Privacy Policy

1. Introduction

TWELVE12 LIMITED trading as GreenRun ("GreenRun", "we", "us", or "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data when you:

• Visit our website at greenrun.uk
• Use the GreenRun website and online booking platform
• Contact us via our enquiry form, email, phone, or WhatsApp
• Book or receive any of our gardening services

TWELVE12 LIMITED trading as GreenRun is the data controller responsible for your personal data. We are registered in England and operate in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you have any questions about this Privacy Policy or our data practices, please contact us:

2. Information We Collect

We collect personal data through several channels depending on how you interact with us. Below is a breakdown of the data we collect and the source.

2.1 Website Enquiry Form

When you submit an enquiry through the contact form on our website (powered by FormSubmit), we collect:

• Your full name
• Email address
• Phone number
• Message content (your enquiry details)

2.2 GreenRun Website Account

When you create an account and use the GreenRun website, we collect:

• Your full name
• Email address
• Phone number
• Home or property address (including postcode)
• Payment information (processed securely via Stripe — we do not store your card details)
• Booking history and service records
• Photographs (before and after garden photos uploaded by you or our team)
• Account authentication data (managed via Firebase Authentication)

2.3 WhatsApp Messages

When you contact us via WhatsApp Business, we collect:

• Your phone number
• Message content (text, images, or voice messages you send us)

2.4 Automatically Collected Data

When you visit our website or use the GreenRun website, we may automatically collect certain technical and device data, including:

• IP address
• Browser type and version
• Device type, model, and operating system
• Screen resolution and language settings
• Pages visited, time spent, and referral source
• With analytics accepted: Google Analytics browser identifiers, page and contact interaction data, and first-party arrival details such as campaign identifiers and the page that brought you to GreenRun. Arrival details may accompany a submitted quote or booking. See our Cookie Policy.
• Cookies and similar tracking technologies (see Section 9)

3. How We Use Your Data

We use the personal data we collect for the following purposes:

4. Data Sharing and Third Parties

We do not sell, rent, or trade your personal data to third parties. However, we share data with trusted service providers who assist us in operating our business. These third-party processors act only on our instructions and are contractually obligated to protect your data.

We may also disclose your data if required to do so by law, regulation, legal process, or enforceable governmental request.

5. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our retention periods are:

When your data is no longer required, we will securely delete or anonymise it.

6. Data Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it, including:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS/SSL (HTTPS).
• Encryption at rest: Data stored in Firebase and Stripe is encrypted at rest using industry-standard encryption.
• Access controls: Only authorised personnel have access to personal data, restricted on a need-to-know basis.
• Secure authentication: Firebase Authentication is used to manage user accounts with secure sign-in methods.
• Payment security: All payment processing is handled by Stripe, which is PCI DSS Level 1 certified — the highest level of security certification in the payments industry.
• Service regions: We configure and review the regions used by our providers; not all GreenRun Firebase processing is limited to the UK or EEA.

While we strive to protect your personal data, no method of electronic transmission or storage is 100% secure. If you become aware of any security issues, please contact us immediately at info@greenrun.uk.

7. Your Rights Under UK GDPR

Under the UK General Data Protection Regulation, you have the following rights in relation to your personal data:

8. International Data Transfers

Our providers may store or process personal data in the United Kingdom, the EEA, the United States and other countries used to provide and secure their services. GreenRun Cloud Functions currently run in us-central1 in the United States; other Firebase and provider products may use different configured or provider-operated locations.

Some of our third-party service providers (such as Stripe and Google) may process data outside the UK/EEA. Where this occurs, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office (ICO)
• The UK International Data Transfer Agreement (UK IDTA) and/or the UK Addendum to the EU SCCs, as required under UK GDPR
• Adequacy decisions by the UK Government recognising the destination country's data protection standards
• The service provider's binding corporate rules or equivalent safeguards

In particular, Google/Firebase and Stripe may process certain data in the United States. Where UK data-protection law requires a transfer safeguard, we rely on the applicable contractual terms, adequacy arrangements or another lawful transfer mechanism provided for that service.

9. Cookies and Tracking Technologies

Our website uses a limited number of cookies and similar technologies:

Use the Cookie preferences button on any page to accept or reject analytics. Rejecting analytics stops further GreenRun analytics events and removes optional attribution and readable Google Analytics cookies from this browser. If browser storage is blocked, your choice applies only to the current page. Essential sign-in and payment functions are separate. You can also manage cookies in your browser settings.

For more information, please see our Cookie Policy.

10. Children's Privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at info@greenrun.uk and we will promptly delete the information.

11. Third-Party Links

Our website may contain links to third-party websites or services, such as payment, messaging or social-media services. We are not responsible for their privacy practices, so please read their privacy information before providing personal data.

12. Complaints

If you are unhappy with how we have handled your personal data, we would like the opportunity to resolve your concerns. Please contact us first at info@greenrun.uk.

If you remain dissatisfied, you have the right to lodge a complaint with the UK's supervisory authority:

13. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the ICO: We will report the breach to the Information Commissioner's Office within 72 hours of becoming aware of it, as required by UK GDPR Article 33.
• Notify affected individuals: Where the breach is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay, explaining the nature of the breach and the steps we are taking to address it.
• Investigate and mitigate: We will promptly investigate the cause, take steps to contain and mitigate the breach, and implement measures to prevent future occurrences.
• Maintain records: We will document all personal data breaches, including the facts, effects, and remedial action taken, regardless of whether they are reportable to the ICO.

If you believe your personal data has been compromised, please contact us immediately at info@greenrun.uk.

14. Automated Decision-Making and Profiling

Under Article 22 of the UK GDPR, you have the right to know about and challenge decisions made solely by automated means that produce legal or similarly significant effects.

We use automated pricing algorithms to calculate the cost of gardening services when you request a quote through the GreenRun website. Our pricing engine takes into account factors such as:

• The type of service requested (e.g., lawn mowing, hedge trimming)
• The estimated size of the area to be serviced
• The complexity and condition of the garden
• Your location and travel distance
• Current demand and scheduling availability

This automated pricing is necessary for the performance of our contract with you (Article 22(2)(a) UK GDPR), as it enables us to provide instant, consistent quotes. The pricing calculation does not use any special category data and does not make decisions about your eligibility for services.

Your rights regarding automated decisions:

• You can request human review of any automated pricing decision by contacting us
• You can express your point of view and contest any price you believe is unfair
• You can request an explanation of how your specific quote was calculated

To exercise any of these rights, please email info@greenrun.uk with the subject line "Automated Decision Review".

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify affected account holders directly where appropriate and where contact details are available
• Post a notice on our website for significant changes

We encourage you to review this page periodically. Your continued use of our services after any changes constitutes acceptance of the updated Privacy Policy.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please do not hesitate to get in touch: