Who is responsible
Snuffleruff Nursery is a trading name of SNUFFLERUFF LTD, a company registered in England and Wales with company number 17569714. “We”, “us” and “our” mean SNUFFLERUFF LTD.
Our correspondence address is Snuffleruff – Suite RA01, 195–197 Wood Street, London, E17 3NU, United Kingdom. This is not a visitor office, collection point or returns address unless we specifically confirm otherwise.
SNUFFLERUFF LTD is the controller for personal information handled by Snuffleruff Nursery. Contact privacy@snuffleruff.com for privacy questions or rights requests. An independent organiser, payment provider or external website may also be responsible for its own processing, as explained at the relevant service.
Information we use
Depending on the service you use, we handle contact details, order and delivery details, correspondence, payment status, communication choices and information you supply about a plant, site or activity. For shared growing, this may include your role, availability, relevant permissions and agreed access arrangements. We ask only for information needed for the purpose.
Payment services handle the payment information required for your transaction; do not send card details in an enquiry. When someone arranges delivery to another person, we use the recipient details for delivery and related communications, not to add them to marketing lists.
Technical information may include IP address, browser and device details, pages requested and proportionate security or error records. Our Cookie Policy explains device storage and tracking. A form that prepares a downloadable note on your device does not send its contents to us: we receive it only if you separately send it through a contact channel.
We obtain information principally from you, from someone authorised to act for you, and from providers handling your order or request. Where information comes from another source, we provide the required privacy information unless a lawful exception applies.
Purposes and lawful bases
Orders and requested services: we use the information necessary to take requested steps before a contract and to perform it, including payment, delivery, returns and customer service.
Enquiries and community arrangements: we rely on our legitimate interests in responding, assessing site suggestions and coordinating requested activities, balanced against your rights. Information necessary for a specific contract is processed on that basis instead.
Security and administration: we rely on legitimate interests in protecting the website, preventing misuse and handling complaints or legal claims. Accounting, tax, regulatory and plant-health traceability records are processed where needed to meet applicable legal obligations.
Optional email marketing: we rely on your separate consent. We do not treat an order, enquiry, participation request or acceptance of terms as a general marketing opt-in. Where optional device technologies require consent, we obtain it separately.
Information required for a contract or legal obligation is identified when collected. If you do not provide necessary information, we may be unable to fulfil the order or service. We explain any materially different use before it begins.
Marketing and communication choices
We send promotional updates for the brands and subjects you choose. You can unsubscribe using the link in a marketing email or contact privacy@snuffleruff.com. Withdrawal does not affect processing that was lawful before withdrawal. We keep a minimal suppression record when needed to respect your choice.
A Nursery choice does not subscribe you to unrelated Snuffleruff lists. Order confirmations, safety notices, responses to enquiries and necessary activity messages are distinct from general marketing. We do not sell personal information or hand enquiry lists to unrelated sponsors for their own marketing.
Who receives information
Information is shared only as needed with providers supporting hosting, security, communications, payments, deliveries and administration, and with professional advisers, regulators or authorities where justified or legally required. Providers acting on our instructions must have appropriate contractual protections.
Couriers receive information needed for delivery. Payment services receive information needed to process and protect the transaction. Where a provider acts as an independent controller, its own notice explains that processing. The relevant provider is identified in the service or transaction flow.
A land suggestion, volunteering enquiry or private message is not automatically public. We explain any necessary handover to an independent site organiser and obtain permission where required. Publication of identifiable photographs or stories is handled separately; participation is not a blanket publicity licence.
How long we keep information
Order, payment, refund and accounting records are retained for the applicable tax, record-keeping and legal-claims periods. Relevant plant-health and traceability records are retained for the period required by the rules applying to the consignment. We do not retain unrelated personal information merely because some business records must be kept.
Enquiries and site suggestions are kept while needed to respond, assess the proposal and complete reasonable follow-up, then deleted or minimised unless an ongoing agreement, complaint or legal obligation requires them. Activity records are kept for participation, safety and proportionate follow-up, with necessary incident records retained according to legal and safeguarding needs.
Marketing details are kept while the subscription remains active, with limited consent and suppression evidence retained as necessary. Security records are retained in proportion to their purpose and any investigation. We review retention and delete or anonymise information no longer needed; residual backups expire through the backup cycle rather than being reused for ordinary purposes. Ask us for the retention criteria relevant to your information.
Security and overseas processing
We use appropriate technical and organisational safeguards for the information handled. No system can guarantee absolute security. Please do not send passwords, payment-card details or identity documents in ordinary correspondence.
Where a service requires a restricted transfer of personal information outside the UK, we use an applicable adequacy arrangement or appropriate safeguards, such as approved contractual protections and any necessary transfer assessment. You can ask privacy@snuffleruff.com about the recipients, countries and safeguards relevant to your information and how to obtain a copy of the safeguards.
Children, access needs and sensitive information
Children have their own privacy rights. Adults arranging family, school or group activities should use their own contact details and avoid sending children’s identifying information unless needed through the appropriate process. Participation ages and supervision are set for each activity; browsing this website does not create an account or an age declaration.
Please discuss access needs privately. Where health or other special-category information is necessary, we explain its purpose, recipients, lawful basis and the additional legal condition before collecting it. An ordinary enquiry does not authorise unrelated sensitive profiling. We do not use this website to make solely automated decisions producing legal or similarly significant effects.
Your rights and complaints
Subject to the conditions in data-protection law, you may request access, correction, deletion, restriction or portability of your information, and object to processing based on legitimate interests. You can object to direct marketing at any time and withdraw consent where we rely on it.
Contact privacy@snuffleruff.com. We may need proportionate identity checks and normally respond within one month, explaining any lawful extension or limitation. You can complain to the Information Commissioner’s Office or another competent regulator where applicable. You do not have to complain to us first.
We update this notice when our practices change and provide further notice where needed. External websites and independently operated services have their own privacy information.