KELTIC GROUNDS CO.ABgardens LtdPRIVACY POLICYEffective date: 19 April 2026This privacy policy explains how Keltic Grounds Co. (operated by ABgardens Ltd) collects, uses, stores and protects your personal data when you use our website, request a quote, or engage our services. We are committed to handling your data responsibly and in accordance with UK GDPR and the Data Protection Act 2018.1. Who We AreCompany name ABgardens LtdTrading as Keltic Grounds Co.Registered in England and WalesRegistered address Sevenoaks, KentEmail info@abgardens.co.ukPhone 07881 121 798Website www.kelticgrounds.co.ukICO Registration [Your ICO registration number — register at ico.org.uk if not yet done]ABgardens Ltd is the data controller for the purposes of UK GDPR. This means we are responsible for deciding how and why your personal data is used.2. What Personal Data We Collect2.1 Data you provide directlyWhen you contact us, request a quote, book a consultation or sign up for our services, we may collect:Full nameHome address and postcodeEmail addressPhone number (mobile or landline)Details about your garden, property and the services you requirePayment information (processed securely — we do not store card numbers ourselves)Direct debit details (processed via GoCardless or equivalent — subject to their privacy policy)Any additional information you voluntarily provide in messages, notes or consultation requests2.2 Data collected automaticallyWhen you visit our website, we automatically collect certain technical data including:IP addressBrowser type and versionDevice type (desktop, mobile, tablet)Pages visited and time spent on each pageReferring URL (how you found our site)Session duration and bounce rate dataThis data is collected via Google Analytics 4 (GA4), Google Tag Manager (GTM), and Hotjar, and is used in aggregated, anonymised form to understand how our website is used and to improve it.2.3 Data from third-party platformsIf you contact us via Facebook, Instagram, WhatsApp Business, or respond to a Meta (Facebook) advertisement, we may receive your name, profile information and any message content you send. This data is also subject to Meta's own privacy policy.If you submit an enquiry via Google (e.g. clicking a Google Ads call extension or submitting a lead form), Google's privacy policy also applies.3. How We Use Your Personal DataWe use your personal data for the following purposes:Purpose Details Lawful basisProviding a quote To calculate and send you a price for our services, either instantly via our online form or following a site visit. Legitimate interest / Pre-contractual stepsDelivering our services To schedule visits, manage your care plan, communicate with your crew, send reminders and report cards. Contract performanceProcessing payments To take monthly direct debit payments or one-off card payments for services rendered. Contract performanceClient communications To respond to your enquiries, send appointment confirmations, updates about your service, and our report cards. Contract performance / Legitimate interestMarketing (email or SMS) To send you relevant offers or updates about our services, only where you have opted in or where permitted under soft opt-in rules. Consent / Legitimate interestImproving our website To understand how visitors use our site using analytics tools (GA4, Hotjar) and improve the user experience. Legitimate interestRunning paid advertising To measure the effectiveness of Google Ads and Meta (Facebook/Instagram) campaigns and optimise our marketing spend. Legitimate interestLegal compliance To meet our obligations under UK law, including HMRC record-keeping and VAT requirements. Legal obligationFraud prevention and security To protect our business and clients from fraudulent activity or misuse of our services. Legitimate interest4. Cookies and Tracking TechnologiesOur website uses cookies and similar tracking technologies. Cookies are small text files placed on your device that help us understand how you use our site and enable certain features to work.4.1 Cookies we useAnalytics: Google Analytics (GA4) Collects anonymised data about website visitors, page views and session behaviour. Data is sent to Google servers. You can opt out via browser settings or Google's opt-out tool.Tag management: Google Tag Manager (GTM) Loads and manages our tracking scripts. Does not collect data directly.Behaviour analytics: Hotjar Records anonymised session replays, heatmaps and scroll data to help us improve usability. No personally identifiable information is captured by Hotjar without consent.Advertising: Google Ads (Conversion tracking) Tracks when a user completes a quote request or visits our thank-you page after clicking a Google Ad. Used to measure campaign performance.Advertising: Meta Pixel Tracks visits and actions on our website for the purpose of measuring and optimising Meta (Facebook/Instagram) ad campaigns. May be used to serve retargeted