GDPR Compliance

Our commitment to data protection

We are committed to complying with the General Data Protection Regulation (GDPR) and ensuring that personal data is processed lawfully, fairly, and transparently. This page outlines how we meet our obligations under GDPR.

Data controller

The data controller responsible for your personal information is:

blossom-drift
Lansdown Horticultural Centre
42 Cavendish Mews
Bath BA1 5TN
United Kingdom

Legal basis for processing

We process personal data under the following legal bases:

• Consent: When you submit an enquiry form, you provide explicit consent for us to process your information
• Legitimate interests: We process data to respond to enquiries, provide services, and improve our website functionality
• Contract: When we enter into service agreements, processing is necessary for contract performance

Your data protection rights

Under GDPR, you have the following rights:

Right of access

You can request copies of your personal data. We may charge a reasonable fee for multiple copies or excessive requests.

Right to rectification

You can request correction of inaccurate or incomplete personal information.

Right to erasure

You can request deletion of your personal data under certain conditions, including when data is no longer necessary for its original purpose.

Right to restrict processing

You can request that we limit how we use your personal data in specific circumstances.

Right to data portability

You can request transfer of your data to another organisation or directly to you in a structured, commonly used format.

Right to object

You can object to processing of your personal data in certain situations, particularly for direct marketing purposes.

Rights related to automated decision making

We do not use automated decision making or profiling in our data processing activities.

How to exercise your rights

To exercise any of these rights, contact us at enquiries [at] blossom-drift.store. We will respond to requests within one month, though complex requests may require up to three months with appropriate notification.

We may need to verify your identity before processing certain requests to protect your personal information.

Data retention periods

We retain personal data only for as long as necessary:

• Enquiry information: 24 months
• Client service records: Duration of service relationship plus 6 years
• Financial records: 7 years as required by law
• Website analytics: 12 months

International data transfers

We do not transfer personal data outside the United Kingdom or European Economic Area. All data storage and processing occurs within jurisdictions with adequate data protection standards.

Data security

We implement appropriate technical and organisational measures including:

• Secure data storage with encryption
• Access controls limiting who can view personal data
• Regular security assessments and updates
• Staff training on data protection principles

Data breach notification

In the event of a data breach affecting your personal information, we will notify you and relevant supervisory authorities within 72 hours as required by GDPR, unless the breach is unlikely to result in risk to your rights and freedoms.

Complaints

If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.

ICO contact information:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk