Privacy Policy
Last updated: 29 September 2026
Same Roots Collective is committed to protecting and respecting your privacy. This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and the rights you have in relation to your personal information.
This policy applies to personal information collected through the Same Roots Collective website and through services connected to our website, including our online booking and payment systems.
We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection and privacy laws.
1. Who We Are
Same Roots Collective is a company limited by guarantee registered in England and Wales and a registered charity.
Company number: 02294320
Registered charity number: 800412
Registered office: Same Roots Collective, Laurel Lane, Queen Camel, Somerset, BA22 7NU
For the purposes of data protection law, Same Roots Collective is the Data Controller. This means that we are responsible for deciding how and why your personal information is used.
If you have any questions about this Privacy Policy or how we handle your personal information, please contact us:
Email: info@samerootscollective.org.uk
2. What Personal Information We Collect
The information we collect depends on how you interact with us.
This may include:
Your name
Your email address
Your telephone number
Information you provide when contacting us through our website
Booking information, including the date, time and type of booking
The number of people attending a booking where relevant
Information relating to payments
Information you choose to provide when discussing accessibility, concessions or eligibility for free or reduced-cost services
Your agreement to relevant terms and conditions
Technical information about your use of our website, such as your IP address and information collected through cookies or similar technologies
We aim to collect only the information that is reasonably necessary for the purposes described in this Privacy Policy.
Special Category Information
We do not intentionally ask visitors to provide special category personal information through our general website contact or booking forms.
In some circumstances, you may choose to contact us directly to discuss accessibility, concessions or eligibility for free or reduced-cost sessions. This may involve sharing information about your circumstances. If you provide information of this nature, we will only use it where necessary to respond to your enquiry or arrange the relevant service, and will handle it in accordance with applicable data protection law.
3. How We Collect Your Information
We may collect personal information when you:
Contact us through our website
Contact us by email or telephone
Make a booking through our online booking system
Make a payment through our website or booking system
Agree to terms and conditions associated with a booking
Use our website and consent to non-essential cookies or similar technologies
We do not currently operate a general email newsletter or mailing list.
4. How We Use Your Information
We may use your personal information to:
Respond to enquiries and messages
Communicate with you about your enquiry
Arrange and manage bookings
Communicate with you about a booking
Provide services you have requested
Process payments
Keep appropriate financial, accounting and business records
Maintain the security and functionality of our website
Understand how visitors use our website and improve its performance, where applicable
Meet our legal and regulatory responsibilities
Protect our organisation, visitors and systems against fraud, misuse or security threats
We will not use your personal information for unrelated purposes without providing appropriate information about that new use where required by law.
5. Our Lawful Bases for Processing
Under the UK GDPR, we must have a lawful basis for processing personal information.
Depending on the circumstances, we may rely on the following lawful bases:
Contract
We may process information where it is necessary to arrange or fulfil a booking or provide a service that you have requested.
Legal obligation
We may process and retain certain information where we are legally required to do so, for example for accounting, tax or other regulatory purposes.
Legitimate interests
We may process information where it is reasonably necessary for the administration, security and day-to-day operation of Same Roots Collective, provided that our legitimate interests do not unfairly override your rights and interests.
Consent
Where we ask for your consent, we will explain what you are consenting to and will only process your information for that purpose where you have given valid consent.
Where consent is our lawful basis, you can withdraw your consent at any time. This does not affect the lawfulness of processing that took place before you withdrew your consent.
6. Our Online Booking System
We use Acuity Scheduling, a Squarespace company, to manage bookings made through our website.
When you make a booking, the information you provide may be processed by Acuity on our behalf. This may include your name, contact details, booking information and other information necessary to arrange your booking.
Acuity provides tools that allow organisations to manage booking information and respond to data protection requests. Squarespace states that how Acuity is configured and what information an organisation chooses to collect forms part of that organisation's own data protection responsibilities.
Acuity may process or store personal information outside the UK. Where personal information is transferred outside the UK, we will ensure that an appropriate legal mechanism and safeguards are in place where required by applicable data protection law.
7. Payments
Payments made through our website or booking system may be processed by Stripe.
We do not store full debit or credit card details on our own systems.
Stripe may process personal information both as a data processor providing payment services to us and, in some circumstances, as an independent data controller for its own purposes. Stripe explains its different roles and processing activities in its Privacy Center.
Stripe may process personal information outside the UK where appropriate safeguards are in place.
8. Who Has Access to Your Information?
We limit access to personal information to people who need it to carry out their responsibilities within Same Roots Collective.
Access to website, booking and administrative information is currently limited primarily to authorised members of our management and administration team.
We do not sell or rent your personal information to third parties.
We may share personal information with trusted service providers where this is necessary to operate our website or provide services to you. These may include:
Squarespace, which hosts our website
Acuity Scheduling, which provides our online booking system
Stripe, which processes payments
Other service providers where necessary to maintain our website, systems or services
Where a third party processes personal information on our behalf, we take appropriate steps to ensure that the information is handled in accordance with applicable data protection requirements.
9. International Transfers
Some of the organisations we use may process personal information outside the United Kingdom.
Where personal information is transferred internationally, we will ensure that the transfer is carried out using an appropriate legal mechanism and safeguards as required by applicable data protection law.
10. How Long We Keep Your Information
We do not keep personal information indefinitely.
We retain information only for as long as it is reasonably necessary for the purpose for which it was collected, unless we are legally required to retain it for longer.
For example:
General enquiries: We normally retain information for as long as reasonably necessary to deal with the enquiry and any resulting communication.
Booking information: We may retain booking records for as long as reasonably necessary for administration, accounting, legal and business purposes.
Financial records: Some financial information must be retained for longer periods to meet legal, accounting and tax requirements.
Cookie and analytics information: Retention periods depend on the relevant Squarespace or third-party service and the settings in use.
When information is no longer required, we will take reasonable steps to securely delete or dispose of it.
11. Cookies and Similar Technologies
Our website is hosted by Squarespace.
Squarespace uses essential cookies and similar technologies that are necessary for the website to function properly, maintain security and provide certain basic features.
We may also use non-essential cookies or similar technologies for purposes such as analytics and understanding how visitors use our website.
Where consent is required, non-essential cookies are restricted until you have made a choice through our cookie banner. UK rules generally require websites to provide clear information about non-essential cookies and obtain consent before using them, subject to limited exceptions for technologies that are strictly necessary.
You can use the cookie settings on our website to manage your preferences.
Some third-party services connected to our website may also use their own cookies or similar technologies. Squarespace notes that its own cookie controls do not necessarily control cookies placed by every third-party service or integration.
We will review our use of cookies and similar technologies periodically and update this policy where necessary.
12. Your Rights
Under UK data protection law, you may have the right to:
Ask for a copy of the personal information we hold about you
Ask us to correct inaccurate or incomplete information
Ask us to delete your personal information in certain circumstances
Ask us to restrict how we use your information in certain circumstances
Object to certain types of processing
Withdraw consent where we rely on consent as our lawful basis
Request the transfer of certain personal information to you or another organisation where the right to data portability applies
These rights are subject to certain legal conditions and exemptions.
If you would like to exercise one of your rights, please contact:
info@samerootscollective.org.uk
We may need to ask you for information to confirm your identity before responding to a request. This is to help protect your personal information from being disclosed to the wrong person.
We will normally respond to valid requests within one month, although this may be extended where permitted by law for particularly complex or numerous requests.
13. Automated Decision-Making and Profiling
We do not use your personal information to make decisions about you solely through automated processing where those decisions have legal or similarly significant effects on you.
We do not carry out profiling for this purpose.
14. Keeping Your Information Secure
We take reasonable technical and organisational measures to protect personal information against accidental loss, unauthorised access, alteration, disclosure or destruction.
However, no website, electronic transmission or storage system can be guaranteed to be completely secure.
If we become aware of a personal data breach that is likely to result in a risk to individuals' rights and freedoms, we will take the appropriate steps required by data protection law.
15. Children's Information
Our website is not specifically directed at children, and we do not intentionally collect personal information from children through our general website contact forms.
Where children attend activities or bookings at Same Roots Collective, any information collected in connection with their participation will be handled separately and appropriately for the circumstances.
16. Third-Party Websites
Our website may contain links to websites operated by other organisations.
This Privacy Policy applies only to the Same Roots Collective website and does not cover external websites or services.
We recommend checking the privacy policies of any external website you visit.
17. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our website, services, data processing practices or legal requirements.
When we make changes, we will update the Last updated date at the top of this page.
We recommend checking this page periodically to make sure you are aware of any changes.
18. Making a Complaint
If you have concerns about the way we have handled your personal information, we encourage you to contact us first so that we have an opportunity to understand and address your concerns.
You also have the right to complain directly to the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection.
Information Commissioner's Office
Telephone: 0303 123 1113
The ICO provides further information about your data protection rights and how to make a complaint on its website.