This policy explains how Loom & Root ("we", "us") collects, uses and looks after your personal data when you contact us through this website. We are the data controller for the information you provide. Loom & Root is a maker based in Bristol, United Kingdom.
What we collect
We only collect the details you choose to give us. When you use our contact form, or email us directly, that may include:
- your name;
- your email address;
- your phone number (optional); and
- the message you send us, including anything you tell us about the piece you have in mind.
We do not take payment through this website, so we do not collect card or bank details here.
Why we use it, and our lawful basis
We use your details to read and respond to your enquiry, to discuss a possible commission, and to keep a record of our conversation. Under the UK GDPR our lawful basis is legitimate interests — responding to an enquiry you have started with us, and running our small business. We do not use your details for marketing unless you have asked us to, and we do not sell your data to anyone.
How long we keep it
An enquiry sent through this website is stored for 180 days and is then deleted automatically. If your enquiry becomes an order, we keep what we need for the work itself and for our own records afterwards, and no longer.
Who we share it with
We do not sell or trade your personal data. We use a small number of service providers to run this website and handle enquiries. Each processes data on our behalf:
- Cloudflare — hosting and delivery of this website, and storage of the enquiries you send us.
- Resend — delivering the enquiry emails our contact form generates.
We may also disclose information if the law requires us to.
Where your data is held
Both providers are based in the United States, and your data may be processed outside the UK. Where that happens, the transfer is made under the safeguards UK data protection law requires for international transfers, such as the UK's International Data Transfer Addendum to the European Commission's standard contractual clauses.
Cookies
This website sets no cookies on the pages you browse, and we use no advertising or tracking cookies. The only cookie we use is on the private part of the site that we sign into ourselves, where it is needed to keep that sign-in secure.
Your rights under UK GDPR
You have the right to:
- ask for a copy of the personal data we hold about you (access);
- ask us to correct anything that is wrong or incomplete (rectification);
- ask us to delete your data where there is no reason for us to keep it (erasure);
- ask us for a copy of your data in a portable form, or to send it to someone else (portability);
- object to, or ask us to restrict, how we use your data; and
- complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk.
We would ask you to raise any concern with us first, so that we can put it right.
How to contact us
For anything to do with your data, or to exercise any of the rights above, email us at [email protected]. We are open Monday to Friday, 9am to 5pm.
Last updated: 25 October 2026.