Privacy Policy
Your Garden Companions CIC | Company No. 17184542 | Version 1.0 | Last updated: May 2026 | Next review: May 2027
Our commitment to your privacy: Your Garden Companions CIC takes your privacy seriously. We collect only the information we genuinely need, we keep it securely, we never sell it, and we are transparent about how we use it. This policy explains your rights and how to exercise them.
1. Who We Are
Your Garden Companions CIC is a Community Interest Company (Company No. 17184542) registered in England and Wales. We provide companion gardening and horticultural therapy services to older and less able people across Cumbria, including one-to-one home visits, community group sessions, and care home sessions.
For the purposes of data protection law, Your Garden Companions CIC is the data controller in respect of the personal information we collect and process. Our joint data controllers are Louise Crouch and Tara Booth.
You can contact us about any data protection matter at [email address] or by writing to us at [registered address].
2. The Information We Collect
We collect different types of personal information depending on how you interact with us:
Category
Examples
Who This Applies To
Identity information
Full name, date of birth, photograph (with consent)
Clients, carers, referrers, volunteers
Contact information
Home address, telephone number, email address
Clients, carers, referrers, enquirers
Health and care information
Medical conditions, mobility needs, cognitive impairment, medication relevant to participation, care needs
Clients
Next of kin / emergency contact
Name, relationship, and telephone number of emergency contact
Clients
Referral information
Name and details of referring professional or organisation (e.g. GP, Link Worker, social worker)
Clients
Session records
Notes from sessions, observations about progress and wellbeing, any incidents or concerns
Clients
Safeguarding records
Information relating to safeguarding concerns, disclosures, or referrals — held separately and securely
Clients
Financial information
Bank details for payment of invoices (care homes and commissioned services only)
Commissioning organisations
Website and enquiry data
Enquiries submitted via our website or by email; IP address if you use our website
Website visitors, enquirers
A note on health information: Health information is 'special category' data under UK GDPR, which means it receives a higher level of legal protection. We only collect health information about clients where it is strictly necessary to deliver our service safely and appropriately. We will always explain why we need it and ask for your consent before collecting it.
3. How We Collect Your Information
We collect personal information in the following ways:
- Directly from you — when you contact us to enquire about or sign up for our services, when you complete an intake form, or during sessions themselves.
- From a referrer — such as an NHS Social Prescribing Link Worker, GP, social worker, or care home staff member, who provides your details when making a referral with your knowledge and consent.
- From a family member or carer — where they contact us on your behalf.
- From care home staff — who share relevant information to enable us to support you safely during sessions.
- Automatically — if you visit our website, standard technical data (such as your IP address and browser type) may be collected automatically by our website platform.
We will always tell you what information we need and why before we collect it. We will never collect more information than we need.
4. Why We Use Your Information — Our Lawful Bases
Data protection law requires us to have a lawful basis for processing your personal information. The table below explains the purposes for which we use your data and the legal basis we rely on in each case:
Purpose
Lawful Basis
Applies To
Delivering our companion gardening service to you safely and appropriately
Contract / Legitimate interests
Clients
Keeping records of sessions and your progress
Legitimate interests
Clients
Communicating with you about your sessions and appointments
Contract / Legitimate interests
Clients, carers
Responding to your enquiry
Legitimate interests
Enquirers
Processing health information to adapt sessions to your needs
Explicit consent / Vital interests
Clients
Fulfilling our safeguarding duties and protecting adults at risk
Legal obligation / Vital interests
Clients
Complying with legal and regulatory obligations (e.g. CIC reporting, DBS)
Legal obligation
All
Communicating with referrers about your progress
Consent
Clients
Improving our services through anonymised feedback and impact data
Legitimate interests
Clients (anonymised)
Where we rely on your consent to process your personal data — particularly health information and sharing updates with your referrer — you have the right to withdraw that consent at any time. Withdrawing consent will not affect the lawfulness of processing carried out before the withdrawal.
5. Who We Share Your Information With
We do not sell, rent, or trade your personal information. We share it only where necessary, and only with the following categories of recipient:
Recipient
Reason for Sharing
Your referrer (e.g. GP, Link Worker, social worker)
To provide updates on your engagement and progress — only with your prior consent
Care home or extra-care facility staff
To coordinate safe delivery of sessions on their premises and to flag any concerns
Emergency services or statutory agencies
Where there is an immediate risk to life or a safeguarding duty to refer (without requiring consent in urgent situations)
Local Authority Adult Social Care
Where we are legally required to make a safeguarding referral under the Care Act 2014
Our insurers
Where required to process a claim involving you
IT service providers hosting our data
Under strict data processing agreements — they may not use your data for any other purpose
We do not transfer your personal data outside the United Kingdom.
6. How Long We Keep Your Information
We keep your personal information only for as long as it is needed, or as required by law:
Type of Record
Retention Period
Client intake and session records
7 years after last session
Safeguarding records
7 years minimum (indefinitely if serious incident)
Referral correspondence
7 years after last contact
Financial records
6 years after the end of the financial year
Volunteer / staff records
6 years after end of engagement
DBS disclosure information
6 months after decision made (outcome retained thereafter)
Website enquiries
12 months from receipt
When information is no longer needed, it is securely deleted from digital systems and physically destroyed where held in paper form.
7. How We Keep Your Information Safe
We take the security of your personal information seriously. Our measures include:
- Client records are held in password-protected digital files, accessible only to our two directors
- Paper records (where used) are kept in a locked cabinet and not left unattended
- Devices used for client-related work are password-protected and kept up to date with security software
- We do not discuss client information in public places or with people who do not need to know it
- Any third parties who process data on our behalf are bound by data processing agreements requiring them to maintain appropriate security
- In the event of a personal data breach likely to risk harm to individuals, we will notify the Information Commissioner's Office (ICO) within 72 hours
8. Your Rights
Under UK GDPR, you have the following rights in relation to your personal data. You can exercise any of these rights by contacting us at hello@yourgardencompanions.org:
Your Right
What It Means
Right of access
You can ask us for a copy of the personal information we hold about you (a 'subject access request'). We will respond within one calendar month, free of charge.
Right to rectification
If information we hold about you is inaccurate or incomplete, you can ask us to correct it.
Right to erasure
In certain circumstances, you can ask us to delete your personal data. This right does not apply where we are required by law to retain it (e.g. safeguarding records).
Right to restrict processing
You can ask us to stop actively using your data while a dispute about its accuracy or use is resolved.
Right to object
You can object to processing based on legitimate interests. We will stop unless we can demonstrate compelling grounds that override your interests.
Right to withdraw consent
Where we rely on consent to process your data, you can withdraw that consent at any time without affecting any processing already carried out.
Right to complain
If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner's Office (ICO).
Making a subject access request: To request a copy of your personal data, please email us at [email address] with the subject line 'Subject Access Request'. We will acknowledge your request within five working days and respond fully within one calendar month. There is no charge for this service.
9. Cookies and Our Website
Our website may use cookies — small text files placed on your device — to enable the site to function and to help us understand how it is being used. We will only place non-essential cookies (such as analytics cookies) on your device with your consent, which you can give or withdraw using the cookie preferences shown when you first visit our site.
We do not use your website data to identify you personally, and we do not combine website analytics data with client records.
10. Photography and Testimonials
We may wish to use photographs or written testimonials for our website, social media, or grant reporting. We will always ask for your explicit written consent before taking any photographs during sessions, explain clearly how any image or testimonial will be used, and remove it promptly if you ask us to — even after it has been published.
Consent for photography is always separate from consent for services. You will never be disadvantaged in any way for declining to be photographed or to provide a testimonial.
11. Changes to This Policy
We review this privacy policy annually and following any significant change to our operations or to applicable data protection law. If we make material changes that affect how we use your personal data, we will contact you directly to inform you. This policy was first adopted in May 2026 and is due for review in May 2027.
12. How to Contact Us or Make a Complaint
If you have any questions about this privacy policy, wish to exercise your rights, or have a concern about how we have handled your personal information, please get in touch:
- Email: hello@yourgardeoncompanions.org
- Phone: 07919620717
If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO):
Information Commissioner's Office (ICO)
Website: ico.org.uk
Telephone: 0303 123 1113 (Monday–Friday, 9am–5pm)
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Your Garden Companions CIC | Company No. 17184542 | Louise Crouch & Tara Booth, Directors | Privacy Policy v1.0 | May 2026