Cookies: A cookie is a piece of data stored on the user’s hard drive containing information about the user. Usage of a cookie is in no way linked to any personally identifiable information while on our site. Once the user closes their browser, the cookie simply terminates. For instance, by setting a cookie on our site, the user would not have to log in a password more than once, thereby saving time while on our site. If a user rejects the cookie, they may still use our site. We enable third party cookies from Trustpilot for purpose of reviews. We enable third party cookies from Mailchimp for the purpose of email marketing.
Log Files: We use IP addresses to analyse trends, administer the site, track user’s movement, and gather broad demographic information for aggregate use. IP addresses are not linked to personally identifiable information.
Surveys and Feedback: From time-to-time our site requests information from users via surveys or feedback forms. Participation in these surveys or user feedback is completely voluntary and the user therefore has a choice whether or not to disclose this information. Information requested may include satisfaction information (such as name, company, use of the product and your views on the product), and demographic information (such as post code, age bracket). Feedback information may be published on the site as a review. Survey information will be used for purposes of monitoring or improving the use and satisfaction of this site. We may also contact you by email upon receipt of your order to request your feedback or review.
Security: This website takes every precaution to protect our users’ information. When users submit sensitive information via the website, your information is protected both online and off-line.
We do not store any credit or debit card information captured online.
We do everything in our power to protect user-information off-line. All of our users’ information, not just the sensitive information mentioned above, is restricted in our offices. Only employees who need the information to perform a specific job (for example, billing or customer services) are granted access to personally identifiable information.
Supplementation of Information: Grass Seeds UK Ltd does not share any information we receive from this website with any third party sources unless those sources are critical to your order. Please see below the GDPR policy for specific details
Site and Service Updates: We may send the user site and service announcement updates. Customers are not able to un-subscribe from service announcements, which contain important information about the service. We communicate with the user to provide requested services and in regards to issues relating to their account via email or phone.
Notification of Changes: If we decide to change our privacy policy, we will post those changes on this page so our users are always aware of what information we collect, how we use it, and under circumstances, if any, we disclose it. If at any point we decide to use personally identifiable information in a manner different from that stated at the time it was collected, we will notify users by way of an email. Users will have a choice as to whether or not we use their information in this different manner. We will use information in accordance with the privacy policy under which the information was collected.
If you have any questions about the security on our website, you can contact us.
GDPR & Privacy Policy Grass Seeds UK Ltd
At Grass Seeds UK Ltd, we value your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, store, and protect your information when you visit and make purchases from our WordPress and WooCommerce website.
We comply fully with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Data Controller Information & Contact Details
Grass Seeds UK Ltd is the Data Controller responsible for your personal data.
- Company Name: Grass Seeds UK Ltd
- Geographic Scope: We explicitly do not ship internationally. Our operations, delivery logistics, and services are strictly limited to customers within the United Kingdom.
- Data Protection Contact:
- Email: [email protected]
- Telephone: 01608 637111
If you have any questions about this policy or wish to exercise your data protection rights, please contact our Data Protection Officer (DPO) contact using the details above.
2. Data We Collect
When you visit our store or place an order through our WooCommerce platform, we collect and process the following personal data:
- Identity Data: First name and last name.
- Contact Data: Billing address, delivery/shipping address, email address, and telephone number.
- Transaction Data: Full e-commerce purchase and order histories, including products ordered, transaction amounts, and date/time of purchase.
- Technical & Analytics Data: IP address, browser type, operating system, network performance metrics, referring URLs, page views, site interactions, and cookie data collected during your visit.
Note on Payment Information: We do not collect or store raw payment card details (such as credit card numbers or CVVs) on our WordPress/WooCommerce servers. All payment details are processed directly by our secure third-party payment gateways.
3. Lawful Bases for Processing & How We Use Your Data
Under UK data protection law, we must have a valid legal basis to process your personal data. We rely on the following bases depending on the purpose:
| Purpose / Activity | Type of Data | Lawful Basis for Processing |
| Processing and fulfilling your orders, managing shipping logistics, and responding to pre-checkout queries. | Identity, Contact, Transaction | Performance of a Contract: Processing is necessary to fulfill our purchase contract with you. |
| Hosting website infrastructure, maintaining database integrity, site security, DDoS protection, web analytics, and fraud prevention. | Technical, Cookie Data, Identity, Contact, Transaction | Legitimate Interests: Necessary for our business interests to maintain secure web servers, ensure site uptime, understand visitor usage, and protect against security threats. |
| Sending marketing newsletters, promotional emails, and non-essential analytics tracking. | Identity, Contact, Cookie Data | Consent: We send marketing communications or place non-essential analytics cookies only if you explicitly opt in. You can withdraw your consent at any time. |
4. Our Third-Party Data Processors & Integrated Tools
To run our online shop, deliver orders, secure our website, and analyze traffic, we share specific data with trusted third-party service providers (Data Processors). Each processor operates under strict contractual obligations to process your data securely and only according to our instructions.
