Privacy Policy - Gardeners West Heath

Gardeners West Heath is committed to protecting the privacy and personal data of all customers in the West Heath area. This Privacy Policy explains how personal data is collected, used, stored, shared, and protected when our services are requested, delivered, or managed. It applies to all Gardeners West Heath customers in the area, including prospective customers, current customers, and former customers whose data we retain for lawful business reasons.

This policy is written in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It sets out what we collect, why we collect it, the legal grounds for processing, how long we keep it, who may process it on our behalf, and the rights available to individuals whose data we hold.

1. Who We Are

Gardeners West Heath provides gardening and related outdoor maintenance services to homes and businesses in West Heath and surrounding local areas. In the context of data protection law, Gardeners West Heath is the data controller for personal data collected in connection with enquiries, bookings, service delivery, administration, invoicing, and customer support.

As data controller, we determine the purposes and means of processing personal data. We take reasonable and appropriate steps to ensure that personal information is handled lawfully, fairly, and transparently.

2. Personal Data We Collect

We only collect personal data that is necessary for providing our services, managing customer relationships, and meeting legal or contractual obligations. The categories of data we may collect include:

Identity information such as name, title, and, where relevant, business name.
Contact information such as address, email address, and telephone number.
Service information including property details, garden requirements, appointment preferences, and instructions relevant to the work.
Financial information such as invoice details, payment status, and transaction records.
Communication records including emails, notes from phone calls, messages, and correspondence about quotes, bookings, complaints, or service updates.
Technical information where relevant, such as basic usage data from our communication systems or online enquiry forms.
Special category data is not normally sought. If it is ever provided incidentally, we will only process it where a lawful basis and additional condition under data protection law applies.

We do not intentionally collect more information than is needed. We also avoid using personal data for unrelated purposes unless we have a lawful reason to do so.

3. How We Collect Personal Data

Personal data may be collected directly from you when you:

make an enquiry;
request a quote or consultation;
book or receive a service;
communicate with us by phone, email, or message;
provide feedback or make a complaint;
submit payment information or billing details;
interact with us in connection with an ongoing customer relationship.

In some cases, information may also be received from third parties acting on your behalf, such as property managers, tenants, landlords, or representatives who arrange services for you. Where appropriate, we may also receive data from payment providers, accounting systems, or service partners involved in fulfilling our work.

4. Lawful Basis for Processing

We process personal data only when we have a valid lawful basis under the UK GDPR. Depending on the context, the lawful bases we rely on are:

Contract

We process data when it is necessary to take steps at your request before entering into a contract, or to perform a contract with you. This includes managing bookings, delivering gardening services, handling invoices, and communicating about the work.

Legal Obligation

We may process and retain data where necessary to comply with legal and regulatory obligations, including tax, accounting, and record-keeping requirements.

Legitimate Interests

We may process data where it is necessary for our legitimate business interests and where those interests are not overridden by your rights and freedoms. This may include maintaining service records, improving service quality, preventing fraud, managing customer communications, and keeping appropriate business records.

Consent

Where required by law, we will ask for your consent before processing your data. If consent is used, you may withdraw it at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.

Important: We do not rely on consent where another lawful basis is more appropriate, such as contract or legal obligation.

5. How We Use Personal Data

Gardeners West Heath uses personal data for the following purposes:

to respond to enquiries and provide quotes;
to arrange, deliver, and manage services;
to keep records of customer requests and instructions;
to issue invoices and process payments;
to maintain accurate customer and service history;
to handle complaints, queries, and after-service support;
to improve our services and internal processes;
to comply with applicable legal and tax obligations;
to protect against misuse, fraud, or unlawful activity.

We will only use your personal data for the purposes for which it was collected, unless we reasonably determine that another compatible purpose is permitted by law.

6. Data Retention

We keep personal data only for as long as necessary for the purposes described in this policy. Retention periods vary depending on the type of data and the legal or operational need to retain it.

Customer and service records are generally retained for the duration of the customer relationship and for a reasonable period afterwards.
Financial and tax records may be kept for up to six years, or longer where required by law.
Communication records may be retained for a shorter or longer period depending on whether they are relevant to service history, complaints, or legal claims.
Enquiry data from individuals who do not become customers may be retained for a limited period to allow follow-up and business administration, after which it is securely deleted or anonymised.

When personal data is no longer required, we will take steps to securely delete, destroy, or anonymise it.

7. Processors and Data Sharing

We may use trusted third-party processors to help us operate efficiently and deliver services. These processors only act on our instructions and are required to handle personal data securely and lawfully.

Processors may include:

IT and hosting providers that support email, storage, and business systems;
accounting and invoicing providers that help manage payments and records;
communication service providers used for messages, scheduling, or customer administration;
payment service providers that process transactions securely;
professional advisers such as accountants, insurers, or legal advisers where necessary.

We may also disclose personal data where required by law, court order, or lawful request from a public authority. We do not sell personal data. Any sharing is limited to what is necessary and subject to appropriate safeguards.

8. Data Security

We use appropriate technical and organisational measures to protect personal data from unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures may include access restrictions, secure storage, staff awareness, and careful handling of customer records.

Although no system can be guaranteed completely secure, we work to maintain a level of protection that is proportionate to the nature of the data we process. If a data breach occurs that is likely to result in a risk to your rights and freedoms, we will respond in accordance with applicable law.

9. Your Rights

Under data protection law, you have rights in relation to your personal data. These rights may include:

Right of access – to request a copy of the personal data we hold about you.
Right to rectification – to ask us to correct inaccurate or incomplete information.
Right to erasure – to ask us to delete your data in certain circumstances.
Right to restriction – to ask us to limit how we use your data in certain situations.
Right to object – to object to processing based on legitimate interests.
Right to data portability – to receive certain information in a structured, commonly used format where applicable.
Right to withdraw consent – where processing is based on consent, you can withdraw it at any time.

Note: Some rights are subject to legal conditions and exceptions. For example, we may need to keep certain records for tax, legal, or contractual reasons even if a deletion request is made.

10. International Transfers

Where personal data is transferred outside the UK, we will ensure that suitable safeguards are in place to protect it and that any transfer complies with applicable data protection law. This may include using approved contractual protections or relying on adequacy decisions where available.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, business practices, or the way we process personal data. The latest version will apply to all Gardeners West Heath customers in the area from the time it is published or otherwise communicated.

By using our services, you acknowledge that you have read and understood this Privacy Policy.