Privacy Policy
H-LABS Ltd., Kostaki Peev Str. No. 5, 4000 Plovdiv, Bulgaria, Company ID 206565439, VAT No. BG206565439, operates the website www.get-roots.com and processes personal data in accordance with this Privacy Policy and the applicable data protection legislation, including Regulation (EU) 2016/679 (GDPR).
1. Personal Data We Collect
The Merchant collects and processes only the personal data necessary for order processing, delivery of Roots™ products, and communication with customers.
The personal data processed may include:
- first and last name
- telephone number
- email address
- delivery address
- information voluntarily provided when creating a user account
These data are not shared with third parties except with courier companies and payment processors when necessary for order fulfillment.
2. Placing Orders – With or Without Registration
2.1. With personal data provided
Customers may place orders:
- by creating a user account on the website for easier future purchases
- without registration (as a guest), in which case the data must be entered again for future orders
2.2. Without providing personal data online
Customers may also place an order without submitting data through the website by contacting the Merchant directly by telephone.
3. Right to Withdraw Consent (GDPR)
Customers may withdraw their consent for the processing of personal data at any time, in whole or in part, with future effect.
Consent can be withdrawn:
- by deleting the account from the “My Account” section (if available)
- by sending a written request to hello@get-roots.com
Following withdrawal of consent, the account and personal data will be deleted unless the law requires certain data to be retained (for example accounting records).
4. Unsubscribing from Marketing Communications
Customers may stop receiving marketing communications at any time by:
- using the unsubscribe link included in marketing emails
- sending a written request to hello@get-roots.com
Unsubscribing from newsletters does not affect transactional messages related to orders (order confirmation, shipping updates, etc.).
5. Payment Cards and Payment Processing
When paying by card, card details are not received, processed, or stored by H-LABS Ltd.
Payments are processed through authorized PCI-DSS compliant payment providers.
Roots™ and H-LABS Ltd. do not have access to card numbers and are not responsible for misuse occurring outside the payment platform.
6. Non-Personal Data
When visiting the website, certain technical data may be collected automatically, such as:
- browser type
- IP address
- number of visits
- average time spent on the website
- pages viewed
These data do not personally identify users and are used to improve website functionality and user experience.
7. Disclosure of Personal Data to Third Parties
Personal data may be shared with:
- courier companies (for delivery);
- payment processors (for payment processing);
- IT and hosting providers, including Shopify (which operates the online store);
- analytics, marketing and advertising providers used on this Website (see “Cookies, Analytics and Advertising” below), such as Google, Meta (Facebook/Instagram), Microsoft, Omnisend, Judge.me and Triple Whale;
- public authorities, where required by law.
We do not sell your personal data. Where our analytics and advertising partners process data for measurement or advertising purposes, this is done only on the basis of your consent, which you can withdraw at any time.
8. Cookies, Analytics and Advertising
Our Website uses cookies and similar technologies. Non-essential cookies (analytics, marketing and advertising) are used only with your consent, obtained via our consent banner, which you can withdraw at any time. Legal basis: Art. 6(1)(a) GDPR and applicable ePrivacy rules.
We use, among others:
- Google Tag Manager – tag management.
- Google Analytics (Google Ireland Ltd.) – website usage analysis.
- Google Ads (Google Ireland Ltd.) – advertising and conversion tracking.
- Meta Pixel (Meta Platforms Ireland Ltd.) – measurement and advertising on Facebook/Instagram.
- Microsoft Clarity (Microsoft) – analytics and session recording (heatmaps; recordings of mouse movement, clicks, scrolling).
- Triple Whale, Inc. – marketing analytics and attribution.
- Omnisend – newsletter and email marketing.
- Judge.me – product reviews.
International transfers: some providers may process data in the USA; they are certified under the EU-U.S. Data Privacy Framework and/or we rely on the EU Standard Contractual Clauses.
9. Data Security and Storage
Personal data are stored on secure servers accessible only to authorized personnel.
Data are retained only for as long as necessary for:
- order fulfillment
- legal and accounting obligations
- statutory retention periods under applicable laws and GDPR
10. Data Subject Rights
Every user has the following rights under GDPR:
- right of access to personal data
- right to rectification
- right to erasure (“right to be forgotten”)
- right to restriction of processing
- right to object to processing
- right to data portability
- right to lodge a complaint with a supervisory authority
Requests related to these rights may be submitted to:
hello@get-roots.com
11. Supervisory Authority
Commission for Personal Data Protection (CPDP)
Address: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria
Email: kzld@cpdp.bg
Website: www.cpdp.bg
12. Changes to This Privacy Policy
The Merchant reserves the right to modify this Privacy Policy at any time.
Any changes will be published on this page and take effect immediately upon publication.
Last updated: 2026