Web Hosting & Infrastructure
- Gambit Nash: Our website, database, and WooCommerce store are hosted on servers operated by Gambit Nash. They process and store account details, customer order data, technical logs, and site database information to ensure our website functions reliably and remains secure.
Payment Gateways
- Stripe & PayPal: When you check out, your payment details are transmitted directly to Stripe or PayPal. They process transaction details securely to authorize payment and prevent fraud. Raw payment card numbers never touch our servers.
Order Management & Logistics
- Linnworks: We use Linnworks as our Enterprise Resource Planning (ERP) and order management system. Your order details, billing/shipping address, contact information, and purchase history flow to Linnworks to allow us to manage stock, pick items, and arrange domestic UK courier delivery.
Security, CDN & Platform Optimization
- Cloudflare: We use Cloudflare to ensure our website is fast, secure, and protected against malicious attacks (such as Distributed Denial of Service (DDoS) attacks). Cloudflare processes web traffic and technical log data (including IP addresses and security event data) to filter out malicious visitors and optimize site speed via its Content Delivery Network (CDN).
Web Analytics & Platform Performance
- Google Analytics: We use Google Analytics to collect standard internet log information and details of visitor behavior patterns (e.g., pages visited, time spent on site, device types). This helps us improve our online store. Google Analytics uses cookies to collect anonymous technical data. IP addresses are anonymized before storage.
- WordPress Analytics (WooCommerce/Jetpack): We utilize built-in WordPress and WooCommerce analytics tools to track aggregate store metrics, popular products, and customer navigation paths to optimize product presentation and site usability.
Marketing & Email Communications
- Mailchimp: If you give explicit consent to join our newsletter or receive marketing emails, your name and email address are processed via Mailchimp. Mailchimp enables us to manage subscription lists and dispatch promotional emails. You can unsubscribe at any time using the link at the bottom of any marketing email.
Customer Feedback & Reviews
- Trustpilot: Following a purchase, we share your name, email address, and order reference with Trustpilot to send an automated post-purchase email inviting you to leave a review about our products and customer service.
5. International Data Transfers
Grass Seeds UK Ltd operates exclusively within the United Kingdom and does not export physical goods outside the UK. Primary website hosting and data storage are managed via UK-based server infrastructure hosted by Gambit Nash.
However, several cloud tools and services integrated into our online platform such as Mailchimp, Cloudflare, and Google Analytics may transfer or store data on infrastructure outside the UK or the European Economic Area (EEA), including in the United States.
Where data is transferred outside the UK to countries without an ICO adequacy decision, we ensure robust legal safeguards are in place. These providers utilize Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or participation in certified transfer mechanisms (such as the UK Extension to the EU-U.S. Data Privacy Framework) alongside vendor technical security measures to guarantee your data receives equivalent protection to that required by UK GDPR.
6. Data Retention Periods
We do not hold onto your personal data longer than necessary for the purposes for which it was collected:
- Order Logs & Financial Records: Transaction details, billing addresses, and order histories stored on our hosted servers and systems are retained for 6 years from the end of the relevant financial year. This is required to comply with UK tax legislation (HMRC auditing regulations) and statutory accounting rules.
- Account & Marketing Data: We retain your marketing details for as long as you remain subscribed. If you withdraw consent, we promptly remove you from our active mailing lists.
- Security & Network Logs (Cloudflare & Server Logs): Server logs, security records, and IP traffic data are typically retained for short periods (generally 30 days or less) unless required for active security investigations.
- Analytics Data (Google & WordPress Analytics): Analytics data retention is configured according to standard retention periods and is periodically aggregated or anonymized.
7. Your UK GDPR Rights
Under the UK GDPR and Data Protection Act 2018, you hold statutory rights regarding your personal information. You can exercise any of these rights free of charge by contacting us at [email protected]:
- Right of Access: You have the right to request a copy of the personal data we hold about you (a Subject Access Request).
- Right to Rectification: You can ask us to correct inaccurate or incomplete personal data.
- Right to Erasure (“Right to be Forgotten”): You can request that we delete your personal data, subject to legal retention obligations (such as tax record keeping).
- Right to Restrict Processing: You can ask us to suspend processing your personal data in certain scenarios (e.g., while disputing its accuracy).
- Right to Object: You have the right to object to processing based on legitimate interests or direct marketing at any time.
- Right to Data Portability: You can request that we transfer your personal data to you or a third party in a structured, commonly used, machine-readable format.
8. How to Lodge a Complaint
If you have concerns about how we handle your personal data, please contact us first so we can resolve the issue directly.
If you remain dissatisfied with our response, you have the right to lodge a complaint with the UK data protection regulator:
- Supervisory Authority: Information Commissioner’s Office (ICO)
- Website: www.ico.org.uk
- Helpline: 0303 123 1113
- Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF