Privacy Policy

Last updated: January 2026

About This Policy

This privacy policy explains how Green Valley Nurseries ("we", "us", "our") collects, uses, and protects your personal data when you use our HortiTrak application.

We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller

The data controller responsible for your personal data is:

Green Valley Nurseries
Greenfield Lane
Harrogate
North Yorkshire
HG1 5AB
Phone: 01555 000 100
Email: info@greenvalleynurseries.co.uk

2. What Data We Collect

We collect and process the following personal data:

  • User Account Data: Name, email address, password (encrypted), role within the organisation
  • Customer Business Data: Business name, contact name, business address, email address, phone number
  • Transaction Data: Delivery and collection records, dates, quantities, driver information
  • Usage Data: Login times, session information for security purposes

3. How We Use Your Data

We use your personal data for the following purposes:

Purpose Lawful Basis
Managing user accounts and authentication Legitimate interests (business operations)
Recording equipment deliveries and collections Legitimate interests (contract fulfilment)
Sending transaction confirmations Legitimate interests (business records)
Sending monthly statements Legitimate interests (account management)
Password reset and account recovery Legitimate interests (security)

4. Data Sharing

We may share your data with:

  • Email Service Provider (SendGrid): To send transaction confirmations and statements. SendGrid processes data under their privacy policy and appropriate safeguards.
  • Hosting Provider (Render): Our application and database are hosted securely on Render's infrastructure.

We do not sell your personal data to third parties.

5. Data Retention

We retain your data for the following periods:

  • Transaction records: 7 years (for accounting and legal requirements)
  • User accounts: Duration of employment/business relationship plus 2 years
  • Customer records: Duration of business relationship plus 7 years

Archived records are retained but hidden from active use.

6. Your Rights

Under UK GDPR, you have the following rights:

  • Right of Access: Request a copy of your personal data
  • Right to Rectification: Request correction of inaccurate data
  • Right to Erasure: Request deletion of your data (subject to legal retention requirements)
  • Right to Restrict Processing: Request limitation of how we use your data
  • Right to Data Portability: Receive your data in a portable format
  • Right to Object: Object to processing based on legitimate interests

To exercise any of these rights, please contact us at info@greenvalleynurseries.co.uk.

7. Data Security

We implement appropriate security measures including:

  • Encrypted passwords (bcrypt hashing)
  • HTTPS encryption for all data in transit
  • Secure database hosting with regular backups
  • Role-based access controls
  • Session timeouts after 7 days of inactivity

8. Cookies

We use essential cookies only:

  • Session Cookie: Required for login functionality (expires after 7 days)
  • Cookie Consent: Remembers your cookie preferences (expires after 1 year)

We do not use analytics, advertising, or tracking cookies.

9. International Transfers

Our service providers may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the ICO.

10. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk
Helpline: 0303 123 1113

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify users of significant changes via email or through the application.

← Back to Dashboard