Privacy Policy
Last updated: September 2026
Green Heart Horticultural Services Limited ("Green Heart", "we", "us", "our") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you visit our website or contact us about our services.
We are registered in England and Wales.
This policy is written in plain English and complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who We Are
Data Controller: Green Heart Horticultural Services Limited
Contact details:
- Email: hello@email.greenhearthort.co.uk
- Telephone: 01270 447666
- Registered office address: 8 Collinbrook Avenue, Crewe, England, CW2 6PN
- Company registration number: 15264023
- Registered in England & Wales
- VAT number: GB 484 921 460
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us using the details above.
2. What Personal Data We Collect
We collect personal data in the following ways:
When you submit an enquiry or consultation request
When you complete our contact form or callback request form, we collect:
- Your full name
- Your email address
- Your telephone number
- Your street address and postcode
- Your garden size (if provided)
- The service you are interested in (if provided)
- Your preferred way for us to reply to your enquiry
- Your approximate monthly garden-care budget (if provided)
- Any additional information you choose to include in your message
Each form marks which fields are required and which are optional. If you do not provide information marked as required, we will not be able to submit or respond to that request.
When you contact us directly
If you contact us by telephone or email, we may collect:
- Your name
- Your contact details
- The content of your communication
When you visit our website
We may collect technical data about your visit, including:
- Your IP address
- Browser type and version
- Pages visited and time spent on the site
- Referring website
This technical data is collected through website analytics tools (see Section 5 for details of third parties we use).
3. Why We Collect Your Personal Data and Our Lawful Basis
Under UK GDPR, we must have a lawful basis for processing your personal data. The table below explains why we collect your data and the lawful basis we rely on.
| Purpose | Lawful Basis |
|---|---|
| Responding to your enquiry or consultation request | Legitimate interests (Article 6(1)(f)) - it is in our mutual interest to respond to your request |
| Providing you with a quotation for our services | Legitimate interests / Pre-contractual steps (Article 6(1)(b)) |
| Delivering services to you as a client | Performance of a contract (Article 6(1)(b)) |
| Sending you service updates, appointment reminders, or follow-up communications | Legitimate interests (Article 6(1)(f)) |
| Sending you marketing communications (newsletters, promotions, content) | Consent (Article 6(1)(a)) - we will only send marketing emails if you have opted in |
| Optional website analytics used to improve our website | Consent (Article 6(1)(a)) |
| Complying with our legal obligations | Legal obligation (Article 6(1)(c)) |
Our legitimate interests: As a professional horticultural services business, we have a legitimate interest in responding to enquiries, providing quotations, and communicating with existing and potential clients about our services. We have assessed that these interests do not override your rights and freedoms, as the data we collect is limited to what is necessary and you would reasonably expect us to use it in this way.
4. How Long We Keep Your Data
We retain your personal data only for as long as is necessary for the purposes for which it was collected.
| Data Type | Retention Period |
|---|---|
| Enquiry and contact form submissions (where no contract results) | 12 months from the date of enquiry |
| Client records (where a contract is entered into) | 7 years from the end of the client relationship, in line with our legal and accounting obligations |
| Marketing communications opt-in records | Until you withdraw your consent, plus 3 years thereafter as evidence of consent |
| Website analytics data | Provider retention is limited through our analytics settings and reviewed periodically. First-party statistics are stored only as anonymous daily totals. Your browser preference remains until you change it. |
After the relevant retention period, your data will be securely deleted or anonymised.
5. Who We Share Your Data With
We do not sell your personal data to third parties. We may share your data with the following categories of organisations where necessary to deliver our services or operate our business:
GoHighLevel (GHL) - Our customer relationship management (CRM) and enquiry management platform. When you submit a contact form or callback request, your data is processed by GoHighLevel. GoHighLevel is a US-based company. Data transfers to the US are made under appropriate safeguards. For more information, see GoHighLevel's privacy policy at gohighlevel.com.
The directly embedded GHL forms currently create form-session, attribution and browsing-history storage, send form, geolocation and attribution events before a form is submitted, and initiate Meta browser technology. These provider-controlled features are being reviewed and are separate from the optional website-wide GHL external-tracking script described below.
Email and communication providers - We use email services to communicate with you. These providers process your email address and the content of our communications.
PostHog - If you accept optional analytics, PostHog records pseudonymous page journeys, limited technical data, and selected interactions such as service, navigation, telephone, email and form entry actions. PostHog may process an IP address when receiving a request. We do not send names, contact details, form contents or free-form text. Person profiles, identification and session recording are disabled, and input text and element attributes are masked.
Google Analytics - If configured and you accept optional analytics, Google Analytics records page visits and limited technical information so we can understand website use. Advertising personalisation and Google Signals are disabled. Google Analytics is not loaded without consent or while its website identifier is not configured.
GoHighLevel external tracking - If you accept optional analytics, our CRM provider loads an external tracking script across the website. It measures page activity and can detect submissions from website forms so we can understand which enquiries result from the site. The script is not loaded if you reject analytics, and our consent controls do not change the information you choose to submit through an enquiry form.
Replit Project Analytics - Our publishing platform provides aggregated statistics about visitors, pages, devices and referrers, plus the same limited non-personal interaction events. This platform-supplied reporting is designed for aggregate measurement rather than identifying visitors and does not receive enquiry or form contents from our code.
Green Heart first-party statistics - If you accept optional analytics, selected page and interaction events are added immediately to anonymous daily totals on our server. We do not retain an event-level journey or include an IP address, cookie identifier, contact detail or form content in these totals. Reporting omits low-volume groups to reduce re-identification risk.
