscriptions, advertising tracking or consent to unrelated processing.

Who receives information

Authorised staff use information to deal with enquiries and orders. Replit provides application hosting, PostgreSQL database storage, authentication and application file storage. Stripe processes payments and receives information necessary to complete and verify them. Resend processes transactional email, including recipient details and message content, when approved sending is enabled.

Delivery providers receive the name, contact and delivery details needed for fulfilment. Professional advisers, tax authorities and other authorities may receive information where necessary for accounting, legal obligations or claims. The owner must confirm the delivery providers and any additional recipients before launch.

Provider privacy information is linked below. Providers may act as processors or independent controllers depending on the service. We do not claim that every provider uses information only on our instructions.

International processing and security

Providers may process information outside the UK. Before live sales, we must confirm the actual hosting locations, subprocessors and applicable UK transfer arrangements, including any adequacy decisions or contractual safeguards. These arrangements have not yet been verified; this draft is not a claim that information stays in the UK. Contact us for details once confirmed.

The application uses protected staff access, secure checkout cookies and HTTPS for payment-related communications. No system can guarantee absolute security. Access should be limited to people who need it, and exports must be handled securely.

Cookies and browser storage

Sign-in uses a session cookie (sid, up to seven days) and short-lived sign-in verification cookies. Guest checkout uses a protected cookie to authorise access to the current order (up to seven days). A separate protected psm-proforma cookie prepares browser access before an unpaid request and supports recovery if the submission response is lost (up to seven days). Stripe may use its own cookies or similar technologies for payments and fraud prevention.

Browser local storage remembers your basket (psm-cart) and comparison list (psm-compare) until cleared. Session storage may remember a random Proforma attempt identifier to avoid duplicate requests after a refresh. Browser storage is not used for checkout names, contact details, addresses, guest credentials or card details. You can clear it in your browser; doing so removes saved selections. Blocking essential cookies may prevent sign-in or checkout.

The store does not currently add advertising pixels or optional analytics in its application code. Any future non-essential storage must be assessed and appropriate choices provided before it is enabled. Provider/platform storage and cookies must also be checked on the final public domain before this notice is approved.

How long information is kept

Current application cleanup is configured to remove saved enquiries and associated notification records after 90 days, and personal details from failed or cancelled orders after 30 days from order creation. Unpaid Proforma requests follow the existing 90-day enquiry window: personal details and notification records are removed, while a non-personal order summary and duplicate-submission reference remain. They are not treated as paid financial records. Terminal sandbox-order personal details are scheduled for removal after seven days from creation. Cleanup depends on the worker running; records involved in active processing can require a later cleanup pass.

The owner-approved schedule is to keep necessary paid-order tax/accounting records for six years after the end of the relevant company financial year, longer only where a legal requirement or active claim requires it. Paid-order financial records are retained separately and are not automatically erased by the abandoned-order cleanup. Applying this approved schedule to paid orders, including legal holds and review at expiry, remains a launch requirement; automatic paid-order deletion is not yet implemented.

Before launch, the owner must confirm retention and deletion arrangements for account records, unresolved payments, logs, provider records, email copies, exports and backups. Deleting an application record does not instantly delete every provider copy or backup. We will retain only information needed for the relevant purpose and lawful obligations; this draft does not promise an unverified deletion deadline.

Your rights and complaints

Contact sales@cleanes.co.uk to ask for access, correction, erasure, restriction or, where applicable, portability of your information. We may need proportionate identity checks. Rights depend on the purpose and lawful basis; necessary financial records or active legal claims may limit erasure. We normally respond within one month, subject to lawful extensions.

Your right to object: you may object to processing based on legitimate interests on grounds relating to your circumstances. You can object to direct marketing at any time. If we rely on consent for any future optional processing, you may withdraw it at any time without affecting earlier lawful processing.

You can complain to us or directly to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to complain to us first.

Automated processing and updates

The machine finder suggests products from catalogue criteria; it does not make credit or legal eligibility decisions. Stripe may perform payment-security and fraud checks under its own arrangements. The owner must review any additional automated decision-making before launch.

This service is intended for people purchasing professional cleaning equipment, not for collecting children's information. We update this notice when our practices change and identify its version date. Material changes must be communicated appropriately; a website update alone does not authorise a new incompatible use of existing data.