Rootr is the trading name of the business that operates rootr.uk and the customer portal at cp.rootr.uk. In these documents, Rootr, we and us mean that business. You are the customer named in the accepted order.
We are not registered for VAT and we do not publish a VAT number. The price shown before you pay is the price you pay.
Support, privacy, complaints and abuse reports: support@rootr.uk. These documents do not publish a postal address or a telephone number. No data protection officer is appointed in this version, and no ICO registration number is stated.
Version 1.0. Effective 17 October 2026. A company number and registered office will be added here when they are confirmed for the business taking new orders.
Related documents: Terms · Consumer terms · Data processing · Privacy · Acceptable use · Email access · Cookies · Retention · Complaints · Domains · Service levels.
Parties, roles and scope
This agreement is between Rootr and the customer named in the accepted order. It binds both of us when that order incorporates it. Words such as personal data, controller, processor, breach and processing have the meanings in applicable data protection law. That law includes the UK GDPR, the Data Protection Act 2018 and PECR, as amended, and the EU GDPR where it applies.
For personal data in hosted websites, databases, mailboxes and associated service data that we process on your behalf (customer personal data), you are the controller and Rootr is the processor. If you act for another controller, you are the processor and Rootr is the subprocessor, and you must have authority for that chain. The real purposes decide the roles. Rootr is a separate controller for its own account, billing and business records, as the Privacy notice explains. That does not turn hosted email content into Rootr business data.
Instructions
We process customer personal data only on documented lawful instructions, including for transfers, unless applicable law requires something else. The contract, these schedules, the service configuration you authorise, and verified support requests are the initial instructions. They cover storing, routing, delivering, securing, backing up where you have bought backups, restoring, migrating and deleting service data, including proportionate filtering and access under the access policy.
We tell you immediately if an instruction appears to infringe data protection law, we pause that instruction, and we look for a lawful resolution. Your confirmation alone does not make unlawful processing lawful. If the law compels us to process in another way, we tell you beforehand unless the law prohibits that notice on important public-interest grounds.
People and security
People authorised to process the data are bound by confidentiality or an appropriate statutory duty, and they receive relevant training. Access is limited to approved people who need it, and it is removed when they no longer do. We implement appropriate technical and organisational measures under Article 32, taking account of risk, technology, cost, and the nature, scope, context and purpose of the processing. The measures below are the ones adopted for these services.
We review whether the measures work, and we do not materially reduce overall security. We do not promise that every service is end-to-end encrypted. You use the controls available to you and you secure your own applications and devices. That does not remove Rootr’s duties.
The adopted measures are: named privileged accounts, least privilege, multi-factor authentication for privileged systems where the platform supports it, secure credential storage, access revocation, staff confidentiality and training. Administration and supported web and mail connections use current secure transport. Ordinary email transport is not end-to-end confidentiality. Tenant separation, proportionate patching, malware and abuse controls, secure administrator devices, incident handling and protected audit logs are maintained. Human access to mailbox content is recorded with the operator, reason, scope and time. Where the upstream log is incomplete, the support ticket records the task. Access and security are reviewed at least yearly and after a significant incident or change. We do not claim an independent security certification on the strength of this list.
Subprocessors
You give general written authorisation for the subprocessors named below and for their disclosed downstream chain. We do appropriate due diligence, we put equivalent data protection obligations in writing, and we remain responsible to you for those subprocessors’ performance of the obligations.
We give at least 30 days’ prior written notice of an intended addition or replacement, including identity, role, location and safeguards, and a chance to object on reasonable data protection grounds. You may object within that notice period. We look for a reasonable alternative. If that is unresolved before the processing begins, we do not expose that customer’s data to the disputed new processor. We either keep an alternative or allow you to end the affected service with a refund of unused prepaid fees. Silence does not waive a statutory right.
An urgent continuity change still needs an effective authorisation: an already authorised provider, a specific approval, or isolation of the affected processing until it is resolved. This is not an open emergency exception.
Current subprocessors
20i Limited supplies the hosting, email, DNS and customer-portal infrastructure for the services sold through cp.rootr.uk. Published hosting and mailbox packages are located in London. 20i processes customer content to provide those services. A complete list of 20i’s own downstream processors, and a finished transfer assessment for every support-access country, is not reproduced on this page. Ask support@rootr.uk for the current register entry.
The payment provider shown at checkout handles the payment. We receive payment status and references. That provider is not a host of mailbox content. Its role for billing data is separate from hosted customer content and is described in the privacy notice.
Google provides optional analytics on the public website rootr.uk, and only after you accept optional cookies. That processing is Rootr’s own website measurement. It is not processing of hosted mailbox or website content. Details are in the cookie notice.
