Privacy Policy - Gardeners Upton Park

Gardeners Upton Park is committed to protecting the privacy and personal data of every customer. This Privacy Policy explains how personal information is collected, used, shared, stored, and protected when services are provided to customers in the Upton Park area. It applies to all Gardeners Upton Park customers in the area, including prospective, current, and former customers whose data is processed in connection with our gardening services.

This policy is designed to meet the requirements of the UK GDPR and the Data Protection Act 2018. It sets out what data is collected, the lawful bases we rely on, how long data is retained, the types of processors we may use, and the rights available to individuals. We aim to handle all personal data fairly, lawfully, transparently, and securely.

1. Data We Collect

We collect only the personal data necessary to manage enquiries, provide gardening services, maintain customer records, and meet legal obligations. The categories of data we may collect include:

Identity information such as your name and title.
Contact details including address, telephone number, and email address.
Service information such as requested gardening work, preferences, appointment details, and service history.
Payment-related information such as billing records and transaction references. Payment card details are not stored unless explicitly stated at the point of collection through a secure payment provider.
Communication records including correspondence, notes from calls, emails, messages, and customer instructions.
Property and access information where needed to deliver services safely and efficiently, for example gate codes, access notes, or garden layout details.
Technical data if you interact with digital systems used for administration, such as basic usage logs or device information.

We do not intentionally collect special category data unless it is required by law or you choose to provide it in a context where it is necessary for service delivery and appropriate safeguards are in place. Special category data may include information about health, religious beliefs, or other sensitive personal data. If such data is received accidentally, we will handle it in accordance with applicable data protection rules and limit access strictly.

2. How We Use Personal Data

Personal data is used for legitimate operational purposes connected with our gardening services. These purposes may include:

responding to enquiries and providing quotations;
managing customer accounts and service bookings;
delivering gardening, maintenance, and related services;
processing payments and issuing invoices or receipts;
keeping records of work completed and customer preferences;
handling complaints, feedback, or service follow-up;
meeting legal, tax, accounting, and insurance obligations;
protecting the security of staff, customers, and property;
improving service quality and administrative efficiency.

We only use personal data for purposes that are compatible with the reason it was collected. If we need to use data for a new purpose, we will assess whether that purpose is lawful and whether additional notice or consent is required.

3. Lawful Basis for Processing

Under data protection law, every processing activity must have a lawful basis. Gardeners Upton Park relies on the following lawful bases where appropriate:

Contract

We process personal data when it is necessary to enter into or perform a contract with you. This includes providing quotes, arranging visits, carrying out the requested gardening work, and managing payment or service-related communications.

Legal Obligation

We may process data to comply with legal obligations, including tax, accounting, record-keeping, insurance, health and safety, and responding to lawful requests from authorities.

Legitimate Interests

We may process data where it is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. Examples include maintaining service records, improving customer service, securing our systems, and preventing fraud or misuse.

Consent

Where consent is required by law, we will ask for it clearly and separately. You can withdraw consent at any time, but this will not affect processing already carried out before withdrawal.

Vital Interests

In rare situations, we may process personal data to protect someone’s vital interests, such as in an emergency affecting health or safety.

4. Data Sharing and Processors

We may share personal data with trusted third parties who act as processors on our behalf. These processors only process data according to our instructions and are required to keep it secure and confidential. Typical processors may include:

IT and cloud service providers that host emails, files, or business systems.
Payment service providers that handle secure financial transactions.
Accounting and bookkeeping providers that support invoicing, tax, and financial administration.
Customer relationship and scheduling tools used to manage appointments and records.
Professional advisers such as accountants, insurers, or legal advisers where necessary.

We may also share personal data with controllers where required by law, such as government bodies, regulators, courts, or law enforcement agencies. Any sharing is limited to what is necessary and proportionate.

We do not sell personal data. We also do not share information for unrelated marketing purposes without a valid lawful basis.

5. Data Retention

We keep personal data only for as long as necessary for the purpose for which it was collected, and in line with legal, tax, accounting, and operational requirements. Retention periods may depend on the type of information and why it is held.

Customer enquiries may be kept for a limited period to manage follow-up and service continuity.
Service and contract records are generally retained for the duration of the relationship and for a reasonable period afterwards.
Financial records are retained for the period required by tax and accounting law.
Correspondence and complaints may be retained for as long as necessary to resolve issues and demonstrate proper handling.

When personal data is no longer required, it is securely deleted, anonymised, or destroyed. If data is retained for statistical or record-keeping purposes, we will ensure that it is reduced to the minimum necessary and protected appropriately.

6. Security of Personal Data

We take reasonable technical and organisational measures to protect personal data from loss, misuse, unauthorised access, alteration, or disclosure. These measures may include access controls, secure storage, encryption where appropriate, staff confidentiality obligations, and regular review of data-handling practices.

Although no system can be guaranteed to be completely secure, we continually aim to maintain a strong standard of protection. If a personal data breach occurs and it is likely to result in a risk to your rights and freedoms, we will act in accordance with applicable law.

7. User Rights

Individuals whose personal data we process have important rights under GDPR. Depending on the circumstances, these rights may include:

Right of access – to request a copy of the personal data we hold about you.
Right to rectification – to ask us to correct inaccurate or incomplete data.
Right to erasure – to request deletion of your data in certain situations.
Right to restriction – to ask us to limit how data is used in certain cases.
Right to object – to object to processing based on legitimate interests or direct marketing.
Right to data portability – to receive certain data in a structured, commonly used format.
Right to withdraw consent – where processing is based on consent.

You may also have the right to challenge automated decision-making if it applies, although we do not typically rely on solely automated decisions that produce legal or similarly significant effects.

If you wish to exercise a right, we may need to verify your identity before responding. Requests will be handled within the time limits set by law, and any refusal or limitation will be explained where permitted.

8. Children’s Data

Our services are aimed at adult customers and property owners or occupiers. We do not knowingly collect personal data from children except where it is incidental to service delivery and lawful to do so. If we learn that we have collected data from a child inappropriately, we will take steps to delete or secure it as required.

9. International Transfers

If any processor stores or accesses data outside the UK, we will ensure that appropriate safeguards are in place, such as adequacy regulations, standard contractual clauses, or equivalent protective measures. These safeguards are intended to keep personal data protected to the required legal standard.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data-handling practices. The latest version will apply from the date it is published or otherwise communicated. We encourage customers to review the policy periodically so they remain informed about how their data is handled.

11. Summary of Our Commitment

Gardeners Upton Park treats privacy as an essential part of customer service. We collect only necessary data, use it for clear and lawful purposes, store it securely, retain it only as long as needed, and respect the rights of every individual whose information we process. This policy applies to all Gardeners Upton Park customers in area and is designed to provide transparency, accountability, and trust.

By using our services, you acknowledge that your personal data may be processed in line with this Privacy Policy and applicable data protection law.