Privacy Policy - Tree Surgeons Norbiton

This Privacy Policy explains how Tree Surgeons Norbiton collects, uses, stores, shares, and protects personal data when providing tree surgery and related services. It applies to all Tree Surgeons Norbiton customers in the area, including individuals, homeowners, landlords, tenants, businesses, and property managers who enquire about, book, or receive our services.

Tree Surgeons Norbiton is committed to handling personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable privacy laws. We aim to be clear and transparent about what information we collect, why we collect it, and how we use it.

1. Personal data we collect

We only collect personal data that is necessary for the services we provide, for managing customer relationships, and for meeting legal, accounting, and operational requirements. The information we may collect includes:

Identity information such as your name, title, and where relevant, company name.
Contact details such as your address, email address, and telephone number.
Property and service information such as the location of the trees, site access details, service preferences, and any information needed to assess the work required.
Enquiry and communication records including messages, quotations, appointment notes, and correspondence.
Billing and payment information such as invoice details, payment records, and transaction references.
Technical data such as IP address, browser type, device information, and usage data if you interact with our digital systems.
Health and safety information where necessary to protect staff, contractors, customers, or visitors during site work.

We generally do not collect special category data unless it is strictly necessary and there is a valid legal reason to do so. If such data is ever collected, we will apply additional safeguards.

2. How we use personal data

We use personal data only for specific and legitimate purposes connected to our work. These purposes may include:

responding to enquiries and providing quotations;
arranging inspections, appointments, and tree surgery services;
carrying out work safely and efficiently;
issuing invoices and processing payments;
managing customer accounts and service records;
handling complaints, disputes, and insurance-related matters;
meeting legal, tax, accounting, and regulatory obligations;
improving our services, administration, and customer experience;
protecting against fraud, misuse, or unlawful activity.

We do not use your personal data for purposes that are incompatible with the reasons it was collected, unless we have a valid lawful basis to do so.

3. Lawful basis for processing

Under data protection law, we must have a lawful basis to process personal data. Depending on the situation, Tree Surgeons Norbiton may rely on one or more of the following lawful bases:

Contract

We process personal data where it is necessary to enter into or perform a contract with you. This includes providing quotes, confirming bookings, carrying out tree surgery services, and managing payment or service administration.

Legal obligation

We may process data where required to comply with the law, including tax, accounting, insurance, and health and safety obligations, as well as record-keeping duties.

Legitimate interests

We may process data where it is necessary for our legitimate business interests and where those interests are not overridden by your rights and freedoms. This can include responding to enquiries, keeping internal records, preventing fraud, improving services, and managing our business operations.

Consent

In limited situations, we may rely on your consent, for example where it is needed for certain optional communications or specific data uses. Where consent is used, you may withdraw it at any time.

Vital interests

In rare circumstances, we may process information to protect someone’s life or physical safety, such as where urgent site safety concerns arise.

4. Data sharing and processors

We may share personal data with trusted third parties where necessary for the running of our business and the delivery of our services. These third parties act as processors or, in some cases, independent controllers. We only share data when there is a valid reason to do so and we require appropriate safeguards to be in place.

Processors may include:

IT and software providers that support email, storage, scheduling, invoicing, and business administration.
Payment service providers that process card or electronic payments.
Accountants and bookkeeping services that support financial management and tax compliance.
Contracted arborists or specialist subcontractors assisting with services where required.
Insurance providers, legal advisers, and claims handlers where necessary for risk management, dispute resolution, or legal compliance.
Public authorities when we are legally required to share information.

We do not sell personal data. Where third parties process data on our behalf, they are required to protect it and use it only for the agreed purpose.

5. International transfers

Where personal data is transferred outside the UK, we will only do so where appropriate safeguards are in place and where the transfer complies with applicable data protection laws. This may include use of adequacy regulations, standard contractual clauses, or other approved legal mechanisms.

6. Data retention

We keep personal data only for as long as necessary for the purpose for which it was collected, including for legal, accounting, insurance, and operational reasons. Retention periods will depend on the nature of the information and the reason it is held.

In general:

customer enquiry records may be kept for a short period after the enquiry is closed;
service records, quotations, and invoices may be kept for several years to meet business and tax requirements;
health and safety documentation may be retained where needed for legal or liability purposes;
communication records may be retained where they are necessary to evidence instructions, decisions, or disputes.

When data is no longer required, we will delete it securely or anonymise it so that it can no longer identify you.

7. Data security

We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration, or disclosure. These measures may include access controls, secure storage, staff confidentiality obligations, and careful selection of service providers.

While we work to protect your information, no system can be completely secure. If a data incident occurs that affects your rights or freedoms, we will handle it in line with our legal obligations.

8. Your rights

Depending on the circumstances and applicable law, you may have the following rights in relation to your personal data:

Right of access – to request a copy of the personal data we hold about you.
Right to rectification – to ask us to correct inaccurate or incomplete information.
Right to erasure – to ask us to delete your data in certain situations.
Right to restriction – to ask us to limit how we use your data in certain cases.
Right to object – to object to processing based on legitimate interests or direct marketing.
Right to data portability – to receive certain data in a structured, commonly used format where applicable.
Right to withdraw consent – where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, you may make a request in writing. We may need to verify your identity before responding. Please note that some rights are subject to legal limits and may not apply in every case.

9. Marketing communications

We will only send marketing communications where permitted by law. If you have given consent or where we are otherwise allowed to contact you under applicable rules, you may opt out at any time. If you opt out, we will stop sending marketing messages, though we may still contact you about existing bookings, invoices, or important service matters.

10. Children’s data

Our services are not directed at children, and we do not knowingly collect personal data from children unless it is necessary in a service context and appropriate safeguards are in place. If we become aware that personal data has been collected from a child without proper authorisation, we will take steps to address it.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or data handling practices. Any updated version will apply from the date it is published or otherwise communicated. We encourage customers to review this policy periodically to stay informed.

12. Summary of our privacy approach

Tree Surgeons Norbiton only collects data needed to provide safe, reliable, and lawful services. We use personal data fairly, keep it only as long as necessary, and protect it with suitable safeguards. We may use processors to help us operate, but they must handle information responsibly and securely. You always retain important rights over your personal data, and we will respect those rights in line with data protection law.

This policy applies to all Tree Surgeons Norbiton customers in the area.