Rights requests and assistance
Taking account of the nature of the processing, we assist with appropriate technical and organisational measures, so far as possible, with requests to exercise data-subject rights. We promptly pass on a request about customer personal data. We do not answer it substantively except on your instruction or where the law requires an answer. Identity checks and exports have to protect other people’s information.
Taking account of the nature of the processing and the information we have, we assist with security, breach notifications, data protection impact assessments and prior consultation under Articles 32 to 36. Exceptional work beyond the ordinary service may be charged at a rate we agree first. A charge, or a payment dispute, does not excuse a mandatory duty or delay urgent statutory help. We bear remediation costs that come from our own breach, subject to a lawful contractual allocation.
Personal data breaches
We notify you without undue delay after becoming aware of a personal data breach affecting customer personal data. We do not wait for a finished investigation, and we do not treat 72 hours as an allowance for this processor notice. The first notice may come in stages and is updated promptly.
The notice includes, so far as known, the nature of the breach, the relevant data, approximate numbers of people and records, a contact point, likely consequences, containment and proposed remedies. We preserve relevant evidence, reduce harm, and cooperate. You normally decide controller notifications. We make a notification ourselves where the law requires it. The controller’s regulator deadline is assessed immediately.
Information, audits and records
We make available the information necessary to demonstrate Article 28 compliance, and we allow and contribute to audits, including inspections, by you or an auditor you mandate. Proportionate notice, confidentiality, and measures that protect other customers may apply. They cannot defeat the right. A report may answer a routine question. It is not an absolute substitute for a justified inspection. An urgent breach or regulator-driven audit is not limited to a yearly window. We keep the processing records the law requires and we cooperate with supervisory authorities.
International processing
Published hosting and email packages are in London. We do not promise that every backup copy, support login or optional analytics request stays in the United Kingdom. We do not make a restricted transfer, including relevant remote access, except on documented instructions and a valid legal mechanism. Where one is required we use the UK IDTA or the EU standard contractual clauses with the UK Addendum, complete the required transfer assessment, and adopt supplementary measures. An EU transfer uses its own mechanism.
Reliance on adequacy, including any UK-US Data Bridge, is checked for the actual recipient, the data covered, and the current status. A link to a supplier policy is not itself a completed transfer mechanism. We provide the relevant safeguards on request, with lawful redaction. This agreement is not a substitute for transfer terms that still have to be signed.
Return, deletion and duration
Processing lasts for the service term and the exit period in the retention policy. At your choice we return or delete customer personal data after the services end, and we delete existing copies unless the law requires retention. Return uses an agreed secure export. After a verified return, remaining copies are deleted under that policy. We record any retention the law requires, we restrict the use, and we delete when the requirement ends.
Backups waiting for their scheduled expiry are isolated from ordinary use and stay protected. If a backup is restored for disaster recovery, prior deletions are applied again. We do not use backups to keep an accessible copy indefinitely. We confirm completion on request. These duties last until the processing and any lawful retention end.
Responsibility
You are responsible for your lawful basis, your transparency information, and valid instructions, and for the conditions required for special-category or criminal-offence data. Rootr remains responsible for its own processor obligations. No clause moves all data protection responsibility onto you. A contractual cap cannot restrict a regulator’s powers, mandatory liability, or a data subject’s rights. Applicable transfer clauses prevail where they must.
Processing particulars
Subject matter: the ordered hosting, email, backup and support. Duration: the service term, plus the export, deletion and backup-expiry periods in the retention policy and the order.
Nature and purpose: receiving data, collecting it through services you configure, organising, storing, routing, retrieving, transmitting, filtering, troubleshooting, authorised content inspection, migration, backup and restore where included, restriction, and deletion, in order to provide and secure the service.
Data subjects: your personnel, website visitors, your customers and prospects, suppliers, correspondents, and others whose data you lawfully place in the service. Tell us in the order if the service is aimed at children or other vulnerable people. The ordinary packages are not a children’s service.
Data types: names, contact details, IP and device identifiers, account identifiers, website submissions, transaction records, email bodies, attachments, address books, mail metadata and associated logs, as you actually use the service. Special-category or criminal-offence data is not expected as the purpose of the service. It may appear incidentally in ordinary email. Incidental presence does not remove the legal safeguards. Say so in the order if you intend to store it as a dataset.
Frequency: ongoing for delivery and storage, and event-driven for support and security. Export format and the authorised contacts are those in the order. Live customer data is deleted within 30 days after the service ends, or sooner if you instruct that. The residual backup expiry is described in the retention policy and is not given a published number in this version.