Privacy Policy

Office Roots ("we", "us", or "our") is operated by Euro Interior Innovators UG (haftungsbeschraenkt), Moosbergstr. 88, 64285 Darmstadt, Germany. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your personal information when you visit our website (officeroots.com) and use our services, in accordance with the General Data Protection Regulation (GDPR) (EU) 2016/679.

Data Controller

What Data We Collect

We collect and process the following categories of personal data:

• Identity and contact data: Your name, email address, phone number, and company name when you fill in a form, request a custom plan, or create an account.
• Business details (B2B): Company name, billing address, VAT number, and purchase order references when you order on behalf of a business.
• Order and delivery data: Delivery address, billing address, order history, and order communications when you make a purchase.
• Payment data: Payment method details processed securely by our payment providers. We do not store full card details on our servers.
• Technical data: IP address, browser type and version, time zone setting, browser plug-in types, operating system and platform, and other technology on the devices you use to access our website.
• Usage data: Information about how you use our website, including pages visited, time spent on pages, navigation paths, and referring URLs.
• Marketing data: Your preferences in receiving marketing communications and your communication preferences, where you have given consent.

How We Use Your Information

We use your personal information for the following purposes:

• To process and fulfil your orders, including delivery and returns
• To generate and deliver business invoices and VAT documentation
• To provide customer support and respond to your enquiries
• To create and deliver custom office plant plans
• To personalise your experience on our website
• To improve our website, products, and services
• To send you marketing communications where you have consented
• To comply with legal and regulatory obligations

Legal Basis for Processing

We process your personal data only when we have a lawful basis to do so under the GDPR:

• Contract fulfillment (Art. 6(1)(b)): Processing your data is necessary to fulfil our contract with you — processing orders, arranging delivery, handling returns, and issuing invoices.
• Legitimate interest (Art. 6(1)(f)): We process data for fraud prevention, website security, improving our services, and communicating with you about your orders where we have a legitimate business interest.
• Consent (Art. 6(1)(a)): Where we rely on consent — for example, marketing emails or non-essential cookies — we will ask for your explicit permission. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): We may process data where required by law, such as tax and accounting obligations.

Data Sharing

We share your personal information only with trusted third parties necessary to deliver our service. We never sell your data.

• Payment processors: To securely process your payments. We do not store your full card details on our servers.
• Delivery partners: To fulfil your orders, we share your name and delivery address with our shipping providers.
• Analytics providers: To help us understand website usage and improve our service.
• Email service providers: To deliver transactional and marketing emails where you have consented.

All third-party providers are contractually obligated to process your data only as instructed by us and in compliance with the GDPR.

Cookies

Our website uses cookies and similar tracking technologies to distinguish you from other users and to provide a good experience.

We use the following types of cookies:

• Essential cookies: Required for the website to function properly, including cart functionality, checkout, and session management. These do not require consent.
• Analytics cookies: Help us understand how visitors interact with our website so we can improve it. These are set only with your consent.

You can manage your cookie preferences at any time through your browser settings. Disabling essential cookies may affect the functionality of our website.

Data Retention

We keep your personal data only for as long as necessary for the purposes described in this policy:

• Order and account data: Retained for the duration of your account and for up to 10 years after for tax and legal compliance purposes.
• Marketing data: Retained until you withdraw consent or ask us to remove you from our mailing list.
• Technical and usage data: Retained for up to 26 months for analytics purposes, after which it is anonymised or deleted.

Data Security

We take the security of your personal data seriously. We use appropriate technical and organisational measures to protect your information against unauthorised access, alteration, disclosure, or destruction. These measures include encrypted data transmission (SSL/TLS), secure payment processing through trusted providers, and restricted access to personal information within our organisation.

While we strive to protect your personal data, no method of electronic storage or transmission is completely secure. We cannot guarantee absolute security but we are committed to maintaining industry-standard protections.

Your Rights

Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can ask us to correct inaccurate or incomplete data.
• Right to erasure: You can request that we delete your personal data where there is no compelling reason to continue processing it.
• Right to data portability: You can request to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object: You can object to our processing of your personal data based on legitimate interest or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, you can withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at hello@officeroots.com with "Data Protection" in the subject line. We will respond to your request within one month. We may request identification to verify your identity before disclosing personal data.

You also have the right to lodge a complaint with a supervisory authority. In Germany, the competent authority is the Der Hessische Beauftragte fuer den Datenschutz und die Informationsfreiheit.

Contact

If you have any questions about this Privacy Policy or how we handle your personal data, please get in touch: