This policy explains what personal information HOME & GARDEN BDG LTD collects when you use this website or buy from us, why we collect it, the legal basis we rely on, how long we keep it, who we share it with, and the rights you have over it. We have written it to be read, not skimmed past.

1. Who we are

The controller of your personal information is HOME & GARDEN BDG LTD, trading as Longevity Gardening, a company registered in England and Wales under company number 16484171, with its registered office at Unit 6 Ash Road North, Wrexham Industrial Estate, Wrexham, Wales, LL13 9JT, United Kingdom.

Questions or requests about your personal information: orders@longevitygardening.com, +44 7576 399918 (Monday to Friday, 9:00 am to 5:00 pm (UK time)), or write to us at the address above.

2. What we collect and where it comes from

Almost everything we hold about you comes from you, when you order, create an account, contact us or use the site. Specifically:

• Identity and contact details — your name, email address, telephone number, and delivery and billing addresses. You give these to us at checkout (on our payment provider’s secure page), when you create an account, or when you contact us.
• Order details — what you bought, when, at what price, delivery information, tracking numbers, and any returns, refunds or guarantee claims. Created by us when you order.
• Payment information — payment is taken by our payment provider, Stripe. We receive confirmation that you paid, the last four digits and type of your card, and the billing address. We never see or store your full card number or security code.
• Account details — if you create an account: your login email, a password we store only in encrypted (hashed) form, and your saved addresses and order history.
• Communications — emails, contact-form messages and phone notes about your orders, returns, guarantee claims or questions, so we have a record of what was agreed.
• Reviews — the name, rating and text you submit if you review a product.
• Technical and usage information — the pages you visit, the products you view and add to your basket, the device and browser you use, your IP address and approximate location, collected through cookies and similar technologies as described in section 5.

We do not collect special category data (such as health information) and do not need it to run the shop. We do not knowingly collect information from anyone under 18 (section 9).

3. Why we use it, and the legal basis

UK data protection law requires a lawful basis for each use. These are ours:

• To take, deliver and support your order — including payment, delivery, returns, refunds and guarantee claims, and the emails that confirm and track them. Basis: performance of a contract with you.
• To keep the records the law requires — order and payment records for tax and accounting, and records of consumer-law obligations such as returns and guarantee claims. Basis: legal obligation.
• To prevent fraud and keep the site secure — checking payments, detecting abuse of accounts or discount codes, and protecting our systems. Basis: legitimate interests in running a safe business; our payment provider also carries out its own fraud checks as a controller in its own right.
• To run and improve the shop — understanding which products and pages people use, fixing errors, and measuring whether the site works on different devices. Basis: legitimate interests, and, for analytics cookies, your consent (section 5).
• To answer your questions and manage complaints — Basis: legitimate interests in good customer service, and contract where the question concerns an order.
• To send you marketing — only if you have asked for it. Basis: consent, which you can withdraw at any time by using the unsubscribe link in any marketing email or by contacting us. We do not sell your personal information and we do not send marketing on behalf of other businesses.

Where we rely on legitimate interests we have considered the effect on you and concluded that it is what you would reasonably expect of an online shop and does not override your rights. You can ask us for details of that assessment.

4. Who we share it with

We share personal information only with organisations that help us run the shop, and only what they need for that:

• Stripe, our payment provider, which processes your payment, collects your delivery address and telephone number on its secure checkout page, and runs fraud prevention. Stripe’s own privacy policy applies to how it handles your card details.
• Delivery carriers, who receive your name, delivery address and telephone number to deliver your order and send delivery notifications.
• Our hosting, email and IT providers, who store and transmit data on our behalf under contracts that require them to protect it.
• Google, where you have consented to analytics or advertising cookies (section 5), which receives technical and usage information about your visit.
• Professional advisers and authorities — our accountants, insurers and lawyers where necessary, and HMRC, courts, regulators or the police where the law requires or permits it.
• A buyer of the business, if we sell or restructure it, in which case your information transfers under the same protections and we will tell you.

We do not sell personal information, and we do not share it with anyone for their own marketing.

5. Cookies, analytics and advertising

Cookies are small files placed on your device. We use two kinds:

• Strictly necessary cookies — the ones that make the shop work: your basket, your login session, the theme you chose and your cookie choice itself. These do not need consent and cannot be switched off without breaking the site.
• Analytics and advertising cookies — used only where we have enabled Google Analytics, Google Tag Manager or Google Ads conversion measurement, and only with your consent. When you first visit, a banner asks whether you accept them. Until you choose, and if you decline, these tools run in a consent-denied mode that sets no advertising or analytics cookies (Google Consent Mode). You can change your choice at any time by clearing the “cookie_consent” cookie in your browser, which brings the banner back.

Analytics tells us which pages and products are viewed, added to the basket and bought, so we can improve the shop; advertising measurement tells Google whether a click on an advert led to a purchase. Google may use this information in accordance with its own privacy policy, including transfers outside the UK (section 6). We do not use cookies to build profiles of you for third parties.

6. International transfers

We are based in the United Kingdom and keep your order records here. Some of our providers — including Stripe and Google — process data in other countries, including the United States. Where personal information leaves the UK we make sure it is protected either by a UK adequacy regulation for the destination, or by the UK International Data Transfer Agreement or Addendum (the UK’s approved contract terms), together with the provider’s own safeguards. You can ask us for details of the safeguards that apply to a particular provider.

7. How long we keep it

• Order, payment and refund records — six years after the end of the financial year of the order, because HMRC requires us to keep them, and because consumer claims can be brought for up to six years in England, Wales and Northern Ireland (five in Scotland).
• Guarantee claims and correspondence about an order — for as long as the guarantee could still be claimed, plus the same six-year period.
• Account details — until you delete your account or ask us to, after which we keep only what the order-record rule above requires.
• Marketing consent — until you withdraw it. We keep a record that you unsubscribed so we do not contact you again.
• Contact-form messages and general enquiries — up to two years, so we can refer back if you contact us again.
• Reviews — for as long as the product is sold, unless you ask us to remove yours.
• Analytics data — held by Google for the retention period set in our analytics account (by default two months for user-level data), and only where you consented.

When a period ends we delete the information or anonymise it so it no longer identifies you.

8. Your rights

Under the UK GDPR you have the right to:

• Access — ask for a copy of the personal information we hold about you and how we use it.
• Rectification — ask us to correct information that is inaccurate or incomplete.
• Erasure — ask us to delete your information where we no longer need it (we must keep order records for the periods in section 7, and will tell you if that applies).
• Restriction — ask us to stop using your information in certain circumstances, for example while a correction is checked.
• Portability — receive the information you gave us in a structured, commonly used, machine-readable format, or have it sent to another provider where technically feasible.
• Object — to uses based on legitimate interests, and to marketing at any time, in which case we will stop.
• Withdraw consent — where we rely on consent (marketing, non-essential cookies), at any time, without affecting anything done before you withdrew it.

We do not make decisions about you by automated means that have a legal or similarly significant effect. To exercise any right, email orders@longevitygardening.com or write to us at the address in section 1. We will respond within one month; if a request is complex we may take up to two further months and will tell you why. There is no fee unless a request is clearly unfounded or excessive. We may ask you to confirm your identity before releasing information.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk, telephone 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

9. Children

This shop is for adults. We do not sell to, or knowingly collect personal information from, anyone under 18 (some of our products are age-restricted by law). If you believe a child has given us personal information, contact us and we will delete it.

10. Security

The site is served over an encrypted connection (HTTPS). Payments are handled entirely on our payment provider’s PCI DSS–certified systems, so card details never touch our servers. Account passwords are stored only as one-way hashes. Access to order data is limited to the people who need it to fulfil and support orders. No system is perfectly secure; if a breach occurs that is likely to put your rights at risk, we will tell you and the ICO as the law requires.

11. Links to other sites

Where this site links to other websites — a carrier’s tracking page, our payment provider, a manufacturer’s manual — their privacy policies apply once you leave ours.

12. Changes to this policy

We will update this policy when our practices or the law change, and the current version is always the one published here. If a change materially affects how we use information we already hold about you, we will tell you by email or by a notice on the site before it takes effect.

13. Contact

Data protection questions and requests: orders@longevitygardening.com, +44 7576 399918 (Monday to Friday, 9:00 am to 5:00 pm (UK time)), through our contact page, or by post to HOME & GARDEN BDG LTD, Unit 6 Ash Road North, Wrexham Industrial Estate, Wrexham, Wales, LL13 9JT, United Kingdom.