Privacy in cleaning services: what to demand in Portugal
Yes: in Portugal, any cleaning company that processes personal data must comply with GDPR and clearly explain what data it collects, why it retains it, and for how long. It must clearly indicate who is responsible for data processing, provide an accessible privacy policy, and ensure your rights to access, rectification, erasure, objection, and portability. If a company hesitates to answer this before handing you the keys to your home, you already have the answer you need.
In summary:
- Cleaning companies in Portugal must provide clear information about what data they collect, why, and for how long, in accordance with GDPR.
- The most common data includes name, phone number, address, tax information, and images, with requests for sensitive information without justification considered irregular.
- Data processing and storage must comply with security requirements, such as encryption, access control, and audit logs, as well as reinforce subcontracting responsibility.
- Before hiring, clients should request the privacy policy, confirm retention periods, and limit consents to what is essential for the service.
- Serious companies, like Cleaning Point, maintain fixed teams, security protocols, and access logs, promoting greater privacy and trust in service execution.
Index
- What data a cleaning company typically collects
- Legal framework in Portugal: GDPR and applicable legal bases
- How data is processed, stored, and shared
- Security measures you should demand and verify
- Subcontracting, physical access, and key management
- Practical checklist for clients before and after hiring
- How Cleaning Point applies these practices
- Privacy vs. convenience: a balance rarely discussed
- Schedule a cleaning with real privacy guarantees
- Sources
- Frequently asked questions
What data a cleaning company typically collects
A cleaning reservation generates more information than most people imagine. It’s not just about the name and phone number: there are access data to the house, tax data, and, in some cases, images of the space.
The most common data collected by a residential cleaning company in Portugal includes:
- Identification and contact: name, mobile phone, email, used to schedule and confirm visits.
- Address and access instructions: door code, key location, alarms, sensitive information that requires extra care.
- NIF and billing data: necessary to issue an invoice according to Portuguese tax law.
- Communication records: messages, special requests, complaints, which are kept for service history.
- Images or recordings: before/after photos of a deep cleaning, should only exist based on clear legal grounds and, ideally, with your explicit consent.
Each of these points serves a specific operational purpose. What is not normal is being asked for a copy of your entire citizen card or health data without any justification. If a reservation form asks for more than this, ask why before filling it out.
Legal framework in Portugal: GDPR and applicable legal bases
GDPR fully applies to cleaning companies established or operating in Portugal, regardless of their size. There is no "exemption for small businesses" when it comes to the fundamental principles of data protection.
A company can process your data based on four distinct legal grounds:
- Contract execution: data necessary to schedule and charge for the service (name, address, NIF) do not require separate consent, as they arise directly from the service contract.
- Legal obligation: tax data that the company is required to keep by the tax authority.
- Legitimate interest: for example, internal quality records, as long as they do not infringe on your rights.
- Consent: required for uses that go beyond what is necessary for the service, such as promotional photographs or direct marketing.
When consent is the basis used, it must be free, specific, and informed, never implied in a generic form. The EDPB guidelines on respecting the rights of data subjects are clear on this: transparency is not optional; it is a structural requirement of the privacy policy.
If you exercise any of your rights, the company must respond within the legal timeframe, which can be extended in complex cases, according to information from the CNPD on citizens' rights. If you do not receive a response within this timeframe, you can complain directly to the national authority.
How data is processed, stored, and shared
From the moment you fill out a form to the day the team enters your home, your data goes through several stages. It is worth knowing which ones, to ask the right questions.
- Initial collection: data typically enters through a reservation form or a call and is recorded in a customer management system (CRM).
- Storage: ideally on servers located in the European Union, with encrypted backups separate from the main system.
- Operational access: only the scheduling team and professionals assigned to the service should see the address and access instructions, never the entire organization.
- Sharing with third parties: if subcontracting occurs, there must be a contract that obliges the subcontractor to comply with the same data protection rules, with clear responsibility in case of non-compliance.
- Deletion: data that no longer serves a contractual or legal purpose must be deleted or anonymized, respecting previously defined retention periods.
You can and should ask the company for documentation about who processes your data, especially if subcontractors are involved. A serious company does not hesitate to show you this; one that makes it difficult to respond is giving you a signal worth paying attention to.
Security measures you should demand and verify
Written policies are the starting point, not the endpoint. Technical and organizational measures are what truly prevent your data (or your house keys) from falling into the wrong hands.
Ask for confirmation on these points before hiring:
- Access control: only authorized personnel should be able to see addresses and entry instructions, with individual and non-shared credentials.
