Privacy Policy

Last updated: 19 August 2026

The Windmill Nursery respects your privacy. This policy explains what personal information we collect when you use thewindmillnursery.co.uk, why we collect it, who we share it with, how long we keep it, and the rights you have over it.

Who is responsible for your data

The Windmill Nursery, Whitley Rd, Sheffield S36 9NY, United Kingdom, is the controller of the personal data described in this policy. For any privacy question or request, contact support@thewindmillnursery.co.uk.

Information we collect

Information you give us: name, email address, phone number, billing and delivery address, order details, and anything you include in messages to us.
Payment information: handled by our payment providers. We receive confirmation of the outcome and a truncated card reference — never your full card number or security code.
Information collected automatically: device and browser information, IP address, pages viewed and actions taken, collected through cookies and similar technologies. See our Cookie Policy.

Why we use it, and our lawful bases

To fulfil your order — process payment, arrange delivery, handle returns and provide support. Lawful basis: performance of a contract.
To meet legal obligations — tax, accounting and consumer law record-keeping. Lawful basis: legal obligation.
To prevent fraud and secure the site. Lawful basis: our legitimate interests in protecting the business and our customers.
To improve the shop through aggregate analytics. Lawful basis: legitimate interests, or consent where required for the cookies involved.
To send marketing where you have opted in or the soft opt-in applies. Lawful basis: consent, or legitimate interests under PECR. See Marketing Communications & Consent.

Who we share it with

We do not sell, rent or trade your personal information. We share it only with parties who need it to deliver the service:

Shopify, which hosts this store and processes orders;
payment providers, including Shopify Payments and PayPal;
delivery carriers, who receive the name, address and contact details needed to deliver;
analytics and, where you have consented, advertising partners;
professional advisers, and public authorities where the law requires it.

International transfers

Some of our providers process data outside the United Kingdom. Where personal data is transferred outside the UK we rely on a recognised safeguard — UK adequacy regulations, or the International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses.

How long we keep it

Order and transaction records: 6 years after the end of the tax year in which the order was placed, to meet HMRC requirements.
Customer support correspondence: up to 3 years after the matter is closed.
Marketing consents and opt-out records: until you withdraw consent, plus a minimal suppression record so we do not contact you again.
Analytics data: generally up to 24 months.

Your rights

Under the UK GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent at any time. Your right to object to direct marketing is absolute.

To exercise any right, email support@thewindmillnursery.co.uk. We respond within one month and do not charge for this. We may ask for information to confirm your identity.

Complaints

If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office — ico.org.uk/make-a-complaint, 0303 123 1113 — or to the supervisory authority where you live.

Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit and access controls. No system is completely secure, and we will notify you and the ICO where required if a breach is likely to affect your rights.

Children

This website is not intended for children under 16 and we do not knowingly collect their personal information. If you believe we hold data about a child, contact us and we will delete it.