Last updated: 17 October 2026

1. Who we are (Data Controller)

This website, barobjects.com (“Bar Objects”, “we”, “us”, “our”), operates an online store offering bar and beverage equipment, supplies and related products, and serves customers internationally.

For the purposes of the EU General Data Protection Regulation (GDPR), the UK GDPR, and related data-protection laws, the data controller responsible for your personal data is:

• Bar Objects
• 3069 McCall Drive, Suite 7, Atlanta, GA 30340, United States
• Email: support@barobjects.com
• Website: https://barobjects.com

If you have any questions about this policy or how we handle your personal data, please contact us using the details above.

2. Scope of this policy

This policy explains what personal data we collect through this website, why we collect it, the legal bases we rely on, who we share it with, how long we keep it, and the rights you have. It also explains, in Section 10, exactly which cookies and similar technologies we use and how you control them.

3. The personal data we collect

Depending on how you use the site, we may process the following categories of personal data:

Category	Examples	Source
Account & order data	Name, email address, telephone number, billing and shipping address, order history, account credentials	Provided by you when you create an account or place an order (WooCommerce)
Enquiry & contact data	Name, email, phone, company, and the content of your message	Provided by you via contact, enquiry or live-chat forms
Payment data	Payment method and transaction confirmation. Full card details are processed directly by our payment provider and are not stored on our servers beyond what is retained in the order record.	Provided by you at checkout; processed by the payment provider
Technical & usage data	IP address, device and browser information, pages viewed, interactions, approximate location, and identifiers set by cookies	Collected automatically, subject to your consent for non-essential cookies (see Section 10)
Security & server logs	IP address, request metadata, and security events (for example from our CDN and security provider)	Collected automatically for security and fraud prevention

We do not intentionally collect special-category data (such as health, biometric or political data) through this website. Please do not submit such data to us.

4. How and why we use your data, and our legal bases

We only process your personal data where we have a lawful basis under Article 6 GDPR:

Purpose	What this involves	Legal basis (Art. 6 GDPR)
Operating the shop & fulfilling orders	Processing orders, payments, delivery, accounts, customer service, and order-related communications	Contract (Art. 6(1)(b))
Responding to enquiries	Handling contact, enquiry and live-chat submissions	Legitimate interests (Art. 6(1)(f)) in responding to you, and/or consent (Art. 6(1)(a)) where you provide it
Analytics & site improvement	Understanding how visitors use the site, via Google Analytics delivered through Google Tag Manager	Consent (Art. 6(1)(a)) — loaded only if you opt in
Embedded media & maps	Loading video embeds (YouTube, Vimeo) and maps (Google Maps) when you choose to	Consent (Art. 6(1)(a)) — click-to-load
Live chat & product insights	Providing live chat (Tawk.to) and understanding site usage (Microsoft Clarity)	Consent (Art. 6(1)(a))
Security, fraud prevention & site delivery	Content delivery, bot and abuse protection, and security logging via Cloudflare	Legitimate interests (Art. 6(1)(f)) in keeping the site secure and available
Legal & tax compliance	Retaining invoices and orders and responding to lawful requests	Legal obligation (Art. 6(1)(c))

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You can object to processing based on legitimate interests (see Section 8).

5. Who we share your data with

We share personal data only where necessary, with:

• Payment providers — to process payments securely (CyberSource and PayPal).
• Shipping and logistics providers — to deliver your orders.
• Service providers and processors that help us run the site, listed in Section 10 (including Google, Vimeo, Cloudflare, Microsoft and Tawk.to).
• Professional advisers and authorities — where required by law, regulation, or to establish, exercise or defend legal claims.
• Hosting provider — our website is hosted by WP Engine and served through Cloudflare.

We do not sell your personal data. Each processor acts under a written data-processing agreement and may only process your data on our instructions.

6. International data transfers

Some of our service providers are located outside the European Economic Area (EEA) and the UK, including in the United States:

• Google LLC (Google Tag Manager, Google Analytics, YouTube, Google Maps) — United States
• Vimeo, Inc. — United States
• Cloudflare, Inc. — United States and global network
• Microsoft Corporation (Microsoft Clarity) — United States
• Tawk.to Inc. — United States

Where personal data is transferred outside the EEA and the UK, we rely on an appropriate transfer mechanism, such as the EU–US Data Privacy Framework (DPF) and/or the European Commission’s Standard Contractual Clauses (SCCs), together with supplementary measures where needed. You can request more information about these safeguards using the contact details in Section 1.

