Triangle Nursery LTD Privacy Policy
Last updated: 25/09/2026
At Triangle Nursery, we know your personal information matters to you - and it matters to us too. This policy explains, in plain English, what information we collect when you visit our website, place an order, contact us or sign up for our newsletter, why we collect it, and what rights you have over it.
If anything here isn't clear, please get in touch - our contact details are in Section 13.
1. Who we are
Triangle Nursery Limited is the "controller" responsible for your personal information under UK data protection law.
- Company name: Triangle Nursery Limited
- Company number: 03481837
- Registered office and trading address: Building 32, Bentwaters Parks, Rendlesham, Woodbridge, Suffolk, IP12 2TW
- Telephone: 01394 385 832
- Email: office@trianglenursery.co.uk
- Data protection contact: Mark, mark@trianglenursery.co.uk
- ICO registration reference: ZA316927
We process your personal information in line with the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR), as amended.
2. Information we collect and why
The table below sets out the main categories of personal information we collect, what we use it for, and the legal basis we rely on for each.
| Category | What it includes | Why we use it | Legal basis |
|---|---|---|---|
| Usage data | IP address, general location, browser and device type, pages viewed, how you found our website, timing and duration of visits | Understanding how our website is used, and improving it | Legitimate interests (and consent for non-essential cookies - see Section 8) |
| Account data | Name and email address | Setting up and managing your account, providing our services, keeping our systems secure | Legitimate interests |
| Order and transaction data | Contact details, order details, delivery address, payment status | Fulfilling your order, taking payment, and keeping proper records | Performance of a contract, and legal obligation (for accounting records) |
| Enquiry data | Details you give us when you contact us about products or services | Responding to your enquiry | Legitimate interests |
| Marketing and notification data | Email address, marketing preferences | Sending you newsletters and offers you've asked to receive | Consent, or the PECR "soft opt-in" for existing customers about similar products |
| Correspondence data | Content of emails, messages and contact-form submissions, and related metadata | Communicating with you and keeping a record of that communication | Legitimate interests |
| Call recordings | Recordings of telephone calls with us, the phone number you call from or we call, and the date and time of the call | Quality monitoring, staff training, checking the details of orders and resolving disputes | Legitimate interests |
| Delivery data | Name, delivery address, contact number | Passed to our courier so they can deliver your order | Performance of a contract |
We don't hold your card payment details - these are collected and processed directly by our payment provider(s) (see Section 4).
We may also process personal information where necessary to comply with a legal obligation, or to protect someone's vital interests.
3. Marketing
We'll only send you marketing emails if you've asked to receive them, either by signing up to our newsletter (using a double opt-in process, so you confirm your subscription before we start sending) or, where the law allows it, because you're an existing customer and we're telling you about similar products or services (the PECR "soft opt-in").
You can change your mind at any time:
- Click "unsubscribe" at the bottom of any marketing email - it's always there and always works immediately.
- Or contact us using the details in Section 13.
You have an absolute right to object to direct marketing at any time, and we'll stop as soon as you ask.
4. Who we share your information with
We do not sell your personal information to anyone.
We share it with the following organisations, only as far as needed for the purpose described:
| Who | What we share it for |
|---|---|
| Stripe | Processing card payments. Stripe holds your card details, not us. |
| Klarna (for orders over £250) | Buy-now-pay-later payment option, if you choose it at checkout |
| Sage 50 (our accounting software) | Accounting, invoicing and financial record-keeping |
| Keap | Our CRM and email marketing platform - stores your contact details, order history and marketing preferences |
| DPD, and our wider courier network | Delivering your order |
| Rackspace | Hosting our website |
| Cloudflare | Website security and performance |
| Google Analytics (GA4) | Understanding how our website is used, so that we can improve it |
| Google reCAPTCHA | Protects our forms from spam and abuse (processes your IP address and device information) |
| Hotjar | Understanding how visitors use our website (e.g. anonymised usage patterns) |
| Google Ads | Measuring our advertising and showing you relevant Triangle ads on other websites, if you've consented to advertising cookies |
| Meta (Facebook/Instagram) | Measuring our advertising and showing you relevant Triangle ads on other websites, if you've consented to advertising cookies |
| Our insurers and professional advisers | Only where reasonably necessary for insurance, legal advice or managing a dispute |
| Our website and IT suppliers | Keeping our website running, secure and backed up |
| Unbounce | Manages pop-ups, sign-up bars and landing pages |
| 4com Network Solutions Ltd | Providing our phone system and securely storing call recordings on our behalf |
| Loqate (Postcode Anywhere) | Address lookup that handles delivery postcodes and addresses |
We may also disclose personal information where required by law, or to protect someone's vital interests.
5. International transfers
Our website hosting (Rackspace, behind a Cloudflare security proxy) is based in the UK.
Some of the service providers listed in Section 4 are based outside the UK, or may process or access personal information from countries outside the UK, including the United States. Where personal information is transferred outside the UK, we ensure that an appropriate safeguard recognised under UK data protection law is in place.