- Encryption: sensitive data, such as access codes, should be encrypted both at rest and in transit.
- Backups: regular backups, stored separately from the main system, to avoid total loss in case of failure.
- Audit logs: a history of who accessed what information and when, useful in case of an incident.
- Training and confidentiality clauses: professionals entering your home should sign confidentiality agreements and undergo background checks.
In sectors with physical access to the home, the combination of contracts, personnel verification, and access logs is often the most effective defense against privacy breaches, according to the EDPB framework. A prepared company also has an incident response plan: it knows how to notify the CNPD within the legal timeframe and how to communicate with you, the client, if something goes wrong.
Professional tip: Request, in writing, the incident response procedure before signing any recurring contract. If the response is vague or non-existent, it is a sign that the privacy policy exists only on paper.
Subcontracting, physical access, and key management
The moment of greatest risk is not the online form; it is the physical entry into your home. This is where privacy in cleaning becomes tangible: someone with a key, a code, or direct access to your private spaces.
- Contractual clauses with subcontractors: any third party involved in the service must be bound by contract to clear limits on data use and sharing.
- Record of who accessed the location: the company must maintain a history of which professional was in your home and on what dates, with prior written authorization from you.
- Rules regarding images: if photos are taken for quality control, you should be able to refuse or request immediate deletion after the service.
Demanding this in writing is not excessive distrust. It is the reasonable minimum when it comes to someone having access to the intimacy of your home.
Practical checklist for clients before and after hiring
Before signing any cleaning contract, there are simple questions that separate an organized company from one that merely promises.
- Request the complete privacy policy and the direct contact of the person responsible for data processing or the data protection officer.
- Confirm retention periods: how long access and billing data are kept after the contract ends.
- Limit consents to the minimum necessary: authorize only what is essential for the service, refusing marketing or photographs without clear necessity.
- Do not leave sensitive documents visible on the day of cleaning, such as bank statements or identification of minors.
- Request written confirmation that the data has been deleted or anonymized when no longer needed.
Professional tip: Always keep the email or message in which you requested the privacy policy and the contact of the responsible person. If you need to complain later to the CNPD, that exchange of messages serves as proof that you tried to resolve the matter directly first.
How Cleaning Point applies these practices
The service is structured around fixed teams whenever possible, detailed checklists, and digital management of reports, which reduces the need to share access instructions with unverified personnel. Access control and careful selection of professionals are part of how each visit is organized, precisely so that the client does not have to repeat sensitive instructions to different people each time.
Anyone wanting to confirm how this works in practice can check the pages for professional home cleaning and residential care, where the usual operational processes are described. For direct questions about data processing, the company's contact is available to provide clarifications before any booking.
Privacy vs. convenience: a balance rarely discussed
Most clients choose a cleaning company for the speed of scheduling, not for the privacy policy. This is understandable but inverted: handing over a house key is a greater act of trust than signing most contracts we do without a second thought.
My practical recommendation is simple. Demand transparency before convenience. A company that responds well to questions about data and access tends to be more careful with the rest of the service.
— Taras
Schedule a cleaning with real privacy guarantees
This is an alternative to hiring cleaning through advertising platforms with random professionals: instead of a different stranger each visit, the approach combines selected and trained teams, transparent checklists, and access management designed to reduce who knows what about your home.
Before scheduling, you can request the service contract and directly confirm that access instructions will be stored and for how long. The services of regular cleaning, deep cleaning, and move-in/move-out cleaning follow the same principle of detailed checklists and consistent teams. If you want to proceed, the next step is simple: schedule a cleaning and request, in the form itself, confirmation of who will have access to your instructions.
Sources
Frequently asked questions
What is required to open a cleaning company in Portugal?
You need activity registration, tax identification number, and compliance with GDPR obligations from the first client. There is no exemption from data protection for being a small business.
What is the law that protects personal data in Portugal?
GDPR is the main legal basis, complemented by national oversight from CNPD. It guarantees rights to access, rectification, erasure, objection, and portability to any data subject.
What are the main types of residential cleaning?
The most common are regular maintenance, deep cleaning, post-construction cleaning, and move-in/move-out cleaning. Cleaning Point offers these four modalities, in addition to extras like upholstery and window cleaning.
How much does a cleaning company charge per hour in Portugal?
The price varies depending on the type of service and the size of the house, with no fixed amount applicable to all cases. Current prices from Cleaning Point are available directly on the service website.
How long does it take for a company to respond to a data request?
The usual timeframe is one month, extendable by two more for complex requests, according to CNPD rules. If you do not receive a response, you can complain directly to the national authority.
