Privacy Policy

Last updated: July 2026

Who we are

Gardening Guru ("we", "us") provides garden maintenance services in Motherwell and the surrounding area, and operates this website. For the purposes of UK data protection law we are the data controller for the personal information described below.

You can contact us about anything on this page by email at info@gardeningguru.co.uk or by phone on 01698 000000.

What we collect

When you request a quote or contact us

• Your name, email address, telephone number and postcode
• The address of the garden, if you give it to us
• The service you are interested in and anything you tell us in the message box
• Any photographs of your garden that you choose to upload
• Your preferred date, if you give one
• Your IP address, browser user-agent and the time of submission

When you create an account

• Your name, email address and telephone number
• A cryptographic hash of your password — we never store the password itself and cannot see it
• The addresses you save, including any access notes you add
• Your visits, subscriptions, invoices and payment records
• Messages you send us through your account
• The date and IP address of your most recent sign-in

When you pay online

Card payments are handled entirely by PayPal. We never see or store your card number. What we keep is the transaction reference, the amount, the currency, the status, and the email address PayPal reports for the payer, so that we can match the payment to your invoice and answer any query about it later.

When you leave a review or comment

• The name and location you choose to display
• Your email address, which is never published — we hold it only to verify the review is genuine
• Your rating and the text of your review, and your IP address

Website analytics

We count page views ourselves, storing only the date and the page path — a running total per page per day. No cookie, no identifier, and nothing that could be traced back to you. We do not use Google Analytics or any third-party advertising or tracking service.

Why we are allowed to use it

• To provide the service you asked for — quoting, scheduling, carrying out the work, invoicing and taking payment. Our lawful basis is performance of a contract, or taking steps at your request before entering one.
• To run the business properly — keeping records, preventing fraud and spam, and securing this website. Our lawful basis is legitimate interests.
• To meet legal duties — keeping accounting and tax records for the period HMRC requires. Our lawful basis is legal obligation.
• To send you marketing — only if you have specifically opted in. Our lawful basis is consent, and you can withdraw it at any time.

Who we share it with

We do not sell your personal information to anyone, ever. We share it only with:

• PayPal (Europe) S.à r.l. et Cie, S.C.A. — to process online payments
• Our web host — which stores this website and its database on our behalf
• Our accountant, and HMRC — for invoices and tax records
• Licensed waste facilities — where a waste transfer note is required, which records the collection address but no other personal detail

We may also disclose information where we are legally required to, or to establish or defend a legal claim.

How long we keep it

• Quote requests that do not become work — 24 months, then deleted
• Photographs you upload with an enquiry — 12 months, then deleted
• Customer accounts — for as long as the account is open, and 24 months after it is closed
• Invoices, payments and accounting records — 7 years, as HMRC requires
• Sign-in and security logs — 12 months
• Website page-view totals — 24 months (these contain no personal data)

How we protect it

• The whole site is served over HTTPS
• Passwords are hashed with a modern algorithm (Argon2id) and are not recoverable, by us or anyone else
• Every database query uses prepared statements, which prevents SQL injection
• Forms are protected against cross-site request forgery and rate limited against abuse
• Photographs you upload are stored outside the public web folder and can only be viewed by us after signing in — they are never publicly reachable or indexed by search engines
• Repeated failed sign-in attempts temporarily lock the account
• Access to customer records is limited to the people who need it to do the work

Your rights

Under UK GDPR you have the right to:

• Be told what we hold about you and why — that is what this page is for
• Get a copy of your personal data (a subject access request)
• Have mistakes corrected — most details you can change yourself in your account
• Have your data deleted, where we are not legally required to keep it
• Restrict or object to how we use it
• Take your data elsewhere in a portable format
• Withdraw consent to marketing at any time

Email info@gardeningguru.co.uk to exercise any of these. We will respond within one month and we will not charge you for it.

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put it right first.

Cookies

We use a small number of strictly necessary cookies and no tracking cookies at all. Our cookie policy lists every one and explains what it does.

Children

This site is intended for adults arranging work on their own property. We do not knowingly collect information about anyone under 16.

Changes to this policy

If we change how we handle personal information we will update this page and change the date at the top. If the change is significant we will tell account holders by email.