Gardeners Grange Park Privacy Policy

This Privacy Policy explains how Gardeners Grange Park collects, uses, stores and protects your personal data. It applies to all Gardeners Grange Park customers in the area, including individuals who visit our premises, use our services, make enquiries or otherwise interact with us offline or online.

We are committed to protecting your privacy and handling your personal data in a fair, transparent and secure manner, in line with applicable data protection laws, including the UK General Data Protection Regulation and the Data Protection Act.

Personal data we collect

We may collect and process the following categories of personal data about you:

Identification and contact details such as your name, postal address, general area of residence, and communication preferences.

Booking and service information such as dates and times of visits, reservations or bookings, details of services you request or purchase, and related correspondence.

Payment and transaction details such as payment method, limited payment details required to process your transaction, and records of payments and refunds. We do not store full card details when payments are processed by secure third-party payment processors.

Communication records such as enquiries, complaints, feedback or other communications you send to us, and any responses we provide.

Usage and technical information such as basic analytics about how you interact with our website or digital services, including pages viewed, time spent and general device information, where this is collected in accordance with applicable cookie and tracking rules.

On-site information such as information related to safety, security and conduct on our premises, which may include incident reports where necessary for legal or safety reasons.

How we collect your personal data

We collect personal data in several ways:

Directly from you when you contact us, make a booking, complete a form, request information, give feedback, or otherwise communicate with us.

Through your use of our services when you visit Gardeners Grange Park or participate in activities, events or services that we provide.

From third parties where permitted by law, such as payment processors that confirm a successful payment, or service partners involved in delivering your booking or event.

Automatically when you interact with our website or digital services, where limited technical and usage information may be gathered using standard technologies in accordance with applicable laws and your choices.

Lawful bases for processing your personal data

We only process your personal data where we have a lawful basis to do so. Depending on the context, we rely on the following lawful bases:

Performance of a contract. We process personal data where it is necessary to enter into or perform a contract with you, for example to manage bookings, provide services you have requested, process payments and communicate with you about your use of our services.

Legitimate interests. We process personal data where it is necessary for our legitimate interests, provided these are not overridden by your rights and freedoms. This includes managing and improving our park and services, maintaining safety and security, responding to enquiries, managing customer relationships and carrying out basic analytics to understand how our services are used.

Legal obligations. We process personal data where we are required to do so to comply with legal or regulatory obligations, such as tax and accounting requirements, health and safety obligations, and responding to lawful requests from authorities.

Consent. In some cases we may rely on your consent, for example for certain forms of direct marketing or for the use of specific optional cookies or similar technologies where required by law. When we rely on consent, you can withdraw it at any time, although this will not affect processing that has already taken place.

How we use your personal data

We use your personal data for the following purposes:

To provide and manage our services, including processing bookings, organising events, maintaining customer records, and delivering the services you request.

To communicate with you, including responding to your enquiries, sending essential service messages related to your bookings or visits, and providing information about changes to our policies, services or facilities.

To manage payments and accounts, including processing payments, refunds, and keeping appropriate records for accounting and audit purposes.

To ensure safety and security in Gardeners Grange Park, including incident management, risk assessment and compliance with health and safety obligations.

To improve our services, including monitoring the use of our facilities and website, analysing trends, and planning future developments and offerings.

To comply with legal and regulatory requirements and to establish, exercise or defend legal claims where necessary.

Data sharing and use of processors

We may share your personal data with selected third parties where necessary for the purposes described in this Privacy Policy and where there is a lawful basis. These third parties may include:

Service providers acting as data processors who provide services on our behalf, such as payment processing, booking and reservation systems, customer management tools, IT hosting, maintenance and security services, and analytics or administrative support. These processors are contractually required to handle personal data only in accordance with our instructions and to implement appropriate security measures.

Professional advisers such as accountants, auditors, legal advisers and consultants, where disclosure is necessary for the provision of their services and subject to confidentiality obligations.

Public authorities and regulatory bodies where required by law or where we reasonably believe disclosure is necessary to comply with legal obligations, protect safety or assert legal rights.

We do not sell your personal data to third parties.

International transfers

Where data processors or service providers are located outside the United Kingdom or the European Economic Area, we take steps to ensure that your personal data is protected in accordance with applicable data protection laws. This may include relying on adequacy regulations or implementing appropriate safeguards such as standard contractual clauses.

Data retention

We retain your personal data only for as long as is necessary for the purposes for which it was collected, and to meet legal, accounting or reporting requirements.

The exact retention period depends on the type of data and the context in which it was collected. In general, we apply the following criteria:

Customer and booking records are kept for as long as you remain an active customer and for a reasonable period thereafter to handle enquiries, disputes or potential claims.

Financial and transaction records are retained for the period required by tax and accounting regulations.

Incident and safety records are retained for the duration necessary to comply with legal obligations and to manage potential claims.

When personal data is no longer required, we will either delete it securely or anonymise it so that it can no longer be associated with an identifiable individual.

Your data protection rights

As a data subject, you have several rights in relation to your personal data, subject to certain conditions and limitations under data protection law:

Right of access. You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data, together with certain information about how it is used.

Right to rectification. You have the right to request that inaccurate or incomplete personal data about you is corrected or updated.

Right to erasure. In some circumstances you have the right to request that we delete your personal data, for example where it is no longer needed for the purposes for which it was collected or where you withdraw consent and there is no other lawful basis for processing.

Right to restriction. You have the right to request that we restrict the processing of your personal data in certain situations, for example while we verify the accuracy of the data or consider an objection you have raised.

Right to object. You may have the right to object to processing based on our legitimate interests, including certain forms of profiling, and to direct marketing. We will stop processing unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms or where processing is required for legal claims.

Right to data portability. Where processing is based on consent or on a contract and carried out by automated means, you may have the right to receive your personal data in a commonly used, machine-readable format and to request that it is transmitted to another controller where technically feasible.

Right to withdraw consent. Where we rely on your consent to process personal data, you can withdraw that consent at any time. This will not affect the lawfulness of processing before withdrawal.

You also have the right to raise concerns with the relevant data protection authority if you believe your data protection rights have been infringed.

Security of your personal data

We take appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures are proportionate to the nature of the data and the risks associated with processing it and are reviewed and updated from time to time.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services or legal obligations. Any updates will be effective from the date of publication. We encourage you to review this Privacy Policy periodically to stay informed about how we handle your personal data.