Privacy Policy - Gardeners Sudbury

This Privacy Policy explains how Gardeners Sudbury collects, uses, stores, shares, and protects personal data when providing gardening services. It applies to all Gardeners Sudbury customers in the area, including people who request quotes, book services, make enquiries, or otherwise interact with us in connection with our work. We are committed to handling personal information in a lawful, fair, and transparent way in accordance with the UK GDPR and the Data Protection Act 2018.

1. Who We Are

Gardeners Sudbury provides gardening-related services to local customers in the area. In this policy, references to we, us, and our mean Gardeners Sudbury. If you use our services, communicate with us, or submit information to us, this policy applies to you as a customer, prospective customer, or website user where relevant.

2. Information We Collect

We only collect personal data that is necessary for legitimate business purposes. The information we may collect includes:

Identity details such as your name or title.
Contact details such as your phone number, email address, and service address.
Service information including details about the gardening work you request, preferences, access notes, and instructions.
Payment-related details such as records of transactions, invoices, and payment status, where applicable.
Communication records including messages, call notes, complaints, and feedback.
Technical information such as device or browsing data if you interact with our digital services, where relevant.
Special category data only if you voluntarily provide it and only when it is necessary to support your service needs, for example accessibility requirements. We will treat this data with extra care.

We do not intentionally collect more information than needed. Where possible, we will only ask for the data required to deliver our services properly.

3. How We Use Your Data

We use personal data for the following purposes:

To provide quotations and respond to enquiries.
To arrange, deliver, and manage gardening services.
To communicate about appointments, changes, and service updates.
To issue invoices, record payments, and manage accounts.
To handle feedback, complaints, or service concerns.
To maintain business records and meet legal, tax, or regulatory obligations.
To improve our service quality, planning, and customer experience.
To protect our rights, property, staff, and customers where necessary.

We will only use your data in ways that are consistent with the purpose for which it was collected, unless we have a lawful basis to use it for another compatible purpose.

4. Lawful Basis for Processing

Under data protection law, we must have a lawful basis for each type of processing. Gardeners Sudbury relies on the following lawful bases:

Contract

We process your personal data where it is necessary to enter into or perform a contract with you. This includes preparing quotes, arranging services, carrying out work, and managing billing.

Legitimate Interests

We may process your data where it is necessary for our legitimate business interests, provided your rights and freedoms do not override those interests. This may include record-keeping, service improvement, fraud prevention, and internal administration.

Legal Obligation

We may process and retain certain information to comply with legal duties, such as tax, accounting, or statutory record requirements.

Consent

Where required, we will rely on your consent, for example for optional communications or if you choose to provide special category information. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

5. Sharing Your Information

We may share personal data with trusted third parties only when necessary and only to the extent needed for the relevant purpose. These may include:

Service processors who support administration, scheduling, accounting, or secure data storage.
Payment providers used to process transactions.
Professional advisers such as accountants or legal advisers, where needed.
Public authorities where disclosure is required by law or a lawful request.

We do not sell your personal information. Any third parties that process data on our behalf are required to handle it securely, use it only for specified purposes, and comply with data protection obligations.

6. Data Processors

Gardeners Sudbury may use external processors to help us operate efficiently. A processor acts on our instructions and does not use your data for its own independent purposes. Examples of processor functions may include:

Appointment scheduling and calendar management.
Secure data hosting or cloud storage.
Customer administration and record management.
Invoice generation or bookkeeping systems.
Email or messaging platforms used for service communications.

We take reasonable steps to ensure processors have appropriate security measures in place, including access controls, confidentiality obligations, and data processing terms. We remain responsible for ensuring your data is handled lawfully and appropriately.

7. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including any legal, accounting, or reporting requirements. Retention periods may vary depending on the type of data and the reason for processing.

Customer service records are retained for a reasonable period to manage ongoing relationships, resolve issues, and maintain continuity of service.
Financial records are retained for the period required by law and standard accounting practice.
Enquiry records may be kept for a limited time if no service is booked, so we can follow up or manage future requests.
Consent-based data is retained only while consent remains valid and necessary.

When data is no longer required, we will securely delete, anonymise, or otherwise dispose of it in a safe manner. Retention decisions are reviewed periodically to ensure they remain appropriate.

8. Data Security

We use reasonable technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration, or disclosure. These measures may include secure storage, restricted access, password protection, and careful handling of paper or electronic records. While no system can be guaranteed completely secure, we take data protection seriously and work to reduce risks wherever possible.

9. Your Rights

As a data subject, you have rights under GDPR in relation to your personal data. These rights may include:

Right of access – to request a copy of the personal data we hold about you.
Right to rectification – to ask us to correct inaccurate or incomplete data.
Right to erasure – to request deletion of your data in certain circumstances.
Right to restriction – to ask us to limit processing in specific situations.
Right to object – to object to processing based on legitimate interests or direct marketing.
Right to data portability – to receive certain data in a usable format where applicable.
Right to withdraw consent – where processing is based on consent.

We will respond to valid requests within the time limits required by law. In some cases, we may need to verify your identity before actioning a request. Certain rights may be limited where legal obligations or legitimate grounds apply.

10. International Transfers

Where personal data is transferred outside the UK, we will only do so where appropriate safeguards are in place to protect your information to the required standard. Any such transfer will be handled in line with applicable data protection rules.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or data handling practices. Any updated version will apply from the date it is made available. We encourage customers to review this policy periodically so they remain informed about how their information is used.

12. Summary of Our Commitment

Gardeners Sudbury respects your privacy and handles personal data with care, transparency, and accountability. We collect only the information needed to deliver our gardening services, rely on lawful bases for processing, retain data for no longer than necessary, use trusted processors where appropriate, and support your rights under GDPR. Our goal is to provide a reliable local service while safeguarding your personal information at every stage.