We’re a family garden centre on Canal Road, not a data company. We only ask for what we need to sell you things, deliver them and answer your questions, we look after it properly, and we never sell it. This page explains, in plain English, what we collect, why, who helps us and the rights you have under UK data protection law.
1. Who we are
ACW Garden Centre is run by ACW Garden Centre LLP, a limited liability partnership registered in England and Wales (registered number OC340899). For this website and our online shop we are the “controller” of your personal data, which means we decide how it is used and we’re responsible for looking after it.
ACW Garden Centre
Canal Road, Bradford, West Yorkshire BD2 1AL
Phone: 01274 392344
Email: enquiries@acwgardencentre.com
For anything about your personal data, email us with “Privacy” in the subject line, write to us at the address above or call and ask for the manager.
This policy covers our website, our online shop, orders by phone or email, and enquiries you send us. Our website contains links to other sites, such as our Facebook and Instagram pages. Those sites have their own privacy policies and we’re not responsible for them.
2. What we collect
Information you give us
- When you order online, by phone or by email: your name, billing and delivery address, email address, phone number, what you’ve ordered, any delivery notes (for example “leave it round the back”) and your choice of delivery or click & collect.
- When you pay: card payments are handled by our payment provider, Stripe. Your full card number goes straight to Stripe and is never seen or stored by us. We only see things like the card type, the last four digits, the expiry date and whether the payment went through (see section 4).
- When you contact us: your name, contact details and whatever you tell us in your message, call or email, for example about a product, a delivery or a mower service.
- When you book a service or repair: your name, contact details and details of the machine and the work needed.
- Returns, refunds and problems with an order: the details we need to sort things out.
We don’t ask for, and don’t want, sensitive information such as health details. Please don’t include it in messages unless it’s genuinely needed, for example a mobility need that affects how we deliver.
Information collected automatically
- Technical information: when you visit our website your device sends information such as your IP address, browser type, device type and the pages you view. Our web host keeps this in server logs for security.
- Visit statistics: we count visits, popular pages and how people use the shop (for example which products are viewed) so we can improve the site (see Cookies).
- Search and SEO monitoring: we use an SEO tool, Harbor SEO, to see what people search for and where our pages could be more helpful. When a page loads, the tool receives the address of the page you’re viewing, the page or site you came from (and any campaign tag in the link) and, as with any web request, your IP address and basic browser details. Harbor SEO processes this for us and only on our instructions. We use it to improve our pages, not to identify you.
- Where an order came from: our shop software records basic information about how you found us when you place an order, for example “from Google search” or “from Facebook”, and the type of device used. We use this to see which of our efforts are worth the bother.
- Fraud-prevention information: when you pay by card, Stripe collects information about your device and connection to help spot fraud.
Information from others
Stripe tells us whether a payment succeeded, failed or was refunded. If someone else orders a gift to be delivered to you, they will give us your name and address for the delivery.
3. How we use it and why
UK data protection law says we must have a valid reason, called a “lawful basis”, for each use of your data. Here’s ours.
| What we do | Lawful basis |
|---|---|
| Take and process your order, take payment, deliver it or get it ready for collection, and send order confirmations and updates | Contract: we need it to sell you what you’ve ordered |
| Deal with cancellations, returns, refunds, faulty goods and your other consumer rights | Contract and legal obligation (consumer law) |
| Keep sales records and invoices for tax and accounting | Legal obligation (for example HMRC and company law) |
| Answer your questions and enquiries, and book services and repairs | Contract, where it relates to an order or booking; otherwise our legitimate interests in replying to people who contact us |
| Prevent fraud and keep our website and shop secure | Legitimate interests, and in some cases legal obligation |
| Understand how our website is used and which advertising works, so we can improve it | Legitimate interests (see Cookies for how to object) |
| Send you marketing emails or texts | Your consent, or the “soft opt-in” for existing customers (see section 6) |
| Deal with legal claims or disputes | Legitimate interests in protecting our business |
Where we rely on legitimate interests, we’ve weighed up our interests against yours and only go ahead where your privacy isn’t unfairly affected. You can ask us for more detail and you have the right to object (see section 12).
If you don’t give us the details we need for an order, such as a delivery address, we won’t be able to complete it. We don’t make decisions about you using fully automated processes that have a legal or similarly significant effect, although Stripe uses automated fraud checks on card payments (see below).
4. Card payments and Stripe
Online card payments are processed by Stripe, one of the world’s biggest payment providers. When you pay:
- your card details are entered into Stripe’s secure payment form and go directly to Stripe. They never touch our website’s database and we can’t see your full card number;
- Stripe uses your payment details, and information about your device and connection, to process the payment, prevent fraud and meet its own legal duties, such as anti-money-laundering rules;
- Stripe may set cookies or similar technologies on our checkout pages for these purposes (see Cookies);
- Stripe tells us the result of the payment and gives us limited card details so we can match payments and issue refunds.
For some of this, mainly fraud prevention and legal compliance, Stripe acts as a separate controller, which means it is responsible for that data under its own privacy policy. You can read it at stripe.com/gb/privacy. If you pay with Apple Pay, Google Pay or another wallet where offered, that provider’s own privacy terms also apply.
If you pay by card in store or over the phone, the card payment is processed by our card payment provider and we don’t keep your full card number.
5. Delivery and click & collect
We deliver within about 15 miles of the garden centre. To work out the delivery price at checkout, your delivery address or postcode is checked against a mapping service (Google) to calculate the distance from our store. Our delivery team uses your name, address, phone number and delivery notes to get your order to you and to call you if they can’t find you or need to rearrange.
For click & collect we use your name, order number and contact details to let you know when your order is ready and to hand it to the right person.
6. Marketing
We’ll only send you marketing emails or texts, such as offers, news or “the real Christmas trees have landed”, if:
- you’ve told us you want them; or
- you’ve bought from us or started to buy from us, we gave you a clear chance to say no at the time, and the messages are about similar products and services from us (the “soft opt-in”).
Every marketing message has an easy way to unsubscribe, or you can just tell us. We’ll stop and keep a note of your details on a “do not contact” list so we don’t contact you again by mistake. Saying no to marketing won’t affect your orders. Order confirmations and delivery updates aren’t marketing, so you’ll still get those.
We never sell or rent your details to anyone for their marketing.
7. Who we share it with
We only share what’s needed with trusted businesses that help us run the shop. Where they act on our behalf (as “processors”), they may only use your data on our instructions and must keep it secure.
| Who | What for |
|---|---|
| Stripe | Card payments, fraud prevention and refunds (see section 4) |
| Our web host (Guru, a UK hosting company) | Hosting our website, shop and order database, and sending order emails through its mail service |
| Website software and maintenance providers, including WooCommerce and Jetpack (Automattic) and our website backup and monitoring service | Running the shop, website security, backups and visit statistics |
| Harbor SEO (Kraft Agency Limited, Ireland) | Monitoring what people search for and which pages need improving (see section 2). Some of its own service providers are in the United States. |
| Calculating delivery distances, the map on our website and the fonts used on our pages | |
| Our accountants, IT support and professional advisers | Accounts, audits, technical help and legal advice |
| HMRC, the police and other authorities | Only where the law requires it, or to prevent or detect fraud or crime |
If our business, or part of it, is ever sold or restructured, customer records may be passed to the new owner so they can carry on looking after you, under the same protections.
8. Data sent outside the UK
Some of our providers, including Stripe, Google, Automattic and Harbor SEO, are based in, or use servers in, the United States or the European Economic Area. Where your data leaves the UK, we make sure it’s protected in a way UK law recognises. That might be a country or organisation the UK Government has approved as offering adequate protection, such as the EEA or US companies certified under the UK Extension to the EU-US Data Privacy Framework, or the UK’s standard contract clauses (the International Data Transfer Agreement or Addendum). Ask us if you’d like more detail.
9. How long we keep it
We keep your data only as long as we need it, then delete or anonymise it.
| Information | How long |
|---|---|
| Orders, invoices and payment records | 6 years from the end of the financial year the order falls in, to meet tax and accounting rules and to deal with any claims |
| Enquiries and messages that don’t lead to an order | Up to 2 years |
| Service and repair records | 6 years from the last job, so we can deal with warranty queries and claims |
| Marketing consent and preferences | Until you unsubscribe. After that we keep a minimal “do not contact” record. |
| Website server logs and visit statistics | As set by our host and statistics provider, usually a matter of months |
10. Cookies
Cookies are small files saved by your browser. Similar technologies, such as your browser’s local storage, work in much the same way and the same rules apply, so we include them here. Some of these our website can’t work without, and some help us understand how the site is used. We don’t use advertising or tracking cookies to follow you around the internet.
| Type | Examples | Why |
|---|---|---|
| Strictly necessary | WooCommerce cart and session cookies; Stripe’s security cookies at checkout; “acw_cookie_choice”, which remembers your cookie choice | To remember what’s in your basket, take you through checkout safely and prevent fraud. These don’t need your consent because the shop can’t work without them. |
| Statistics | WooCommerce Analytics via Jetpack (Automattic, cookies beginning “tk_”); WooCommerce order attribution (cookies beginning “sbjs_”); Harbor SEO (browser storage entries beginning “harbor_seo”, which only note which page addresses it has already checked) | To count visits, see which pages and websites bring people to us and spot gaps in our pages, so we can improve the site. Under UK law (as updated by the Data (Use and Access) Act 2025) these can be used without asking first, as long as we tell you about them and you can easily object. |
| Third-party content | Google Maps on our Find Us page; Google Fonts | To show you a map and display our pages properly. The map only loads if you click “Show the map”, and Google may then set its own cookies. Google Fonts receives your IP address when our pages load. |
Your choice: when you first visit, a short cookie notice lets you choose OK or Opt out. Opting out switches off the statistics tools listed above (WooCommerce Analytics, order attribution and Harbor SEO) and clears their cookies and stored data from your browser. You can change your mind at any time using the Cookie settings link at the bottom of every page. We remember your choice with a cookie called “acw_cookie_choice” for 12 months.
You can also block or delete cookies and stored site data in your browser settings. If you block strictly necessary cookies, the basket and checkout won’t work.
11. Keeping it safe
Our website uses an encrypted (HTTPS) connection. Card payments are handled by Stripe, which is certified to the highest payment card security standard (PCI DSS Level 1). Access to customer and order information is limited to staff who need it, protected by passwords, and our website is kept updated and backed up. No system is 100% secure, but if something did go wrong that put your information at risk, we’d follow the law, which includes telling the Information Commissioner’s Office and, where needed, you.
12. Your rights
Under UK data protection law you have the right to:
- Access: ask for a copy of the personal data we hold about you;
- Correction: ask us to correct anything wrong or incomplete;
- Erasure: ask us to delete your data. We may have to keep some records, such as invoices, for legal reasons;
- Restriction: ask us to limit how we use your data in certain circumstances;
- Object: object to us using your data based on legitimate interests, and to direct marketing at any time (we’ll always stop marketing when asked);
- Portability: ask for data you gave us in a commonly used electronic format, where we use it under contract or consent;
- Withdraw consent: where we rely on your consent, withdraw it at any time. This doesn’t affect anything we did before.
To use any of these rights, contact us using the details in section 1. It’s free in most cases. We may need to check your identity first and may ask you to clarify what you’re after. We’ll reply within one month, or tell you within that month if we need longer for a complex request (up to two further months). The time limit doesn’t run while we’re waiting for ID or a clarification from you.
13. Complaints
If you’re unhappy with how we’ve handled your personal data, please tell us first. Email enquiries@acwgardencentre.com with “Privacy complaint” in the subject line, write to us or give us a ring. We’ll acknowledge your complaint within 30 days, look into it properly and let you know the outcome without undue delay.
If you’re still not happy, you can complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO), at ico.org.uk/make-a-complaint or on 0303 123 1113. The ICO generally expects you to have raised the issue with us first.
14. Children
Our online shop is for adults. You must be 18 or over to place an order. We don’t knowingly collect personal data from children through this website. If you think a child has given us their details, let us know and we’ll delete them.
15. Changes to this policy
We’ll update this policy when the law changes or the way we work changes, for example when we add new ways to pay or new services. The date at the top shows when it was last updated. If we make a big change that affects how we use your existing data, we’ll tell you directly where we can.