Rootle Privacy Policy

Last updated: 7 October 2026

1. Who we are and how to contact us

Rootle Limited ('Rootle', 'we', 'us' or 'our') is responsible for deciding how and why your personal information is used. Data protection law calls us the controller. We are registered in England and Wales under company number 17230731.

If you have a privacy question, want to exercise a privacy right or want to make a data protection complaint, you can contact us at:

Email: hello@rootle.uk

Post: Rootle Limited, 5 New Street Square, London, EC4A 3TW.

2. What information we use and why

We only use personal information where we have a legal reason to do so. The main legal bases we rely on are:

• Contract - where we need the information to provide a service you ask for, take steps at your request before entering into a contract, or perform a contract with you.
• Legitimate interests - where using the information is necessary for our business or to protect Rootle and our customers, and those interests are not outweighed by your rights and interests.
• Legal obligation - where we need to use or keep information to comply with the law.
• Consent - where we ask for and receive your permission for a particular use.
• Public task - where anti-money laundering law treats our use of information to prevent money laundering, terrorist financing or proliferation financing as a task carried out in the public interest.

Your account and initial valuation

When you create an account or ask for a valuation, we use the information you give us, including your name, email address, phone number, postal address and login details. We also use the descriptions, categories or tags, photographs, documents and other information you submit about your items. We use this information to create and manage your account, produce an indicative valuation and decide whether your parcel is eligible for prepaid postage. We keep the valuation and related service history with your account.

Legal basis: contract, including steps you ask us to take before entering into a sale.

Postage, appraisal, offers and payment

We use your contact and address details to provide and manage a postage label, track your parcel and arrange any return. We use information and documents you provide about your items, together with our inspection findings, to appraise and verify them, make and manage offers, and deal with any issues about the items or transaction.

If you accept our offer, we use the account holder's name, sort code and bank account number to pay you by bank transfer. We also keep payment confirmations and relevant transaction records.

Legal basis: contract. We also use and keep information where necessary to meet tax, accounting or other legal obligations.

Questions, support and complaints

We use your contact details, account and transaction information, messages, attachments and relevant support notes to answer questions, provide service updates, deal with delivery issues and handle complaints.

Legal basis: contract where the support relates to the service you have asked us to provide; legitimate interests in answering other enquiries and resolving disputes; and legal obligation where we are handling data protection rights or complaints.

Recording what arrives in your parcel

We photograph items and use desk cameras to video-record parcels being opened and checked. These records are linked to your account through the postage label and may show the label, packaging, contents and any personal information visible on them.

We use these records to confirm what arrived and its condition, investigate loss, damage or disputes, and help prevent or investigate fraud or other unlawful activity.

Legal basis: our legitimate interests in keeping an accurate record of what we receive and protecting Rootle and our customers against loss, disputes and fraud or other unlawful activity.

Keeping accounts and transactions secure

We use technical information such as your IP address, browser and device details, login activity and security logs to operate and protect the website and customer accounts. We may also compare account, contact, transaction and payment information where necessary to investigate suspected fraud or other unlawful activity, duplicate accounts or misuse of promotions.

Legal basis: our legitimate interests in operating a secure and reliable service and preventing misuse, fraud and other unlawful activity.

Feedback and reviews

We may ask you to leave feedback or a review about your experience with Rootle. We use Trustpilot’s automated review invitation service and may share limited contact details with Trustpilot so that it can send a review invitation on our behalf.

If you leave a public review, we may read and respond to it, and Trustpilot reviews may also be displayed on our website. If we want to use an identifiable customer story, photograph, review or testimonial separately in our own promotional materials, we will ask for your permission first.

Legal basis: our legitimate interests in asking for and responding to customer feedback and improving our service; consent for the separate promotional use described above.

Do you have to provide this information?

We will tell you when information is required. If you do not provide information we need to create or manage your account, value your items, arrange postage or returns, or pay you, we may not be able to provide that part of the service. If we need information for a legal or regulatory check, we will explain this when we ask for it.

Marketing choices, optional cookies and permission to use a testimonial are voluntary. Please keep your contact and return address details up to date.

3. Where the information comes from

Most of the personal information we use comes directly from you, including through our website, your photographs and parcels, email, WhatsApp and other communications with us.

We also create information when we provide the service, such as valuations, inspection records, parcel-opening recordings, offers and support notes. We collect technical information automatically when you use the website, including through cookies and similar technologies.

