Privacy Policy

1. Who we are

This Privacy Policy explains how Larkfield Wellness Ltd ("Larkfield Wellness", "we", "us", "our") collects, uses and protects personal data when you visit our website at gardensieveiu.world or purchase our products.

We are committed to processing your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data we collect

2.1 Data you provide directly

• Order enquiry data: full name, telephone number, and any optional notes you include when submitting an order enquiry form.
• Contact form data: name, email address, subject line and message content when you contact us via our contact page.
• Consent records: a record that you ticked the consent checkbox at the time of form submission, including the timestamp.

2.2 Data collected automatically

• Technical log data: IP address, browser type and version, operating system, referring URL, pages visited, and timestamps - collected by our web server for security and operational purposes.
• Cookie data: see Section 8 and our Cookie Policy for full details.
• Analytics data (only if you consent): aggregated usage data via analytics tools. We use Consent Mode v2 defaults of denied until you accept cookies.
• UTM and tracking parameters: source, medium and campaign parameters appended to URLs by advertising platforms, captured only if you arrive via a tracked link.

2.3 Data we do not collect

We do not collect payment card data directly - order fulfilment and payment are handled separately. We do not collect special category data (health data, biometric data, etc.) through our website forms.

3. How we use your data

• Processing your order enquiry: to contact you, confirm your order, arrange delivery and handle any returns or refund requests.
• Responding to contact form messages: to reply to your enquiry within 2 working days.
• Website operation and security: server log data is used to maintain security, prevent fraud, and diagnose technical issues.
• Analytics and improvement (consent-dependent): understanding how visitors navigate our site so we can improve the content and user experience.
• Marketing (consent-dependent): if you opt in separately, we may send relevant product information by email. You may withdraw consent at any time.
• Legal compliance: retaining records as required by applicable law (e.g. VAT records under HMRC requirements).

4. Legal basis for processing

Under UK GDPR Article 6, we rely on the following lawful bases:

• Contract (Article 6(1)(b)): processing your name and telephone number to fulfil an order enquiry you have initiated.
• Consent (Article 6(1)(a)): analytics cookies, advertising cookies, and any email marketing - only processed where you have given explicit consent via our cookie banner or a separate opt-in. You may withdraw consent at any time without affecting prior processing.
• Legitimate interests (Article 6(1)(f)): server security logging, fraud prevention, and maintaining the security of our website. We have balanced these interests against your rights and concluded they are not overridden.
• Legal obligation (Article 6(1)(c)): retaining financial records for the period required by HMRC and applicable UK law.

5. Who we share data with

We do not sell your personal data. We may share data with:

• Hosting and infrastructure providers: our website host processes server logs and form data on our behalf under a Data Processing Agreement.
• Analytics providers (consent-dependent): Google Analytics (if you accept analytics cookies). Data is processed under Google's EU Standard Contractual Clauses with UK addendum.
• Advertising platforms (consent-dependent): Google Ads conversion data, processed only after explicit consent via Consent Mode v2.
• Delivery and fulfilment partners: your name and delivery address may be shared with a courier service solely for the purpose of delivering your order.
• Legal and regulatory authorities: where required by law, court order or to protect our legal rights.

All processors are bound by contractual obligations to process data only on our documented instructions and to implement appropriate security measures.

6. How long we keep your data

• Order enquiry records: retained for 6 years from the date of the last transaction for financial compliance purposes, then securely deleted.
• Contact form messages: retained for 12 months from receipt, then deleted unless a continuing legal or commercial relationship requires longer retention.
• Server logs: retained for 90 days, then automatically overwritten.
• Cookie consent records: retained for 12 months from the date consent was recorded.
• Analytics data: subject to the retention settings of the analytics platform (default 26 months in Google Analytics), if consented.

7. Your rights

Under UK GDPR, you have the following rights, which you may exercise free of charge by contacting us at info@gardensieveiu.world:

• Right of access (Article 15): to request a copy of the personal data we hold about you.
• Right to rectification (Article 16): to have inaccurate data corrected or incomplete data completed.
• Right to erasure (Article 17): to request deletion of your data where there is no longer a lawful reason to retain it.
• Right to restriction of processing (Article 18): to request that we limit how we use your data in certain circumstances.
• Right to data portability (Article 20): to receive your data in a structured, machine-readable format where processing is based on consent or contract and carried out by automated means.
• Right to object (Article 21): to object to processing based on legitimate interests, including profiling.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
• Right not to be subject to automated decision-making: we do not use solely automated decision-making that produces legal or similarly significant effects.

We will respond to rights requests within one calendar month. We may ask you to verify your identity before processing your request.

8. Cookies

We use cookies and similar technologies on our website. For full details of the cookies we use, their purposes, duration and how to control them, please read our Cookie Policy.

When you first visit our website, a cookie consent banner is displayed. Non-essential cookies (analytics, advertising) are set to denied by default under Google Consent Mode v2. They are only activated if you click "Accept All". You may change your preferences at any time by clearing your browser cookies and revisiting the site.

9. International data transfers

Where we use third-party services that process data outside the UK (for example, Google LLC in the United States), we ensure that appropriate safeguards are in place, including:

• UK International Data Transfer Agreements (IDTAs) or UK Addendum to EU Standard Contractual Clauses;
• adequacy decisions where applicable.

You may request details of the specific safeguards in place by contacting us at info@gardensieveiu.world.

10. Children

Our website and products are intended for adults aged 18 and over. We do not knowingly collect personal data from children under 18. If you believe we have inadvertently collected data from a minor, please contact us immediately so we can delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our website after an update constitutes acceptance of the revised policy.

12. Contact & complaints

For any privacy-related queries, to exercise your rights, or to raise a concern, please contact us:

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.