Privacy & terms

Who we are

Roots & Pantry is a trading name of BMS Cyber Defence Ltd. We decide how your information is used, so we're the "data controller" under UK data protection law.

Questions about your information go to Jason Lewis, who runs Roots & Pantry, at [email protected].

The short version

• We only collect what we need to run Roots & Pantry.
• We never sell your information, and we don't use advertising trackers.
• Our database and files are stored in the European Union.
• A producer's phone number and full postcode are never shown publicly.
• When you search for producers, we only use the first half of your postcode, and we don't store it.

Families can't sign up yet. Before they can, we'll update this notice to cover the family app.

What we collect and why

Visiting this website

We count visits with Cloudflare Web Analytics. It doesn't use cookies or follow you to other websites. Our hosting provider also keeps short-lived technical logs, such as your IP address, to keep the site secure and working. Why: to run a secure website (our legitimate interests).

Searching for producers

If you type a postcode into the producer search, we only use the first half (for example, TF1) to work out distances. We remove the second half straight away and don't store your search. Why: to show you producers near you (our legitimate interests).

Signing in

We use your email address to send you a 6-digit sign-in code. We store the code in a scrambled form that can't be read back. When you sign in, we set one cookie to keep you signed in. To stop abuse, we limit how many codes can be sent. To do that we keep a scrambled version of your email address and IP address for a short time. Why: to give you the account you asked for (contract) and to keep accounts secure (our legitimate interests).

Producers

When you list your business we collect:

• Shown publicly on your listing: business name, what you make or sell, your postcode district (for example, TF1) and county, website, Facebook page, food hygiene rating link, shop address, markets and opening times, delivery area, and your deals.
• Kept private, for us only: your name, email address, phone number, full postcode, the date you agreed to our producer terms, and any notes about our decisions on your listing.

Discount codes are never shown on public pages. Families will see them in the app once it opens. Why: to run your listing under our producer terms (contract). We also keep records of our decisions in case of a dispute (our legitimate interests).

We email producers about their listing, for example when it's approved or when a deal is about to end. We don't send marketing emails unless you've asked for them.

Contacting us

If you use our contact form or email us, we keep your name, email address and message so we can reply. Why: to answer you (our legitimate interests).

Keeping the service safe

We keep a log of sign-ins, listing changes and admin decisions, with who made them and when. Why: to keep the service secure and fair, and to investigate problems (our legitimate interests).

How long we keep it

Who else handles it

These companies process information for us, under contracts that only let them use it to provide their service to us:

• Cloudflare hosts our website, app, database and files, and runs the anti-spam check on our forms. Our database and files are stored in the EU. Cloudflare, Inc. is a US company, so some information (such as IP addresses) may pass through its systems elsewhere. That's protected by the UK Extension to the EU-US Data Privacy Framework and standard contractual clauses.
• Brevo (France) sends our emails, from servers in the EU. Brevo adds a small image to emails that tells us whether an email was opened. We've set this to be anonymous, and we don't use it to track you.
• Zoho runs our email inbox, in its EU data centre.

Our map is served from our own website, so no map company sees what you look at. If you click "Get directions" on a producer's page, Google Maps opens and Google's privacy policy applies.

We'll only share information with anyone else if the law requires it.

Cookies

This public website sets no cookies. The app sets one cookie, only when you sign in, to keep you signed in. It's strictly necessary, so we don't ask for consent. Our anti-spam check (Cloudflare Turnstile) runs on some forms and doesn't use cookies to track you.

Your rights

You can ask us to:

• give you a copy of the information we hold about you
• correct anything that's wrong
• delete your information
• stop or limit how we use it
• send your information to you or another organisation in a reusable format

Email [email protected]. It's free, and we'll reply within one month. Producers can change most of their details themselves in their dashboard.

If you're unhappy with how we've used your information, please tell us first and we'll try to put it right. You can also complain to the Information Commissioner's Office (ICO).

Children

Producer accounts are only for people aged 18 or over. The family app, which opens later, will have its own rules for children. We'll explain them here before it opens.

Terms

• Producer terms: the rules for listing your business and your deals.
• Family terms will be published here before families can sign up.

Changes to this notice

If we change this notice, we'll update the date at the top. We'll email producers about any important change before it takes effect.