ads to past visitors.4.2 Managing cookiesYou can control and delete cookies through your browser settings. Disabling certain cookies may affect the functionality of our website. You can also opt out of Google Analytics tracking at: tools.google.com/dlpage/gaoptoutFor Meta advertising cookies, visit: facebook.com/settings/adsFor Hotjar, visit: hotjar.com/policies/do-not-track/We will display a cookie consent notice on your first visit to our website, where relevant under UK GDPR requirements.5. Who We Share Your Data WithWe do not sell your personal data to third parties. We share data only with trusted service providers who help us operate our business, and only to the extent necessary for those purposes:Jobber (scheduling) Our field service management platform — used to schedule jobs, manage client records and generate invoices. Data is processed in the USA under Standard Contractual Clauses. See: getjobber.com/privacyGoCardless (payments) Our direct debit provider. Processes your bank details securely in accordance with UK GDPR. See: gocardless.com/privacyGoogle (analytics & ads) Google Analytics, Google Ads and Google Tag Manager. Data may be transferred internationally. See: policies.google.com/privacyMeta (advertising) Facebook/Instagram advertising platform and Meta Pixel. See: facebook.com/policy.phpHotjar (analytics) Website behaviour analytics. Data is anonymised. See: hotjar.com/privacyAirtable (CRM/data) Database and workflow management. Data is processed under Standard Contractual Clauses. See: airtable.com/privacyEmail/SMS providers Any email or SMS communication platform used to send quote confirmations or appointment reminders.HMRC and legal authorities We may disclose data where required by law, regulation, or court order.All third-party providers are required to handle your data securely and in compliance with applicable data protection law. We carry out basic due diligence on all third parties who process personal data on our behalf.6. International Data TransfersSome of our service providers (including Google and Airtable) are based outside the UK and European Economic Area (EEA). Where your data is transferred internationally, we ensure it is protected by one or more of the following safeguards:UK adequacy regulations (where the destination country is deemed to provide adequate protection)Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's OfficeThe service provider's adherence to the UK-US Data Bridge framework where applicableYou can obtain more information about the specific safeguards in place by contacting us at the details in Section 1.7. How Long We Keep Your DataWe retain your personal data only for as long as necessary for the purposes described in this policy, or as required by law. Our standard retention periods are:Active client records For the duration of our service relationship with you, plus 7 years after the last transaction (in line with HMRC record-keeping requirements for VAT and tax purposes).Enquiry and quote records If you requested a quote but did not become a client, we retain your data for 12 months, after which it is securely deleted.Marketing data Where you have opted in to marketing, we retain your data until you unsubscribe or withdraw consent. We conduct an annual review and remove contacts who have not engaged in 24 months.Website analytics data GA4 data is retained for 14 months by default. Hotjar session recordings are retained for 365 days. Aggregated, anonymised data may be retained indefinitely.Financial records Invoices, payment records and direct debit mandates are retained for 7 years from the relevant financial year end.Correspondence and communications Emails, WhatsApp messages and notes relating to client services are retained for the duration of the service plus 2 years.8. Your Rights Under UK GDPRUnder UK GDPR, you have the following rights in relation to your personal data:Right of access You have the right to request a copy of the personal data we hold about you. We will respond within one month. This is known as a Subject Access Request (SAR).Right to rectification You have the right to ask us to correct inaccurate or incomplete personal data we hold about you.Right to erasure ('right to be forgotten') You have the right to ask us to delete your personal data where there is no compelling reason for us to continue processing it. This right is not absolute — we may need to retain certain data for legal or contractual reasons.Right to restrict processing You have the right to ask us to restrict how we use your data in certain circumstances — for example, while a complaint is being investigated.Right to data portability Where we process your data by automated means on the basis of your consent or a contract, you have the right to receive a copy of that data in a structured, commonly used format.Right to object You have the right to object to us processing your data where we rely on legitimate