Privacy Policy

Last updated: 01.01.2026

Please read this Privacy Policy carefully before using our site or placing an order. By accessing the site www.rootfulnutrition.com and by using our services, you confirm that you have taken note of this policy.

1. Identity of the data controller

The personal data controller is:

• Name: SC Pro Natura Biotechnologies S.R.L.
• CUI (Unique Registration Code): RO50513932
• Trade Register No.: J2024020346007
• Registered office: Jud. Ilfov, Sat Snagov, Comuna Snagov, Șoseaua Principală, Bl. D1, Etaj Parter
• E-mail: support@rootfulnutrition.com
• Website: www.rootfulnutrition.com

SC Pro Natura Biotechnologies S.R.L. (hereinafter “Rootful”, “we”, “our” or “the Controller”) is a commercial company registered in Romania, specialising in the sale of food supplements in the greens and superfoods category through the Shopify platform.

2. Categories of personal data collected

Depending on your interaction with our site and services, we may collect the following categories of personal data:

2.1. Account (registration) data

• First and last name
• E-mail address
• Account password (stored in encrypted form)

2.2. Order and delivery data

• First and last name
• Delivery address and/or billing address
• E-mail address
• Details of the products ordered, quantity and price
• Order number and order history

2.3. Payment data

• Selected payment method (bank card, cash on delivery, bank transfer)
• Last 4 digits of the card (for card payments), solely for identification

2.4. Browsing data (technical data)

• IP address (anonymised, where possible)
• Browser type and version
• Operating system
• Pages visited, duration of the visit and actions taken on the site
• Referral source (referring URL)
• Cookie identifiers and similar technologies

2.5. Subscription data (newsletter / communications)

• E-mail address
• Name (optional)
• Communication preferences
• Date and time of consent (including proof of opt-in)

2.6. Marketing and interaction data

• Interaction with e-mail campaigns (opens, clicks)
• Data collected through remarketing pixels (Meta Pixel, Google Ads)
• Advertising identifiers
• Aggregated data on purchasing behaviour (for marketing segmentation)

2.7. Direct communication data

• The content of messages sent through the contact form or by e-mail
• Information provided voluntarily in the context of support requests

3. Purposes of processing and legal basis

We process your personal data only on the basis of a valid legal ground, in accordance with art. 6(1) GDPR. The table below sets out the purposes of processing, the categories of data used, the applicable legal basis and the storage period:

Purpose of processing	Categories of data	Legal basis (art. 6 GDPR)	Storage period
Creating and managing the customer account	Account data	Performance of a contract: art. 6(1)(b)	For as long as the account exists + 30 days after its deletion
Processing and delivering orders	Order data, delivery data, payment data	Performance of a contract: art. 6(1)(b)	For the time needed to fulfil the order + the legal guarantee period
Issuing invoices and meeting accounting and tax obligations	Order data, billing data	Legal obligation: art. 6(1)(c) (the Fiscal Code, Accounting Law no. 82/1991)	10 years from the end of the financial year in which the invoice was issued
Processing payments	Payment data (last 4 digits of the card, payment method)	Performance of a contract: art. 6(1)(b)	For the time needed to process the transaction + legal retention obligations
Communications about order status (confirmation, dispatch, delivery)	E-mail address	Performance of a contract: art. 6(1)(b)	For the duration of order processing
Customer support and complaint handling	Account data, direct communication data	Performance of a contract: art. 6(1)(b); Legitimate interest: art. 6(1)(f)	3 years from the date of the last interaction
Sending newsletters and commercial communications	Subscription data, marketing data	Consent: art. 6(1)(a); Law no. 506/2004, art. 12	Until consent is withdrawn
Personalised marketing and audience segmentation	Browsing data, marketing data, order data (aggregated)	Consent: art. 6(1)(a)	Until consent is withdrawn or a maximum of 2 years from the last interaction
Remarketing and online advertising (Meta, Google)	Browsing data, advertising identifiers	Consent: art. 6(1)(a)	In accordance with the cookie policy; a maximum of 13 months from collection
Analysing and improving the site and services	Browsing data (anonymised/pseudonymised)	Legitimate interest: art. 6(1)(f)	A maximum of 26 months
Fraud prevention and transaction security	Account data, order data, IP address	Legitimate interest: art. 6(1)(f)	For the time needed for the investigation + legal obligations
Defending rights in court or before the authorities	Any relevant data	Legitimate interest: art. 6(1)(f)	For the applicable limitation period (3 years as a general rule)

4. Recipients and sharing of personal data

In order to carry out our activity and provide our services to you, we may transfer personal data to the following categories of recipients, only to the extent necessary and subject to appropriate safeguards:

4.1. E-commerce platform

• Shopify Inc.: the provider of the platform on which our site is hosted. Shopify acts as a processor on behalf of the Controller and processes data in accordance with the Shopify Data Processing Addendum (DPA).

