Gardeners Sutton Privacy Policy
This Privacy Policy explains how Gardeners Sutton collects, uses, stores, and protects personal data of its customers and prospective customers in the Sutton area. It also explains your rights under the UK General Data Protection Regulation and related data protection laws. This Privacy Policy applies to all Gardeners Sutton customers and any individuals who contact or interact with Gardeners Sutton in the Sutton area in relation to our gardening and related services.
Who we are and scope of this policy
Gardeners Sutton is a gardening services provider operating in the Sutton area. For the purposes of data protection law, Gardeners Sutton is the data controller in respect of the personal data described in this Privacy Policy. This Privacy Policy applies whenever we act as a data controller in relation to personal data of customers, potential customers, suppliers, and other individuals in the Sutton area with whom we deal in the course of providing our services.
Personal data we collect
We may collect and process the following categories of personal data when you contact us, request a quote, or use our services:
Identification and contact details: name, address, postcode, and general location details required to visit your property, and any other contact details you choose to provide.
Service information: details of your garden or outdoor space, property access instructions you choose to share, records of work requested, quotes provided, invoices issued, and payment history.
Communication data: information contained in communications you send to us, such as enquiries, feedback, or complaints, and any related notes we keep about our interactions.
Payment information: limited payment data necessary to process your payment, such as confirmation of payment and method used. We do not store full card details; these are handled by payment service providers acting as processors or independent controllers.
Technical and usage data: if you interact with us online, we may receive technical data such as IP address, browser type, device identifiers, and general site usage information from analytics or hosting providers.
Lawful bases for processing your data
We process your personal data only where we have a lawful basis under applicable data protection laws. Depending on the situation, we rely on the following lawful bases:
Performance of a contract: where processing is necessary to provide our services, including responding to your enquiries, providing quotes, scheduling visits, performing gardening work, and managing billing and payments.
Legitimate interests: where it is necessary for our legitimate business interests and those interests are not overridden by your rights and freedoms. This includes managing our relationship with you, improving our services, maintaining business records, and protecting our business and property. We consider and balance any potential impact on you before relying on this basis.
Compliance with legal obligations: where processing is necessary for us to comply with legal and regulatory requirements, such as tax, accounting, and record keeping obligations, and responding to lawful requests from public authorities.
Consent: where required by law, we may rely on your consent for specific forms of processing, such as certain marketing communications. You may withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal.
How we use your personal data
We use the personal data we collect for the following purposes:
To provide gardening and related services, including visiting your property, planning work, and completing agreed tasks.
To respond to your enquiries, provide quotes, and manage bookings or changes to bookings.
To issue invoices, manage payments, and maintain accounting and business records.
To manage our relationship with you, including handling feedback, queries, and complaints.
To maintain and improve our services, systems, and business processes.
To protect our business, staff, and property, including the prevention and detection of fraud or misuse of our services.
To comply with legal obligations and cooperate with regulators and authorities where required.
Data processors and other recipients
We may share your personal data with trusted third parties who act as data processors on our behalf. These processors only process your data in accordance with our instructions and for the purposes described in this Privacy Policy. They are required to implement appropriate security measures and to protect your personal data.
Types of processors and recipients may include:
IT, hosting, and system providers that support our website, communications, and data storage.
Payment service providers that process payments for our services.
Professional advisers, such as accountants or legal advisers, where necessary for the management of our business.
Suppliers and subcontractors involved in delivering our services, where necessary for the performance of a contract with you.
Public authorities or law enforcement, where we are required to disclose data by law or where it is necessary to protect our rights or the rights of others.
International transfers
Where any of our processors or service providers are located outside the United Kingdom or the European Economic Area, or store data in such locations, we take steps to ensure that your personal data is afforded a level of protection essentially equivalent to that guaranteed under UK data protection law. This may include using standard contractual clauses approved for international data transfers or relying on other appropriate safeguards as permitted by law.
Data retention
We keep your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to meet legal, accounting, or reporting requirements.
In determining appropriate retention periods, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it, whether we can achieve those purposes through other means, and applicable legal requirements.
Customer records relating to services provided are generally retained for a period necessary to manage our relationship and comply with tax and accounting obligations. Communications and enquiry records may be kept for a reasonable period to respond to follow-up requests and to improve our services. Where data is no longer required, it will be securely deleted or anonymised.
How we protect your data
We take appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or damage. These measures include limiting access to personal data to staff and processors who need it for legitimate business purposes, using secure systems and tools, and regularly reviewing our security practices. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Your data protection rights
Under data protection laws, you have a number of rights in relation to your personal data. These rights apply to all Gardeners Sutton customers and individuals in the Sutton area whose personal data we process, subject to certain legal limitations and conditions.
Right of access: you have the right to request confirmation that we process your personal data and to request a copy of that data, together with certain information about how we use it.
Right to rectification: you have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
Right to erasure: in certain circumstances, you have the right to request that we delete your personal data. This is not an absolute right and may be limited where we need to retain the data for legal or legitimate business reasons.
Right to restriction: you have the right to request that we restrict our processing of your personal data in certain situations, for example while we verify its accuracy or consider an objection.
Right to object: you have the right to object, on grounds relating to your particular situation, to our processing of your personal data where we rely on legitimate interests as the lawful basis. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where we need the data for legal claims.
Right to data portability: where our processing is based on your consent or on a contract and is carried out by automated means, you may have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller.
Right to withdraw consent: where we rely on your consent, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing carried out before withdrawal.
You also have the right to lodge a complaint with a supervisory authority if you believe that your data protection rights have been infringed. In most cases this will be the data protection authority in the country where you live, work, or where the alleged infringement took place.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or other factors. Any updates will take effect from the date of publication. We encourage you to review this Privacy Policy periodically to stay informed about how we handle your personal data.