Spotify and YouTube - We offer an optional Spotify podcast player and YouTube video player. Their iframes are not created until you select the relevant provider's load button. Loading a player connects your browser to that provider, which may use cookies or similar browser storage. Read Spotify's privacy information and Google's privacy information.
Accountants and professional advisers - We may share limited personal data with our accountants or legal advisers where required to fulfil our legal and financial obligations.
Legal and regulatory authorities - We may disclose your personal data to law enforcement or regulatory bodies where required to do so by law.
All third parties who process data on our behalf are required to handle it securely and in accordance with UK GDPR.
6. International Data Transfers
Some of the third-party services we use (including GoHighLevel) are based outside the United Kingdom. Where your data is transferred outside the UK, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses or reliance on an adequacy decision. If you would like more information about the safeguards in place for any specific transfer, please contact us.
7. Your Rights
Under UK GDPR, you have the following rights in relation to your personal data:
Right of access - You have the right to request a copy of the personal data we hold about you. This is known as a Subject Access Request (SAR).
Right to rectification - You have the right to ask us to correct any inaccurate or incomplete personal data we hold about you.
Right to erasure - You have the right to ask us to delete your personal data in certain circumstances (for example, where we no longer need it for the purpose it was collected, or where you withdraw consent).
Right to restriction of processing - You have the right to ask us to restrict how we use your personal data in certain circumstances.
Right to data portability - Where we process your data by automated means on the basis of your consent or a contract, you have the right to receive your data in a structured, commonly used, machine-readable format.
Right to object - You have the right to object to our processing of your personal data where we rely on legitimate interests as our lawful basis. You also have an absolute right to object to your personal data being used for direct marketing purposes at any time.
Right to withdraw consent - Where we process your data on the basis of your consent (for example, for marketing emails), you have the right to withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. You can withdraw consent by contacting us at hello@email.greenhearthort.co.uk or by clicking the unsubscribe link in any marketing email.
To exercise any of these rights, please contact us at hello@email.greenhearthort.co.uk or by telephone on 01270 447666. We will respond to your request within one calendar month.
8. Cookies
Our website uses essential browser storage where required for normal operation. PostHog, configured Google Analytics, GoHighLevel external tracking and first-party statistical events are optional and are not activated unless you select "Accept analytics". Until then, these optional trackers are not loaded and no first-party statistical events are sent.
You can review or withdraw your choice at any time using "Analytics preferences" in the website footer. Rejecting or withdrawing stops further PostHog, configured Google Analytics and GoHighLevel external tracking and clears their analytics storage from your browser. The website and enquiry forms continue to work without optional analytics. You can also clear browser storage using your browser settings.
| Technology | Purpose and duration |
|---|---|
| green-heart-analytics-consent | Stores your accepted or rejected analytics choice in this browser until you change it or clear browser storage. |
| PostHog ph_* storage | Optional pseudonymous analytics identifiers created only after analytics consent in local storage and a first-party cookie. The provider's default browser lifetime is up to one year; withdrawal clears them sooner. |
| Configured Google Analytics _ga / _ga_* cookies | Optional visitor and session measurement identifiers created only after analytics consent. Google's standard maximum lifetime is two years; withdrawal clears them sooner. GA4 is currently dormant until configured. |
| GoHighLevel external-tracking _ud / lc_session_* storage | Optional website attribution identifiers created only after analytics consent. Their lifetime is provider-controlled and our preference control clears them. |
| GoHighLevel embedded-form v2_*, v3_*, ghl_form_survey_event_v1 and ghl_geo_country_v1 storage | Provider-controlled form session, fingerprint-labelled, geolocation, attribution and browsing-history entries. Their duration is set by GoHighLevel and these settings are under review. |
| green-heart-external-media-spotify / green-heart-external-media-youtube | Records that you chose to load that provider's media. It remains until you reset external media or clear browser storage. |
| Spotify sp_t and session storage / YouTube ytidb storage | May be created by the selected provider only after you load its player. Provider-controlled duration; use Reset external media to prevent the iframe loading again and browser settings to clear provider storage. |
| GAESA | Strictly necessary hosting session-affinity cookie set by Replit's Google serving infrastructure to route requests to the correct app instance. It carries no app-specific data, is controlled by the hosting platform and currently expires after 30 days. |
Use "Reset external media" in the footer to remove the stored Spotify and YouTube choices and hide loaded players. Because provider storage belongs to Spotify or Google, use your browser settings if you also want to delete storage already created on their domains.
9. How We Protect Your Data
We take the security of your personal data seriously. We have implemented appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction, or alteration. These measures include:
- Secure, encrypted connections (HTTPS) on our website
- Restricted access to personal data within our organisation
- Use of reputable, security-compliant third-party service providers
- Regular review of our data handling practices
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you directly.
10. Children's Data
Our services are intended for adults. We do not knowingly collect personal data from children under the age of 18. If you believe we have inadvertently collected data from a child, please contact us immediately and we will take steps to delete it.
11. Links to Other Websites
Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites and encourage you to read their privacy policies before providing any personal data.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make significant changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.
13. How to Complain
If you are unhappy with how we have handled your personal data, we encourage you to contact us first so that we can try to resolve the matter.
If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection supervisory authority:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk
This Privacy Policy was drafted in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, with reference to guidance published by the Information Commissioner's Office (ico.org.uk).