For example, Google LLC participates in the UK Extension to the EU-US Data Privacy Framework (the UK-US Data Bridge). Meta uses the UK Addendum to the EU Standard Contractual Clauses for relevant transfers of UK personal information, and Hotjar uses the EU Standard Contractual Clauses together with the UK Addendum. Unbounce is based in Canada and is subject to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), for which the UK recognises an adequacy arrangement for relevant private-sector organisations. Where personal information is transferred to a country covered by UK adequacy regulations, we may rely on those adequacy regulations.
6. How long we keep your information
We don't keep personal information for longer than we need it. Our general retention periods are:
| Category | Retention period |
|---|---|
| Accounting and tax records | 6 years from the end of the relevant financial year, in line with HMRC and Companies Act requirements |
| Account and order history | 5 years from your last order with us, then deleted |
| Marketing consent and preferences | Until you withdraw consent or unsubscribe, whichever is sooner |
| Enquiries that don't lead to an order | 12 months from the date of your enquiry |
| Call recordings | 6 months from the date of the call, then automatically deleted (unless needed to resolve an ongoing complaint or dispute) |
| Website analytics data | 14 months, in line with Google Analytics settings |
Where we can't state an exact period in advance (for example, an ongoing legal or insurance matter), we'll keep the information only for as long as that matter reasonably requires.
7. Your rights
Under UK data protection law, you have the right to:
- Access a copy of the personal information we hold about you
- Correct inaccurate or incomplete information
- Erase your personal information in certain circumstances
- Restrict how we use your information in certain circumstances
- Object to our use of your information, including an absolute right to object to direct marketing
- Port your data to another provider, where technically possible
- Withdraw consent at any time, where consent is the basis for our processing
- Complain to us, and to the ICO (see Section 11)
To exercise any of these rights, contact us using the details in Section 13.
We'll ask you to confirm your identity in a way that's proportionate to the request - usually by checking the details already on your account, rather than requesting formal documents such as a passport or utility bill unless there's a good reason to.
We'll respond within one month of receiving your request. If it's complex or you've made a number of requests, we may need up to three months - if so, we'll tell you within the first month and explain why.
The first copy of your information is free. If you ask for further copies, we may charge a reasonable fee based on our administrative cost of providing them.
Where we or our service providers use automated decision-making that has a legal or similarly significant effect on you, you have the right to request human review, to express your point of view, and to contest the decision.
8. Cookies
A cookie is a small file stored by your browser when you visit our website, which helps the website work properly and helps us understand how it's used.
We only set cookies that aren't strictly necessary once you've given us your consent, using the cookie settings tool (banner) on our website, Cookiebot. You can change your preferences at any time using the same tool, or through your browser settings.
Cookies we currently use:
| Cookie | Purpose | Type |
|---|---|---|
| Triangle.Authentication | Identifies you and keeps you logged in | Strictly necessary |
| ASP.NET_SessionId | Remembers the contents of your shopping basket | Strictly necessary |
| Cloudflare security cookies: __cf_bm | Protects our website against fraud and abuse | Strictly necessary |
| Google Analytics: (_ga, _ga_<container ID>) | Helps us understand how our website is used, so we can improve it | Analytics - requires consent |
| Hotjar: _hjSessionUser_<site ID> _hjSession_<site ID> and related cookies | Helps us understand how visitors use our website | Analytics - requires consent |
| Meta/Facebook advertising cookie: _fbp | Measures and improves our Facebook/Instagram advertising | Advertising - requires consent |
| Google Ads cookies: _gcl_au, IDE | Measures and improves our Google advertising | Advertising - requires consent |
| Cookie consent tool cookie: CookieConsent | Remembers your cookie preferences | Strictly necessary |
Most browsers also let you block or delete cookies yourself. Doing so may affect how well our website works.
9. Children
Our website and services are aimed at people aged 16 and over. If we become aware that we hold personal information about someone under that age, we'll delete it.
10. Keeping your information secure
We take appropriate technical and organisational steps to protect your personal information against unauthorised access, loss, misuse or disclosure - including secure hosting, access controls and working with reputable service providers. No method of transmission or storage is completely secure, but we work hard to keep your information safe and to respond quickly if anything goes wrong.
Calls to and from our team are recorded, and a message at the start of each incoming call explains this. Recordings are password protected and can only be accessed by authorised staff. If you choose to pay by card over the phone, we pause the recording while your card details are discussed, so they are never recorded.
11. Complaints
If you're unhappy with how we've handled your personal information, please tell us first, using the details in Section 13, so we can put things right. We'll acknowledge your complaint within 30 days and aim to resolve it without undue delay, keeping you updated on progress.
You can also complain directly to the Information Commissioner's Office (ICO) at any time:
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Telephone: 0303 123 1113
- Website: ico.org.uk
12. Changes to this policy
We may update this policy from time to time - for example, if we start using a new service provider, or the law changes. We'll publish the latest version on this page and update the date at the top. Where a change is significant, we'll also let registered customers know by email or through their account.
13. How to contact us
- Post: Triangle Nursery Limited, Building 32, Bentwaters Parks, Rendlesham, Woodbridge, Suffolk, IP12 2TW
- Telephone: 01394 385 832
- Email: office@trianglenursery.co.uk
- Website contact form: available on our website