Cookie and Privacy Notice

This notice explains how Root And Erect uses personal information and how we use cookies on our website. It covers everyone whose information we hold: visitors to this website, people who contact us, job applicants, clients, sub-consultants and collaborators, and people who take part in our community engagement work. Our staff are covered by a separate notice, which we give to them when they join.

This notice was last updated 14th September 2026.

1. Who we are

Root And Erect is the trading name of Erect Architecture Ltd, registered in England and Wales, company number 06393307, registered office Unit 22B Regent Studios, 8 Andrews Road, London E8 4QN.

We are the data controller for the personal information described in this notice, except where we collect information on behalf of a client, as explained in section 4.4.

You can contact us by email at hello@rootanderect.co.uk or by telephone on +44 (0)20 7254 6336. Our contact for data protection is Susanne Tutsch, Director.

2. Cookies

A cookie is a small text file placed on your device when you visit a website. Cookies do not usually identify you personally, but information stored in a cookie may be linked to other information we hold about you.

When you first visit our website, a banner asks whether you agree to analytics cookies. These cookies are not placed on your device unless you agree.

We use the following cookies:

  • _ga (Google Analytics) - Analytics. Counts visitors and shows how people move around the website, so that we can improve it.
  • rootanderect.co.uk - Functional. Remembers your cookie preference so that you are not asked again on each visit.

Google Analytics is provided by Google, which acts as our processor and may transfer information outside the UK. See section 6.

You can also control cookies through your browser settings. Most browsers accept cookies by default and the help menu in your browser explains how to change this or delete cookies already stored. Further general information is available at aboutcookies.org.

3. Where we get personal information from

Most of the information we hold is given to us directly by the person concerned. We also receive information indirectly:

  • from a client, collaborator or former employer who refers or recommends someone;
  • from our own research, when we are identifying potential clients or collaborators; and
  • from public sources such as company registers and professional bodies.

4. How we use personal information

4.1 Website visitors and people who contact us

We collect your name, email address, telephone number, the content of your correspondence, and technical information collected through cookies.

We use this to respond to enquiries and correspondence, and to understand how the website is used and improve it. Our lawful basis is our legitimate interests in responding to people who contact us and in maintaining our website. For analytics cookies we rely on your consent, as set out in section 2.

We keep general enquiries and correspondence for two years.

4.2 Job applicants

We collect your name and contact details, your CV and work history, your correspondence with us, and any references we receive.

We use this to assess your application and to contact you about it. Our lawful basis is taking steps at your request before entering into a contract, together with our legitimate interests in recruiting for our practice.

We keep application information from unsuccessful applicants for six months, or for up to twelve months where we would like to consider you for future vacancies, unless you ask us to delete it sooner. If you are offered a role, your information is kept in accordance with our staff privacy notice.

4.3 Clients, sub-consultants and collaborators

We collect the name, role and contact details of individuals at the organisations we work with, together with organisation details (company registration and VAT numbers, size, and any Central Digital Platform identifier), CVs and details of roles on projects, documents you issue to us, correspondence and meeting minutes, invoices and payment details, insurance certificates, policies and procedures, professional memberships and registrations, and any declarations made in our Sub-Consultant Questionnaire.

We use this information to:

  • deliver projects and maintain effective working relationships;
  • communicate on projects and prospective projects;
  • prepare and submit tenders, and meet the requirements set by clients and contracting authorities;
  • check that quality standards, policies and insurance cover are adequate for the work;
  • maintain accurate financial records and make payments;
  • meet the professional standards required of a RIBA Chartered Practice; and
  • promote completed projects accurately and credit those who worked on them.

Our lawful bases are the performance of a contract, compliance with a legal obligation (for example keeping financial records), and our legitimate interests in submitting tenders, checking the standards of those we work with, and promoting our work.

We keep these records for six years after the last project we worked on together. Project records, which may include correspondence and minutes naming individuals, are kept for fifteen years after completion of the project.

4.4 Community engagement participants

Much of our work involves consultation, co-design and engagement with the people who use a place. Where we carry out this work for a client such as a local authority, the client is usually the data controller and we collect the information on their behalf. Their privacy notice will apply, and we will tell you at the time who is responsible for your information.

Where we are the controller, we may collect your name and contact details, your views and feedback, and photographs or recordings of workshops and events. Where you take part in a paid role, we also collect the information we need to pay you, including bank details.

We use this information to design and develop proposals, to report on engagement to our clients, to evaluate our work, and to keep participants informed about a project. Our lawful basis is our legitimate interests in designing places that reflect the needs of those who use them, except that we rely on your consent for photographs and recordings and for staying in touch after a project ends, and on contract and legal obligation where we pay you for your time.

Where children or young people take part, we obtain consent from a parent, carer or the school or setting responsible for them, and we follow our safeguarding policy.

We keep engagement records for twelve months after completion of a project, unless they are transferred to the client. Photographs and recordings are kept for as long as the image is in use and consent has not been withdrawn.

5. Who we share information with

We may share personal information with:

  • our directors and staff;
  • our clients and, where a project is publicly procured, the relevant contracting authority;
  • other consultants and collaborators working on the same project;
  • our professional indemnity insurer and insurance broker;
  • our accountant and payroll provider;
  • our IT provider, website host and the providers of the platforms listed in section 6; and
  • professional membership bodies, where required.

We do not sell personal information, and we do not use it for advertising.

6. How we store information, and transfers outside the UK

Information is stored on our server, our onsite and offsite back-ups, and in Google Workspace (Gmail, Google Drive and Google Contacts). Some information may also be held in Slack, our internal communications platform. Access is limited to those who need it, and our security measures are set out in our Data Protection Policy.

Where information is transferred outside the UK, for example through our use of Google Workspace, Slack or website analytics, we rely on the safeguards required under UK data protection law, including the UK International Data Transfer Addendum and/or Standard Contractual Clauses set out in the relevant provider's terms.

7. Special category and criminal offence information

We collect a limited amount of more sensitive information. This may include accessibility requirements disclosed when someone takes part in engagement, equality monitoring information where a client requires it, and declarations about criminal convictions made by sub-consultants as part of procurement. We collect this only where necessary, keep it with restricted access, and share it only where there is a clear legal basis for doing so.

8. Freedom of information

Most of our clients are public authorities. Information we provide to them, including the names and details of sub-consultants and collaborators, may be subject to disclosure under the Freedom of Information Act 2000 or the Environmental Information Regulations 2004. Decisions about disclosure are made by the authority concerned.

9. Your rights

Under UK data protection law you have the right to:

  • be informed about how we use your personal information;
  • ask us for a copy of the personal information we hold about you;
  • ask us to correct information you think is inaccurate or incomplete;
  • ask us to erase your personal information in certain circumstances;
  • ask us to restrict how we use your personal information in certain circumstances;
  • object to our use of your personal information in certain circumstances;
  • ask us to transfer your information to you or to another organisation in certain circumstances; and
  • withdraw your consent at any time, where we rely on consent.

There is no charge for exercising these rights. We will respond within one month. If your request is complex we may extend this by up to two further months, and we will tell you within one month if that is the case.

To exercise any of these rights, contact Susanne Tutsch, Director, at hello@rootanderect.co.uk.

10. How to complain

If you are unhappy with how we have used your personal information, please tell us by emailing hello@rootanderect.co.uk or writing to us at the address above. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you informed, and tell you the outcome.

You can also complain to the Information Commissioner's Office at any time, whether or not you have complained to us first:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline: 0303 123 1113 Website: ico.org.uk

11. Changes to this notice

We may update this notice from time to time. Any changes will be posted on this page, with the date on which the notice was last updated.