This page was last updated on 4 September 2026

1. General

1.1 Biogroei BV, trading as “Rootsum”, with registered office at Tiensesteenweg 341 - V1, 3010 Leuven, Belgium, and company number BE 0650.847.036, complies with Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR), as well as the relevant Belgian legislation.

1.2 Rootsum complies with this legislation through this privacy policy.

2. Personal data

2.1 Personal data you provide to us

  • Without registration: your IP address, browsing behaviour, origin and search terms
  • When creating an account: your profile name, password, e-mail address and login details (“Rootsum account”)
  • When subscribing to our newsletter: your e-mail address
  • Through cookies (see Article 8)
  • When placing an order: your name, delivery and billing address, and phone number (the latter is used to notify you promptly of any delivery issues, as our products are living plants)
  • When writing a review: your name and the content of your review
  • When contacting our customer service: the information you share with us by e-mail, phone or through our chatbot
  • When taking part in a promotion or competition: your name and e-mail address

Please note: we do not process your payment details ourselves. Payments are handled in a secure, external payment environment; Rootsum never has access to your payment data.

2.2 How we collect this data

  • Through the use of cookies (see Article 8)
  • During your registration and use of the website
  • When placing an order
  • When contacting our customer service

2.3 rootsum.com also uses cookies that collect certain personal data. For details on our use of cookies, see Article 8.

2.4 We obtain all of this personal data directly from you, for example through your account, your order, your browsing behaviour or your contact with us. We do not collect personal data from public sources or third parties.

3. Purposes of processing

3.1 General purposes

Rootsum will only use the personal data collected from you for the following purposes:

  • Maintaining and improving this website and including personal data in anonymous statistics, legal basis: Rootsum’s legitimate interest in continuously improving its website and services (functional and analytical cookies).
  • Managing your Rootsum account, legal basis: performance of the contract between you and Rootsum.
  • Displaying personalised content and product recommendations based on your browsing and purchase behaviour, legal basis: your prior consent.
  • Displaying personalised advertisements on social media and search engines, legal basis: your prior consent.
  • Sending direct marketing, newsletters, promotions and offers, legal basis: your explicit, prior consent (“opt-in”).
  • Sending product-related tips and usage information after purchase, legal basis: our legitimate interest in providing you with the best possible information about the product you purchased.
  • Delivering and invoicing the products you ordered, legal basis: providing the service you requested. You are not obliged to share your data, but certain services may then be unavailable to you.
  • Supporting customer service and order processing with the help of AI tools, for example to answer your questions or correct a delivery address at your request, legal basis: performance of the contract between you and Rootsum. These tools operate under our supervision; human intervention remains possible for any decision with legal effects on you.

3.2 Direct marketing

Your personal data will also be used for direct marketing purposes, provided you have given your explicit consent (“opt-in”). If you are already on our mailing list to receive marketing material in paper and/or electronic form, Rootsum may use your data to send you marketing and other material relating to Rootsum, its products and/or services. Rootsum may use the data you provide to update the records it holds.

3.3 Disclosure to third parties

In the event of a full or partial reorganisation or transfer of Rootsum’s business, whether through restructuring, transfer or discontinuation of its activities, or in the event of Rootsum’s bankruptcy, your data may be transferred to new entities or third parties. Rootsum will make reasonable efforts to inform you of this in advance, but acknowledges that this may not always be technically or commercially feasible. Rootsum will not sell, rent, distribute or otherwise make your personal data commercially available to third parties, except as described here or with your prior consent.

3.4 Legal requirements

In rare cases, Rootsum may be required to disclose your personal data pursuant to a court order or to comply with other mandatory laws or regulations. Rootsum will make reasonable efforts to inform you of this in advance, unless prevented from doing so by legal restrictions.

4. Duration of processing

4.1 We retain and process personal data for the period necessary in view of the purposes of processing and the contractual relationship between Rootsum and you. Personal data is deleted once it is no longer needed for these purposes, or once you validly exercise your right to erasure.

4.2 Specifically:

  • Inactive Rootsum accounts are deleted after 3 years of inactivity.
  • Invoicing, payment and order data is kept for at least 10 years after the last invoice date, in accordance with accounting legislation.
  • Data collected on the basis of your consent (newsletter, marketing and personalisation cookies) is kept until you withdraw your consent or unsubscribe.

5. Your rights

5.1 Right of access and inspection

You have the right to obtain, free of charge and at any time, information about your personal data and how we use it.

5.2 Right to rectification, erasure and restriction

You are free to decide whether or not to share your personal data with Rootsum. You also always have the right to ask us to correct, complete or delete your personal data. You acknowledge that certain services and products cannot be provided if you refuse to share your data or request its deletion. You may also request that we restrict the processing of your personal data.

5.3 Right to object

You also have the right to object to the processing of your personal data for serious and legitimate reasons. In addition, you always have the right to object to the use of your data for direct marketing purposes, in which case you do not need to provide a reason.

5.4 Right to data portability

You have the right to receive the personal data we process about you in a structured, commonly used and machine-readable format, and/or to have it transmitted to another controller.

5.5 Right to withdraw consent

Where processing is based on your prior consent, you have the right to withdraw that consent at any time.

5.6 Exercising your rights

You can exercise your rights by contacting us by e-mail at [email protected], by post at Tiensesteenweg 341 - V1, 3010 Leuven, Belgium, or via the contact form on our website.

5.7 Automated decision-making and profiling

We use profiling for the following purposes: (i) displaying personalised advertisements based on your browsing and purchase behaviour, and (ii) automatically recommending products based on your previous purchases and interests. This does not result in automated decisions with legal effects on you. You have the right to object to these forms of profiling (see above, right to object).

5.8 Right to lodge a complaint

You have the right to lodge a complaint with the Belgian Data Protection Authority (DPA): Rue de la Presse 35, 1000 Brussels, Belgium — Tel.: +32 (0)2 274 48 00 — E-mail: [email protected]. This is without prejudice to your right to bring proceedings before a civil court. If you suffer damage as a result of the processing of your personal data, you may bring a claim for compensation.

6. Security and confidentiality

6.1 We have implemented appropriate technical and organisational security measures to prevent the destruction, loss, falsification, alteration, unauthorised access to, or accidental disclosure to third parties of, personal data collected, as well as any other unauthorised processing of this data.

6.2 Rootsum can under no circumstances be held liable for any direct or indirect damage resulting from improper or unlawful use of your personal data by a third party.

6.3 You must comply with security requirements at all times, including by preventing unauthorised access to your login details and password. You are solely responsible for the use made from your computer, IP address and identification details, as well as for their confidentiality.

7. Third-party access

7.1 In order to process your personal data, we grant our employees access to it.

7.2 We guarantee a similar level of protection by imposing contractual obligations on these employees and representatives that are comparable to this privacy policy.

7.3 These third parties also include our processors. We work with carefully selected external providers for the following categories of processing:

  • Payment processing
  • Customer reviews
  • Hosting and technical management of the online shop
  • Network security for the website (including DDoS protection)
  • Delivery of orders
  • Marketing communications and newsletter distribution
  • Website analytics and online advertising
  • Accounting and invoicing
  • Customer service, including chatbot and AI support for order processing

7.4 Some of these processors are established outside the European Union (including in the United States). Appropriate safeguards apply to these transfers, such as the European Commission’s Standard Contractual Clauses.

8. Cookies

8.1 Our website uses cookies and similar technologies to distinguish your usage preferences from those of other users. This helps us provide you with a better experience and optimise our website. For more information on our use of cookies, please see our cookie policy.

9.1 The website may contain links to other websites. Our privacy policy applies only to our own website; when you visit a linked website, that website’s own privacy policy applies.

10. Contact

If you have any questions or comments about the processing of your personal data, you can contact us by e-mail at [email protected] or by phone at +32 (0)2 793 04 25.

Rootsum has not appointed a Data Protection Officer (DPO).

11. Changes

This privacy policy will be updated from time to time to reflect changes to our services. When we publish changes, we will revise the “last updated” date at the top of this page. In the event of material changes to how we collect, use and/or share your personal data, we will notify you through a clearly visible notice on the website.