Privacy Policy - Gardeners Mill Hill

Last updated: This Privacy Policy explains how personal data is collected, used, stored, shared, and protected by Gardeners Mill Hill in relation to all customers in the Mill Hill area. It applies to every customer, prospective customer, and individual who interacts with our gardening services in this area.

We are committed to handling personal data in a fair, lawful, transparent, and secure manner in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy is written to help you understand what information we collect, why we collect it, how long we keep it, who may process it on our behalf, and what rights you have over your personal data.

1. Who this policy applies to

This policy applies to all Gardeners Mill Hill customers in the area, including people who request a quote, book a visit, receive gardening services, communicate with us about a project, or otherwise provide personal information to us. It also applies where we process data about property owners, tenants, residents, and authorised representatives connected to our services.

2. Information we collect

We collect only the information necessary to provide and manage our services. Depending on your interaction with us, we may collect the following categories of personal data:

Identity data: your name, title, and any relevant business or household name.
Contact data: address, email address, and telephone number.
Service and property details: information about your garden, outdoor areas, access instructions, preferred work schedules, and service history.
Transaction data: records of quotes, invoices, payments, payment status, and service agreements.
Communication data: messages, notes from calls, and correspondence relating to enquiries or complaints.
Technical data: limited information such as device or browser details when you interact with digital systems used for scheduling or administration.
Special category data: we do not ordinarily seek sensitive information. If such information is voluntarily provided, we will only process it where a lawful basis exists and where it is necessary for a specific purpose.

We do not intentionally collect more data than is needed. Where possible, we keep our records concise and relevant.

3. How we collect personal data

We may obtain personal data directly from you when you:

request a quotation or service;
book, amend, or cancel an appointment;
communicate with us by phone, email, or written message;
provide property access or service instructions;
make a payment or receive an invoice;
submit a complaint, enquiry, or feedback.

We may also receive information from third parties where appropriate, such as landlords, letting agents, property managers, joint account holders, or payment providers, but only when they are authorised to share it or when the sharing is otherwise permitted by law.

4. Lawful basis for processing

Under data protection law, we must have a lawful basis for every type of processing. Gardeners Mill Hill relies on the following lawful bases:

Contract

We process personal data when it is necessary to enter into or perform a contract with you. This includes providing quotes you request, delivering gardening services, managing bookings, issuing invoices, and handling payment administration.

Legal obligation

We may process certain information to comply with legal requirements, including tax, accounting, record-keeping, fraud prevention, and regulatory obligations.

Legitimate interests

We may process data where it is necessary for our legitimate business interests, provided your rights and interests do not override those interests. Examples include service management, internal administration, quality control, business security, and responding to customer enquiries.

Consent

In limited cases, we may rely on consent, for example where you choose to receive certain optional communications. Where we rely on consent, you may withdraw it at any time.

Vital interests and legal claims

These grounds may apply in rare circumstances, such as protecting someone’s safety or defending a legal claim.

We do not use personal data for unrelated purposes. Any new purpose will be assessed to ensure it is lawful, necessary, and fair.

5. How we use your data

We use personal data to:

provide gardening and related services;
prepare and manage quotations;
schedule visits and coordinate work;
communicate about service changes or updates;
maintain accurate customer records;
process payments and manage accounts;
respond to questions, feedback, or complaints;
comply with legal and administrative obligations;
protect against misuse, fraud, or unauthorised access.

We will not sell your personal data. We also do not use personal data for automated decision-making that produces legal or similarly significant effects.

6. Retention of personal data

We keep personal data only for as long as necessary for the purpose for which it was collected, and to satisfy legal, accounting, or reporting requirements. Retention periods depend on the type of information and the reason for holding it.

Customer service and contract records: retained for the duration of the relationship and for a reasonable period afterwards.
Financial and tax records: retained for the period required by law and accounting practice.
Communication records: retained as long as needed to resolve queries, maintain service continuity, or evidence agreements.
Support and complaint records: retained for a period necessary to review and respond appropriately.

When data is no longer needed, it will be securely deleted, anonymised, or archived in a restricted format where appropriate. We review retention regularly to ensure information is not kept longer than necessary.

7. Processors and sharing of personal data

We may use carefully selected third-party processors to help us operate efficiently and securely. These processors act on our instructions and are required to protect your data and process it only for the agreed purpose.

Examples of processors may include:

IT and cloud service providers used for secure storage, scheduling, or administration;
Accounting and bookkeeping providers used for invoicing and financial management;
Payment processors used to handle transactions;
Communication service providers used for business correspondence;
Professional advisers such as auditors, insurers, or legal advisers where required.

We may also disclose data if required by law, by a court order, or to protect our rights, property, staff, customers, or the public. If data is transferred outside the UK, we will ensure appropriate safeguards are in place.

All processors are selected with data protection in mind. Where required, we put contractual measures in place to protect confidentiality, security, and lawful processing.

8. Security of your information

We take reasonable technical and organisational measures to protect personal data from loss, misuse, unauthorised access, alteration, or disclosure. These measures may include access controls, secure storage, staff confidentiality expectations, and limited retention practices.

Although no system can be guaranteed completely secure, we work to reduce risk and to respond appropriately if an incident occurs. If a data breach is likely to result in a high risk to your rights and freedoms, we will act in accordance with legal requirements.

9. Your rights

Under data protection law, you have a number of rights in relation to your personal data. These rights are not absolute and may apply only in certain circumstances.

Right of access: you can ask for a copy of the personal data we hold about you.
Right to rectification: you can ask us to correct inaccurate or incomplete information.
Right to erasure: in some cases, you can ask us to delete your data.
Right to restrict processing: you can ask us to limit how we use your data in certain situations.
Right to object: you can object to processing based on legitimate interests or direct marketing.
Right to data portability: where applicable, you can ask for data in a machine-readable format.
Right to withdraw consent: where processing is based on consent, you can withdraw it at any time.

We will respond to valid requests within the time limits required by law. If we need to verify your identity before acting on a request, we may ask for reasonable information to confirm it is really you.

10. Complaints

If you believe your personal data has been handled incorrectly, you have the right to raise a concern. We encourage you to review the information in this policy and make contact through the normal service channels used for your account or enquiry. You also have the right to complain to the Information Commissioner’s Office (ICO) if you are dissatisfied with how your data is handled.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect legal, operational, or service changes. The latest version will apply to all relevant customers in the Mill Hill area. Please review this policy periodically so you remain informed about how we process your personal data.

Gardeners Mill Hill is committed to treating personal information with care, confidentiality, and respect. We aim to ensure that every customer in the area receives a service that is both practical and compliant with applicable privacy standards.