Privacy Policy - Gardeners Totteridge

Gardeners Totteridge is committed to protecting the personal data of all customers in the Totteridge area and handling information in a fair, transparent, and lawful way. This Privacy Policy explains what personal data we collect, how and why we use it, how long we keep it, who may process it on our behalf, and the rights available to individuals under the UK GDPR and the Data Protection Act 2018. This policy applies to all Gardeners Totteridge customers in the area, including prospective customers, existing customers, and those who enquire about our gardening services.

1. Who this policy applies to

This policy applies to anyone whose personal data we handle in connection with our gardening services, quotations, bookings, service management, billing, and customer support. It covers individuals in the Totteridge area who contact us, request a visit, receive a quotation, or engage us for any form of garden maintenance or related service. It does not cover third-party websites or external services that may be linked from other sources.

2. Personal data we collect

We collect only the information that is necessary to provide our services and manage our business responsibly. Depending on how you interact with us, we may collect:

Identity details: name, title, and any preferred form of address.
Contact details: postal address, telephone number, and email address.
Service information: details about the garden, property access, requested work, service history, quotations, and customer preferences.
Payment information: records of payments made and invoices issued. Payment card information, where used, is normally processed by secure payment providers rather than stored by us.
Communication records: emails, call notes, messages, feedback, complaints, and appointment correspondence.
Technical data: limited information such as device or browser details if collected through digital systems used for administration.

We do not intentionally collect special category data unless there is a clear and lawful reason to do so, and only where it is necessary for a specific purpose. We ask that you do not send sensitive information unless it is relevant to a service matter and you are comfortable for us to handle it.

3. How we use personal data

We use personal data for legitimate business purposes connected with delivering and managing our services. These purposes include:

responding to enquiries and arranging quotations;
booking and delivering gardening services;
managing customer accounts and service records;
issuing invoices and recording payments;
dealing with complaints, queries, and follow-up requests;
maintaining accurate business records;
meeting legal, accounting, and tax obligations;
protecting our staff, customers, and property;
improving our services and customer experience.

We always aim to ensure that any use of personal data is relevant, proportionate, and limited to what is necessary.

4. Lawful basis for processing

Under data protection law, we must have a lawful basis for processing personal data. Gardeners Totteridge relies on the following lawful bases:

Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes providing quotations at your request, carrying out gardening work, managing bookings, and handling payments.

Legal obligation

We may process personal data when required to comply with laws and regulations, including tax, accounting, record-keeping, fraud prevention, and other legal duties.

Legitimate interests

We may process data where it is necessary for our legitimate interests, provided these are not overridden by your rights and freedoms. This may include maintaining business records, improving service quality, protecting against misuse, and managing customer communications.

Consent

In limited circumstances, we may rely on your consent, for example where it is needed for a specific optional purpose. If we rely on consent, you can withdraw it at any time.

5. Retention of data

We keep personal data only for as long as it is needed for the purpose for which it was collected, or as required by law. Retention periods vary depending on the type of record and the reason it is held.

Customer and service records: retained for the duration of the service relationship and for a reasonable period afterwards to handle queries or disputes.
Financial and accounting records: kept for the period required by law and good accounting practice.
Correspondence and complaints: retained long enough to resolve the issue and maintain appropriate business records.

When data is no longer needed, we will take reasonable steps to delete it securely or anonymise it so that it can no longer identify you.

6. Processors and data sharing

We may use trusted third parties to process personal data on our behalf. These service providers act as processors and are only allowed to use data according to our instructions and for defined purposes. Typical processors may include:

administration and record-management providers;
email and communication services;
accounting, invoicing, or bookkeeping systems;
payment processing services;
IT support and secure data storage providers.

Where necessary, we may also disclose information to professional advisers, insurers, legal bodies, or public authorities if required by law or if needed to protect our rights, staff, or customers. We do not sell personal data.

7. Data security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. These measures may include secure storage, access controls, staff awareness, and limiting access to personal data to those who need it for business purposes. While no system can be guaranteed completely secure, we work to reduce risks and handle data carefully.

8. Your data protection rights

Under the UK GDPR, you have a number of rights in relation to your personal data. These rights may be subject to legal conditions and exceptions. They include:

Right of access: you can request a copy of the personal data we hold about you.
Right to rectification: you can ask us to correct inaccurate or incomplete information.
Right to erasure: you can request deletion of personal data in certain circumstances.
Right to restriction: you can ask us to limit how we use your data in certain situations.
Right to object: you can object to processing based on legitimate interests in some cases.
Right to data portability: you may request certain data in a portable format where applicable.
Right to withdraw consent: where processing is based on consent, you can withdraw that consent at any time.

Gardeners Totteridge will respond to valid requests within the time required by law and may need to verify your identity before acting on a request. We may not always be able to comply fully if keeping or using the data is necessary for legal, contractual, or operational reasons.

9. Complaints and supervisory authority

If you are concerned about how we handle personal data, you have the right to raise a complaint with the relevant data protection authority. We encourage customers to contact us first so that we can try to resolve the matter promptly and fairly. However, you are not required to do so, and you may contact the supervisory authority directly if you believe your data rights have been infringed.

10. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in law, regulation, or our business practices. Any updates will take effect when published in the revised version. We recommend reviewing this policy periodically so that you remain informed about how we protect personal data.

11. Summary of our approach

Gardeners Totteridge handles personal data with care, necessity, and respect. We collect only information needed to deliver services, rely on clear lawful bases for processing, keep data only as long as required, and use processors responsibly. Our aim is to provide a reliable service while safeguarding the privacy of every customer in the Totteridge area.