Privacy Policy

Last updated: 10 April 2026

1. Who We Are

Penwortham Gardeners is a trading name of Heimdell Tech AI ("we", "us", "our"). Heimdell Tech AI is the data controller responsible for your personal data.

We are registered with the Information Commissioner's Office (ICO) under Heimdell AI's registration.

• Email: contact@penworthamgardens.co.uk
• Website: penworthamgardens.co.uk

2. What Data We Collect

Data Type	How We Collect It
Full name	Enquiry form, chatbot, phone
Phone number	Enquiry form, chatbot, phone
Email address	Enquiry form
Postcode	Enquiry form, chatbot
Service requirements	Enquiry form, chatbot, phone
Garden photos	AI quote tool (uploaded voluntarily)
Chat conversation logs	AI chatbot (Alan)
Cookie preferences	Cookie consent banner
IP address & browser info	Automatically via website server logs

3. How We Use Your Data

We process your personal data for the following purposes:

• To provide our services — responding to enquiries, generating quotes, scheduling visits (Legal basis: contract performance)
• To communicate with you — phone calls, emails, and AI-automated messages regarding your enquiry or booking (Legal basis: legitimate interest / consent)
• To improve our website — analytics and performance monitoring (Legal basis: legitimate interest)
• To comply with legal obligations — tax records, legal disputes (Legal basis: legal obligation)

4. AI-Powered Features

Our website uses AI-powered tools including:

• Alan — AI Garden Advisor: A chatbot powered by Anthropic Claude that can answer gardening questions and collect your details for a callback. Conversations are processed via Anthropic's API and are not used to train AI models.
• AI Quote Tool: Uses OpenAI's GPT-4o to analyse garden photos you upload and provide estimated pricing. Images are processed via OpenAI's API and are not stored permanently.

When you use these tools, your inputs (messages, photos) are sent to third-party AI providers solely to generate responses. These providers process data under their own privacy policies and data processing agreements.

5. Who We Share Your Data With

Recipient	Purpose	Safeguards
Google (Sheets, Apps Script)	Storing enquiry form submissions and chatbot leads	Google Workspace terms, US data processing with EU SCCs
Anthropic	Processing AI chatbot conversations	API data processing terms, data not used for training
OpenAI	Processing AI quote tool requests	API data processing terms, data not used for training
Netlify	Website hosting and serverless functions	GDPR-compliant hosting, DPA in place

We do not sell your personal data to any third party.

6. How Long We Keep Your Data

• Enquiry data: Up to 24 months after your last interaction, or until you request deletion
• Customer records: 6 years after the last service (for tax and legal compliance)
• Chat logs: Not stored permanently — processed in-session only
• Uploaded photos: Processed in real-time and not permanently stored
• Cookie preferences: Stored in your browser's local storage until cleared

7. Your Rights Under UK GDPR

You have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data ("right to be forgotten")
• Restrict processing — ask us to limit how we use your data
• Data portability — receive your data in a structured, machine-readable format
• Object — object to processing based on legitimate interest or direct marketing
• Withdraw consent — where processing is based on consent, withdraw it at any time

To exercise any of these rights, email us at contact@penworthamgardens.co.uk. We will respond within 30 days.

8. Cookies

Our website uses minimal cookies. For full details, see our Cookie Policy.

9. Data Security

We take appropriate technical and organisational measures to protect your data, including:

• HTTPS encryption on all pages
• Secure API keys for third-party services
• Access controls on stored data
• Regular review of data processing activities

10. Children's Data

Our services are not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this policy from time to time. Any changes will be posted on this page with an updated "last updated" date. We encourage you to review this page periodically.

12. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113