We may receive information from other organisations where relevant to the service, including delivery and tracking information from postal or courier services, payment confirmations from banks or payment providers, and findings from specialist valuers or authenticators. If we carry out financial crime checks, we may also obtain information from public sources and online screening or search services, including sanctions lists, politically exposed person (PEP) information and adverse-media sources. If you use a third-party communication or review service, such as WhatsApp or Trustpilot, we receive the information you send or make available through that service.

4. Automated valuations and AI-assisted support

How the initial valuation works

Our AI-Driven Valuation Tool automatically analyses the photographs, descriptions and other information you submit about your items to produce an indicative valuation. The valuation is based on the information you provide and is not a final offer to buy your items.

The system uses the indicative valuation to decide whether your parcel meets Rootle's shipping threshold for prepaid postage. If it does not meet the threshold, the system will not issue a prepaid label for that parcel. If you send items to us, our team will physically inspect them before Rootle decides whether to make a final offer and at what price.

Our Website Terms of Use and Customer Terms and Conditions explain the service rules for the valuation, postage and sale process.

If Rootle makes a significant decision about you using only automated processing, the safeguards described in section 12 will apply.

AI-assisted customer support

We use an external customer support platform with AI tools to help route and answer customer enquiries. If you contact us through WhatsApp, your phone number may be used to find the relevant account and the system may use relevant account information, such as parcel or payment status, to deal with your query. Some replies may be generated and sent automatically.

5. Identity and financial crime checks

We monitor customer and transaction activity to help us meet our legal and regulatory obligations and protect Rootle from fraud and financial crime. This may include considering the type and value of items, your recent transactions with Rootle, whether contact or payment details appear to be linked to other accounts, and other indicators of financial crime risk.

Where additional checks are needed, we may ask you for information or documents about your identity, address, ownership or provenance of your items or the transaction. This may include a photograph of an identity document and a selfie. We may use identity details, such as your date or place of birth, to help distinguish genuine screening matches from false positives. We may also check sanctions lists, politically exposed person (PEP) information, adverse-media sources and other relevant public records or online screening or search services.

We use this information to verify identity and ownership, assess transaction risk, comply with anti-money laundering and related laws, and prevent or detect money laundering, terrorist financing, sanctions breaches, fraud and other unlawful activity. If a check cannot be completed satisfactorily, we may ask for further information, pause or decline a transaction, or take other steps required or permitted by law.

Some checks are required under anti-money laundering law. Where we process personal information under the Money Laundering Regulations to prevent money laundering, terrorist financing or proliferation financing, data protection law treats this as a task carried out in the public interest. Personal information collected for those purposes will only be used for those purposes, unless another use is permitted by law.

We may also carry out additional proportionate fraud and financial crime checks where necessary for our legitimate interests in protecting Rootle, our customers and our service from unlawful activity.

If information is required to complete a check and you do not provide it, or the check cannot be completed satisfactorily, we may ask for further information, pause or decline the transaction, or be unable to make an offer or payment.

6. Service messages and marketing

Messages about the service

We send messages needed to provide the service you ask for, such as your valuation, account or security messages, postage and parcel updates, offers, payment or return information and replies to your enquiries. These are service messages, not optional marketing, so you may still receive them if you unsubscribe from marketing.

Marketing choices

When you first sign up, we give you the choice to receive marketing from Rootle. If you opt in, we will contact you using the method or methods you select. Marketing may include Rootle news, offers and invitations to use our service again. You do not have to agree to marketing to get a valuation or use our service.

You can change your mind at any time using the unsubscribe or opt-out instructions in a marketing message, or by contacting us. We keep a limited record of your opt-out so that we can respect it. We will not share your details with another business for its own direct marketing without your separate permission.

Legal basis: consent for the marketing described above, and legitimate interests in keeping an opt-out record so that we do not contact you against your wishes.

7. Cookies and similar technologies

Cookies and similar technologies can store information on, or access information from, your browser or device. We use them to support functions such as secure sign-in and remembering choices, and we may use other technologies to understand how the website is used or for advertising.

We only use these technologies without consent where allowed to do so by law. Where consent is required, we ask before using the technology. Advertising cookies and similar advertising technologies require consent. You can change your choices through our cookie settings.

Where these technologies involve personal information, we rely on consent when we ask for consent. For permitted uses that do not require consent, we rely on an appropriate UK GDPR legal basis, usually our legitimate interests in operating, securing or improving the website.

Our Cookie Policy explains the technologies we use, their purposes, who provides them, how long they last and the choices available to you.

8. Who we share information with

We share personal information only where needed for the purposes described in this policy. Depending on how you use Rootle, this may include sharing information with:

• website, hosting, storage, CRM, IT and customer-support suppliers, including suppliers that provide AI tools;
• postal and courier services;
• banks and payment providers;
• specialist valuers or authenticators where we need their help with an item;
• providers of public databases and online search or screening services used for financial crime checks;
• communication services, such as WhatsApp, where you choose to contact us through them;
• review platforms, such as Trustpilot, where we use them to send review invitations or display reviews;
• lawyers, accountants, insurers and other professional advisers; and
• the police, National Crime Agency, HMRC, regulators and other authorities where disclosure is required by law or is otherwise necessary and lawful to investigate or report suspected criminal activity.

Suppliers acting on our behalf must protect the information and use it only in accordance with our instructions. Some organisations may also use personal information for their own purposes; where they do, their own privacy information explains those uses.

9. How we protect your information

We use appropriate technical and organisational measures to protect personal information against accidental or unlawful loss, use, access, alteration or disclosure. We limit access to people who need the information for their work and require suppliers handling information for us to protect it too.

Please keep your account login details private and tell us promptly if you think someone else has accessed your account without permission.

10. Information used outside the UK

Some of our suppliers may process personal information outside the UK. Where UK transfer rules apply, we make sure the transfer is covered by UK adequacy regulations or appropriate safeguards, such as approved data transfer terms.

You can contact us for more information and, where applicable, a copy of the relevant safeguards.

11. How long we keep information

We keep personal information only for as long as we need it for the purposes described in this policy, including to meet legal, regulatory, tax, accounting or reporting requirements. We may keep information for longer where we need it to deal with a complaint, resolve a dispute or establish, exercise or defend a legal claim.

When deciding how long to keep information, we consider what the information is, how sensitive it is, why we need it, the risks of keeping it, whether we can achieve the purpose another way, and any legal or regulatory requirements. If we anonymise information so that it can no longer be linked to you, it is no longer personal information and we may use it for research or statistical purposes.

Where we carry out customer due diligence under applicable anti-money laundering rules, we keep the required identity, verification and supporting transaction records for five years after the relevant transaction is complete or the relevant business relationship ends, unless the law requires or permits us to keep them for longer.

12. Your privacy rights

You have a number of rights over your personal information. Some rights only apply in certain circumstances.

Access your information

You can ask us for a copy of the personal information we hold about you and information about how we use it.

Correct your information

You can ask us to correct personal information that is inaccurate or complete information that is incomplete.

Ask us to delete your information

You can ask us to delete your personal information in certain circumstances. We may sometimes need to keep information despite your request, for example where the law requires us to keep it.

Ask us to restrict how we use your information

In certain circumstances, you can ask us to restrict how we use your personal information, although we may continue to store it.

Object to how we use your information

You can object to us using your personal information where we rely on legitimate interests. Whether we have to stop will depend on the circumstances and our reasons for using the information.

You can object to your personal information being used for direct marketing at any time. If you do, we will stop using it for that purpose, including any profiling related to that marketing.

Withdraw your consent

Where we rely on your consent, you can withdraw it at any time. This will not affect anything we did lawfully before you withdrew your consent.

Move your information

In certain circumstances, you can ask us to provide personal information you have given us in a structured, commonly used and machine-readable format, or ask us to transfer it to another organisation where technically possible. This right generally applies where we use the information electronically on the basis of your consent or a contract with you.

Automated decisions

If we make a significant decision about you using only automated processing, you can ask us for information about the decision, give us your point of view, ask for a person to intervene in the decision and challenge it. Section 4 explains the automated parts of the Rootle service.

How to exercise your rights

To exercise a privacy right, contact us using the details in section 1. We may ask for enough information to confirm your identity before dealing with the request. We normally respond within one month. Some rights are subject to exemptions or limitations under data protection law, and we will explain if these affect your request.

13. Privacy concerns and complaints

You can make a data protection complaint directly to us using the contact details in section 1. We will investigate the complaint without undue delay, keep you informed and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator. You can find information about making a complaint at:

ico.org.uk/make-a-complaint

14. Other websites and changes to this policy

If you follow a link to another website or choose to use another provider's service, that provider's own privacy information explains how it uses your information. This does not change our responsibility for personal information that Rootle uses itself or asks a supplier to handle for us.

We will review this policy as our service develops. If we plan to use personal information for a new purpose that is not compatible with what we have already told you, we will update our privacy information and bring the new use to your attention before we start it. We will also update the date at the top of this policy when it changes.

Back to home