Privacy Policy - Gardeners Crayford

Gardeners Crayford is committed to protecting the personal data of all customers in the Crayford area. This Privacy Policy explains how we collect, use, share, store, and protect personal information, and it applies to all Gardeners Crayford customers in the area. We process personal data in accordance with the UK GDPR and the Data Protection Act 2018.

This policy is designed to help you understand what information we collect, why we collect it, how long we keep it, and what rights you have over it. Your privacy matters to us, and we take a careful, lawful, and transparent approach to data handling.

1. Information We Collect

We only collect information that is necessary to provide our gardening services, manage customer relationships, and meet legal obligations. Depending on your interaction with us, we may collect:

Identity details such as your name and title.
Contact information such as address, email address, and phone number.
Service information such as the type of gardening work requested, property access notes, service preferences, and appointment details.
Billing information such as invoice records, payment status, and transaction references.
Communication records such as emails, messages, quotes, complaints, and service updates.
Technical information if you use our online forms, which may include IP address, browser type, and basic usage data.

We do not intentionally collect special category data unless it is strictly necessary and you have provided it voluntarily, or we are required to process it for a valid legal reason. We ask that you do not share unnecessary sensitive information with us.

2. How We Use Your Data

We use personal data for the following purposes:

To provide quotations and carry out gardening services.
To manage bookings, scheduling, and service delivery.
To communicate with you about your account, appointments, or service changes.
To issue invoices and manage payments.
To respond to questions, feedback, and complaints.
To keep business and accounting records.
To improve our customer service and operational efficiency.
To comply with legal, regulatory, tax, and insurance obligations.

We will only use your personal data for the purposes for which it was collected, unless we reasonably consider that we need to use it for another compatible reason. If we need to use it for an unrelated purpose, we will explain the legal basis and, where required, seek your permission.

3. Lawful Basis for Processing

Under data protection law, we must have a valid lawful basis to process personal data. Gardeners Crayford relies on the following bases:

Contract

We process your data where it is necessary to enter into or perform a contract with you. This includes providing quotes, arranging services, carrying out gardening work, and managing payments.

Legal Obligation

We may process personal data where needed to comply with legal requirements, including accounting, tax, record-keeping, or responding to lawful requests from authorities.

Legitimate Interests

We may use data where it is necessary for our legitimate business interests, provided these interests do not override your rights and freedoms. Examples include maintaining service records, improving our operations, preventing fraud, and handling customer enquiries.

Consent

In limited situations, we may rely on your consent, for example where you choose to receive certain optional communications. If consent is used, you can withdraw it at any time. Withdrawing consent will not affect the lawfulness of processing carried out before withdrawal.

4. Sharing Your Data and Processors

We may share personal data with trusted third parties that help us run our business. These third parties act as processors when they handle data on our behalf and only under our instructions. Examples may include:

Accounting and bookkeeping providers.
Payment processing services.
Email, messaging, and document storage providers.
IT support and system maintenance providers.
Professional advisers such as accountants or legal advisers.

We require processors to protect personal data, use it only for agreed purposes, and apply appropriate security measures. Where a third party acts as an independent controller, such as a bank or public authority, its own privacy policy may also apply.

We do not sell your personal data. We do not share more data than necessary, and we only disclose information when there is a legitimate business need, a contractual requirement, or a legal obligation.

5. Data Retention

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including meeting legal, tax, accounting, and insurance requirements. Retention periods may vary depending on the type of information and the reason it was collected.

Customer and service records are typically retained for as long as needed to manage the relationship and resolve any follow-up issues.
Invoice and accounting records are generally kept for the period required by law.
Communication records may be retained for a reasonable period to support service history and complaint handling.
Technical and form submission data is kept only as long as necessary for the relevant purpose.

When data is no longer required, we will securely delete it, anonymise it, or archive it where appropriate. We review retention practices regularly to ensure we do not keep information longer than necessary.

6. Data Security

We take appropriate technical and organisational measures to safeguard personal data against loss, misuse, unauthorised access, disclosure, alteration, or destruction. These measures may include access controls, secure storage, restricted permissions, staff awareness, and careful management of third-party systems.

Although we take strong precautions, no system can be guaranteed to be completely secure. If a personal data breach were to occur and pose a risk to your rights and freedoms, we would respond in line with applicable legal requirements.

7. Your Rights

As a data subject under UK GDPR, you have certain rights in relation to your personal data. These include:

Right of access - to request a copy of the personal data we hold about you.
Right to rectification - to request correction of inaccurate or incomplete data.
Right to erasure - to ask us to delete your data in certain circumstances.
Right to restriction - to ask us to limit how we use your data in certain situations.
Right to data portability - to receive certain data in a structured, commonly used format.
Right to object - to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent - where processing relies on consent.

These rights are not absolute and may be subject to legal limitations. If you make a request, we may need to verify your identity before responding. We aim to handle requests fairly and within the required timeframes.

8. Children’s Data

Our services are intended for adults and property owners, occupiers, or authorised representatives arranging gardening work. We do not knowingly collect personal data directly from children. If we become aware that we have inadvertently received such information, we will take appropriate steps to delete it where required.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data handling practices. When we do, we will revise the policy so that it remains accurate and current. We encourage customers to review it periodically to stay informed about how we protect personal data.

10. Summary of Our Approach

Gardeners Crayford handles personal data with care, transparency, and respect. We collect only what we need, use it for clear and lawful purposes, share it only with trusted processors when necessary, and keep it only for as long as required. Our aim is to deliver reliable gardening services while respecting your privacy rights at every stage.

This Privacy Policy applies to all Gardeners Crayford customers in the Crayford area. By using our services, you acknowledge that your personal data may be processed as described in this policy, in accordance with applicable data protection law.