Privacy policy

Privacy Policy — Hardy’s Cottage Garden Plants

Hardy’s Cottage Garden Plants is an independent, family-run nursery specialising in growing and supplying herbaceous perennials to the general public and trade. The nursery is owned by Robert & Rosemary Hardy as a Partnership, trading from Priory Lane Nursery, Whitchurch, Hampshire RG28 7FA.

We are registered with the Information Commissioner’s Office (ICO). Registration number: ZA312561.

This privacy policy explains how we collect, use and protect your personal information when you use this website, purchase from us, subscribe to our marketing emails or submit a customer review.

What information do we collect about you?

We collect information about you when you:

  • Place an order for products or services
  • Create a website account
  • Contact us by email, telephone or via our website
  • Browse our website, through cookies and usage data
  • Subscribe to one of our marketing mailing lists
  • Submit a customer review

The personal information we collect includes your name, delivery address and postcode, telephone number and email address. We do not store your card payment details. These are handled securely by Shopify Payments, our payment processor.

When you submit a review, we process the information you provide, which may include your name, email address, rating, review text and any photographs or videos you upload. Customer contact and purchase information is also used to manage review invitations and help establish whether a review relates to a purchase.

How will we use your information?

We use your personal information to:

  • Process and fulfil your order
  • Manage your account and keep your records up to date
  • Communicate with you about your order by email or telephone
  • Send you marketing communications where you have given your consent
  • Invite customers to review recent purchases
  • Collect, verify, manage and display customer reviews
  • Comply with our legal obligations

Our lawful bases for processing your data are:

  • Contract: to process and fulfil orders you place with us
  • Legal obligation: to retain financial records as required by law, and to maintain records of plant movements and distance selling transactions as required under UK plant passporting regulations, for a minimum of three years
  • Legitimate interests: to manage our business, prevent fraud, handle complaints, and collect and manage feedback about recent purchases to help improve our products and service, taking account of customers’ rights and reasonable expectations
  • Consent: for marketing communications and non-essential cookies. You may withdraw consent at any time

Customer reviews and review invitations

We use Judge.me Ltd to send review invitations following recent purchases and to collect, manage and display customer reviews.

Each invitation explains why you have received it and includes a link to unsubscribe from further review-request emails. We respect the relevant email opt-outs recorded in Shopify and unsubscribe requests made through Judge.me. You can also ask us to stop review invitations by contacting info@hardysplants.live.

Our EmailOctopus mailing lists are managed separately. Unsubscribing from an EmailOctopus newsletter does not automatically unsubscribe you from Judge.me review invitations, or vice versa. You can contact us to ask us to stop both.

Leaving a review is voluntary. Published reviews are publicly visible and may include your reviewer display name, rating, comments and any photographs or videos you upload. Please do not include contact details or other private information in your review or uploads.

We check reviews submitted through Judge.me before publishing them on our website. We welcome both positive and critical feedback and do not reject reviews simply because they are negative. We may decline to publish content that is abusive, spam, unrelated to a genuine customer experience or exposes personal information.

Customers may also leave reviews through the Shop app. Reviews submitted through Shop are managed under Shop’s review policies, rather than our website’s approval process.

Judge.me’s privacy notice describes publication on its own service and possible sharing of reviews and information linking them to purchases with Shopify and the Shop app. Removing a review from one service does not necessarily remove copies held by another.

To request access to, correction or deletion of your review-related personal information, please contact info@hardysplants.live. Where necessary, we will coordinate with the relevant service providers to respond. If your request concerns a separate account you hold directly with Judge.me, you can also contact Judge.me using the details in its privacy policy.

Sharing your information

We share your information only where necessary:

  • Shopify: our website and e-commerce platform is hosted by Shopify Inc. Shopify processes information to provide the platform and related services. Depending on the processing involved, Shopify may act as a data processor or a separate data controller. For details of how Shopify collects and uses customer data, please see the Shopify Consumer Privacy Policy.
  • DHL: we share your delivery name, address and contact telephone number with DHL to facilitate delivery of your order.
  • Notify Me (Cartbite by Staqlab): we use a back-in-stock notification service to send alerts you have requested. Your email address is shared with Staqlab to provide this service. For full details, see the Notify Me Privacy Policy.
  • EmailOctopus (Three Hearts Digital Ltd): we use EmailOctopus to manage and send our marketing emails. Your name and email address are shared with EmailOctopus for this purpose. EmailOctopus acts as a data processor on our behalf and does not use your data for its own marketing purposes. Our EmailOctopus mailing lists are managed independently of this website. For full details, see the EmailOctopus Privacy Policy.
  • Judge.me Ltd: we use Judge.me to manage review invitations and customer reviews. Judge.me acts as a data processor for customer information received from us through our e-commerce platform. If you create an account with Judge.me or interact directly with its website, it acts as a separate data controller for information collected through those interactions. Its privacy notice also describes possible sharing with Shopify and the Shop app to publish reviews. For further details, see the Judge.me Privacy Policy.
  • Google Analytics 4 (Google LLC): we use Google Analytics 4 to understand how visitors use our website. This service processes technical and usage information about website traffic and behaviour. For more information, see the Google Privacy Policy.
  • Tapita (SEO & Speed Optimiser): we use Tapita to manage SEO and site performance. This app may use cookies and collect information about website behaviour. For details, see the Tapita Privacy Policy.
  • Legal requirements: we may disclose your information where required by law, or to protect the rights, property or safety of Hardy’s Cottage Garden Plants, our customers or others.

