Last updated: 10 October 2026

1. Who we are

Rootlet (www.rootlet.co.uk) is operated by Rootlet Ltd, registered in England and Wales under company number [COMPANY NUMBER], at [REGISTERED ADDRESS]. We are the data controller for your personal data and are registered with the Information Commissioner's Office (ICO) under registration number [ICO REGISTRATION NUMBER].

If you have any questions about this policy or your data, contact us at support@rootlet.co.uk.

2. The data we collect

• Account data: your name, email address, password (stored encrypted), profile photo and any profile details you add.
• Purchase data: the courses you buy, amounts paid, and billing details. Card payments are handled by our payment providers; we do not see or store your full card number.
• Learning data: courses you are enrolled in, your progress, quiz results, certificates, reviews and messages.
• Instructor data: if you teach on Rootlet, your biography, course content, and the payout details needed to pay you (such as PayPal email or bank details).
• Technical data: IP address, browser and device type, and how you use the site, collected through cookies (see our Cookie Policy).
• Communications: emails and messages you send us, and your marketing preferences.

3. How and why we use your data

Under UK GDPR we must have a lawful basis for using your data. We use it:

• To provide our service (contract): to create your account, process purchases, give you access to courses, issue certificates and pay instructors.
• To run and improve Rootlet (legitimate interests): to keep the site secure, prevent fraud, fix problems and understand how the site is used.
• To send you service messages (contract): such as purchase receipts, password resets and important account updates.
• To send marketing (consent): news, offers and course recommendations by email, only if you opt in. You can unsubscribe at any time using the link in any email.
• To use analytics and marketing cookies (consent): see our Cookie Policy.
• To meet legal obligations (legal obligation): such as keeping tax and accounting records.

4. Who we share your data with

We never sell your personal data. We share it only with:

• Instructors of courses you enrol in, who can see your name, progress and any questions or reviews you post on their course.
• Service providers who help us run Rootlet, such as our website host, payment providers (for example Stripe and PayPal), email delivery services, video hosting and analytics providers (for example Google Analytics). They may only use your data to provide services to us.
• Professional advisers and authorities where required by law, or to protect our rights, users or the public.
• A buyer of our business, if Rootlet is ever sold or merged, who would continue to use your data in line with this policy.

5. International transfers

Some of our service providers are based outside the UK, for example in the United States. Where your data is transferred outside the UK, we make sure it is protected by an adequacy decision (such as the UK-US Data Bridge) or by approved safeguards such as the UK International Data Transfer Agreement or Addendum.

6. How long we keep your data

• Account and learning data: for as long as your account is open. If you close it, we delete or anonymise it within 90 days, unless we need to keep it for the reasons below.
• Purchase and payout records: 6 years, as required for tax and accounting.
• Marketing data: until you unsubscribe or withdraw consent.

7. Your rights

Under UK data protection law you have the right to:

• access a copy of your personal data;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to how we use your data, including objecting to direct marketing at any time;
• receive your data in a portable format; and
• withdraw your consent at any time, where we rely on consent.

To use any of these rights, email support@rootlet.co.uk. We will respond within one month. There is normally no charge.

8. Security

We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS) and encrypted password storage. No online service is completely secure, so please use a strong, unique password.

9. Children

Rootlet is intended for adults. We do not knowingly collect personal data from children under 13. If you believe a child has given us their data, please contact us and we will delete it.

10. Complaints

If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

11. Changes to this policy

We may update this policy from time to time. We will post the latest version here and tell you about significant changes.