Privacy Policy

Privacy Policy

Last updated: August 20, 2026

This Privacy Policy explains how David's Roots ("we," "us," or "our") collects, uses, and protects information when you visit or make a purchase from our website (the "Site"). We are committed to collecting only the information necessary to operate our store and to being transparent about how it is used.

Contact us about privacy:
Email: davidsroots@use.startmail.com

1. Information We Collect

We collect information only when you actively provide it to us, either through our contact form or when placing an order. We do not use analytics tracking or email marketing tools, and we do not passively track your browsing behavior beyond what is strictly necessary for our store to function (via Shopify, our e-commerce platform).

1.1 Contact Form

If you use our contact form, we collect your name, email address, and the content of your message, solely to respond to your inquiry.

1.2 Orders and Checkout

When you place an order, we (through our platform, Shopify) collect the information necessary to process and fulfil it:

  • Full name
  • Email address
  • Phone number
  • Shipping and/or billing address
  • Payment information (processed securely by Shopify's payment systems — we do not store your full card details ourselves)

1.3 Cookies

Our Site runs on Shopify, which uses essential cookies required for core store functions such as maintaining your shopping cart, processing checkout, and keeping your session secure. We do not use advertising, retargeting, or analytics cookies.

For more detail on the cookies Shopify uses, see Shopify's own Cookie Policy.

2. How We Use Your Information

We use the information collected strictly to:

  • Process, fulfil, and ship your orders
  • Communicate with you about your order or inquiry
  • Comply with legal and tax obligations
  • Prevent fraud and protect the security of our Site

We do not sell, rent, or use your information for advertising, profiling, or marketing purposes.

3. Sharing of Information

We do not sell your personal information. We only share it with the following categories of service providers, strictly as needed to run our store:

  • Shopify — our e-commerce and payment processing platform
  • Shipping carriers, solely to deliver your order
  • Tax or legal authorities, where required by law

These providers may process data outside your country of residence, including in Canada and the United States, where Shopify Inc. is based. Where required, such transfers are protected by appropriate safeguards (such as Standard Contractual Clauses) as required under GDPR and UK GDPR.

4. Data Retention

We retain order information for as long as necessary to comply with our legal, tax, and accounting obligations, and to resolve any disputes. Contact form messages are retained only for as long as needed to respond to and resolve your inquiry.

5. Your Rights

5.1 If you are in the European Union or United Kingdom (GDPR / UK GDPR)

You have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data ("right to be forgotten")
  • Restrict or object to certain processing
  • Request a copy of your data in a portable format
  • Lodge a complaint with your local data protection authority

5.2 If you are a California resident (CCPA/CPRA)

You have the right to:

  • Know what personal information we collect and how it is used
  • Request deletion of your personal information
  • Opt out of the "sale" or "sharing" of personal information — note that we do not sell or share your information
  • Not be discriminated against for exercising these rights

5.3 How to Exercise Your Rights

To exercise any of the above rights, contact us at davidsroots@use.startmail.com. We will respond within the timeframe required by applicable law.

6. Data Security

We take reasonable technical and organizational measures to protect your information, and rely on Shopify's PCI-DSS compliant infrastructure to securely process payment information. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

7. Children's Privacy

Our Site and products are not directed to, and are not intended for use by, individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected information from a minor, we will delete it promptly.

If you believe a child has provided us with personal information, please contact us at davidsroots@use.startmail.com so we can remove it.

8. International Visitors

Our Site is operated from Spain and is intended primarily for customers in the United States and United Kingdom. By using our Site, you understand that your information may be transferred to and processed in countries other than your own, including Spain, Canada, and the United States.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. The "Last updated" date at the top of this page indicates when it was last revised. We encourage you to review this page periodically.

10. Contact Us

If you have any questions about this Privacy Policy or how we handle your information, please contact us at:

David's Roots
Email: davidsroots@use.startmail.com