Privacy Policy - Gardeners Shirley

Gardeners Shirley is committed to protecting the privacy and personal data of all customers in the Shirley area. This Privacy Policy explains how personal information is collected, used, stored, shared, and protected when customers use our gardening services. It applies to all Gardeners Shirley customers in the area, including residential and commercial clients, and it is designed to reflect the requirements of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We aim to be clear, fair, and transparent about our data practices. This policy should be read alongside any terms of service, quotations, or service agreements that may apply to our work. By using our services, you acknowledge that your data may be processed in accordance with this policy.

1. Information We Collect

Gardeners Shirley collects only the personal data that is necessary for lawful and legitimate business purposes. Depending on the nature of the service requested, we may collect the following categories of information:

Identity details: your name and, where relevant, the name of your business or property management contact.
Contact details: address, email address, telephone number, and any other contact information you provide.
Service details: information about your garden, outdoor space, requested work, access arrangements, preferred service times, and instructions related to your booking.
Billing and payment information: invoicing details, payment history, and records needed for financial administration.
Communication records: emails, messages, calls, notes, and feedback relating to enquiries, quotations, and completed work.
Technical information: limited website or device data, if applicable, such as IP address or browser type when you interact with our online services.

We do not intentionally collect special category data unless it is necessary and you have provided it for a specific reason, or unless required by law. For example, if a customer chooses to tell us about access needs, we will only use that information for the purpose for which it was shared.

2. How We Use Personal Data

Your information is used to provide a safe, reliable, and efficient service. Gardeners Shirley may process personal data for the following purposes:

to respond to enquiries and provide quotations;
to schedule and deliver gardening services;
to manage customer accounts and service records;
to issue invoices, process payments, and maintain financial records;
to communicate about appointments, changes, and service updates;
to handle complaints, disputes, or customer support requests;
to comply with legal, tax, accounting, and regulatory obligations;
to improve our services, processes, and customer experience;
to protect against fraud, misuse, or unlawful activity.

We will only use personal data in ways that are compatible with the purposes explained in this policy. If we need to use your data for a new purpose that is materially different, we will ensure there is a lawful basis for doing so.

3. Lawful Basis for Processing

Under GDPR, we must have a lawful basis before processing personal data. Gardeners Shirley relies on the following lawful bases depending on the context:

Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes providing quotes, arranging appointments, carrying out agreed gardening work, and managing billing and customer administration.

Legitimate Interests

We may process data where it is necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms. Examples include maintaining service records, improving our operations, communicating effectively with customers, and protecting our business from fraud or misuse. We always consider the impact on your privacy before relying on this basis.

Legal Obligation

We may process personal data where required to comply with legal obligations, such as tax laws, accounting rules, insurance requirements, or lawful requests from authorities.

Consent

In some limited situations, we may rely on your consent, particularly where it is required by law or where we need to process optional information. If we rely on consent, you can withdraw it at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.

Gardeners Shirley does not rely on consent where another lawful basis is more appropriate. We aim to choose the most accurate and transparent lawful basis for each type of processing.

4. Data Sharing and Processors

We may share personal data with trusted third parties when necessary to deliver our services or meet legal obligations. These third parties act as processors or independent data controllers, depending on their role.

Processors may include:

IT and hosting providers that store data securely or support business systems;
payment service providers that handle card or electronic payments;
accountants or bookkeeping services that support financial administration;
software providers used for scheduling, communication, or record keeping;
professional advisers such as legal or insurance advisers when needed;
subcontractors or specialist service partners where required to complete requested work.

When we use processors, we take reasonable steps to ensure they only process personal data on our instructions, keep it secure, and comply with data protection requirements. We do not sell personal data to third parties.

We may also disclose data if required by law, court order, or regulatory obligation. In such cases, we will limit disclosure to what is necessary and lawful.

5. International Transfers

Where any processor or service provider is located outside the UK, we will ensure that appropriate safeguards are in place before transferring personal data. These safeguards may include adequacy regulations, standard contractual clauses, or other approved mechanisms that protect your information to a GDPR-compliant standard.

6. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected. Retention periods are determined by the type of information, legal requirements, contractual needs, and operational necessity.

Customer and service records: kept for the duration of the customer relationship and for a reasonable period afterwards in case of queries or disputes.
Financial and tax records: retained for the period required by law.
Communication records: kept as long as needed to manage services, resolve issues, or maintain an appropriate business record.
Marketing or consent-based records: retained until you withdraw consent or ask us to stop processing.

When personal data is no longer required, we will delete it securely or anonymise it so that it can no longer identify you. In some cases, records may be kept longer if needed for legal claims, fraud prevention, or compliance obligations.

7. Data Security

We use appropriate technical and organisational measures to protect personal data from loss, misuse, unauthorised access, disclosure, alteration, or destruction. These may include access controls, secure storage, password protection, staff confidentiality obligations, and data minimisation practices.

While we work to protect all personal information, no method of transmission or storage is completely risk-free. We therefore cannot guarantee absolute security, but we will take reasonable and proportionate steps to reduce the risk of harm.

8. Your Rights

Under data protection law, you have important rights over your personal data. Subject to legal limits, these rights may include:

Right of access: to request a copy of the personal data we hold about you.
Right to rectification: to ask us to correct inaccurate or incomplete information.
Right to erasure: to request deletion of your data in certain circumstances.
Right to restriction: to ask us to limit how we use your data in certain situations.
Right to object: to object to processing based on legitimate interests or direct marketing.
Right to data portability: to request transfer of certain data to you or another controller where applicable.
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.

You may also have rights in relation to automated decision-making, although Gardeners Shirley does not generally use automated decisions that produce legal or similarly significant effects.

If you wish to exercise any of these rights, we will respond in accordance with legal timeframes and may need to verify your identity before actioning your request.

9. Children’s Data

Our services are intended for adults who can arrange gardening work on behalf of a property or business. We do not knowingly collect personal data from children except where it is incidental and necessary for the delivery of services, such as where household contact details are provided by an adult customer.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, business practices, or service arrangements. Any revised version will apply from the date it is published or otherwise communicated. We encourage customers to review this policy periodically so they remain informed about how their data is used.

11. Complaints and Further Information

If you are concerned about how your personal data has been handled, you have the right to raise a complaint with the appropriate data protection authority. You may also contact us through the usual business channels if you wish to raise a concern, make a request, or ask for clarification about this policy.

Gardeners Shirley takes privacy seriously and is committed to handling personal data responsibly, lawfully, and in a way that respects your rights. We believe that transparent data practices are an important part of delivering a trustworthy service to every customer in the Shirley area.