4.2. Payment processors

• Shopify Payments / Stripe: for processing card payments, PCI-DSS Level 1 certified
• Other authorised payment processors, as applicable (for example, for payment by bank transfer)

4.3. Courier and delivery services

• Partner courier companies (for example: FAN Courier, Sameday, Cargus or other contracted courier services), to fulfil the delivery of orders. The following are shared: the recipient's name, the delivery address and the parcel details.

4.4. Marketing and analytics service providers

• Klaviyo: the e-mail marketing and automation platform used to send newsletters and commercial communications (on the basis of your consent)
• Meta Platforms (Facebook / Instagram): through the Meta Pixel and Conversions API, to measure the effectiveness of advertising campaigns and for remarketing (on the basis of your consent)
• Google (Google Analytics, Google Ads): to analyse site traffic and measure the performance of advertising campaigns (on the basis of your consent)

4.5. IT and hosting service providers

• Providers of maintenance, cybersecurity and technical infrastructure management services

4.6. Public authorities

• Tax authorities, investigative bodies or courts, only in the cases provided by law or at the legitimate request of a competent authority

5. International data transfers

Some of our service providers, including Shopify Inc., may store or process personal data on servers located outside the European Economic Area (EEA), including in the United States of America and Canada.

Whenever personal data is transferred outside the EEA, we ensure that appropriate safeguards are in place, in accordance with Chapter V of the GDPR, including:

• Standard contractual clauses (SCCs): adopted by the European Commission under art. 46(2)(c) GDPR, Implementing Decision (EU) 2021/914
• Adequacy decisions: where the destination country benefits from an adequacy decision issued by the European Commission (for example, Canada for commercial organisations subject to PIPEDA)
• Supplementary measures: encryption, pseudonymisation and Transfer Impact Assessments, where necessary

You can request further information about the safeguards applicable to international transfers by contacting us at the e-mail address indicated in Section 13.

6. Data storage period

Rootful keeps personal data only for as long as strictly necessary to fulfil the purposes for which it was collected, in line with the storage limitation principle set out in art. 5(1)(e) GDPR.

The general criteria used to determine the storage period are:

• Account data: for the entire time the account is active. After a request to delete the account, the data is deleted within 30 days, except for data needed to meet legal obligations.
• Order and billing data: 10 years from the end of the financial year in which the invoice was issued, in accordance with Accounting Law no. 82/1991 and the Fiscal Code.
• Payment data (last 4 digits of the card): for the time needed to process the transaction and resolve any disputes, a maximum of 13 months.
• Marketing and newsletter data: until consent is withdrawn. After unsubscribing, the e-mail address is kept on a suppression list to prevent further communications being sent.
• Browsing and cookie data: in accordance with the periods specified in the Cookie Policy, generally a maximum of 13 months.
• Communication data (customer support): 3 years from the date of the last interaction.
• Data needed for defence in court: for the general limitation period of 3 years or for the duration of judicial or administrative proceedings, where applicable.

When the storage period expires, the data is deleted or irreversibly anonymised so that it no longer allows the data subject to be identified.

7. Your rights

In accordance with Regulation (EU) 2016/679 (GDPR), you have the following rights regarding your personal data:

7.1. Right of access (art. 15 GDPR)

You have the right to obtain confirmation from us as to whether or not we process personal data concerning you and, if so, to access that data, as well as information on the purposes of processing, the categories of data, the recipients and the storage period.

7.2. Right to rectification (art. 16 GDPR)

You have the right to request the rectification of inaccurate personal data concerning you, as well as the completion of incomplete data.

7.3. Right to erasure (“right to be forgotten”) (art. 17 GDPR)

You have the right to request the erasure of personal data concerning you where one of the grounds set out in art. 17 GDPR applies (for example, the data is no longer needed for the original purposes, you withdraw your consent, or the data has been processed unlawfully). This right does not apply where the processing is necessary to comply with a legal obligation or for the establishment, exercise or defence of legal claims.

7.4. Right to restriction of processing (art. 18 GDPR)

You have the right to obtain restriction of processing in the cases provided by art. 18 GDPR, for example when you contest the accuracy of the data or object to the processing.

7.5. Right to data portability (art. 20 GDPR)

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and the right to transmit that data to another controller without hindrance from us.

7.6. Right to object (art. 21 GDPR)

You have the right to object at any time to the processing of personal data based on the legitimate interest of the Controller (art. 6(1)(f) GDPR), including profiling. If you object to processing for direct marketing purposes, the data will no longer be processed for that purpose.

7.7. Right to withdraw consent (art. 7(3) GDPR)

Where the processing is based on your consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. You can withdraw consent by:

• The unsubscribe link in any commercial e-mail;
• Your account settings on the site;
• Sending a request to the e-mail address indicated in Section 13.

7.8. Right to lodge a complaint with the supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) if you consider that the processing of personal data concerning you infringes the GDPR.

Exercising your rights

To exercise any of the rights mentioned above, please send us a written request at the e-mail address support@rootfulnutrition.com or by post to the registered office address. We will respond to your request within a maximum of 30 calendar days of receipt. In complex cases or where there is a large number of requests, this period may be extended by a further 60 calendar days, with prior notice to the requester.

We reserve the right to verify your identity before acting on the request, in order to protect personal data against unauthorised access.

8. Data security

Rootful implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with art. 32 GDPR, including but not limited to:

• Encryption: all connections to our site are protected by the SSL/TLS (HTTPS) protocol, ensuring that data is encrypted in transit. Sensitive data is also encrypted at rest.
• Access control: access to personal data is limited exclusively to authorised personnel, on a “need-to-know” basis, with multi-factor authentication where available.
• Shopify platform security: the Shopify platform is PCI-DSS Level 1 certified and implements advanced security measures, including continuous monitoring, automatic backups and protection against DDoS attacks.
• Monitoring and auditing: periodic monitoring of access to data and regular vulnerability assessments.
• Staff training: employees and collaborators who have access to personal data receive periodic training on confidentiality obligations and security procedures.
• Incident management procedures: we have internal procedures for detecting, reporting and investigating security incidents, in accordance with art. 33 and 34 GDPR, including notifying ANSPDCP within 72 hours and informing data subjects, where applicable.

9. Cookies and similar technologies

Our site uses cookies and other tracking technologies (such as tracking pixels, local storage and device fingerprinting) to ensure the site works properly, improve the browsing experience, analyse traffic and enable marketing features.

Non-essential cookies (analytics, marketing, remarketing) are activated only on the basis of your explicit consent, given through the cookie banner displayed on your first visit to the site.

For detailed information on the types of cookies used, their purposes, providers and storage periods, as well as how to manage your preferences, please see the Cookie Policy.

10. Marketing and commercial communications

Rootful may send commercial communications (newsletters, promotional offers, product recommendations) only to people who have given their explicit and freely given consent to this, in accordance with art. 6(1)(a) GDPR and art. 12 of Law no. 506/2004.

Consent is obtained through clear opt-in mechanisms (for example, ticking a box that is not pre-selected when creating an account, placing an order or subscribing to the newsletter). We do not use pre-ticked boxes and we do not treat inaction as consent.

Right to unsubscribe

You have the right to withdraw your consent to commercial communications at any time, without any justification and free of charge, by:

• Clicking the “Dezabonare” (or “Unsubscribe”) link in the footer of every commercial e-mail;
• Changing the preferences in your account on the site;
• Sending a request to support@rootfulnutrition.com.

After you withdraw your consent, you will no longer receive commercial communications. We will process the unsubscribe request as quickly as possible, but no later than 48 hours from receipt. Withdrawing consent does not affect transactional communications (for example, order confirmation, delivery notifications), which are sent on the basis of the performance of the contract.

11. Protection of minors' data

The Rootful site and services are not intended for people under 16 years of age. We do not knowingly collect personal data from minors under 16 years of age.

If we find that we have collected personal data from a minor under 16 years of age without the consent of the holder of parental responsibility, we will delete that data as soon as possible.

If you are a parent or legal guardian and are aware that a minor in your care has provided us with personal data, please contact us at the e-mail address indicated in Section 13 to request the deletion of that data.

12. Changes to this policy

Rootful reserves the right to update or amend this Privacy Policy at any time, to reflect legislative changes, changes in our data processing practices or improvements to our services.

In the event of significant changes, we will take reasonable steps to inform you in advance, by:

• Displaying a visible notice on the site;
• Sending an e-mail notification (to customers with an active account or newsletter subscribers);
• Updating the “Last updated” date at the top of this document.

We recommend that you check this page periodically to stay informed of any changes. Continued use of our site and services after changes are published constitutes implicit acceptance of the updated version.

Where a change requires your new consent (for example, for new consent-based processing purposes), we will request that consent explicitly before implementing the changes.

13. Contact: Data Protection Officer

For any question, request or application regarding the processing of your personal data or the exercise of the rights set out in this policy, you can contact us at:

• Data Protection Officer (DPO): SC Pro Natura Biotechnologies S.R.L.
• E-mail: support@rootfulnutrition.com
• Correspondence address: Jud. Ilfov, Sat Snagov, Comuna Snagov, Șoseaua Principală, Bl. D1, Etaj Parter

We will make every effort to respond to your requests as quickly as possible, but no later than 30 calendar days from receipt of the request.

© SC Pro Natura Biotechnologies S.R.L. All rights reserved. This Privacy Policy has been drafted in accordance with Regulation (EU) 2016/679 (GDPR) and the applicable Romanian legislation.