Privacy Policy

1. Who We Are (Data Controller)

Jute & Root Ltd (“we”, “us”, “our”) is the Data Controller responsible for your personal data collected through https://juteroot.com.

ICO Registration Notice: Jute & Root Ltd is required under the Data Protection (Charges and Information) Regulations 2018 to register with the UK Information Commissioner's Office (ICO) and pay the annual data protection fee.

2. What Personal Data We Collect

Depending on how you interact with our website, we may collect the following categories of personal information:

• Identity Data: First name, last name, and title.
• Contact Data: Delivery address, billing address, email address, and telephone number.
• Transaction Data: Details of products ordered, order numbers, payment amounts, and courier delivery tracking references. (Note: Full payment card details are processed directly by our PCI-DSS Level 1 certified payment processor, Stripe, and never touch our servers).
• Technical Data: IP address, browser type and version, time zone setting, operating system, and anonymised analytics identifiers.
• Marketing & Communications Data: Your preferences in receiving email newsletters, where you have provided explicit opt-in consent.

3. Our Lawful Bases for Processing Under UK GDPR

4. Who We Share Your Data With (Data Processors)

We do not sell, rent, or trade your personal data. We only share data with essential third-party service providers bound by strict data processing agreements:

• Payment Processing: Stripe Payments Europe Ltd (PCI-DSS Level 1 compliant) for card authorizations and fraud scoring.
• Postal & Courier Partners: Royal Mail Group plc, Evri, and DPD for UK address fulfillment and delivery notification emails.
• Cloud Infrastructure: Hostinger International Ltd (UK & EU data centres) for website hosting and secure database storage.
• Professional Advisers & Authorities: HMRC, fraud prevention authorities, or legal advisers where required by UK law.

5. How Long We Keep Your Data

We only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

By UK law, we must keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for 6 full tax years following the financial year of purchase to comply with HMRC statutory requirements.

6. Your Statutory Rights

Under UK data protection law, you have rights including:

• Right of Access: Request a copy of the personal information we hold about you (Subject Access Request).
• Right to Rectification: Ask us to correct any inaccurate or incomplete data.
• Right to Erasure (“Right to be Forgotten”): Ask us to delete your personal data, subject to statutory tax retention duties.
• Right to Restrict or Object: Restrict processing or object to processing based on legitimate interests.
• Right to Data Portability: Receive your personal data in a structured, commonly used machine-readable format.

To exercise any of these rights, please contact our Data Protection Officer at privacy@juteroot.com. We respond to all verified requests within one calendar month, free of charge.

7. Complaints to the Information Commissioner's Office (ICO)

If you have any concerns about our use of your personal data, you have the right to lodge a formal complaint with the UK supervisory authority for data protection:

We would appreciate the opportunity to address your concerns directly before you approach the ICO, so please contact us at privacy@juteroot.com in the first instance.