1. Who we are
GardensSorted provides subscription garden care in Yorkshire through gardenssorted.co.uk. We are the data controller for personal data collected through this website and your customer account.
For data protection enquiries, email hello@gardenssorted.co.uk. If you need our full registered company name and postal address (for example for legal correspondence), ask us by email and we will provide it.
2. What we collect
- Account and identity - name, email address, phone number (if provided), and login credentials (passwords are stored hashed, never in plain text).
- Property and service - address, postcode, garden size band, access notes, visit preferences, plan and add-ons selected, visit history, and optional garden photos you upload.
- Subscription and billing - plan, pricing, minimum term, payment status, and Stripe customer identifiers. Card details are entered on Stripe's secure pages; we do not store full card numbers on our servers.
- Signup and quotes - if you enter your email in the quote flow before completing payment, we may save your progress (name, email, garden size, step reached) so we can follow up or help you finish signup.
- Communications - support chat messages, emails, and SMS about visits or your account where permitted (see marketing below).
- Technical and security data - IP address, browser type, device information, and logs from our website and API to keep the service secure and diagnose faults.
- Website usage (with consent) - if you accept non-essential cookies, analytics and advertising partners may collect online identifiers and interaction data as described in our cookie policy.
3. How we use your information
We use personal data to:
- Provide and manage your subscription and scheduled garden visits
- Match you with vetted local gardeners and share visit details with them
- Process payments, invoices, and billing-related communications
- Respond to support requests, complaints, and safety issues
- Send transactional messages (visit confirmations, reminders, service updates)
- Improve our service, measure marketing performance, and prevent fraud or misuse
- Comply with legal, tax, and accounting obligations
4. Legal basis (UK GDPR)
We process personal data where one or more of the following applies:
- Contract - processing is necessary to perform our agreement with you (running your subscription and visits).
- Legitimate interests - for example service improvement, security, recovering debts, and enforcing our terms, where your rights do not override those interests.
- Consent - for optional marketing emails, non-essential cookies (Meta Pixel, analytics), and similar choices where we ask for your permission. You can withdraw consent at any time.
- Legal obligation - where we must retain or disclose information (for example tax records).
5. Marketing
We may send you service-related emails (quotes, account updates, visit information) as part of providing the service. Separate promotional emails are optional. If we offer a marketing opt-in at signup or elsewhere, we will only send promotional messages when you have agreed, and you can unsubscribe using the link in each email or by contacting us.
Advertising cookies (such as Meta Pixel) are only used if you choose Accept all on our cookie banner. See the cookie policy to change your preference.
6. Who we share data with
We use trusted processors to run the platform. They process data on our instructions and only as needed:
- Stripe - payment processing and customer billing portal (may involve processing outside the UK).
- SendGrid - transactional and service email.
- Twilio - SMS visit notifications where enabled.
- Vercel - website hosting.
- Railway - API and database hosting.
- Meta (Facebook / Instagram) - advertising measurement and remarketing, only if you accept marketing cookies.
- Google - analytics, if enabled and you accept non-essential cookies.
- Approved gardeners - name, address, access notes, schedule, and photos needed to complete visits safely.
We do not sell your personal data.
We may disclose information if required by law, to protect our rights, or in connection with a business sale or restructuring (you would be notified where required).
7. International transfers
Some processors (including Stripe, Meta, Google, and cloud hosts) may store or process data outside the UK. Where data is transferred internationally, we rely on appropriate safeguards permitted under UK law (such as adequacy regulations, UK International Data Transfer agreements, or Standard Contractual Clauses). You can request more detail by contacting us.
8. Cookies and similar technologies
Essential cookies and local storage keep you signed in and remember your cookie choice. Optional analytics and marketing tools are described in our cookie policy, including Meta Pixel and Google Analytics.
9. How long we keep data
- Active customers - for the life of your account and subscription.
- After you leave - account, billing, and visit records for a period needed for support, disputes, tax, and legal claims (typically several years unless a longer period is required by law).
- Signup leads - incomplete signups for a limited period so we can help you complete checkout, then deleted or anonymised unless you become a customer.
- Support and chat - for as long as needed to resolve issues and improve service.
- Marketing consent records - for as long as needed to demonstrate compliance.
You can ask us to delete data where we are not legally required to keep it.
10. Your rights
Under UK data protection law you can request:
- Access to the personal data we hold about you
- Correction of inaccurate data
- Erasure in certain circumstances
- Restriction or objection to processing in certain circumstances
- Data portability where applicable
- Withdrawal of consent (for example marketing or non-essential cookies) without affecting lawfulness before withdrawal
To exercise these rights, email hello@gardenssorted.co.uk. We respond within one month in most cases (this may be extended for complex requests).
You may complain to the Information Commissioner's Office (ICO): ico.org.uk.
11. Children
Our service is aimed at adults contracting for household garden care. We do not knowingly collect personal data from children under 16. Contact us if you believe we have done so and we will delete it.
12. Automated decisions
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Visit scheduling and gardener matching involve human oversight and operational rules.
13. Security
We use technical and organisational measures appropriate to the data we hold (access controls, encryption in transit, hashed passwords, and processor security standards). No online service is completely secure; please use a strong unique password and keep your login details private.
14. Changes
We may update this policy from time to time. Material changes will be highlighted on this page (the "Last updated" date will change). Where required, we will notify you by email or in your account.