1. Who We Are and How to Contact Us
Cottage Garden School is operated by SABI LOGIC LIMITED, a company incorporated in England and Wales (Company Number: 17152838), with its registered office at 128 City Road, London, EC1V 2NX, United Kingdom.
SABI LOGIC LIMITED is the data controller for personal data collected through the sax-home.com website. This means we are responsible for deciding how and why your personal data is used.
If you have any questions, concerns or requests regarding this Privacy Policy or your personal data, please contact us by post at our registered address above or by using the contact form on our Contact page. We aim to respond to all privacy enquiries within 30 days.
This Privacy Policy explains what personal data we collect, why we collect it, how we use it, who we share it with, how long we keep it, and what rights you have in relation to it. We are committed to protecting your privacy and handling your data in an open and transparent manner, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. What Personal Data We Collect
Depending on how you interact with our Website, we may collect and process the following categories of personal data:
Information you provide directly:
- Identity data: first name, last name;
- Contact data: email address, telephone number;
- Communication data: messages you send us via our contact form or WhatsApp, including any information you voluntarily include in those messages;
- Course enrolment data: your stated gardening interests or experience level where provided.
Information collected automatically:
- Technical data: IP address, browser type and version, operating system, referring URLs, pages visited, time and date of access, and other diagnostic data collected via server logs and cookies;
- Usage data: information about how you use our Website, including which pages you visit, how long you spend on them, and what links you click.
We do not collect any special categories of personal data (such as data about race, religion, health, or biometric data) and we do not knowingly collect data from children under the age of 18.
3. How We Collect Your Data
We collect personal data through the following means:
- Direct interactions: when you complete an enrolment form, a contact form, or communicate with us via WhatsApp or email;
- Automated technologies: when you browse our Website, we automatically collect technical and usage data through cookies and similar tracking technologies (see Section 8 below);
- Third parties: we may receive data about you from analytics providers and other technology partners, always in compliance with applicable data protection law.
4. Why We Use Your Data and Our Legal Basis
Under UK GDPR, we must have a valid legal basis for processing your personal data. The following table explains how and why we use your data and our lawful basis for doing so:
- To deliver our free educational course: We process your enrolment details to provide you with access to course materials and updates. Lawful basis: Legitimate interests (providing the educational service you have requested).
- To respond to your enquiries: We process contact data to respond to questions, provide support and communicate with you. Lawful basis: Legitimate interests.
- To send course-related communications: With your consent or where we have a legitimate interest, we may send you emails about new modules, gardening tips or updates. You may opt out at any time. Lawful basis: Consent / Legitimate interests.
- To improve our Website and Service: We analyse usage data to understand how our Website is used and to make improvements. Lawful basis: Legitimate interests.
- To comply with legal obligations: We may process your data where necessary to comply with applicable laws and regulations. Lawful basis: Legal obligation.
- To prevent fraud and ensure security: We may use technical data to detect and prevent fraudulent activity or security breaches. Lawful basis: Legitimate interests.
5. How We Share Your Data
We do not sell, rent or trade your personal data to third parties. We may share your data with:
- Service providers: companies that provide IT, system administration, website hosting, email delivery and analytics services on our behalf, who process data only on our instructions;
- Communication platforms: where you contact us or join support groups via WhatsApp, Meta Platforms Ireland Limited will also process your data in accordance with their own privacy policy;
- Legal and regulatory authorities: where required by law, court order or other legal process, or to protect the rights, property or safety of SABI LOGIC LIMITED, our users or others;
- Business transfers: in the event of a merger, acquisition or sale of assets, your data may be transferred as part of that transaction, subject to appropriate safeguards.
Where we share data with third-party processors, we ensure appropriate data processing agreements are in place. Where data is transferred outside the UK, we ensure adequate safeguards are in place in accordance with UK GDPR requirements.
6. How Long We Keep Your Data
We retain your personal data only for as long as is necessary for the purposes described in this Policy, or as required by law. Our general retention periods are:
- Enrolment and course data: retained for the duration of your engagement with the course and for up to 3 years thereafter, to allow us to answer queries and maintain course records;
- Contact and communication data: retained for up to 2 years from the date of last contact;
- Technical and usage data: typically retained for up to 13 months;
- Legal compliance records: retained for up to 7 years where required by law.
When your data is no longer required, we will securely delete or anonymise it.
7. Your Rights Under UK GDPR
Under UK data protection law, you have the following rights in relation to your personal data:
- Right of access: you have the right to request a copy of the personal data we hold about you (a "Subject Access Request");
- Right to rectification: you have the right to ask us to correct inaccurate or incomplete personal data;
- Right to erasure: you have the right to ask us to delete your personal data in certain circumstances (the "right to be forgotten");
- Right to restrict processing: you have the right to ask us to restrict the processing of your personal data in certain circumstances;
- Right to data portability: where processing is based on consent or contract and carried out by automated means, you may request a copy of your data in a structured, machine-readable format;
- Right to object: you have the right to object to processing based on legitimate interests, including for direct marketing purposes;
- Rights related to automated decision-making: you have the right not to be subject to solely automated decision-making that produces legal or similarly significant effects, where applicable.
To exercise any of these rights, please contact us using the details in Section 1. We will respond within one month. If we are unable to comply, we will explain why. You will not be charged a fee for exercising your rights unless your request is manifestly unfounded or excessive.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at ico.org.uk or by calling 0303 123 1113.
8. Cookies and Tracking Technologies
Our Website uses cookies and similar technologies to provide and improve the Service, analyse usage and remember your preferences. A cookie is a small text file placed on your device by a website.
We use the following types of cookies:
- Strictly necessary cookies: essential for the Website to function (e.g. remembering your cookie preference). These cannot be disabled;
- Analytical/performance cookies: collect information about how visitors use our Website to help us improve it. These are only set with your consent;
- Functionality cookies: remember your preferences to enhance your experience.
When you first visit our Website, you will see a cookie banner requesting your consent for non-essential cookies. You can withdraw consent at any time by clearing your browser cookies. For more information on how to manage cookies, please visit aboutcookies.org.
9. Security of Your Data
We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, disclosure, alteration or destruction. These measures include secure server environments, encrypted data transmission (SSL/TLS) and restricted access controls.
However, no method of transmission over the internet or method of electronic storage is 100% secure. While we strive to protect your data using commercially acceptable means, we cannot guarantee its absolute security. You transmit data to us at your own risk.
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. We will post any updated policy on this page with a revised "Last updated" date. We encourage you to review this Policy periodically. Your continued use of the Website following any changes constitutes your acceptance of the updated Policy. Where we make material changes, we will endeavour to notify you by email (if we hold your email address) or by a prominent notice on the Website.