How to request data deletion.
Email info@thegardenhub.co.uk with the subject line "Data deletion request". Include the email address you used with us, plus any other emails or order references that might help us find your records.
We'll reply within one working day to confirm we've received your request, and complete the deletion within one calendar month (UK GDPR Article 12). Most are done same week.
Logged-in customers can also raise a deletion request directly from My Account → Support — pick "Existing order" as the topic and mention data deletion. It lands in the same support inbox and includes your order history automatically.
What gets deleted.
A deletion request removes everything we hold about you across the site:
- Your account — name, email, addresses, phone, password hash, login history.
- Newsletter subscription — your subscriber row plus tags, send history, click logs, and any automation state.
- Support tickets — every email or contact-form thread you have with us, plus replies, attachments, and event history.
- WhatsApp conversations — every message in either direction on our +44 7459 554 265 line.
- Lead-magnet sign-ups — any guide downloads or email captures.
- Saved checkouts — any in-progress basket snapshots stored against your email.
- Mail log — copies of every email we sent you.
What we may retain.
UK GDPR Article 17 lets us keep certain data even after a deletion request, where there's a legal obligation or legitimate basis. In practice that means:
- Order and financial records — UK law requires us to keep these for 6 years (Limitation Act 1980, HMRC record-keeping rules). Your order and invoice will remain in our system, but personal identifiers can be redacted on request where the law allows.
- Anti-fraud signals — hashed payment fingerprints used to detect fraud. These are not personal data once hashed and are kept indefinitely.
- Suppression list entries — if you unsubscribed from marketing, we keep a hashed record of that fact so we never accidentally email you again.
Anything that falls outside these exceptions is fully removed.
How long it takes.
Under UK GDPR we have one calendar month to action a deletion request. In practice we handle most within the same week. If your request is unusually complex, we may extend the deadline by a further two months — and we will tell you why and when to expect completion.
Once your data is deleted, we will email you a confirmation. The deletion is irreversible.
If you're not satisfied.
If we've handled your request poorly, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. We'd rather you came to us first — most disputes are misunderstandings about what we hold or what we're legally required to keep, which we can usually clear up in a single email.
For the full picture of how we handle your data, see our privacy policy.