Privacy Policy

Last updated: 25 May 2026

This Privacy Policy explains how ZTOA DRIVEWAY LTD ("we", "us", "our"), Company Number 17152993, registered at 304a Hoylake Road, Wirral, United Kingdom, CH46 6DE, collects, uses, stores, and protects personal data when you visit our website at casa-machado.com (the "Website") or enrol in our free gardening courses (the "Services").

We are the data controller for all personal data collected through the Website. We are committed to processing your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).

Please read this Privacy Policy carefully. By using our Website or Services, you acknowledge that you have read and understood this policy.

1. What Personal Data We Collect

We may collect the following categories of personal data from you:

Identity Data: First name, last name;
Contact Data: Email address, telephone/WhatsApp number;
Technical Data: IP address, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access the Website;
Usage Data: Information about how you use our Website and Services, including pages viewed, time spent, and links clicked;
Communications Data: Records of correspondence between you and us, including messages sent via contact forms or WhatsApp.

We do not collect any Special Category Personal Data (such as health, racial or ethnic origin, religious beliefs, or financial information) through our Website or Services.

2. How We Collect Personal Data

We collect personal data through the following means:

Enrolment and contact forms: When you register for our free courses or submit a contact form, you provide us with identity and contact data directly;
Automated technologies: As you interact with our Website, we may automatically collect technical and usage data through cookies, server logs, and similar technologies;
WhatsApp communications: If you contact us via WhatsApp, we may receive your contact details and message content;
Third parties: We may receive technical or usage data from analytics providers, such as aggregated traffic statistics.

3. Legal Basis for Processing

Under the UK GDPR, we must have a valid legal basis for processing your personal data. We rely on the following lawful bases:

Consent (Article 6(1)(a) UK GDPR): Where you have given clear, informed consent — for example, when submitting the enrolment form or accepting cookies;
Legitimate Interests (Article 6(1)(f) UK GDPR): Where processing is necessary for our legitimate interests, such as improving the Website, understanding how users engage with our content, and communicating with prospective students — provided such interests are not overridden by your rights and freedoms;
Compliance with a Legal Obligation (Article 6(1)(c) UK GDPR): Where processing is required to comply with applicable laws or regulations.

4. How We Use Your Personal Data

We use your personal data for the following purposes:

To process your enrolment and provide access to our free gardening courses and resources;
To respond to your enquiries and provide customer support via email or WhatsApp;
To send you course-related communications, updates, and educational content (where you have consented);
To analyse Website usage and improve the quality and relevance of our content and services;
To comply with our legal and regulatory obligations;
To detect and prevent fraud, abuse, or security incidents.

We will not use your personal data for automated decision-making or profiling in a way that produces legal or similarly significant effects.

5. Cookies and Tracking Technologies

Our Website uses cookies and similar tracking technologies to distinguish you from other users and to enhance your browsing experience. A cookie is a small text file placed on your device by a web server.

We use the following types of cookies:

Strictly necessary cookies: Essential for the Website to function correctly, such as session management and security tokens;
Analytical/performance cookies: Allow us to recognise and count visitors and understand how they move around the Website, helping us improve its performance;
Preference cookies: Remember your choices, such as your cookie consent preference.

You can control and manage cookies through your browser settings. Please note that disabling certain cookies may affect Website functionality. Your cookie consent preference is stored locally in your browser using localStorage and does not transfer your personal data to us.

6. Data Sharing and Third Parties

We do not sell, rent, or trade your personal data to third parties for their marketing purposes. We may share your personal data with trusted third parties only in the following circumstances:

Service providers: Third-party companies that perform services on our behalf, such as web hosting, email delivery, and analytics. These parties process data only on our instructions and are subject to data processing agreements;
Legal compliance: Where we are required to disclose your data to comply with a legal obligation, court order, or regulatory requirement;
Business transfers: In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the relevant party, subject to appropriate confidentiality obligations;
Protection of rights: Where necessary to protect the rights, property, or safety of ZTOA DRIVEWAY LTD, our users, or others.

7. International Data Transfers

We primarily store and process personal data within the United Kingdom and the European Economic Area (EEA). Where data is transferred to countries outside the UK or EEA, we ensure that appropriate safeguards are in place in accordance with UK GDPR requirements — such as Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO), or transfers to countries with an adequacy decision.

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements. Specifically:

Enrolment and contact data: retained for up to 3 years from your last interaction with us, unless a longer period is required by law;
Technical and usage data: retained in anonymised or aggregated form for up to 2 years;
Communications: retained for up to 2 years from the date of the last communication.

After the applicable retention period, data is securely deleted or anonymised so that it can no longer be associated with you.

9. Your Rights Under UK GDPR

Under UK data protection law, you have the following rights in relation to your personal data:

Right of access: You can request a copy of the personal data we hold about you (a "Subject Access Request");
Right to rectification: You can ask us to correct inaccurate or incomplete personal data;
Right to erasure: You can request deletion of your personal data in certain circumstances;
Right to restrict processing: You can ask us to limit how we use your data in certain circumstances;
Right to data portability: You can request a copy of your data in a structured, machine-readable format where processing is based on consent or contract;
Right to object: You can object to processing based on legitimate interests or for direct marketing purposes;
Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us via the Contact page or write to us at our registered address. We will respond within one calendar month of receiving your request. In some cases we may need to verify your identity before fulfilling a request.

If you are dissatisfied with how we handle your personal data or your rights request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk or by calling 0303 123 1113.

10. Data Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include encryption of data in transit (HTTPS), access controls, and regular security reviews.

However, no internet transmission or electronic storage method is 100% secure. While we strive to protect your personal data, we cannot guarantee its absolute security. You share your data with us at your own risk, and we encourage you to keep your contact details up to date and use secure devices and connections.

11. Children's Privacy

Our Website and Services are not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected such data, please contact us immediately and we will take steps to delete it as quickly as practicable.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the law, or the Services we offer. We will post any changes on this page with a revised "Last updated" date. Where changes are significant, we will notify enrolled users by email where possible. Your continued use of the Website after any changes constitutes acceptance of the revised policy.

We encourage you to review this Privacy Policy regularly to stay informed about how we are protecting your information.

Contact the Data Controller:
ZTOA DRIVEWAY LTD
Company No. 17152993
304a Hoylake Road, Wirral, United Kingdom, CH46 6DE
Website: Contact Page