‌Effective Date: 3 October 2026‌

Welcome to www.forestmasterltd.com, operated by Forest Master Ltd. This Privacy Policy is designed to clearly and transparently explain how we collect, use, store, share, and protect your personal data when you visit our e-commerce website, browse our gardening product collection, create an account, place an order, or interact with our services in any capacity. As a UK-based gardening tool retailer with registered details at 112 Whitley Road, Whitley Bay, Tyne & Wear, NE26 2NE, UK, we are fully committed to complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR) to safeguard your personal information and respect your rights as a data subject.

1. Introduction and Our Legal Obligations

At Forest Master Ltd, we recognize that the security and responsible processing of your personal data is a fundamental part of building long-term trust with every customer, website visitor, and stakeholder. This policy applies to all personal data processing activities we conduct, regardless of whether you are browsing our catalog of plant labels, gardening trowels, watering cans, pruning tools, or completing a transaction on our platform. We adhere to the core data protection principles outlined in UK GDPR: all personal data we collect will be processed lawfully, fairly, and transparently; limited only to the specific, explicit purposes we disclose to you; kept to the minimum necessary scope to fulfill those purposes; maintained accurately and updated when required; stored only for the duration necessary to meet the stated purposes; and processed with appropriate security measures to prevent unauthorized access, disclosure, or loss.

Compliance with these regulations is not merely a legal requirement for our business. It is a core operational value that ensures you can shop with complete confidence, knowing that your personal information is never misused, overshared, or stored longer than needed. We maintain full accountability for all data processing activities conducted on our platform, and we regularly review our internal systems to ensure ongoing alignment with all applicable UK data protection laws, including recent updates under the Data (Use and Access) Act 2025.

2. Contact Details of the Data Controller

The data controller responsible for your personal data under applicable UK data protection laws is:
‌Forest Master Ltd‌
Address: 112 Whitley Road, Whitley Bay, Tyne & Wear, NE26 2NE, UK
Contact Email: logqv@forestmasterltd.com
Contact Telephone: +44 191 447 5920

If you have any questions, concerns, or requests related to this Privacy Policy or the handling of your personal data, you can reach out to our dedicated data protection team at any time via the contact details provided above. We will respond to all legitimate inquiries within 30 calendar days, and we will provide full support if you wish to submit a complaint regarding our data processing practices directly to the Information Commissioner’s Office (ICO), the UK’s independent regulatory authority for data protection.

3. Categories of Personal Data We Collect

We only collect personal data that is directly relevant to delivering our e-commerce services to you, following the data minimization principle required by UK GDPR. The categories of personal data we may collect include, but are not limited to:

• ‌Identification Data‌: Full name, username, password, and account profile details you provide when registering for an account on our website.
• ‌Contact Data‌: Email address, billing address, shipping address, and phone number that you submit during account creation, checkout, or when contacting our customer support team.
• ‌Transaction Data‌: Details related to your orders, including purchased products, order value, payment records, delivery preferences, and return or refund history. We do not store full credit card or payment card details on our internal servers, as all payment processing is handled through PCI DSS compliant third-party payment gateways.
• ‌Technical Data‌: Internet Protocol (IP) address, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, and device identifiers collected automatically when you access our website.
• ‌Website Usage Data‌: Information about how you navigate our site, including page visit durations, click paths, search queries you submit, product view history, and interaction with promotional banners.
• ‌Marketing and Communications Data‌: Your preferences for receiving email marketing updates, newsletters, and promotional offers related to our new arrivals, seasonal gardening collections, and exclusive discount programs.

Our definition of personal data covers all information that can directly or indirectly identify you as an individual, aligning with the expanded scope defined in UK GDPR. We will never collect any personal data that is not strictly necessary to deliver our core e-commerce services to you, and we will not process special category personal data (such as information related to your health, race, religion, or biometric details) under any circumstances without your explicit, documented consent.

4. Lawful Bases for Processing Your Personal Data

Under UK GDPR, all our processing of your personal data is supported by a clearly defined lawful basis, which we outline fully in this section:

1. ‌Performance of a Contract‌: Most of our data processing activities are conducted to fulfill our contractual obligations to you, including processing your orders, arranging product shipment, managing returns and refunds, and providing post-purchase customer support for your gardening tools. Without the necessary personal data required to complete these contractual steps, we will not be able to fulfill your order or deliver the services you request from us.
2. ‌Legitimate Interests‌: Where it is legally permitted, we process your personal data to pursue our legitimate business interests in a way that does not override your fundamental data protection rights. These legitimate interests include optimizing our website functionality to deliver a smoother shopping experience, preventing fraudulent transactions and payment scams, analyzing sales trends to improve our product catalog, and sending you service-related notifications related to your active orders or account updates. We always conduct a careful balancing test before relying on legitimate interests as a processing basis, to ensure your privacy rights are fully protected.
3. ‌Legal Compliance‌: We process your personal data to meet our legal obligations as a UK-based business, including maintaining accurate financial records for tax reporting purposes, responding to valid official requests from law enforcement or regulatory authorities, and retaining order and transaction records for the legally required duration under UK commercial and tax laws.
4. ‌Explicit Consent‌: For any processing activities that are not covered by the three lawful bases outlined above, we will collect your explicit, freely given, specific, and unambiguous consent before proceeding. This includes sending non-transactional marketing emails to new prospects, deploying non-essential analytical and advertising cookies on your first visit to our website, and sharing your personal data with non-essential third-party service providers that are not required to fulfill your order. You retain the full right to withdraw your consent at any time, and withdrawal of consent will not affect the lawfulness of any processing activities completed prior to that withdrawal.

5. Purposes for Which We Use Your Personal Data

We only process your personal data for the explicit, transparent purposes that we disclose to you, and we will never repurpose your data for any new use that is incompatible with these original purposes without providing you advance notice and collecting any required new consent. The core processing purposes include:

• To create and manage your customer account on www.forestmasterltd.com, allowing you to track order status, save your favorite products, access exclusive member discounts including the 15% OFF offer for new registrations, and manage your saved shipping addresses for faster checkout in future purchases.
• To process, fulfill, and deliver your orders for gardening products, including transmitting necessary shipping details to our selected logistics and courier partners to ensure your plant markers, trowels, pruning shears, or garden sprayers are delivered to your specified address accurately and on time.
• To process payment transactions securely, verify your identity to prevent payment fraud, and manage all post-purchase services including return requests, refund processing, product support inquiries, and warranty claims for your purchased items.
• To send you strictly necessary service-related communications, such as order confirmation emails, shipping tracking updates, notifications about product recall alerts, and critical website maintenance announcements that directly impact your use of our platform.
• To respond fully and promptly to your customer support inquiries, whether you contact us via email, phone, or the contact form on our website, using your submitted contact details to follow up on your questions about product specifications, shipping policies, or return procedures.
• To optimize and improve our website experience for all visitors, using anonymized usage data to fix technical bugs, adjust site navigation, and ensure our product pages for categories like new arrivals, popular plant labels, and pruning tools are easy to browse and load correctly across all desktop and mobile devices.
• To comply with all our legal and regulatory obligations under UK law, including maintaining mandatory financial and transaction records, cooperating with official ICO investigations if required, and meeting data protection audit requirements.
• When you have provided explicit consent, to send you personalized marketing emails about our new product launches, seasonal gardening promotions, exclusive discount events, and helpful gardening tips to get the most out of your Forest Master tools. For existing customers, we may also use the soft opt-in mechanism permitted under PECR to send you email updates about similar gardening products that align with your past purchase history, as long as we provided you with a clear, easy-to-use opt-out option at the point when you first made a purchase on our site.
• To protect the security, integrity, and safety of our website, our customers, and our business operations, by monitoring for unauthorized access attempts, fraudulent account activity, and other malicious behavior that could pose a risk to our platform or your personal data.

6. Cookie Consent and Electronic Communications Compliance

In full alignment with PECR requirements, we do not deploy any non-essential cookies on your device when you first visit our website without your explicit, freely given consent. Our cookie consent banner provides you with equal, clear options to Accept All non-essential cookies, Reject All non-essential cookies, or Customize your cookie preferences to select only the categories you wish to allow. The banner also links to our full Cookie Policy, which explains in complete detail every category of cookies we use, their specific purposes, their retention periods, and whether any third-party analytics or advertising partners are involved in setting these cookies. We never use pre-ticked opt-in boxes for non-essential cookie consent, as this practice does not meet the explicit consent standard required under UK data protection laws.

For all marketing electronic communications, we strictly follow PECR rules: for new prospects who have not previously purchased from us, we will only send marketing emails if we have collected their explicit, separate consent through a clear opt-in mechanism on our website. For existing customers who have made a purchase on our platform, we may send marketing emails about similar gardening products using the PECR soft opt-in exemption, and every marketing email we send includes a prominent, one-click unsubscribe link that allows you to opt out of all future marketing communications at any time. If you choose to unsubscribe from marketing messages, we will update your preferences within 7 working days, and you will continue to receive all essential service-related emails related to your active orders and your customer account.

7. Disclosure and Sharing of Your Personal Data

We will never sell, rent, or lease your personal data to third parties for their own independent marketing purposes under any circumstances. We only share your personal data with trusted third-party service providers when it is strictly necessary to fulfill the purposes outlined in this policy, and we ensure every such third party processes your data in full compliance with UK GDPR requirements. All of these service providers are bound by a formal Data Processing Agreement (DPA) that clearly defines their responsibilities for data security, confidentiality, and compliance, in line with our obligations under data protection law. The categories of third parties we may share your data with include:

• Courier and logistics partners, who receive your full name, shipping address, and contact phone number for the sole purpose of delivering your purchased products to your specified location and resolving any delivery-related issues.
• PCI-compliant payment processing service providers, who handle your payment card details securely to complete your transaction, and never store or process your sensitive payment information for any secondary purpose.
• Cloud hosting and website service providers who host our e-commerce platform, including our website infrastructure provider and our e-commerce platform partner, who process your personal data only to maintain the stable, secure operation of www.forestmasterltd.com.
• Email service providers who help us manage our transactional and marketing email communications, and who are prohibited from using your contact data to send any unsolicited messages on their own behalf.
• Authorized regulatory bodies, law enforcement agencies, or judicial authorities, but only when we are legally compelled to disclose your personal data in response to a valid, lawful official request, court order, or regulatory investigation.

We will never transfer your personal data to any recipients located outside of the United Kingdom and the European Economic Area (EEA) unless we can ensure appropriate safeguards are in place to protect your data rights, as required by UK GDPR. Any such cross-border data transfer will be supported by approved data transfer mechanisms including the UK government’s standard contractual clauses (SCCs), and we will provide you with full details of these safeguards upon request.

8. Data Retention Periods

We will not retain your personal data for any longer than is strictly necessary to fulfill the exact purposes for which we originally collected it. We define our standard retention schedules based on the following clear criteria:

• For customer account data: We retain your full account profile data for as long as your account remains active on our website. If you submit a valid request to delete your account, we will erase all your personal account data within 30 calendar days, except for the limited data we are required to retain to meet legal tax, financial, and record-keeping obligations.
• For order and transaction data: We retain order records, purchase history, and related transaction documents for a minimum of 7 years after your order is completed, to comply with UK tax law requirements and resolve any potential post-purchase disputes, warranty claims, or product return requests that may arise.
• For marketing communication contact details: We retain your email address for marketing purposes only for as long as you maintain your active opt-in consent to receive these messages. If you unsubscribe from our marketing communications, we will add your email address to our internal suppression list permanently, to ensure we do not send you any further non-essential marketing emails.
• For website technical and usage data: We retain standard website technical data including IP addresses and session logs for a maximum of 12 months, after which we anonymize or permanently delete this data unless it is required for a formal active security or fraud investigation.

At the end of each applicable retention period, we will securely erase or irreversibly anonymize your personal data, ensuring no identifying details can be recovered or reconstructed from the remaining information.

9. Your Data Subject Rights Under UK GDPR

As a data subject under UK law, you hold a comprehensive set of enforceable rights over your personal data. We are fully committed to supporting you to exercise these rights easily, with no unreasonable barriers or excessive fees, in most cases free of charge. These rights include:

