Privacy Policy

Last updated: 02.11.2026

This Privacy Policy explains how POLYGEX LTD, company number 17236783, registered at 128 City Road, London, United Kingdom, EC1V 2NX (“we,” “our,” “us”), collects, uses, stores, and protects personal data when you access or use savorroots.net (the “Platform”).

For privacy-related enquiries, please contact us at info@savorroots.net.

This Privacy Policy applies to users of the Platform, including customers and creators who upload or offer digital content through the Platform.

1. Data Protection Framework

We process personal data in accordance with applicable data protection and privacy legislation, including:

the UK General Data Protection Regulation (UK GDPR);
the Data Protection Act 2018;
the Privacy and Electronic Communications Regulations 2003 (PECR), where applicable;
the EU General Data Protection Regulation (EU GDPR), where applicable to our processing activities or users;
applicable UK legislation governing electronic communications, payments, fraud prevention, and financial record keeping.

Where required by applicable law, we act as a data controller in relation to personal data processed for operating and administering the Platform.

2. Information We Collect

We may collect the following categories of personal data.

Information You Provide

This may include:

name and contact details;
email address;
account login credentials;
billing and transaction information;
information required to process purchases or payments;
content, recipes, videos, written materials, comments, ratings, and reviews that you upload or submit;
communications with us, including customer support enquiries;
information you provide when creating or managing an account.

We do not generally store complete payment card details. Payment card information is processed through our authorised third-party payment service providers.

Information Collected Automatically

When you use the Platform, we may automatically collect:

IP address;
device type and operating system;
browser type and version;
approximate geographic location derived from IP address;
date and time of access;
pages viewed and interactions with the Platform;
technical and diagnostic information;
security and fraud-prevention information.

Where cookies or similar technologies are used, they are handled in accordance with applicable law and our Cookies Policy.

Information From Third Parties

We may receive information from:

payment service providers;
fraud-prevention and security providers;
analytics and technology providers;
identity or transaction verification providers;
social media or third-party services where you choose to connect or interact with them.

3. How We Use Personal Data

We may use personal data to:

create and manage user accounts;
provide and operate the Platform;
process purchases and transactions;
facilitate transactions between customers and creators;
deliver purchased digital content;
communicate with users regarding accounts, transactions, orders, and support requests;
provide customer service;
maintain Platform security;
detect and prevent fraud, abuse, unauthorised transactions, and other unlawful activity;
comply with legal and regulatory obligations;
maintain appropriate business and financial records;
analyse and improve the Platform and its functionality;
personalise content and recommendations where permitted by law;
send marketing communications where you have provided the required consent or where another lawful basis permits us to do so.

We do not use personal data for purposes incompatible with the purposes described in this Privacy Policy unless permitted or required by applicable law.

4. Lawful Bases for Processing

Where the UK GDPR or EU GDPR applies, we process personal data on one or more of the following legal bases:

Contract: where processing is necessary to provide the Platform, manage an account, process a purchase, or fulfil our contractual obligations;
Legal obligation: where processing is required to comply with applicable laws or regulatory requirements;
Legitimate interests: where processing is necessary for legitimate business interests, such as Platform security, fraud prevention, service improvement, and administration, provided that those interests are not overridden by your rights and freedoms;
Consent: where we request your consent, including for certain marketing communications or non-essential cookies;
Vital interests: where processing is necessary to protect someone’s vital interests in circumstances permitted by applicable law.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

5. Payment Processing

Payments made through the Platform may be processed by third-party payment service providers.

Payment providers may collect and process payment and transaction information in accordance with their own privacy policies and applicable payment regulations.

We may receive limited payment-related information, such as:

transaction amount;
transaction date and time;
payment status;
payment method;
transaction or payment reference;
limited information required for fraud prevention and transaction verification.

We do not generally store full payment card numbers, CVV/CVC security codes, or other sensitive card authentication data on our own systems.

Payment processing is carried out using payment service providers that implement appropriate security measures and applicable PCI DSS requirements.

6. Strong Customer Authentication (SCA) and 3D Secure

Where required by applicable payment regulations, including the UK Payment Services Regulations and requirements derived from PSD2, payments may be subject to Strong Customer Authentication (SCA).

Depending on the payment provider and transaction, authentication may involve:

a one-time passcode;
approval through a banking application;
biometric authentication;
another authentication method supported by the card issuer or payment provider.

We may use 3D Secure (3DS) or equivalent authentication technologies to help verify payment transactions and reduce payment fraud.

If the required authentication is unsuccessful, incomplete, or declined, the payment may not be authorised and the transaction may not be completed.

7. Sharing of Personal Data

We do not sell personal data.

We may share personal data where reasonably necessary with:

Service Providers

This may include:

payment processors;
hosting and infrastructure providers;
security and fraud-prevention providers;
analytics providers;
customer-support providers;
email and communications providers;
technical service providers.

These providers may process personal data only as necessary to provide services to us and, where applicable, under contractual data protection obligations.

Creators

Where necessary to fulfil a purchase or provide purchased digital content, certain information may be made available to the relevant creator, such as the information required to identify or fulfil the transaction.

Creators are responsible for handling personal data they receive through the Platform in accordance with applicable data protection laws.

Legal and Regulatory Authorities

We may disclose personal data where required or permitted by law, including to courts, regulators, law-enforcement authorities, tax authorities, or other competent public bodies.

Business Transfers

If POLYGEX LTD is involved in a merger, acquisition, restructuring, sale of assets, or similar corporate transaction, personal data may be transferred as part of that transaction, subject to applicable data protection requirements.

8. International Data Transfers

Some of our service providers may process personal data outside the United Kingdom or the European Economic Area (EEA).

Where personal data is transferred internationally, we take appropriate steps to ensure that the transfer is carried out in accordance with applicable data protection law.

Depending on the circumstances, this may include:

an applicable adequacy decision;
the UK International Data Transfer Agreement (IDTA);
the UK Addendum to the EU Standard Contractual Clauses;
EU Standard Contractual Clauses;
other lawful transfer mechanisms or safeguards recognised under applicable law.

9. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including to:

provide and administer the Platform;
maintain account and transaction records;
comply with legal, tax, accounting, financial, and regulatory obligations;
prevent fraud and abuse;
resolve disputes;
establish, exercise, or defend legal claims.

Different categories of information may therefore be retained for different periods.

Where information is no longer required, we will securely delete it or anonymise it where appropriate.

10. Data Security

We use appropriate technical and organisational measures designed to protect personal data against:

unauthorised access;
accidental loss;
destruction;
alteration;
disclosure;
misuse.

Security measures may include access controls, encryption where appropriate, secure payment processing, authentication mechanisms, monitoring, and fraud-prevention measures.

However, no internet transmission or electronic storage system can be guaranteed to be completely secure.

11. Marketing Communications

Where required by law, we will obtain your consent before sending direct electronic marketing communications.

You may unsubscribe from marketing communications at any time by using the unsubscribe mechanism provided in the relevant communication or by contacting info@savorroots.net.

You may continue to receive essential service communications, such as transaction confirmations, security notices, account notifications, and important changes to the Platform.

12. Your Privacy Rights

Depending on your location and the applicable law, you may have the right to:

request access to your personal data;
request correction of inaccurate or incomplete personal data;
request deletion of personal data in certain circumstances;
request restriction of processing;
object to certain processing;
request data portability;
withdraw consent where processing is based on consent;
object to direct marketing;
request information about international transfers and applicable safeguards;
lodge a complaint with the relevant data protection supervisory authority.

To exercise your rights, contact:

info@savorroots.net

We may need to verify your identity before processing certain requests.

13. Cookies and Similar Technologies

We may use cookies and similar technologies to operate, secure, analyse, and improve the Platform.

Where required by law, we will request consent before placing non-essential cookies or similar technologies on your device.

Further information is available in our Cookies Policy.

14. Children's Privacy

The Platform is intended for users aged 18 or over.

We do not knowingly collect personal data from children under 18. If we become aware that personal data has been collected from a child contrary to applicable law, we will take appropriate steps to delete it.

15. Third-Party Websites and Services

The Platform may contain links to third-party websites, services, or platforms.

We are not responsible for the privacy practices, security, or content of third-party services. We recommend reviewing the privacy policies of those third parties before providing them with personal information.

16. Supervisory Authority

We aim to handle personal data fairly, lawfully, and transparently.

If you are located in the United Kingdom and believe that your data protection rights have been infringed, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

You can contact the ICO through its official website.

If you are located in the EEA, you may also have the right to complain to the data protection authority in your country of residence, workplace, or the place where you believe an infringement occurred.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, legal requirements, technology, or data-processing practices.

The latest version will be published on this page and identified by the “Last updated” date.

18. Governing Law

This Privacy Policy and the processing of personal data by POLYGEX LTD are governed by the laws of England and Wales, together with the UK GDPR and the Data Protection Act 2018, without prejudice to any mandatory rights or protections that may apply to you under the laws of another jurisdiction.

19. Contact Us

If you have questions about this Privacy Policy, our processing of personal data, or your privacy rights, please contact:

POLYGEX LTD
Company number: 17236783
128 City Road
London, United Kingdom
EC1V 2NX

Email: info@savorroots.net