Privacy Policy

Last updated: 2 September 2026

Introduction and Scope

This Privacy Policy explains how ILHAMI LIMITED ("we", "us", "our"), a company registered in England and Wales operating from 87 Millmead Business Centre, Mill Mead Road, London, N17 9QU, United Kingdom, collects, uses, stores, shares, and protects personal data when you use our website at https://ilhami.agency, engage our personal care, professional laundry, lifestyle concierge, home organisation, pet care, wellness coordination, and specialised cleaning services, or otherwise interact with us.

We are committed to protecting your privacy and processing personal data in accordance with the UK General Data Protection Regulation (UK GDPR) as incorporated into UK law by the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and applicable guidance issued by the Information Commissioner's Office (ICO).

This policy applies to all personal data processed by ILHAMI LIMITED regardless of whether you are a prospective client, active client, former client, website visitor, job applicant, or business partner. It should be read alongside our Cookie Policy, Terms of Service, and Terms and Conditions.

Data Controller Information

The data controller responsible for your personal data is ILHAMI LIMITED, registered address 87 Millmead Business Centre, Mill Mead Road, London, N17 9QU, United Kingdom. For all data protection enquiries, please contact us at about@ilhami.agency or +44 7480 234567. We have not appointed a Data Protection Officer as our core activities do not require one under UK GDPR Article 37, but all data protection matters are handled by our designated privacy coordinator reachable at about@ilhami.agency.

Categories of Personal Data Collected

We collect and process the following categories of personal data depending on your relationship with ILHAMI LIMITED: Identity data including full name, title, and date of birth where relevant for age verification; Contact data including email address, telephone number, postal address, and property access details for service delivery; Financial data including payment card details processed by our payment provider, bank account details for invoicing, and transaction history; Service data including garment inventories, laundry preferences, concierge task details, home organisation notes, pet care schedules, wellness appointment information, and cleaning requirements.

Technical data collected through our website including IP address, browser type and version, time zone setting, browser plug-in types, operating system, device identifiers, and platform information; Usage data including pages visited, time spent on pages, navigation paths, and interaction with website features; Marketing and communications data including your preferences for receiving marketing and your communication history with us.

We do not routinely collect special category data as defined under UK GDPR Article 9. Where wellness coordination services involve health-related appointment scheduling, we process this data only with your explicit consent and solely for the purpose of delivering the requested coordination service.

Lawful Bases for Processing

Under UK GDPR Article 6, we process personal data on the following lawful bases: Contract performance (Article 6(1)(b)) — processing necessary for delivering services you have requested or entered into a contract for, including laundry collection, concierge dispatch, and personal assistance; Legitimate interests (Article 6(1)(f)) — processing necessary for our legitimate business interests including service improvement, fraud prevention, and internal administration, balanced against your rights and freedoms; Legal obligation (Article 6(1)(c)) — processing required to comply with UK law including tax reporting, health and safety requirements, and responding to lawful requests from authorities.

Consent (Article 6(1)(a)) — processing based on your freely given, specific, informed, and unambiguous consent, including marketing communications and non-essential cookies, which you may withdraw at any time without affecting the lawfulness of prior processing.

How We Use Your Personal Data

ILHAMI LIMITED uses personal data to deliver, manage, and improve our personal service offerings. Specific uses include: conducting initial drape read consultations and ongoing fit confirmation reviews; scheduling and executing laundry collection, processing, and delivery cycles; dispatching concierge tasks and personal assistance requests; coordinating home organisation, wellness, pet care, and cleaning services; processing payments and maintaining financial records; communicating service updates, appointment confirmations, and schedule changes.

We also use personal data for internal business purposes including staff training, quality assurance, service pattern optimisation, and compliance monitoring. Website usage data helps us improve site functionality and user experience. With consent, we use contact data for marketing communications about relevant services and company updates.

Data Sharing and Disclosure

We share personal data only where necessary and with appropriate safeguards. Recipients include: professional laundry and dry cleaning partner facilities that process garments under our direction and data processing agreements; payment processing providers handling transaction data on our behalf; cloud service providers hosting our client management and scheduling systems; insurance providers where claims require service documentation.

We may disclose personal data to law enforcement, regulatory authorities, courts, or legal advisers where required by law, court order, or to establish, exercise, or defend legal claims. We do not sell personal data to third parties. Any international transfers are conducted with appropriate safeguards as described in this policy.

