Privacy Policy

1. General information

At BarBrain GmbH (“BarBrain”), we attach great importance to the protection and security of your personal data. We treat your personal data with appropriate care and in accordance with the applicable data protection regulations, in particular Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR” (DSGVO)) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, “BDSG”). This means that we only ever process your data on the basis of an existing legal permission under data protection law.

This privacy policy applies to the website www.barbrain.com, all associated subpages, the web-based application and all mobile applications (“Apps”) of BarBrain (together the “Services”).

Please read this privacy policy carefully. If you have any questions, please contact the controller named in section 2.

2. Controller

The controller within the meaning of Art. 4(7) GDPR (Art. 4 Nr. 7 DSGVO) is:

BarBrain GmbH
Lindwurmstraße 25
80337 München
Email: hello@barbrain.com
Phone: +49 (0) 89 12085622

For further information, please refer to our legal notice (https://barbrain.com/legal/impressum).

3. Principles of data processing

3.1 The subject of data protection is personal data within the meaning of Art. 4(1) GDPR (Art. 4 Nr. 1 DSGVO). This includes all information relating to an identified or identifiable natural person. Data that has been anonymised or aggregated and can no longer be used to identify a specific natural person is not considered personal data.

3.2 We process your personal data in accordance with the principle of data minimisation (Art. 5(1)(c) GDPR (Art. 5 Abs. 1 lit. c DSGVO)). This means that we only collect the data that is necessary for the respective processing purpose.

3.3 With regard to the processing of personal data, the following legal bases in particular may apply:

• Art. 6(1)(a) GDPR (Art. 6 Abs. 1 lit. a DSGVO) (consent),
• Art. 6(1)(b) GDPR (Art. 6 Abs. 1 lit. b DSGVO) (performance of a contract and pre-contractual measures),
• Art. 6(1)(c) GDPR (Art. 6 Abs. 1 lit. c DSGVO) (compliance with legal obligations),
• Art. 6(1)(f) GDPR (Art. 6 Abs. 1 lit. f DSGVO) (legitimate interests).

3.4 We do not carry out any automated decision-making, including profiling, pursuant to Art. 22 GDPR (Art. 22 DSGVO).

4. Data collected and purposes of processing

4.1 Registration and user account

When you register for our Services, we collect the following data:

• first name and surname,
• email address,
• telephone number,
• postal address (billing address).

Legal basis: Art. 6(1)(b) GDPR (Art. 6 Abs. 1 lit. b DSGVO) (performance of a contract). The data is required to set up and manage your user account and to perform the contract.

4.2 Use of the software

When you use our software, the following data is processed automatically:

• access data (email address, hashed password),
• usage data (log data, device information, time of last login),
• content data (product and stock data that you enter into the software).

Legal basis: Art. 6(1)(b) GDPR (Art. 6 Abs. 1 lit. b DSGVO) (performance of a contract). The processing is necessary to provide and operate the software.

4.3 Payment processing

Payments are processed via our payment service provider Stripe Payments Europe, Ltd. (see section 6). In the course of payment, the billing address and payment information are processed.

Legal basis: Art. 6(1)(b) GDPR (Art. 6 Abs. 1 lit. b DSGVO) (performance of a contract).

4.4 Support and communication

If you contact our support (by email, chat or telephone), we process the data you provide (name, email address, content of the enquiry) in order to deal with your request. The in-app chat is provided via our service provider Intercom (see section 6).

Legal basis: Art. 6(1)(b) GDPR (Art. 6 Abs. 1 lit. b DSGVO) (performance of a contract), alternatively Art. 6(1)(f) GDPR (Art. 6 Abs. 1 lit. f DSGVO) (legitimate interest in handling customer enquiries).

4.5 Transactional emails

We send system-generated emails (e.g. registration confirmation, password reset, system notifications) via our service provider Twilio Inc. (SendGrid) (see section 6).

