Skip to content
Rootwell
Shop by sceneBalcony & potsVeg bedFamily & kidsPicnicDay hikeCampingBackyardGifts

This policy explains how DUTHUS INVESTMENTS LIMITED ("Rootwell", "we", "us") collects, uses, shares and protects personal data when you visit duthinve.shop, place an order, subscribe to membership, or contact us.

1. Who is responsible for your data

The data controller is DUTHUS INVESTMENTS LIMITED, registered office 80/3 Commercial Street, Edinburgh, Scotland, EH6 6LX, United Kingdom. For any privacy question or request, contact us at support@duthinve.shop or +44 7537193978.

2. What we collect

  • ·Order and delivery data: name, email, phone (optional), delivery address, items ordered, and order value.
  • ·Account and membership data: email, membership tier, and subscription status (if you subscribe).
  • ·Support and enquiry data: the name, email, and message details you send through our contact, wholesale, or order-tracking forms.
  • ·Payment data: handled by our payment processor. We receive confirmation of payment and limited card metadata (such as card brand and last four digits). We never receive or store your full card number, CVC, or full card details.
  • ·Technical and usage data: IP address, device and browser type, and pages viewed, collected through essential and (if enabled) analytics cookies.

3. Collection sources

Most data is provided by you when you order, subscribe, or contact us, including your shipping address for order fulfilment and returns support. Technical data is automatically collected by our hosting and cookie technologies. Payment confirmation comes from our payment processor.

4. Why we use it, and our legal bases

  • ·To process and deliver orders and manage returns — legal basis: performance of a contract.
  • ·To operate membership subscriptions and billing — performance of a contract.
  • ·To provide customer support and respond to enquiries — legitimate interests and/or performance of a contract.
  • ·To keep records for accounting, tax and legal compliance — legal obligation.
  • ·To retain incomplete-checkout enquiries so we can help you finish or follow up — legitimate interests (and consent where required).
  • ·To improve the site and, where you consent, measure usage with analytics — consent / legitimate interests.
  • ·To prevent fraud, abuse and disputes — legitimate interests.

5. Who we share it with

We do not sell your personal data. We share it only with service providers who process it on our behalf:

  • ·Payment processing: Stripe, to take card payments securely. Stripe processes card details directly under its own privacy terms.
  • ·Hosting and content delivery: our cloud hosting provider, which stores and serves the site.
  • ·Database and lead storage: our managed database provider, which stores order, account and enquiry records.
  • ·Email delivery: our transactional email provider, used to send order and support emails.
  • ·Delivery carriers: the courier or postal service that ships your parcel, which receives your name and delivery address.
  • ·Professional advisers and authorities: where required by law, or to establish, exercise or defend legal claims.

6. International transfers

Some of our providers process data outside the UK/EEA. Where they do, we rely on appropriate safeguards such as UK/EU adequacy decisions or Standard Contractual Clauses (with the UK International Data Transfer Addendum where applicable) to protect your data.

7. How long we keep it

  • ·Order and transaction records: retained for up to 7 years to meet accounting and tax obligations.
  • ·Account and membership data: for as long as your membership is active, then archived or deleted.
  • ·Support and enquiry (lead) data: up to 24 months from last contact, then deleted.
  • ·Analytics data: retained per the retention window of our analytics settings.

8. Your rights (UK GDPR / EU GDPR)

You have the right to:

  • ·Access a copy of the personal data we hold about you.
  • ·Rectify inaccurate or incomplete data.
  • ·Erase your data where there is no overriding legal reason to keep it.
  • ·Restrict or object to certain processing, including direct marketing.
  • ·Data portability for data you provided to us.
  • ·Withdraw consent at any time, without affecting prior processing.

To exercise any right, email support@duthinve.shop. You also have the right to complain to your data protection authority — in the UK, the Information Commissioner's Office (ICO).

9. California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use it, to request access or deletion, and to not be discriminated against for exercising your rights.

10. Do Not Sell or Share My Personal Information

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. There is no sale or share to opt out of. If this ever changes, we will update this policy and provide an opt-out.

11. Cookies and analytics

We use essential cookies to run the cart and checkout, and, where you consent, analytics cookies to understand usage. See our Cookie Policy for details and choices.

12. Automated decisions and children

We do not make decisions with legal or similarly significant effects using solely automated processing. Rootwell is not directed at children: you must be at least 13 to create an account or order, and customers aged 13–17 must have the consent of a parent or guardian.

13. Security

We use encryption in transit (HTTPS), access controls, and reputable processors to protect your data. No method of transmission is completely secure, but we take reasonable measures to safeguard it and to notify you and regulators of any breach where legally required.

14. Changes and contact

We may update this policy from time to time; the date above reflects the latest version. Questions or requests: support@duthinve.shop, DUTHUS INVESTMENTS LIMITED, 80/3 Commercial Street, Edinburgh, Scotland, EH6 6LX, United Kingdom.