• ‌Right of Access‌: You have the right to request a complete copy of all personal data we hold about you, along with full information about how we process that data, what recipients we have shared it with, and the applicable retention period. We will provide this data to you in a structured, commonly used, machine-readable format within one calendar month of receiving your verified request.
• ‌Right to Rectification‌: If you believe any of the personal data we hold about you is inaccurate, incomplete, or out of date (such as an old shipping address or misspelled name), you have the right to request immediate correction of that information. We will update or complete your data promptly, and notify any third-party service providers who hold the same incorrect information to ensure they also apply the necessary corrections.
• ‌Right to Erasure (Right to be Forgotten)‌: Under specific circumstances permitted by UK GDPR, you have the right to request that we permanently erase all of your personal data from our systems, when the data is no longer necessary for the original purposes we collected it for, you have withdrawn your consent for processing, or you object to the processing and we have no overriding legitimate grounds to continue retaining the data. We will fulfill valid erasure requests without undue delay, unless we are legally required to retain specific limited data for statutory record keeping purposes.
• ‌Right to Restriction of Processing‌: You have the right to request that we temporarily pause processing of your personal data, for example while we verify the accuracy of your data after you have submitted a rectification request, or while we assess the validity of your objection to our legitimate interests processing. During the restriction period, we will only process your personal data for limited purposes that you have agreed to, or as required by law.
• ‌Right to Data Portability‌: For all personal data you have directly provided to us based on your consent or for the performance of a contract, you have the right to request that we transfer that data directly to you, or to another nominated data controller of your choice, in a structured, interoperable, machine-readable format that allows you to reuse your data easily across different services.
• ‌Right to Object‌: You have the full right to object at any time to our processing of your personal data that we conduct based on our legitimate interests, including profiling activities we conduct for marketing or sales trend analysis purposes. If you object to our processing, we will pause all related processing activities immediately, unless we can demonstrate compelling, legitimate overriding grounds that take priority over your rights, or we need to continue processing the data to establish, exercise, or defend legal claims. You also have an absolute right to object to processing for direct marketing purposes at any time, with no exceptions.
• ‌Rights Related to Automated Decision Making‌: We do not conduct any automated decision-making activities or profiling that would produce legal or similarly significant effects on you as a user, outside of standard anti-fraud checks that are necessary to protect our platform and your payment security. If you have concerns about any automated processing that impacts you, you can contact us at any time to request human review of the decision.

To exercise any of these rights, you can submit your request to us via our contact email logqv@forestmasterltd.com, or by phoning our support team on +44 191 447 5920. We will verify your identity before processing your request using basic, non-intrusive verification steps to ensure we do not disclose your personal data to any unauthorized third party. We will respond to all valid requests within 30 calendar days, and will notify you clearly if we need to extend that period by up to a further two months due to the complexity or volume of your request. If you are not satisfied with our response to your request, you retain the full right to submit a formal complaint directly to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.

10. Data Security Measures

We have implemented rigorous technical and organizational security measures to protect your personal data from unauthorized access, accidental loss, destruction, alteration, or disclosure, in line with the security requirements defined in UK GDPR. These measures include:

• Full end-to-end SSL encryption (HTTPS) across every page of our www.forestmasterltd.com website, which encrypts all data transmitted between your browser and our servers to prevent interception by unauthorized third parties when you browse our products or submit personal details during checkout.
• Regular scheduled security updates, vulnerability scanning, and penetration testing of our website infrastructure to identify and patch any potential security gaps before they can be exploited.
• Strict role-based access controls for all our internal staff, meaning only the small number of authorized team members who need access to your personal data to process your orders or respond to your support inquiries are granted permission to access that information, with all access activities fully logged and audited.
• Secure, encrypted offsite backups of all transaction and customer data that are routinely tested for integrity and recoverability, to prevent data loss in the event of an unforeseen technical system failure.
• Regular data protection and security training for all our employees, to ensure every team member understands their responsibilities for protecting customer personal data and follows mandatory internal data handling protocols.

In the highly unlikely event that we discover a personal data breach that poses a high risk to your rights and freedoms as a data subject, we will notify the ICO within 72 hours of becoming aware of the breach, and we will notify you directly without undue delay if the breach is likely to result in serious adverse consequences for you.

11. Updates to This Privacy Policy

We may occasionally update and revise this Privacy Policy from time to time to reflect changes to our business operations, new legal and regulatory requirements, or updates to our website functionality. When we make material changes to this policy, we will update the effective date listed at the top of the page, and we will publish a prominent notification on the homepage of www.forestmasterltd.com to alert all users that the policy has been updated. For any changes that fundamentally alter how we process your personal data in a way that would require your fresh consent under UK GDPR rules, we will provide you with clear advance notice and collect any required new consent before implementing the new processing practices. We encourage you to review this Privacy Policy periodically whenever you visit our website, to stay informed about how we are protecting your personal information.

12. Contact Information for Inquiries

If you have any questions, comments, or concerns about this Privacy Policy, or about any aspect of how Forest Master Ltd processes your personal data, please do not hesitate to get in touch with us directly:
By Email: logqv@forestmasterltd.com
By Telephone: +44 191 447 5920
By Post: Forest Master Ltd, 112 Whitley Road, Whitley Bay, Tyne & Wear, NE26 2NE, UK