Your Rights Under UK GDPR

You have the following rights regarding your personal data: Right of access (Article 15) — request a copy of personal data we hold about you; Right to rectification (Article 16) — request correction of inaccurate or incomplete data; Right to erasure (Article 17) — request deletion of your data where legally applicable; Right to restriction (Article 18) — request limitation of processing in specified circumstances; Right to data portability (Article 20) — receive your data in a structured, machine-readable format where processing is based on consent or contract.

Right to object (Article 21) — object to processing based on legitimate interests or for direct marketing purposes; Rights related to automated decision-making (Article 22) — not be subject to solely automated decisions with legal or significant effects. To exercise any right, contact us at the details provided in this policy.

Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our services, legal requirements, or data processing practices. Material changes will be communicated via our website at https://ilhami.agency and, where appropriate, by direct notification to active clients. The date of the most recent revision appears at the top of this document. Continued use of our services following notification of changes constitutes acceptance of the updated policy.

Data Retention Schedules

ILHAMI LIMITED maintains structured retention schedules aligned with UK GDPR Article 5(1)(e) storage limitation principles. Personal data collected for service delivery is retained only for the duration necessary to fulfil the contracted service pattern and any associated legal obligations. Client contact records are retained for six years following the end of the contractual relationship in accordance with standard UK limitation periods for contractual claims. Financial transaction records including invoices and payment confirmations are retained for seven years in compliance with HMRC record-keeping requirements under the Finance Act 1998 and subsequent amendments.

Garment care records including item descriptions, processing notes, and quality verification logs are retained for the duration of the active service relationship plus twelve months following termination, after which they are securely deleted unless a specific retention requirement applies due to ongoing claims or disputes. Concierge task logs containing details of errands, appointments, and personal assistance activities are retained for three years following task completion to support service quality reviews and dispute resolution.

Marketing consent records and communication preferences are retained for as long as consent remains active plus twelve months following withdrawal to demonstrate compliance with consent management obligations. Cookie consent logs are retained for thirteen months in alignment with ICO guidance on consent evidence retention for website analytics and functional cookies.

International Data Transfers

ILHAMI LIMITED primarily processes personal data within the United Kingdom and European Economic Area. Where data processing involves third-party service providers located outside the UK/EEA, we implement appropriate safeguards including Standard Contractual Clauses approved by the UK Information Commissioner's Office, adequacy decisions where applicable, and supplementary technical measures including encryption in transit and at rest.

Our professional laundry partners operating within Greater London process garment data locally. Cloud-based scheduling and client management systems may utilise servers located in the EEA with data processing agreements in place. We conduct transfer impact assessments where required by UK GDPR Article 46 and maintain records of all international data transfers as required by Article 30.

Children's Data

ILHAMI LIMITED personal services are directed at adults aged eighteen and over. We do not knowingly collect personal data from children under sixteen without verified parental or guardian consent. Where household services involve children's garments, school uniforms, or family scheduling, data relating to children is processed solely for the purpose of delivering the contracted service to the adult account holder and is handled with enhanced care in accordance with ICO guidance on children's data.

Automated Decision Making

ILHAMI LIMITED does not engage in solely automated decision-making including profiling that produces legal or similarly significant effects on data subjects. Service pattern recommendations following the initial drape read consultation involve human coordinator assessment. Scheduling algorithms used for collection route optimisation process logistical data only and do not evaluate personal characteristics of clients.

Supervisory Authority

You have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection matters. The ICO can be contacted at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, or via ico.org.uk. We encourage you to contact us first at about@ilhami.agency so we may address your concerns directly before you approach the supervisory authority.

Security Measures Detail

ILHAMI LIMITED implements a layered security architecture protecting personal data across collection, processing, storage, and disposal lifecycle stages. Access to client management systems requires multi-factor authentication for all personnel. Role-based access controls ensure staff members access only the data necessary for their assigned service functions. Garment tracking systems use encrypted barcode references rather than personal identifiers on physical labels.

Physical security at our Millmead Business Centre coordination hub includes access-controlled entry, CCTV monitoring of common areas in compliance with UK GDPR and Surveillance Camera Code of Practice, and secure storage for client documents requiring physical retention. Personnel accessing client homes for collection, delivery, or personal assistance services carry company identification and operate under strict access protocols defined in individual service agreements.

Incident response procedures require notification to the ICO within seventy-two hours of becoming aware of a personal data breach likely to result in a risk to individuals' rights and freedoms, in accordance with UK GDPR Article 33. Affected data subjects are notified without undue delay where the breach is likely to result in a high risk to their rights and freedoms under Article 34.

Third Party Processors

ILHAMI LIMITED engages carefully selected data processors to support service delivery. All processors operate under written data processing agreements compliant with UK GDPR Article 28 requirements, specifying processing purposes, duration, data categories, and security obligations. Our processor categories include professional laundry and dry cleaning partners, cloud hosting providers for client management systems, payment processing services, and communication platform providers.

We maintain a register of all sub-processors and notify clients of material changes to our processor arrangements where required by contract or applicable law. Each processor is assessed for GDPR compliance, security certifications, and data handling practices before engagement and reviewed annually thereafter.

Marketing Communications

With your explicit consent, ILHAMI LIMITED may send marketing communications about new service patterns, seasonal offers, and company updates via email. You may withdraw marketing consent at any time by contacting about@ilhami.agency or using the unsubscribe mechanism included in each marketing email. Withdrawal of marketing consent does not affect the lawfulness of processing based on consent before its withdrawal.

We do not sell personal data to third parties for marketing purposes. Service-related communications including appointment confirmations, collection notifications, and fit confirmation review invitations are sent on the basis of contractual necessity and do not require separate marketing consent.

Client Rights Exercise

To exercise any of your data protection rights including access, rectification, erasure, restriction, portability, or objection, please submit a written request to about@ilhami.agency or write to us at 87 Millmead Business Centre, Mill Mead Road, London, N17 9QU, United Kingdom. We respond to valid requests within one calendar month, extendable by two further months where requests are complex or numerous, with notification of any extension within the initial month.

We may request reasonable identity verification before processing rights requests to protect against unauthorised disclosure of personal data. There is no fee for exercising rights unless a request is manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable administrative fee or refuse the request with written explanation.

Website Analytics

Our website at https://ilhami.agency may use analytics tools to understand visitor behaviour and improve user experience. Analytics data is collected in anonymised or pseudonymised form where possible. IP addresses may be truncated before processing. Analytics cookies are deployed only with your consent via our cookie consent mechanism described in our Cookie Policy.

Data Retention Schedules (Part 2)

International Data Transfers (Part 2)

Children's Data (Part 2)

Automated Decision Making (Part 2)

Supervisory Authority (Part 2)

Security Measures Detail (Part 2)

Third Party Processors (Part 2)

Marketing Communications (Part 2)

Client Rights Exercise (Part 2)

Website Analytics (Part 2)

Data Retention Schedules (Part 3)

International Data Transfers (Part 3)

Children's Data (Part 3)

Automated Decision Making (Part 3)

Supervisory Authority (Part 3)

Security Measures Detail (Part 3)

Third Party Processors (Part 3)

Marketing Communications (Part 3)

Client Rights Exercise (Part 3)

Website Analytics (Part 3)

Personal Data Collected Through Service Delivery

When you engage ILHAMI LIMITED for professional laundry services, we collect garment descriptions, fabric types, care instructions, collection and delivery addresses, preferred scheduling windows, and any special handling notes you provide. This data is necessary to process your garments correctly and deliver them to the specified location. Garment data is linked to your Pattern Reference for tracking purposes throughout the processing cycle.

Concierge and personal assistance services require us to collect task descriptions, location details for errands, appointment preferences, vendor contact information, authorisation limits for purchases, and access instructions for your property. Task data is logged in our client management system with timestamps and completion confirmations to maintain service quality records.

Home organisation services involve collection of room layout information, inventory descriptions, storage preferences, and disposal authorisations. We may photograph organisation areas before and after service delivery with your consent for quality documentation purposes.

Pet care coordination requires pet species, breed, age, temperament description, veterinary contact details, dietary requirements, medication schedules, and grooming preferences. This information is shared with partner providers only to the extent necessary for service delivery.

Wellness coordination involves collection of appointment preferences, provider contact details, treatment schedules, and calendar availability. We do not collect or store clinical medical records, diagnoses, or treatment outcomes.

