Privacy policy.
What we collect when you book a visit, why we need it, who we share it with, and how to get it back or have it deleted.
Last updated 10 July 2026
Who we are
Garden Harvest on Stone Street is the data controller for the personal information described in this policy. That means we decide what is collected and what happens to it.
Garden Harvest on Stone Street
Stone Street, Kent, CT4 6DD
info@garden-harvest.co.uk
What we collect, and why
We only ask for what we need to run a booked visit. Every item below is tied to a specific purpose and a lawful basis under the UK General Data Protection Regulation.
| What | Why we need it | Lawful basis |
|---|---|---|
| Your name, email address and telephone number | To take your booking, send your confirmation with a check-in QR code and PIN, and reach you if a visit has to change. We send a text message to your telephone number when your booking is confirmed, moved or cancelled | Performance of a contract |
| Your car registration, if you give it | To recognise your vehicle when you arrive and match it to your booking | Performance of a contract |
| The number of companions coming with you | To keep each time slot within a safe and comfortable capacity | Performance of a contract |
| Your booking record, the amount paid, and the reference numbers Square gives us for the order and the payment | To confirm your visit, to issue a refund if you cancel in time, and to keep proper accounting records | Performance of a contract; legal obligation |
| The time you check in at the gate | To know who is in the garden during a slot, and to match anything you buy at the till back to your visit | Performance of a contract |
| What you buy at the till on the day | To take payment and to keep proper accounting records | Performance of a contract; legal obligation |
| Your marketing preference, with the date, time and IP address recorded when you gave it | To send you our weekly email update, only if you asked for it, and to be able to show that you did | Consent |
We do not collect special category data, and we do not make any automated decisions about you or build a profile of you.
Card payments and the details we never see
Payments are taken by Square. Your card number, expiry date and security code are entered directly into a form hosted by Square and are sent straight to them. They never reach our server and we never store them.
What we keep is the amount, the date, and the reference identifiers Square returns for your order and payment. That is enough to find your booking, issue a refund, and satisfy our accountants.
Who we share it with
We never sell your personal information, and we do not share it with advertising networks. We do rely on a small number of service providers to run the garden:
- Square — processes card payments and holds a customer record so that your booking and any purchases at the till can be matched to you. See Square’s privacy notice.
- Brevo — delivers your booking confirmation, harvest updates for the day you are visiting, and, if you asked for them, our seasonal emails. Brevo also delivers the text messages we send about your booking.
- Google Analytics — if you accept analytics cookies, tells us how the site is used (which pages, roughly where visitors come from) so we can improve it. It never sees your name, email address or booking details.
- Our hosting provider — stores the booking database on servers within the United Kingdom or the European Economic Area.
Where a provider transfers data outside the United Kingdom, that transfer is covered by the UK International Data Transfer Addendum or an equivalent safeguard.
We may also disclose information where the law requires it, or to establish or defend a legal claim.
How long we keep it
- Booking and payment records are kept for 7 years, because HM Revenue & Customs requires us to retain accounting records for six complete financial years plus the current one.
- Check-in records are kept for 12 months, then removed.
- Marketing preferences are kept until you withdraw your consent, and then for a short period afterwards so that we can prove we stopped when you asked us to.
Your rights
Under UK GDPR you have the right to:
- Be told what personal information we hold about you, and get a copy of it.
- Correct anything that is wrong or incomplete.
- Have it erased, where we have no continuing reason to keep it. Records we are required to retain for tax purposes are the usual exception.
- Restrict or object to how we use it.
- Receive it in a portable format, so you can take it elsewhere.
- Withdraw your consent to marketing at any time. Withdrawing it is as easy as giving it, and it does not affect anything we sent you beforehand.
To exercise any of these rights, email info@garden-harvest.co.uk. We will respond within one calendar month. There is no charge.
If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first, so we can put it right.
Cookies
The cookies needed to make the site work are set automatically. We also use Google Analytics to understand how visitors use the site — but only if you agree. When you first arrive you are asked to accept or decline; nothing analytics-related is set unless you accept, declining changes nothing about your booking, and we set no advertising cookies and nothing that follows you to other websites. You can change your mind at any time by clearing this site's cookies in your browser.
| Cookie | Purpose | Expires |
|---|---|---|
laravel-session |
Keeps track of your session so that the booking form remembers what you entered as you move between steps | When you close your browser, or after two hours of inactivity |
XSRF-TOKEN |
A security token that stops another website from submitting a form on this site in your name | With the session |
| Square cookies, on the payment step only | Set by Square to detect fraudulent card use. Without them the payment cannot be taken | Set and controlled by Square |
_ga, _ga_… |
Set by Google Analytics, only after you accept, to measure how the site is used — which pages are visited and roughly where visitors come from. No advertising, and nothing that identifies you by name | Up to two years |
gh_cookie_consent |
Remembers whether you accepted or declined analytics, so you are not asked on every visit | Six months |
Our typefaces are served by Google Fonts. Google does not set a cookie for this, but it does see your IP address when the fonts load.
Changes to this policy
When we change this policy we update the date at the top of the page. If a change materially affects how we use your information, we will tell you directly rather than expect you to notice.
You may also want to read our booking terms.