7. How long we keep your data (retention)

We keep personal data only for as long as necessary for the purposes described above:

• Order and invoice records — retained to meet tax, accounting and legal obligations for the statutory period applicable in the relevant jurisdiction.
• Account data — retained while your account is active and for a reasonable period afterwards.
• Enquiry and chat data — retained for as long as needed to handle your enquiry and for a reasonable period afterwards.
• Cookie consent records — we log your consent choices as proof of consent for the period required by law.

Erasure on request is enabled: when you make a verified erasure request, personal data within your orders and account is removed in line with Section 8, except where we are legally required to retain certain records.

8. Your rights

Subject to the conditions and exemptions in applicable law, you have the right to:

• Access — obtain a copy of the personal data we hold about you;
• Rectification — have inaccurate or incomplete data corrected;
• Erasure — ask us to delete your data (the “right to be forgotten”);
• Restriction — ask us to limit how we use your data;
• Portability — receive certain data in a portable, machine-readable format;
• Object — object to processing based on legitimate interests, and to direct marketing at any time;
• Withdraw consent — where we rely on consent (such as analytics, embedded media, maps, live chat and product insights), withdraw it at any time, without affecting the lawfulness of processing before withdrawal (see Section 10 for how).

To exercise any of these rights, contact us using the details in Section 1. We will respond within the timeframe required by law (generally one month). We may need to verify your identity before acting on a request.

Right to complain: if you believe we have not handled your data properly, you may lodge a complaint with your local data protection supervisory authority.

9. Children

This website and shop are intended for adults and business customers. We do not knowingly collect personal data from children. In line with the GDPR, visitors under the age of 16 should not consent to optional (non-essential) services themselves — a parent or legal guardian should agree to those services on their behalf. If you believe a child has provided us with personal data without appropriate consent, please contact us and we will delete it.

10. Cookies and similar technologies

We use cookies and similar technologies to operate the website and, with your consent, to provide analytics, embedded media, maps, live chat and product insights. We use Real Cookie Banner to obtain and manage your consent.

10.1 How consent works

• When you first visit, our cookie banner lets you Accept all, continue without consent, or set your preferences individually by category.
• No non-essential cookies are set and no analytics, marketing or tracking data is sent before you consent. Non-essential services are blocked until you opt in.
• Only strictly necessary (essential) technologies run without consent, because the site cannot function without them.
• You can change or withdraw your consent at any time — withdrawing is as easy as giving consent — using the floating “Cookie settings” widget shown on every page (it lets you revoke consent, change your choices, and view your consent history).
• Your consent choice is stored so we can prove consent and respect your preferences.

10.2 Cookie and service categories

We group the services that may set cookies or process data as follows. Only Essential services run automatically; everything else requires your opt-in.

Essential — always active (strictly necessary; no opt-in required)

Service	Provider	Purpose
Real Cookie Banner	Self-hosted (software by devowl.io; your consent choices are stored in our own website database and are not sent to the vendor)	Stores your cookie-consent choices
WooCommerce	Self-hosted (us)	Shopping cart, checkout, session and order functionality
Cloudflare	Cloudflare, Inc.	Content delivery, security, bot and abuse protection

Functional — opt-in

Service	Provider	Purpose
Google Tag Manager	Google LLC	Loads and manages other tags, including Google Analytics 4, after you consent
YouTube	Google LLC	Plays embedded videos. Videos are blocked until you click to load them, so no data goes to YouTube until you choose to watch.
Vimeo	Vimeo, Inc.	Plays embedded videos. Blocked until you click to load them.
Google Maps	Google LLC	Displays interactive maps when you choose to load them

Marketing — opt-in

Service	Provider	Purpose
Microsoft Clarity	Microsoft Corporation	Aggregated product and usage insights (such as interaction analytics) to help us improve the site
Tawk.to	Tawk.to Inc.	Provides live-chat support

Analytics note: Google Analytics 4 is delivered through the Google Tag Manager container above rather than as a separate category; it loads only after you consent to the Functional category.

Our fonts are self-hosted, so no font data is sent to Google Fonts, Adobe Fonts or other third parties.

10.3 Managing cookies in your browser

In addition to our cookie settings, you can control or delete cookies through your browser settings. Blocking essential cookies may stop parts of the site (such as the cart or checkout) from working.

11. How we protect your data

We use appropriate technical and organisational measures to protect your personal data, including encryption in transit (HTTPS), access controls, and a security and content-delivery layer (Cloudflare). No method of transmission or storage is completely secure, but we work to protect your data and to notify you and the relevant authority of any breach where legally required.

12. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you or ask for renewed consent.

13. Contact

For any privacy question or to exercise your rights, contact us at:

• Email: support@barobjects.com
• Postal address: 3069 McCall Drive, Suite 7, Atlanta, GA 30340, United States