1. Who we are
This privacy policy explains how Fernwick Garden Design Ltd (“Fernwick”, “we”, “us”) collects and uses personal data when you visit our website, contact us, or become a client. We are a garden and landscape design studio based in Bath, working across Bath, Bristol, Wiltshire and the Cotswolds.
The data controller responsible for your personal data is:
Fernwick Garden Design Ltd
14 Walcot Street, Bath BA1 5BG, United Kingdom
Registered in England and Wales, company no. 14582937
ICO registration no. ZB712845
Telephone: 01225 480 312
Email for privacy requests: [email protected] (subject line “Privacy request”)
We are a small business and are not required to appoint a Data Protection Officer. Our managing director, Eleanor Marsh, is responsible for data protection and handles all privacy requests personally.
2. What this policy covers
This policy applies to personal data about:
- visitors to our website;
- people who send us an enquiry by form, email or phone;
- clients for whom we provide consultations, design, build, planting or maintenance services;
- neighbours or other people we deal with in the course of a project, for example when arranging access or a party wall notice;
- suppliers and subcontractors who are individuals or sole traders.
It does not cover websites we link to, such as our social media pages, which have their own privacy policies.
3. The personal data we collect
We only collect what we need. Depending on how you deal with us, this may include:
- Contact details — your name, postal address, email address and telephone numbers.
- Enquiry details — the service you are interested in and what you tell us about your garden, including any photos you send.
- Project information — survey measurements, photographs and drawings of your garden and property, access arrangements, and notes from meetings. Photographs may occasionally include people or neighbouring properties incidentally.
- Financial information — invoices, payments received and, where you pay by bank transfer, the name and account details shown on the payment. We do not store card numbers.
- Correspondence — emails, letters and notes of telephone calls.
- Technical data — when you visit the website, our hosting provider automatically records your IP address, browser type and the pages requested in server logs. Your browser also stores your cookie choice locally (see our cookie policy).
We do not ask for, and ask you not to send us, special category data such as health information. If you tell us about a disability so that we can adapt a garden design or a site visit, we will use that information only for that purpose and with your explicit consent.
4. How we use your data and our lawful bases
UK data protection law requires us to have a lawful basis for each use of your personal data. The table below sets out what we do and why.
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Replying to your enquiry and arranging a consultation | Steps taken at your request before entering into a contract (6(1)(b)); our legitimate interest in responding to people who contact us (6(1)(f)) |
| Providing design, build, planting and maintenance services | Performance of a contract with you (6(1)(b)) |
| Invoicing, keeping accounts and VAT records | Legal obligation (6(1)(c)) under the Companies Act 2006 and HMRC requirements |
| Dealing with complaints, guarantees and legal claims | Legitimate interests (6(1)(f)) in defending our position and honouring guarantees |
| Using photographs of a finished garden on our website or social media | Your consent (6(1)(a)), which you can withdraw at any time. We never show house numbers or identifiable people without permission. |
| Website security and server logs | Legitimate interests (6(1)(f)) in keeping the website secure and working |
| Optional analytics and marketing cookies | Your consent, as required by the Privacy and Electronic Communications Regulations 2003 |
We do not sell your data, and we do not use it for automated decision-making or profiling.
5. Who we share your data with
We share personal data only where necessary, and only with organisations that are bound to keep it secure:
- Service providers who process data on our behalf: our website host, our email and file-storage provider, and our cloud accounting software.
- Suppliers and specialist trades working on your project, such as a stone supplier delivering to your address or an electrician fitting garden lighting. They receive only the details needed for the job.
- Professional advisers such as our accountant, solicitor and insurers, where necessary.
- Public bodies where you ask us to, for example a local planning authority when we submit an application for you, or a council when we apply for a skip licence or parking suspension.
- HMRC and other authorities where we are required to by law.
6. International transfers
Most of our data is stored in the United Kingdom or the European Economic Area. Some of our service providers, including Google (which serves the fonts used on this website), may process data in the United States. Where this happens, the transfer is covered by UK adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework, or by the International Data Transfer Addendum approved by the ICO.
When this website loads, your browser requests font files from Google Fonts, which means your IP address is sent to Google. Google states that it does not use this information to build profiles or set cookies.
7. How long we keep your data
| Type of data | How long we keep it |
|---|---|
| Enquiries that do not lead to work | 24 months from our last contact, then deleted |
| Client contracts, drawings and project records | 12 years after completion, to cover our 10-year guarantee and the limitation period for claims |
| Invoices and accounting records | 6 years from the end of the financial year they relate to |
| Photographs used with consent for marketing | Until you withdraw consent, or 10 years, whichever is sooner |
| Website server logs | 30 days |
| Cookie choice stored in your browser | 12 months, after which we ask again |
8. Your rights
You have the following rights under the UK GDPR and the Data Protection Act 2018:
- Access — to ask for a copy of the personal data we hold about you.
- Rectification — to have inaccurate data corrected or incomplete data completed.
- Erasure — to ask us to delete your data where there is no good reason for us to keep it.
- Restriction — to ask us to pause using your data, for example while a dispute about its accuracy is resolved.
- Objection — to object to processing based on our legitimate interests, and to object at any time to direct marketing.
- Portability — to receive data you provided to us in a machine-readable format, or have it sent to another organisation.
- Withdrawing consent — where we rely on consent, you may withdraw it at any time without affecting what we did before.
There is normally no charge. We will reply within one month, or tell you within that month if we need longer because the request is complex. We may need to confirm your identity before releasing information.
9. How to make a privacy request
Please email [email protected] with “Privacy request” in the subject line, write to us at 14 Walcot Street, Bath BA1 5BG, or call 01225 480 312 during office hours (Monday to Friday, 8:30–17:30). Tell us which right you wish to exercise and give us enough information to find your records — for example, the address of the garden we worked on.
10. Complaints and the supervisory authority
If you are unhappy with how we have handled your personal data, please contact us first so that we can try to put things right. You also have the right to complain to the UK supervisory authority, the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, helpline 0303 123 1113, website ico.org.uk. Complaints can be made online at ico.org.uk/make-a-complaint.
11. How we keep your data secure
We use password-protected, two-factor-authenticated accounts for email, file storage and accounts, encrypt our laptops and phones, and limit access to client files to the people working on your project. Paper drawings are kept in a locked plan chest at the studio and shredded when no longer needed. If a personal data breach is likely to put your rights at risk, we will tell you and, where required, the ICO within 72 hours.
12. Children
Our services are intended for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us their details, please contact us and we will delete them.
13. Changes to this policy
We review this policy at least once a year. The date at the top shows when it was last updated. If we make significant changes that affect how we use data you have already given us, we will tell you directly. This version was published on 6 October 2026.