Privacy Policy

Roots Fine Catering is the data controller responsible for your personal data. If you have any questions about this policy or our data practices, please contact us.

Email: hello@rootsfinecatering.co.uk

We may collect and process the following personal data:

• Identity data: Name, title
• Contact data: Email address, telephone number, delivery/billing address
• Order data: Details of services or products you have purchased from us
• Financial data: Payment card details (processed securely by our payment provider; we do not store full card numbers)
• Dietary data: Dietary requirements and allergen information you provide
• Technical data: IP address, browser type and version, time zone, browser plug-in types, operating system and platform
• Usage data: Information about how you use our website
• Marketing data: Your preferences in receiving marketing from us

We collect data through:

• Direct interactions — when you complete forms on our website, place an order, request a quote, or correspond with us
• Automated technologies — cookies and similar technologies when you visit our website
• Third parties — payment processors and analytics providers

We use your personal data to:

• Process and fulfil your orders and bookings
• Manage your customer account and relationship with us
• Send you booking confirmations, order updates, and invoices
• Respond to your enquiries and provide customer support
• Comply with legal obligations
• Send you marketing communications where you have consented or where we have a legitimate interest
• Improve our website and services through analytics

Our lawful bases for processing include: performance of a contract, legal obligation, legitimate interests, and consent (where applicable).

We may share your personal data with:

• Payment processors (e.g. Stripe) to process transactions securely
• Email service providers to send transactional and marketing emails
• Analytics providers (e.g. Google Analytics) to help us understand website usage
• Legal authorities where required by law

We do not sell your personal data to third parties.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements.

Order and booking records are typically retained for 7 years in line with HMRC requirements. Marketing preferences are retained until you withdraw consent.

Under UK GDPR, you have the following rights:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your personal data in certain circumstances
• Restriction: Request we restrict processing of your data
• Portability: Request transfer of your data to another organisation
• Objection: Object to processing based on legitimate interests
• Withdraw consent: Where processing is based on consent, you may withdraw at any time

To exercise any of these rights, please contact us. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

We use cookies to improve your experience on our website. For full details of the cookies we use, please see our Cookies Policy.

We have implemented appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction. Payment data is processed via PCI-DSS compliant payment providers.

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites and encourage you to read their privacy policies.

We may update this Privacy Policy from time to time. The date at the top of this page will reflect the most recent update. We encourage you to review this policy periodically.