Privacy Policy - Gardeners Crofton Park

This Privacy Policy explains how Gardeners Crofton Park collects, uses, stores, and protects personal data belonging to its customers and service users. It applies to all Gardeners Crofton Park customers in the area, including individuals who request quotations, book garden services, receive ongoing maintenance, or otherwise interact with our business in connection with gardening work.

We are committed to handling personal information in a lawful, fair, and transparent way in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We only collect data that is necessary for the operation of our services, and we take appropriate steps to keep that data secure. This policy is intended to inform you about what we collect, why we collect it, how long we keep it, who may process it on our behalf, and the rights available to you as a data subject.

1. Data We Collect

We may collect and process different categories of personal data depending on how you engage with Gardeners Crofton Park. The types of data may include:

Identity details such as your name, title, and any relevant household or business name.
Contact details such as your address, email address, and telephone number.
Service information such as the type of gardening work requested, preferred dates, access notes, and instructions relating to your property or outdoor space.
Communication records such as enquiries, service messages, complaint details, feedback, and correspondence relating to bookings or ongoing work.
Billing and payment information such as invoice details, payment status, and transaction references where relevant.
Technical and usage data where applicable, such as basic website or device information collected through security logs or analytics tools.

We do not intentionally collect special category data unless it is necessary and lawful to do so. If such information is ever required, we will process it only where a valid legal condition applies and where appropriate safeguards are in place.

2. How We Use Your Data

We process personal data for specific and legitimate purposes connected to our services. These purposes may include:

responding to enquiries and providing quotations;
arranging, delivering, and managing gardening services;
keeping records of work completed and customer preferences;
issuing invoices, managing payments, and handling account administration;
communicating service updates, schedule changes, or important notices;
resolving complaints, disputes, or service issues;
maintaining security, preventing fraud, and ensuring safe operations;
meeting legal, tax, accounting, or regulatory obligations.

We only use personal information for the purpose for which it was collected, unless we reasonably believe we need to use it for a compatible purpose or another lawful purpose allowed by data protection law.

3. Lawful Basis for Processing

Under data protection law, we must have a lawful basis for each use of personal data. Gardeners Crofton Park relies on the following lawful bases where appropriate:

Contract

Contractual necessity applies when we process your data to provide a quote, arrange services, carry out gardening work, manage bookings, or fulfil our obligations under an agreement with you.

Legitimate Interests

We may process data where it is necessary for our legitimate interests and where those interests are not overridden by your rights and freedoms. Examples include managing business records, improving service quality, preventing misuse, and maintaining effective customer communication.

Legal Obligation

Some processing is necessary to comply with legal duties, including tax, accounting, insurance, record-keeping, and any lawful requests from public authorities.

Consent

In limited cases, we may rely on your consent, particularly where it is required by law or where we wish to use your information for a specific optional purpose. If we rely on consent, you may withdraw it at any time.

4. Data Sharing and Processors

We may share personal data only when necessary and only with parties that help us operate our services or comply with legal duties. Any third party acting on our behalf must process data securely and only under our instructions. These may include:

IT and cloud service providers that store or support business systems;
payment processors that handle card or electronic payments;
accounting or bookkeeping providers that assist with financial records;
communication service providers that support email, messaging, or scheduling;
professional advisers such as insurers, auditors, or legal advisers where needed;
public authorities where disclosure is required by law.

These organisations act as data processors or independent controllers depending on the circumstances. We take steps to ensure that any processor we use offers appropriate technical and organisational safeguards for personal data. We do not sell personal data.

5. Retention of Personal Data

We keep personal data only for as long as it is necessary for the purposes for which it was collected. The exact retention period depends on the type of information and the reason it is held. In general:

enquiry records may be kept for a limited period after the enquiry ends;
customer and service records may be kept for the duration of the working relationship and for a reasonable period afterward;
invoice, payment, and accounting records are usually retained for the period required by law;
complaint or dispute records may be retained for as long as necessary to resolve the issue and defend legal claims.

When data is no longer needed, we will delete it securely or anonymise it so that it can no longer identify you. Retention periods may vary depending on legal requirements, operational needs, and the nature of the data involved.

6. Data Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or disclosure. These measures may include access controls, secure storage, restricted permissions, staff awareness, and careful selection of service providers. While no system can be guaranteed completely secure, we work to reduce risk and to handle data responsibly.

7. Your Rights

As a data subject, you have a number of rights under the UK GDPR. Subject to legal limitations, these rights may include:

Right of access – to request a copy of the personal data we hold about you.
Right to rectification – to ask us to correct inaccurate or incomplete data.
Right to erasure – to request deletion of data in certain circumstances.
Right to restriction – to ask us to limit how we use your data in some situations.
Right to object – to object to processing based on legitimate interests or direct marketing.
Right to data portability – to receive certain data in a structured, commonly used format where applicable.
Right to withdraw consent – where processing is based on consent, you may withdraw it at any time.

You also have the right to raise concerns with the relevant data protection authority if you believe your data has been handled unlawfully. We encourage you to contact us first so that we can try to address your concerns promptly and fairly.

8. Changes to This Policy

We may update this Privacy Policy from time to time to reflect legal, operational, or service changes. Any revised version will apply from the date it is published or otherwise made available. We recommend reviewing this policy periodically to stay informed about how your information is handled.

Gardeners Crofton Park is committed to responsible data protection and to treating customer information with care, respect, and transparency. By using our services, you acknowledge that this policy explains the way we handle personal data for all customers in the area.