Privacy Policy - Gardeners Norbiton

Gardeners Norbiton is committed to protecting personal data and respecting privacy. This Privacy Policy explains how personal information is collected, used, stored, shared, and protected when individuals use our gardening services. It applies to all Gardeners Norbiton customers in the area, including residential and commercial clients, and covers all services we provide.

This policy is written to reflect the principles of the UK GDPR and the Data Protection Act 2018. It is designed to be clear, lawful, and transparent, so customers understand what happens to their data and what rights they have.

1. Information We Collect

We collect only the personal data that is necessary for providing our services, managing customer relationships, and meeting legal obligations. The information we may collect includes:

Identity details such as name and title.
Contact details such as address, telephone number, and email address.
Service information such as property access notes, garden preferences, appointment details, and work history.
Billing information such as invoice records and payment status.
Communication records such as messages, service requests, complaints, and feedback.
Technical data if a customer contacts us online, including basic device or usage information where relevant.

We do not intentionally collect special category data unless it is required for a specific lawful purpose and the customer has been informed. We do not knowingly collect more data than is needed to deliver services safely and efficiently.

2. How We Use Personal Data

Gardeners Norbiton uses personal data to operate effectively and provide services that meet customer needs. Typical uses include:

arranging and delivering gardening services;
issuing quotations, invoices, and payment reminders;
keeping records of work completed;
responding to enquiries, complaints, and service changes;
managing access to properties and work schedules;
maintaining internal service quality and business records;
meeting legal, tax, insurance, and regulatory obligations.

We only use personal data for the purposes explained in this policy unless a new lawful basis applies or the customer is informed about a compatible new use.

3. Lawful Basis for Processing

Under UK GDPR, we must have a lawful basis for each use of personal data. Gardeners Norbiton may process personal data on the following bases:

Performance of a Contract

We process data when it is necessary to provide a quoted or agreed service. This includes managing bookings, completing gardening work, handling invoices, and recording service details.

Legal Obligation

Some information must be retained or used to meet legal obligations, such as accounting, taxation, health and safety requirements, and fraud prevention.

Legitimate Interests

We may use data where it is in our legitimate business interests and where those interests are not overridden by the rights and freedoms of the individual. This may include record-keeping, service improvement, business administration, and protecting our services from misuse. When we rely on legitimate interests, we consider the impact on privacy and keep data use proportionate.

Consent

Where required by law, we may ask for consent, for example for certain types of marketing communication. When consent is used, it will be freely given, informed, specific, and easy to withdraw.

4. Sharing Data and Processors

We may share personal data with carefully selected third parties, known as processors or service providers, where this is necessary for business operations. These third parties may include:

IT and cloud service providers that store records or support communication systems;
accounting or bookkeeping providers that help manage invoicing and financial records;
payment service providers that process transactions securely;
professional advisers such as legal or insurance advisers where needed;
subcontractors or workforce partners who support service delivery under our instructions.

All processors are required to handle data securely, process it only on our instructions, and meet GDPR requirements. We do not sell personal data. We do not share data for unrelated purposes without a lawful basis.

In limited cases, we may also disclose information to public authorities, regulators, insurers, or law enforcement where required by law or where necessary to protect rights, safety, and property.

5. Data Retention

We keep personal data only for as long as necessary for the purpose for which it was collected, and for any additional period required by law. Retention periods vary depending on the type of information and the reason it is held.

For example, customer service records may be kept while a service relationship is active and for a reasonable time afterwards to deal with follow-up queries, complaints, or legal claims. Financial records are typically retained for the periods required by tax and accounting law. Where data is no longer needed, we will delete it securely or anonymise it so it can no longer identify an individual.

We regularly review the data we hold to ensure it is not kept for longer than necessary. Retaining data responsibly is an important part of our privacy and security approach.

6. Data Security

Gardeners Norbiton takes appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration, or disclosure. These measures may include access controls, secure storage, password protection, staff awareness, and restricted sharing of information on a need-to-know basis.

While no system can be completely secure, we work to reduce risk and respond appropriately if a security incident occurs. If a personal data breach is likely to create a high risk to individuals, we will handle it in accordance with legal requirements.

7. User Rights

Individuals whose data we process have a number of rights under data protection law. Subject to legal limits and verification of identity, customers may be able to:

access the personal data we hold about them;
rectify inaccurate or incomplete information;
erase data in certain circumstances;
restrict the processing of their data in certain situations;
object to processing based on legitimate interests or direct marketing;
data portability where processing is based on consent or contract and carried out by automated means;
withdraw consent at any time where consent is the lawful basis;
lodge a complaint with the UK Information Commissioner’s Office if they are unhappy with how data is handled.

Requests will be handled within the time limits required by law. We may ask for sufficient information to confirm identity and to understand the request before responding.

8. Children’s Data

Our services are aimed at adults and property owners or occupiers. We do not knowingly collect personal data from children unless it is incidental and necessary for lawful service administration. If we become aware that data has been collected inappropriately, we will take steps to delete or correct it where appropriate.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or privacy practices. Any updated version will apply from the time it is published or otherwise communicated. Customers are encouraged to review this policy periodically so they remain informed about how their data is used.

10. Summary of Our Commitment

Gardeners Norbiton respects privacy and processes personal data fairly, lawfully, and transparently. We collect only the information needed to provide gardening services, use it on an appropriate lawful basis, retain it only as long as necessary, and share it only with trusted processors or where required by law. Customers in the area can rely on this policy as the standard governing how their information is handled.

By using our services, customers acknowledge that their personal data may be processed as described in this policy, subject always to their rights under applicable data protection law.