Legal Basis Detail for Each Processing Activity

Contact form submissions through https://ilhami.agency are processed on the basis of legitimate interest in responding to enquiries and, where you proceed to service engagement, on the basis of contractual necessity. Form data includes your name, email address, and message content.

Payment processing is conducted on the basis of contractual necessity. Card details are processed directly by our PCI-DSS compliant payment provider and are not stored on our systems. We retain transaction records including amount, date, and invoice reference for accounting and dispute resolution purposes.

Service quality monitoring and Fit Confirmation reviews are processed on the basis of legitimate interest in maintaining and improving service standards. Review data includes coordinator notes, client feedback, and service performance metrics.

Compliance record-keeping including health and safety incident reports, insurance claims documentation, and regulatory correspondence is processed on the basis of legal obligation.

Data Subject Access Request Procedure

Upon receiving a valid data subject access request at about@ilhami.agency, our privacy coordinator logs the request with a reference number and acknowledges receipt within five working days. We verify the requestor's identity using information already held before disclosing personal data.

The response includes: confirmation of whether we process the requestor's personal data; categories of personal data held; purposes of processing; recipients or categories of recipients; retention periods; information about the right to rectification, erasure, restriction, and objection; and the source of data if not collected directly from the data subject.

Where requests are complex or numerous, we may extend the response period by up to two additional months, notifying the requestor within the initial one-month period with reasons for the extension.

We provide data in a commonly used electronic format unless the requestor specifies otherwise. For service records spanning multiple Service Patterns, data is organised chronologically with Pattern Reference cross-references.

Breach Notification Procedure

ILHAMI LIMITED maintains an internal data breach register recording all personal data breaches regardless of severity. The register includes breach date, nature of breach, categories and approximate number of data subjects affected, likely consequences, and remedial measures taken.

Our Data Breach Response Team, led by the privacy coordinator, assesses each breach within twenty-four hours of discovery to determine whether notification to the ICO is required under UK GDPR Article 33 and whether affected data subjects must be notified under Article 34.

Where notification to data subjects is required, we provide clear information about the nature of the breach, contact details for further information, likely consequences, and measures taken to address the breach. Notification is made without undue delay.

Privacy Impact Assessments

ILHAMI LIMITED conducts Privacy Impact Assessments (PIAs) for new service patterns, technology implementations, and processing activities that may present high risk to data subjects' rights. PIAs are documented and reviewed annually or when processing activities change materially.

Recent PIA subjects include implementation of digital garment tracking, client portal development, and integration of concierge scheduling with third-party calendar platforms.

Data Protection Training

All ILHAMI LIMITED personnel receive data protection training upon commencement of employment and annually thereafter. Training covers UK GDPR principles, client confidentiality requirements, secure data handling procedures, breach reporting obligations, and specific requirements for handling personal data in client homes during service delivery.

Personnel with access to client management systems receive additional training on access control, password management, and secure device usage.

Records of Processing Activities

Under UK GDPR Article 30, ILHAMI LIMITED maintains records of processing activities documenting: controller name and contact details; purposes of processing; categories of data subjects and personal data; categories of recipients; international transfers and safeguards; retention schedules; and technical and organisational security measures.

These records are available to the ICO upon request and are reviewed quarterly for accuracy.

Joint Controller and Controller-Processor Relationships

ILHAMI LIMITED acts as data controller for all personal data processing described in this policy. Where we share data with laundry partners, concierge support providers, or cleaning contractors, those entities act as data processors operating under Article 28 data processing agreements.

We do not act as joint controller with any third party. Where clients introduce third parties (such as family members or employees) whose data we process, the client acts as the primary data source and confirms authority to share.

Specific Retention Periods by Data Category

Identity and contact data: duration of service relationship plus six years. Garment processing records: duration of relationship plus twelve months. Concierge task logs: three years from task completion. Financial records: seven years from transaction date. Marketing consent records: duration of consent plus twelve months. Website analytics: twenty-six months. Cookie consent logs: thirteen months. Job application data: six months if unsuccessful, duration of employment plus six years if successful. Complaint records: three years from resolution.

Contact for Data Protection Enquiries

For all data protection enquiries including rights requests, breach reports, and policy questions, contact our privacy coordinator at about@ilhami.agency or write to Data Protection, ILHAMI LIMITED, 87 Millmead Business Centre, Mill Mead Road, London, N17 9QU, United Kingdom. We aim to respond to all enquiries within five working days.