Privacy Policy

Last updated: 30.09.2026

1. Controller

Roots Radicals GmbH, Eisenbahnstr. 42/43, 10997 Berlin, Germany, represented by Monica Kisic Aguirre. Email: hello@rootsradicals.berlin, phone: 017685260145.

2. Overview

Our wholesale portal is for businesses; the catalogue can be viewed without logging in. We mainly process personal data when you order: data of your contact persons and your company. We use no third-party advertising or tracking services and no third-party cookies.

3. Hosting and server logs

The website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. With every request technically necessary data (IP address, date and time, URL, referrer, browser and device data, status codes) are processed to deliver the pages and fend off attacks (Art. 6(1)(f) GDPR), under a data processing agreement. Processing may take place in the USA; Vercel Inc. is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Logs are kept only briefly.

4. Database

Orders, contacts and catalogue data are stored with Supabase (Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513) in a data centre in the EU (Ireland), under a data processing agreement; any access from third countries is covered by EU Standard Contractual Clauses.

5. Orders

For an order we process the company name, contact person, email address, optionally phone number and VAT ID, billing and delivery address, notes and the products and prices ordered, to perform the contract with your company (Art. 6(1)(b) GDPR; for contact persons Art. 6(1)(f) GDPR — our legitimate interest is communicating with our business customer) and to meet commercial and tax law obligations (Art. 6(1)(c) GDPR). You receive acknowledgement, confirmation and status emails. If we need to change an order you receive a personal link to confirm or decline the change; confirmation emails may contain an "order again" link. These links contain a random identifier and are meant for you only. Retention: accounting records 8 years, business letters 6 years, books and annual accounts 10 years, each from the end of the calendar year (§ 257 HGB, § 147 AO).

6. Address check (Photon / OpenStreetMap)

While you type the billing address we suggest matching addresses and check that the address exists. Our server sends the address parts you typed (street, house number, postcode, city — no name and not your IP address) to the Photon geocoding service of komoot GmbH, Kienberger Allee 4, 12529 Schönefeld, Germany, based on OpenStreetMap data; your browser does not connect to komoot. Legal basis: our legitimate interest in correct delivery and billing addresses (Art. 6(1)(f) GDPR). Using the suggestions is optional.

7. Invoicing (Lexware Office)

We create invoices with Lexware Office by Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany, transmitting company name, address, VAT ID where given, contact person and invoice lines (Art. 6(1)(b) and (c) GDPR).

8. Shipping (GLS)

For parcel and pallet shipments we pass name or company and delivery address to General Logistics Systems Germany GmbH & Co. OHG (GLS), GLS-Germany-Straße 1–7, 36286 Neuenstein, Germany, which delivers under its own responsibility (Art. 6(1)(b) GDPR). We only pass on email or phone where needed for delivery or with your agreement.

9. Emails (Resend)

Emails are sent via Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) under a data processing agreement; the provider is certified under the EU-US Data Privacy Framework.

10. Customer care and email marketing

We keep the contact data from your orders (company, contact person, email, order history) in our customer records to look after your company as a customer (Art. 6(1)(f) GDPR). We may email you about our own similar products (§ 7(3) UWG, Art. 6(1)(f) GDPR). You can object at any time, at no cost other than the basic transmission costs, via the unsubscribe link in every email or by emailing us; we then record the objection so that we respect it permanently. If we did not receive your business contact data from you (e.g. at trade fairs or from public sources such as your website), we store company, name, business contact details and the source in order to contact your company (Art. 6(1)(f) GDPR); in that case we send promotional emails only with your consent.

11. Browser storage and consent

rr-b2b-cart (local storage, your cart), rr-locale (cookie, your language choice, only set when you switch language), rr-b2b-consent (your banner choice) and a short-lived session storage entry after submitting an order (to show the email status on the confirmation page) are strictly necessary (§ 25(2) no. 2 TDDDG). rr-b2b-vid (local storage, random id for our visit statistics) is used only with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR); without consent it is neither created nor read and no statistics are sent. You can withdraw consent any time via "Privacy settings" at the bottom of the page; "Decline" deletes the id.

12. Our own visit statistics (with consent only)

With your consent we record pages viewed, product details opened and products added to the cart, together with the random id, the time, the referring page and a coarse location (country, city) derived by our host Vercel from the IP address. We do not store the IP address itself.

13. Product portfolio (PDF)

The downloadable product portfolio is hosted on Google Drive. Clicking the link takes you off our website; Google's privacy notice applies (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).

14. Fonts

Fonts are served from our own server, without any connection to Google Fonts.

15. Transfers to third countries

Transfers to the USA go to Vercel Inc. and Plus Five Five, Inc. (Resend) based on the EU-US Data Privacy Framework (Art. 45 GDPR). Where Supabase Pte. Ltd. (Singapore) can access data, EU Standard Contractual Clauses apply.

16. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3)). Right to object (Art. 21 GDPR): you may object at any time to processing based on legitimate interests on grounds relating to your particular situation, and to direct marketing without giving reasons. You may lodge a complaint with a supervisory authority (Art. 77 GDPR); ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin. There is no automated decision-making (Art. 22 GDPR). The fields marked as required are needed to conclude an order.