interests as our lawful basis. We must stop processing unless we can demonstrate compelling legitimate grounds that override your interests.Rights in relation to automated decision-making You have the right not to be subject to decisions made solely by automated processing that have a significant legal or similarly significant effect on you. We do not currently use fully automated decision-making in relation to our clients.Right to withdraw consent Where we process your data on the basis of your consent (e.g. for marketing), you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing before the withdrawal.To exercise any of your rights, please contact us at info@abgardens.co.uk with the subject line 'Data Rights Request'. We will respond within one calendar month. We may need to verify your identity before processing your request. There is no charge for exercising your rights in most cases.9. Direct MarketingWe may send you marketing communications by email, SMS or WhatsApp in the following circumstances:You have given us your explicit consent to receive marketing communications when submitting a form on our website.You are an existing client and we are marketing similar services to those you have already purchased from us (the 'soft opt-in' rule under PECR). You will always be given a clear option to opt out.We will never share your contact details with third parties for their marketing purposes.To unsubscribe from any marketing communication, simply reply with 'STOP' (SMS/WhatsApp) or click the unsubscribe link in any email. You can also contact us directly at info@abgardens.co.uk.10. How We Protect Your DataWe take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it, including:All data is transmitted over encrypted connections (HTTPS/TLS).Access to client records in Jobber and Airtable is restricted to authorised personnel only, with role-based access controls.We do not store payment card details — all card transactions are processed by PCI-DSS compliant payment processors.Direct debit mandates are processed and stored by GoCardless, which is regulated by the FCA and subject to its own rigorous security standards.We conduct regular reviews of who has access to personal data and remove access when it is no longer required.Our staff and contractors who handle personal data receive guidance on data protection obligations.In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours where required by law, and will notify affected individuals without undue delay.11. Children's DataOur services and website are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data about a child, please contact us immediately at info@abgardens.co.uk and we will delete it promptly.12. Links to Third-Party WebsitesOur website may contain links to third-party websites, including our social media profiles (Facebook, Instagram) and payment platforms. This privacy policy applies only to our website and services. We are not responsible for the privacy practices of third-party sites and encourage you to read their privacy policies before providing any personal data.13. Changes to This Privacy PolicyWe may update this privacy policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make significant changes, we will update the effective date at the top of this document and, where appropriate, notify active clients by email.We encourage you to review this policy periodically. Continued use of our services after any changes constitutes your acceptance of the updated policy.The most current version of this policy is always available at www.kelticgrounds.co.uk/privacy-policy.14. How to ComplainIf you are unhappy with how we have handled your personal data, please contact us in the first instance at info@abgardens.co.uk. We will investigate your complaint and respond within 30 days.If you are not satisfied with our response, or if you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the UK's data protection supervisory authority:Name Information Commissioner's Office (ICO)Website www.ico.org.ukPhone 0303 123 1113Post Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AFPlease note that you also have the right to seek a remedy through the courts if you believe your data protection rights have been infringed.15. Contact UsFor any questions, concerns or requests relating to this privacy policy or the personal data we hold about you, please contact us:Data controller ABgardens Ltd (trading as Keltic Grounds Co.)Email info@abgardens.co.ukPhone 07881 121 798Website www.kelticgrounds.co.ukAddress Sevenoaks, KentThis document was prepared for ABgardens Ltd t/a Keltic Grounds Co. and reflects our practices as at the date above. This is not a substitute for legal advice. We recommend having this policy reviewed by a qualified solicitor before publication, particularly if you expand your use of data processing tools, employ staff, or take on commercial contracts with specific data handling requirements.