We do not share your information with other companies for their own direct marketing purposes.

Marketing

If you have consented to receive marketing communications, we may send you information about our products, services and seasonal offers via email. We manage our email marketing through EmailOctopus, a service provided by Three Hearts Digital Ltd.

We operate three separate mailing lists:

  • News from the Nursery: our main monthly newsletter, sent to all subscribers
  • Hardy Gardeners: emails specifically for visitors to our nursery shop
  • Trade: a separate list for our trade customers

You can opt out of any of these lists at any time by:

  • Clicking the unsubscribe link in any marketing email
  • Emailing us at info@hardysplants.live
  • Writing to us at the address below

To stop Judge.me review invitations, please use the unsubscribe link in a review-request email or contact us. EmailOctopus newsletter subscriptions and Judge.me review invitations have separate unsubscribe arrangements.

We will never share your email address with third parties for their own marketing purposes.

Cookies

Cookies are small files placed on your device to help our website function and improve your experience. We and our partners, including Shopify, use cookies and similar technologies to personalise your experience, perform analytics and, where you have consented, serve relevant advertising.

We also use Google Analytics 4 cookies to help us understand how visitors use our website. This service processes technical and usage information about visits to the website.

Judge.me’s service uses cookies and similar technologies, including session, preference and security cookies, and may collect technical information such as IP addresses, browser details and usage data. Further details are available in the Judge.me Privacy Policy.

For details of how Shopify uses cookies and similar technologies, please see the Shopify Consumer Privacy Policy.

You can manage or disable cookies through your browser settings, or update your preferences through our cookie banner. Please be aware that disabling cookies may affect the functionality of this website.

How long do we hold your information?

  • Financial records, including invoices and associated paperwork: retained for six years after the end of the calendar year to which they relate, as required by law
  • Plant passporting and distance selling records: retained for a minimum of three years as required under UK plant passporting regulations
  • Order and account information: retained while your account is active and for a reasonable period thereafter
  • Marketing consent records: retained for as long as reasonably necessary to demonstrate and manage your preferences and meet applicable obligations
  • Customer reviews: review-related personal information is retained for as long as reasonably necessary to collect, verify, manage and display reviews and handle related enquiries or disputes. Where Shop or Judge.me processes information as a separate data controller, its own privacy policy also applies
  • Opt-out records: we retain the minimum information needed to honour an opt-out for as long as necessary to prevent further unwanted communications
  • General correspondence: retained for as long as it remains relevant

Your rights

Under UK GDPR, you have the right, subject to applicable conditions and exemptions, to:

  • Access the personal information we hold about you
  • Correct inaccurate or incomplete information
  • Request erasure of your information, subject to our legal obligations and other applicable grounds for retaining it
  • Restrict how we process your information in certain circumstances
  • Object to processing based on legitimate interests or for direct marketing
  • Data portability: receive certain information you have provided in a structured, commonly used format
  • Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us using the details below. We normally respond within one month. If an extension is permitted and necessary, we will explain why and let you know within that period. Requests are normally free of charge.

For requests concerning reviews or review invitations managed through Judge.me, please contact us at info@hardysplants.live. Where necessary, we will coordinate with Judge.me and other relevant service providers to respond.

Protecting your information

We take data security seriously. Our website is hosted on Shopify’s secure platform. Access to your personal information within our business is restricted to those who need it to provide products and services to you.

Our service providers, including Shopify, DHL, Staqlab, EmailOctopus, Judge.me, Google and Tapita, are required to protect your information in accordance with applicable law and their contractual obligations.

International transfers

Shopify and Google are global companies and your data may be processed outside the UK. Applicable safeguards for international transfers may include UK adequacy arrangements and approved contractual safeguards. Further information is available in the Shopify Consumer Privacy Policy and Google Privacy Policy.

Personal information processed through Judge.me may also be transferred outside the UK, including to the United States. Judge.me states that it uses applicable adequacy arrangements or contracts approved for use in the UK to protect these transfers. Further information is available in the Judge.me Privacy Policy.

Other websites

Our website may contain links to third-party websites. This privacy policy applies to Hardy’s Cottage Garden Plants’ processing of personal information. Other services, including Shop and Judge.me where they act as separate data controllers, have their own privacy policies. We encourage you to read the privacy policies of other websites and services you use.

Changes to this policy

We keep this privacy policy under regular review. Any updates will be posted on this page. This policy was last updated on 5 October 2026.

How to contact us

If you have any questions about this privacy policy or the information we hold about you, please contact us:

  • Telephone: 01256 896533
  • Email: info@hardysplants.live
  • Post: Hardy’s Cottage Garden Plants, Priory Lane Nursery, Whitchurch, Hampshire RG28 7FA
  • Website: Contact us

If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO):