Privacy Policy

Last updated: 26 March 2026

This Privacy Policy explains how Rootcause Global Ltd ("we", "us", or "our") collects, uses, and protects your personal information when you visit our website. We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

The data controller responsible for your personal information is:

• Business name: Rootcause Global Ltd
• Company registration number: 13941806 (registered in England and Wales)
• Registered address: 249 Cranbrook Road, Ilford, England, IG1 4TG
• Contact email: jt@rootcause.global

2. What Information We Collect

Contact Form Submissions

When you use our contact form, we collect:

• Your name
• Your email address
• Your organisation (optional)
• Your area of interest (optional)
• Any information you choose to include in your message
• Whether you wish to subscribe to our newsletter

Newsletter Sign-Ups

When you sign up to receive our newsletter via our website, we collect your email address. Our newsletters are delivered via Beehiiv, which acts as a data processor on our behalf.

We also publish The Populist Decoder newsletter on Ghost Pro (ghost.org). If you choose to subscribe to that newsletter, you will be directed to the Ghost platform, where Ghost Foundation Ltd collects and manages your data under its own privacy policy.

Website Analytics

We use Vercel Analytics to understand how visitors use our website. Vercel Analytics does not use persistent cookies, does not track users across different websites, and collects only anonymised, aggregated data. No personally identifiable information is retained through this tool.

Spam Prevention

We use Google reCAPTCHA v3 on our contact and newsletter forms to protect against spam and abuse. When you submit a form, reCAPTCHA collects information including your IP address, browser characteristics, and interaction behaviour, which is sent to Google for analysis. This processing is necessary to verify that submissions are made by humans rather than automated bots.

3. How We Use Your Information

We use your personal information for the following purposes:

• To respond to your enquiries submitted via our contact form
• To send you newsletters and updates, where you have opted in to receive them
• To monitor and improve the performance and usability of our website
• To protect our website against spam and abuse
• To comply with our legal and regulatory obligations

4. Our Legal Basis for Processing

Under UK GDPR, we must have a lawful basis for processing your personal data:

• Contact form submissions: Legitimate interests — to respond to your enquiry
• Newsletter sign-ups: Consent — you have actively opted in to receive communications
• Website analytics: Legitimate interests — Vercel Analytics collects only anonymised, non-identifying data
• Spam prevention (reCAPTCHA): Legitimate interests — to protect our website and users from spam and abuse

5. Cookies and Tracking

Our website uses a limited number of cookies and tracking technologies:

• Essential cookies: Necessary for the website to function correctly
• Analytics: Vercel Analytics collects anonymised usage data without persistent cookies or cross-site tracking
• Spam prevention: Google reCAPTCHA may set cookies to distinguish human visitors from bots. These cookies are set by Google and are subject to Google's privacy policy
• Third-party cookies: YouTube video embeds may set cookies when you interact with them. These are set by Google/YouTube and subject to their own privacy policies

You can control or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of some features on our website.

6. YouTube Embeds

Our website includes embedded YouTube videos. When you watch or interact with these videos, YouTube (operated by Google LLC) may collect data about you, including your IP address and viewing behaviour, even if you are not signed into a Google account. This data is processed by Google in accordance with their own privacy policy.

We recommend reviewing Google's Privacy Policy at policies.google.com/privacy for full details of how they handle your data.

7. International Data Transfers

Some of our third-party service providers are based outside the UK. Where personal data is transferred internationally, we ensure appropriate safeguards are in place:

• Beehiiv (USA): Subscriber data is processed in the United States. Beehiiv provides Standard Contractual Clauses (SCCs) as the transfer mechanism to ensure your data receives equivalent protection
• Ghost Pro (Ghost Foundation Ltd): If you subscribe to The Populist Decoder newsletter, your data is collected and stored by Ghost directly. Ghost stores data in the EU and does not require international transfer safeguards
• Resend (USA): Contact form submissions are delivered via Resend, which processes data in the United States under Standard Contractual Clauses
• Vercel (USA): Website infrastructure and analytics are processed via Vercel, which provides a UK GDPR-compliant Data Processing Addendum and uses Standard Contractual Clauses for international transfers
• Google (USA): YouTube embeds and reCAPTCHA may transfer data to the US under Google's Standard Contractual Clauses

8. Who We Share Your Data With

We do not sell your personal data. We share it only with the following trusted third parties:

• Beehiiv — newsletter delivery and subscriber management (data processor)
• Ghost Pro (Ghost Foundation Ltd) — hosts The Populist Decoder newsletter; collects subscriber data directly when you sign up on their platform
• Resend — email delivery for contact form submissions (data processor)
• Vercel Inc — website hosting, infrastructure, and anonymised analytics (data processor)
• Google LLC — reCAPTCHA spam prevention and YouTube embedded video content
• Law enforcement or regulatory authorities, where required by law

All third-party processors are required to handle your data securely and only for the purposes we specify.

9. How Long We Keep Your Data

We retain personal data only for as long as necessary:

• Contact form enquiries: Up to 36 months after our last communication
• Newsletter subscribers: Until you unsubscribe, or after 36 months of inactivity
• Analytics data: Anonymised only; no personally identifiable data is retained by Vercel Analytics
• reCAPTCHA data: Processed in real time by Google; we do not retain reCAPTCHA data ourselves

10. Your Rights

Under UK GDPR, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Ask us to correct inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data ("right to be forgotten")
• Right to restrict processing: Ask us to limit how we use your data
• Right to data portability: Request your data in a commonly used, machine-readable format
• Right to object: Object to processing based on legitimate interests, or to direct marketing
• Right to withdraw consent: Where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, please contact us at jt@rootcause.global. We will respond within one calendar month.

11. How to Unsubscribe

You can unsubscribe from our Rootcause newsletter at any time by clicking the unsubscribe link included in every email, or by contacting us directly at jt@rootcause.global. Unsubscribe requests are processed promptly via Beehiiv.

To unsubscribe from The Populist Decoder newsletter, use the unsubscribe link in those emails or manage your subscription on the Ghost platform directly.

12. How We Protect Your Data

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, or destruction. Our third-party processors — Vercel, Resend, and Beehiiv — all maintain their own security programmes and comply with applicable data protection laws.

13. Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the UK's data protection regulator:

• Information Commissioner's Office (ICO)
• Website: www.ico.org.uk
• Helpline: 0303 123 1113

We would appreciate the opportunity to address your concerns before you approach the ICO, so please contact us first.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.

15. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

• Email: jt@rootcause.global
• Post: Rootcause Global Ltd, 249 Cranbrook Road, Ilford, England, IG1 4TG

Rootcause Global Ltd is registered in England and Wales (company no. 13941806). This policy is drafted in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.