Privacy Policy

Garden Worx UK & IRL Ltd (“Garden Worx”, “we”, “us”, “our”) is a landscaping and groundworks company registered in England & Wales under company number 15412682, with its registered office at:

Garden Worx UK & IRL Ltd
2nd Floor, College House
17 King Edwards Road
Ruislip
London
HA4 7AE
United Kingdom

Our day-to-day operations and site works are run from Suffolk.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Garden Worx is the data controller of the personal data described in this policy.

The person responsible for data protection at Garden Worx is Martyn Peters. You can contact us about anything in this policy at contact@gardenworx.co.uk or on 07595 373077.

This policy covers personal data we collect when you:

• visit gardenworx.co.uk;
• fill in our contact, quote or instant-quote forms;
• enter a competition or giveaway we run;
• upload a photograph to the AI garden visualiser;
• make a payment via the website;
• contact us by phone, WhatsApp, SMS, email or social media; or
• engage Garden Worx to carry out work at your property.

Our Terms & Conditions of Business (which govern the contract for the works themselves) are available at /terms.

3.1 Contact and enquiry data. When you contact us or request a quote, we collect your name, email address, telephone number, postal address or postcode, and the details of your enquiry (including any photos or descriptions of your garden you choose to share).

3.2 Quotation and contract data. If we provide you with a quotation and you proceed, we hold site-survey notes, measurements, design drawings, materials specifications, the agreed quotation, deposit and balance amounts, correspondence relating to the works, and proof of completion (including completion notices issued by email and SMS).

3.3 Payment data. Card payments are processed directly by Square. Garden Worx does not see or store your full card number, expiry date or CVC. We receive only a transaction reference, the amount, the date, and a masked last-four digits of the card used.

3.4 Competition entry data. If you enter a competition, we collect the details you provide on the entry form (typically name, email, telephone, postcode, and answers to entry questions) and a record of your entry date and acceptance of the competition terms.

3.5 Garden visualiser uploads. If you use the AI garden visualiser, we process the photograph you upload and the design prompt you select. See section 12 for how the visualiser uses third-party AI providers.

3.6 Technical and usage data. Our hosting provider and analytics tools automatically collect limited technical data when you visit the site: your IP address (anonymised where possible), browser type and version, device type, the pages you visit, referring URL, and timestamps. See section 10 for cookies and tracking specifically.

3.7 Photographs of completed works. We may take photographs of completed projects for our portfolio, gallery and marketing. These photographs are of the works themselves and do not normally identify you personally. If a photograph would identify you (for example by including you, your family or vehicle registration plates), we will ask before publishing.

3.8 Special category data. We do not ask for, and you should not send us, special category data (such as health, race, religion, sexual orientation, or political views).

We use your personal data to:

• respond to your enquiry and prepare a quotation;
• arrange a site visit, schedule work, and carry out the agreed landscaping or groundworks;
• take payment, issue invoices and completion notices, and pursue overdue accounts where necessary;
• send transactional emails and SMS messages relating to your quotation, booking, work in progress, completion, or warranty claims;
• administer competitions, contact entrants, and notify winners;
• generate AI garden visualisations you have requested and return the result to you;
• operate and improve our website, monitor performance, prevent fraud, and keep the site secure;
• comply with our legal, tax, accounting and regulatory obligations;
• with your consent, send you marketing communications about Garden Worx services and run advertising on platforms such as Meta (Facebook / Instagram) — see sections 10 and 11.

We rely on the following lawful bases under Article 6 of the UK GDPR:

• Contract. To take steps at your request before entering into a contract (such as preparing a quote) and to perform our contract with you.
• Legal obligation. To comply with tax, accounting, consumer-protection and health-and-safety law (for example, retention of invoices for six years under HMRC rules).
• Legitimate interests. To run and grow our business — including responding to enquiries, recovering overdue debts, securing our website, preventing fraud, defending legal claims, and producing portfolio photography of completed works.
• Consent. For non-essential cookies, third-party advertising pixels, competition entry, and any direct-marketing email or SMS we send. You can withdraw consent at any time (see section 13).

We do not sell your personal data. We share it only with the service providers we need to run the business, and with authorities where the law requires it. Our main processors are:

• Supabase — secure database hosting for quote, contact and competition records.
• Vercel — website hosting and request-level analytics.
• Resend — transactional email delivery (quotation emails, completion notices, etc.).
• Microsoft (Outlook / 365) — our business inbox at contact@gardenworx.co.uk.
• Square — card-payment processing.
• Replicate, OpenAI and Anthropic — AI providers used by the garden visualiser (see section 12).
• Meta Platforms Ireland — the Meta Pixel on this website, used to measure ad performance and reach relevant audiences on Facebook and Instagram (see sections 10 and 11).
• Our accountant and professional advisors — for tax, accounting and legal advice.
• Debt-recovery and legal services — only where an account is overdue and recovery is necessary.
• HMRC, courts and regulators — where we are legally obliged to disclose.

Each processor is bound by a written agreement requiring them to handle your data securely and only on our instructions.

Some of our processors (notably Vercel, Supabase, Resend, Square, Replicate, OpenAI, Anthropic and Meta) are based in, or transfer data to, the United States and other countries outside the UK.

Where personal data is transferred outside the UK, we rely on the safeguards permitted under the UK GDPR — typically the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an applicable adequacy decision (for example the UK Extension to the EU-US Data Privacy Framework where the recipient is certified). You can request more information about the safeguards in place by emailing contact@gardenworx.co.uk.

We do not keep personal data for longer than we need it.

• Enquiries that don't lead to a contract: up to 24 months from your last contact, then deleted.
• Contracted projects: for the duration of the workmanship guarantee (10 years from completion) so we can administer warranty claims, plus a further 6 years for limitation-of-actions purposes — i.e. up to 16 years in total.
• Invoices and payment records: at least 6 years after the end of the relevant tax year, as required by HMRC.
• Competition entries: until the competition has been drawn, the prize awarded, and any related queries resolved — typically 6 months — unless you have separately consented to marketing.
• Garden visualiser uploads: processed transiently to generate the result and not retained for marketing. See section 12.
• Marketing consents: until you unsubscribe or withdraw consent.
• Website analytics: in line with the retention defaults of each analytics provider (typically up to 26 months).

The website is served over HTTPS. Card details are entered directly into Square's PCI-DSS-certified payment fields and never touch our servers. Database access is restricted by role-based permissions and protected by Supabase's row-level-security policies. Staff access to systems is limited to those who need it for their role, and is protected by strong passwords and (where supported) multi-factor authentication.

No system is ever 100% secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and, where required, notify you directly without undue delay.

A cookie is a small text file stored on your device. We also use similar technologies such as local storage and tracking pixels. The technologies used on gardenworx.co.uk fall into the following categories:

• Strictly necessary. Required for the site to function — for example, remembering your cookie preference, keeping the admin area secure, and processing payments. These do not require consent.
• Analytics. Vercel Analytics collects anonymised, aggregated data about how the site is used (page views, referrers, country-level location). It does not use cross-site tracking cookies.
• Advertising / Meta Pixel. The Meta Pixel (Facebook Pixel) sets cookies and sends event data to Meta Platforms Ireland Ltd so we can measure the effectiveness of our Facebook and Instagram advertising and show ads to people who have visited the site (and to similar audiences). The Pixel may receive your IP address, the pages you visit, the actions you take (such as submitting a quote or entering a competition), and a Meta cookie identifier.

We ask for your consent to non-essential cookies (including the Meta Pixel) via the cookie banner the first time you visit. You can change your choice at any time by clearing your browser cookies for this site and reloading the page, or by emailing us at contact@gardenworx.co.uk. You can also opt out of Meta's use of cookies for ads in your Facebook ad-preference settings, and you can use browser settings to block or delete cookies generally — although doing so may affect parts of the site.

11.1 Email and SMS marketing. We only send marketing emails or text messages where you have given us consent, or where you are an existing customer and we are telling you about similar Garden Worx services (the “soft opt-in” permitted under PECR). Every marketing message contains a clear unsubscribe link or instruction.

11.2 Social-media advertising. We run paid advertising on Meta platforms (Facebook and Instagram). With your consent to the Meta Pixel, we may build custom audiences from people who have visited the site or taken specific actions, and lookalike audiences derived from those. We never upload your name, email address or phone number to Meta as part of a custom audience unless you have separately given consent for that.

11.3 Withdrawing consent. You can withdraw consent for any marketing activity at any time by emailing contact@gardenworx.co.uk. Withdrawing consent does not affect the lawfulness of any processing carried out before withdrawal.

Our AI garden visualiser lets you upload a photograph of your garden and generate a re-imagined design. When you use it:

• Your image and prompt are sent over an encrypted connection to third-party AI providers — currently Replicate (for image generation), and OpenAI and Anthropic (for prompt assistance and design suggestions).
• Each provider processes the data on our behalf to return a result to you. We do not authorise them to use your uploaded images to train their public models, and we configure their APIs to that effect where the provider supports it.
• We store a record of the request so we can show you the result and improve the feature, and so we can respond to misuse or abuse reports. We do not publish your uploaded photograph without your explicit permission.
• Please do not upload photographs that contain identifiable people (other than yourself) or any other personal data of third parties without their consent.

Under the UK GDPR you have the right to:

• Access — ask for a copy of the personal data we hold about you;
• Rectification — ask us to correct data that is inaccurate or incomplete;
• Erasure (“right to be forgotten”) — ask us to delete your data where we no longer need it and there is no overriding legal reason to keep it;
• Restriction — ask us to stop using your data in certain circumstances while a question about it is resolved;
• Portability — ask for a copy of certain data in a structured, machine-readable format so you can move it to another provider;
• Objection — object to processing based on legitimate interests (including direct marketing);
• Withdraw consent at any time where we rely on consent;
• Not be subject to a solely automated decision with legal or similarly significant effects. We do not make such decisions about you.

To exercise any of these rights, email contact@gardenworx.co.uk. We will respond within one month (extendable by two further months for complex requests, in which case we will tell you). We may ask you to verify your identity before disclosing personal data. There is no fee, unless your request is manifestly unfounded or excessive.

If you have a concern about how we have handled your personal data, please contact us first at contact@gardenworx.co.uk so we can try to put it right.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at any time:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Garden Worx services are aimed at homeowners and businesses, not children. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

Our website may link to third-party websites (for example suppliers, social media, or review platforms). We are not responsible for the privacy practices of those sites. Please read their privacy notices before sharing personal data with them.

We may update this policy from time to time — for example, when we add a new feature, change processor, or there is a change in the law. The current version, with the “Last updated” date at the top, always applies. For material changes we will draw your attention to the update on the site.

For any privacy question or request:

• Email: contact@gardenworx.co.uk
• Phone: 07595 373077 or 07904 805377
• Post: Garden Worx UK & IRL Ltd, 2nd Floor, College House, 17 King Edwards Road, Ruislip, London, HA4 7AE, United Kingdom (company no. 15412682)

For the contract terms covering the works themselves, see our Terms & Conditions.