UK privacy addendum
This addendum sits alongside the main Barsys privacy policy and adds the disclosures required for UK visitors under the UK GDPR and the Data Protection Act 2018.
Data controller
The data controller for personal data collected through 360.barsys.com and the Barsys 360 checkout is New Barsys Inc, contactable at privacy@barsys.com. New Barsys Inc is not established in the UK; for UK GDPR purposes we act as a non-UK controller offering goods to individuals in the United Kingdom.
Article 13(1)(f) — International transfers
Personal data collected on the UK store is processed on servers located in the United States and, for some services, in the European Economic Area. This means your personal data is transferred outside the United Kingdom.
These transfers rely on the following safeguards under UK GDPR Chapter V:
| Recipient | Country | Safeguard |
|---|---|---|
| Google Cloud (hosting, analytics infrastructure) | USA / EEA | UK Addendum to EU Standard Contractual Clauses; Data Privacy Framework certification for US processing |
| PayPal Holdings, Inc. (payment processing) | USA / Luxembourg | UK Addendum to EU Standard Contractual Clauses |
| Braze, Inc. (lifecycle messaging) | USA | UK Addendum to EU Standard Contractual Clauses; Data Privacy Framework certification |
| Kaptureit and PayPal analytics | USA | UK Addendum to EU Standard Contractual Clauses |
You are entitled to a copy of these safeguards. Request one from privacy@barsys.com.
Article 13(2)(a) — Retention periods
| Category | Retention | Legal basis |
|---|---|---|
| Order and payment records | 7 years from order date | Value Added Tax Regulations 1995, reg. 31 |
| Delivery address (post-fulfilment) | 2 years from delivery, then deleted | Legitimate interest — delivery dispute handling |
| Marketing consent and preferences | Until withdrawn, then archived 24 months for audit | Consent (UK GDPR Art 6(1)(a)) |
| Support correspondence | 3 years from last message | Legitimate interest — warranty and CRA claims |
| Analytics identifiers (cookies) | 13 months maximum | Consent (PECR reg. 6) |
| Recovery / abandoned-checkout data | 30 days from last activity | Legitimate interest, subject to opt-out |
Your rights
Under the UK GDPR you have the right to access, rectification, erasure, restriction, portability and objection, and the right not to be subject to automated decision-making that produces legal effects. To exercise any of these rights, email privacy@barsys.com. We will respond within one month.
If you are unhappy with how we have handled your personal data, you can lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or by calling 0303 123 1113.
Last updated 10 September 2026. For the general privacy policy that applies globally, see barsys.com/privacy-policy.