Last updated: 26 April 2026
1. Who we are
GardenSlate is a trading name of Garden Slate and Stone Ltd, a company registered in England and Wales.
- Company number: 13873441
- Registered office: 1 Bryn Eglwys, Llanllechid, Bangor, Gwynedd, Wales, LL57 3LE
- Trading address: Nantlle Valley, Eryri
- Email: info@gardenslate.co.uk
- Website: gardenslate.co.uk
For the purposes of UK GDPR and the Data Protection Act 2018, Garden Slate and Stone Ltd is the data controller for the personal data we collect about you.
2. What this policy covers
This Privacy Policy explains what personal data we collect when you use gardenslate.co.uk, how we use it, who we share it with, how long we keep it, and the rights you have over your data.
If you have any questions about this policy or how we handle your data, please contact us at info@gardenslate.co.uk.
3. What personal data we collect
We collect personal data when you place an order, contact us, or browse our website. Specifically:
- Identity and contact data: your name, email address, phone number, and delivery/billing addresses
- Order data: details of products purchased, order history, delivery preferences
- Payment data: payment method details. We do not store full card details — these are handled directly by Stripe, our payment processor
- Communication data: the content of any emails or messages you send us
- Technical data: your IP address, browser type, device information, and general browsing behaviour on our site (such as pages viewed)
- Marketing preferences: whether you have opted in to receive marketing communications from us
4. How we collect your data
- Directly from you when you place an order, sign up for our newsletter, or contact us
- Automatically when you browse our site (cookies and similar technologies — see our Cookie Notice below)
- From third parties such as Stripe (payment confirmation) and our shipping partners (delivery status updates)
5. Why we use your data and our legal basis
Under UK GDPR, we must have a lawful basis for processing your personal data. Here's how we use your data and why:
| Purpose | Lawful basis | |---|---| | To process and fulfil your order | Performance of a contract | | To take payment via Stripe | Performance of a contract | | To deliver your order via our shipping partners | Performance of a contract | | To send order confirmation, dispatch, and delivery emails | Performance of a contract | | To respond to your enquiries or complaints | Legitimate interests / Performance of a contract | | To send marketing emails (if you opt in) | Consent | | To comply with legal obligations (e.g. tax records) | Legal obligation | | To prevent fraud and secure our website | Legitimate interests |
You can withdraw consent for marketing at any time by clicking the unsubscribe link in our emails or by emailing info@gardenslate.co.uk.
6. Who we share your data with
We share your data only when necessary, and only with trusted third parties:
- Stripe — to process your payment securely. Stripe is PCI-DSS compliant. See Stripe's privacy policy.
- Brevo — to send transactional emails (order confirmations, dispatch notifications). See Brevo's privacy policy.
- Our shipping/delivery partners (e.g. H.F. Owen Transport) — to deliver your order. They receive only the information needed to complete delivery (your name, address, phone number).
- Cloudinary — for image hosting on our website. Does not receive your personal data.
- Railway and Vercel — our hosting providers for the website and database. Your data is stored on infrastructure they manage.
- HMRC and other regulators — where required by law.
We do not sell your personal data to anyone, and we do not share it for third-party marketing purposes.
7. International transfers
Some of our service providers are based outside the UK (for example, Stripe processes payments through systems based in the US and EU). When we transfer your data outside the UK, we ensure appropriate safeguards are in place — typically the UK-EU adequacy decision or Standard Contractual Clauses approved by the UK Information Commissioner's Office.
8. How long we keep your data
We keep your data only as long as necessary:
- Order and customer records: 6 years after your last transaction (required by HMRC for tax purposes)
- Marketing data: until you unsubscribe, plus a short suppression record so we don't accidentally email you again
- Website analytics data: typically 14 months
- Customer service correspondence: 2 years after the matter is resolved
When data is no longer needed, we delete or anonymise it.
9. Your rights
Under UK GDPR you have the following rights over your personal data:
- Right of access — you can ask for a copy of the data we hold about you
- Right to rectification — you can ask us to correct inaccurate data
- Right to erasure — you can ask us to delete your data (subject to our legal obligations to retain certain records)
- Right to restrict processing — you can ask us to stop using your data in certain ways
- Right to data portability — you can ask for your data in a machine-readable format
- Right to object — you can object to us processing your data for marketing or based on legitimate interests
- Right to withdraw consent — where we rely on consent, you can withdraw it at any time
To exercise any of these rights, email info@gardenslate.co.uk. We will respond within one month.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office:
- Website: ico.org.uk
- Phone: 0303 123 1113
10. Cookies
Our website uses cookies — small text files stored on your device — to make the site work and improve your experience. We use:
- Essential cookies to keep your shopping cart working, remember your login, and process orders. These cannot be disabled.
- Analytics cookies (if applicable) to understand how visitors use the site so we can improve it.
You can control cookies through your browser settings. Disabling essential cookies will prevent the site from working properly.
11. Security
We take the security of your data seriously:
- All data transmitted between your browser and our site is encrypted using HTTPS/TLS
- Payment data is handled directly by Stripe and never stored on our servers
- Passwords (where applicable) are hashed using industry-standard algorithms
- Access to customer data is restricted to authorised personnel only
No system is perfectly secure, but we follow recognised best practices to protect your data.
12. Changes to this policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top will reflect the latest changes. For significant changes, we will notify you by email or a prominent notice on our website.
13. Contact us
If you have any questions about this Privacy Policy or how we handle your data, please email info@gardenslate.co.uk or write to us at our registered office address.