Legal basis: Art. 6(1)(b) GDPR (Art. 6 Abs. 1 lit. b DSGVO) (performance of a contract).

4.6 Use of aggregated data

We are entitled to use the data generated through use of the software in aggregated and anonymised form for statistical purposes, for product improvement and for market analyses. It is not possible to draw conclusions about individual customers or their business operations.

Legal basis: Art. 6(1)(f) GDPR (Art. 6 Abs. 1 lit. f DSGVO) (legitimate interest in improving our products). Anonymised data is no longer subject to the GDPR (DSGVO).

4.7 Reference customers

Unless you object, we use your company name and logo for advertising purposes (e.g. on our website, in presentations and in marketing materials). You may object to this use at any time in text form (see § 13(2) of our Terms & conditions (AGB)).

Legal basis: Art. 6(1)(f) GDPR (Art. 6 Abs. 1 lit. f DSGVO) (legitimate interest in marketing our products).

5. Cookies and web analytics

5.1 Cookies – general information

Our website uses cookies and similar technologies. Cookies are small text files that are stored on your device. Some cookies are technically necessary for the operation of the website; other cookies serve to analyse usage behaviour or are used for marketing purposes.

5.2 Cookie consent management (Usercentrics)

We use the consent management platform Usercentrics to obtain and document your consent to the storage of certain cookies and the use of certain technologies. The provider is Usercentrics GmbH, Sendlinger Straße 7, 80331 München.

When you visit our website, a Usercentrics cookie is stored in your browser which records the consents you have given or their withdrawal. The data is stored until you ask us to delete it, delete the cookie yourself or the purpose for storing the data no longer applies.

Legal basis: Art. 6(1)(c) GDPR (Art. 6 Abs. 1 lit. c DSGVO) (legal obligation) in conjunction with § 25(1) TDDDG (§ 25 Abs. 1 TDDDG). Obtaining consent is required by law.

5.3 Google Analytics

We use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses cookies to enable an analysis of the use of our website. The information generated by the cookie about your use is usually transferred to a Google server in the USA and stored there.

We use Google Analytics with the IP anonymisation function. As a result, your IP address is truncated within the member states of the EU or the EEA before it is transmitted to Google.

Google Analytics is only activated if you have given your consent via our cookie consent tool (Usercentrics).

Legal basis: Art. 6(1)(a) GDPR (Art. 6 Abs. 1 lit. a DSGVO) (consent). You can withdraw your consent at any time with effect for the future via the cookie consent tool.

Transfer to third countries: Insofar as data is transferred to Google LLC in the USA, Google is certified under the EU-U.S. Data Privacy Framework.

6. Recipients and processors

In providing our Services, we use the following processors within the meaning of Art. 28 GDPR (Art. 28 DSGVO):

Beyond this, we do not pass on your personal data to third parties unless we are legally obliged to do so or you have given your express consent. Under no circumstances do we sell personal data.

Further details on processing on our behalf are set out in our data processing agreement (Auftragsverarbeitungsvertrag – AVV) pursuant to Art. 28 GDPR (Art. 28 DSGVO), which forms part of our Terms & conditions (AGB).

7. Transfer of data to third countries

Your personal data is generally processed within the European Union or the European Economic Area. Insofar as data is transferred to recipients in the USA (DigitalOcean LLC, Twilio Inc., Google LLC), this is done on the basis of the European Commission’s adequacy decision pursuant to Art. 45 GDPR (Art. 45 DSGVO) (EU-U.S. Data Privacy Framework), provided that the respective recipient is certified under this framework. In addition, standard contractual clauses pursuant to Art. 46(2)(c) GDPR (Art. 46 Abs. 2 lit. c DSGVO) are agreed.

8. Storage period

8.1 Your personal data is generally stored for the duration of the contractual relationship.

8.2 After termination of your user account, your data will be deleted unless its retention is required for reasons of commercial or tax law (in particular §§ 147 AO (German Fiscal Code), 257 HGB (German Commercial Code); retention period of up to 10 years). You can delete your account yourself in your user profile.

