Privacy policy (GDPR)

Data controller: Nico Funke - Roots & Regions, address as stated in the legal notice, hello@rootsandregions.com.

Our approach: We process personal data only as needed to operate the shop and do not share it with third parties for advertising.

What data we use and why:

• Orders & account: Name, email address and, optionally, telephone number; for business customers, company name and VAT/NIF number; delivery and billing addresses; order history; and when you accepted the terms and withdrawal information. Purpose: performance of the contract (Art. 6(1)(b) GDPR). We keep the data for as long as required by law, including record-keeping obligations.
• Sign-in: By email magic link or Google sign-in, if you choose to use it. Purpose: access to your account.
• Payment: Payments are handled by PayPal or Stripe (MB WAY, Multibanco, card and Klarna). You enter payment details directly with the payment provider; we receive confirmation of payment only.
• Newsletter (only with your consent): If you sign up via the newsletter form on the website or tick the box at checkout to receive news by email, we store your email address, the time of consent, the language and the wording you agreed to. We email you only after you click the link in our confirmation email (double opt-in). Legal basis: consent (Art. 6(1)(a) GDPR). You can withdraw it at any time using the unsubscribe link or by emailing hello@rootsandregions.com.
• Back-in-stock notification (only with your consent): If you sign up for “Notify me” on a sold-out product, we store your email address, the product, the language and the time you signed up. Purpose: we email you exactly once as soon as the product is available again - no newsletter, no further marketing. Legal basis: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by emailing us. Retention: until we have notified you or until you withdraw; after that we delete the entry within 12 months at the latest.

Service providers (processors):

• Hosting: Vercel Inc., USA (website hosting; data processing is based on the EU Standard Contractual Clauses).
• Audience measurement: Vercel Web Analytics (Vercel Inc., USA; EU Standard Contractual Clauses) counts page views without cookies and without storing anything in your browser. It records the page visited (without URL parameters), the referring page, country, browser, operating system and device type. Visitors are only distinguished by an anonymous value that changes daily; IP addresses are not stored, and recognising you across days or websites is not possible. Account, partner, order and admin pages are not measured. Purpose: improving our website. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Database & authentication: Supabase, with servers in the EU (Ireland).
• Email delivery: Resend, Inc., USA (sending order and sign-in emails; EU Standard Contractual Clauses).
• Payments: PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg; Stripe Payments Europe, Ltd., Dublin, Ireland.
• Optional sign-in: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland - only if you use “Sign in with Google”. Purpose: sign-in (access to your account). You are redirected to Google; Google processes your sign-in (including your IP address and Google account) and transmits your name, email address, Google account ID and, where applicable, profile picture to us (stored with Supabase). Google may transfer data to Google LLC in the USA on the basis of the EU-US Data Privacy Framework (adequacy decision of the European Commission). Legal basis: Art. 6(1)(b) GDPR. If you use the email link instead, no data is sent to Google.
• Fonts: served locally (self-hosted; no data is sent to Google when you visit the site).

Your rights: You may request access, rectification, erasure, restriction, data portability or object to processing (GDPR Arts. 15-21). You may also complain to a supervisory authority. Contact us at hello@rootsandregions.com.

Cookies: Without consent, because technically necessary: sign-in session (Supabase cookies, only if you sign in), selected language (cookie “NEXT_LOCALE”, 1 year), basket and your cookie choice (in browser storage). Only with your consent (“Allow all” in the notice): we remember in browser storage for 30 days which partner or referral link brought you here (for commission or referral credit), and the PayPal button loads directly from paypal.com in the basket. Without consent, nothing is stored: the attribution only applies while the page stays open (not after reloading), and PayPal loads only when you click it. Legal basis: Section 25(1) TDDDG, Art. 6(1)(a) GDPR. You can change or withdraw your choice at any time via “Cookie settings” at the bottom of every page. No tracking or advertising cookies (audience measurement works without cookies, see above).