8.3 After deletion of your account, all data associated with the account is, as a rule, irrevocably deleted within 30 days. An export function in common machine-readable formats (in particular CSV) is available. It is the customer’s responsibility to back up their data before deletion.

9. Your rights as a data subject

You have the following rights. To exercise your rights, an informal message by email to hello@barbrain.com is sufficient.

9.1 Right of access (Art. 15 GDPR (Art. 15 DSGVO)): You have the right to request information about your personal data processed by us, including the purposes of processing, the categories of data processed, the recipients, the planned storage period and the origin of your data.

9.2 Right to rectification (Art. 16 GDPR (Art. 16 DSGVO)): You have the right to the immediate rectification or completion of your personal data.

9.3 Right to erasure (Art. 17 GDPR (Art. 17 DSGVO)): You have the right to request the erasure of your personal data, unless statutory retention periods preclude this or we still require the data for the proper performance of the contract.

9.4 Restriction of processing (Art. 18 GDPR (Art. 18 DSGVO)): You have the right to request the restriction of the processing of your data, for example while the accuracy of your data is being verified, in the case of unlawful data processing, for the assertion of legal claims or where you have lodged an objection.

9.5 Notification obligation (Art. 19 GDPR (Art. 19 DSGVO)): If you have exercised your right to rectification, erasure or restriction, we will notify all recipients to whom your data has been disclosed, unless this proves impossible or involves disproportionate effort.

9.6 Data portability (Art. 20 GDPR (Art. 20 DSGVO)): You have the right to receive the personal data concerning you that we process by automated means on the basis of your consent or in performance of a contract in a commonly used, machine-readable format, or to request its transfer to another controller.

9.7 Right to withdraw consent (Art. 7(3) GDPR (Art. 7 Abs. 3 DSGVO)): Where processing is based on your consent, you may withdraw it at any time with effect for the future. The lawfulness of the processing carried out until the withdrawal remains unaffected. An email to hello@barbrain.com or changing your settings in the cookie consent tool is sufficient for the withdrawal.

9.8 Right to object (Art. 21 GDPR (Art. 21 DSGVO)): Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR (Art. 6 Abs. 1 lit. f DSGVO)), you may object to this processing at any time. We will then cease the processing unless there are compelling legitimate grounds for further processing.

9.9 Right to lodge a complaint (Art. 77 GDPR (Art. 77 DSGVO)): In the event of breaches of data protection law, you have the right to lodge a complaint with the competent supervisory authority. The authority responsible for BarBrain is the Bayerisches Landesamt für Datenschutzaufsicht (Bavarian Data Protection Authority, BayLDA), Promenade 18, 91522 Ansbach; https://www.lda.bayern.de.

10. Data security

We take appropriate technical and organisational security measures pursuant to Art. 32 GDPR (Art. 32 DSGVO) to protect your data against accidental or intentional manipulation, loss, destruction or unauthorised access. These include in particular:

• encryption of data transmission using TLS (at least version 1.2) and encryption of stored data (encryption at rest),
• role-based access controls and two-factor authentication,
• regular automated data backups (daily, retained for at least 14 days),
• monitoring and logging of security-relevant events,
• documented processes for detecting, reporting and handling security incidents (incident response).

The specific technical and organisational measures are described in Annex 2 of our data processing agreement (AVV). All employees are bound to confidentiality.

11. Minors

Our Services are aimed exclusively at entrepreneurs (Unternehmer) within the meaning of § 14 BGB (German Civil Code). Users under the age of 16 should only transmit personal data to us with the consent of their parents or legal guardians.

12. Changes to this privacy policy

From time to time, it may become necessary to amend the content of this privacy policy. We therefore reserve the right to change this privacy policy as required. The current version is always available at https://www.barbrain.com/datenschutz.

Last updated: April 2026