Privacy Policy
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) and other applicable data protection provisions is:
BAR Ventures e.K.
Sülzgürtel 6
50937 Cologne
Germany
Proprietor: Jan Barenbrock
Email: hello@bar-ventures.de
2. General Information on Data Processing
We take the protection of your personal data seriously. Personal data means any information relating to an identified or identifiable natural person.
We process personal data only insofar as this is necessary to provide our online services, conduct our business processes and contractual relationships, communicate with customers and interested parties, process orders and payments, ensure technical security and – where you have given your consent – for analytics and marketing purposes.
Depending on how you use our online services, the following categories of personal data may in particular be processed:
Inventory and master data, in particular name and address,
Contact details, in particular email address and telephone number,
Contractual and order data,
Delivery and billing data,
Payment and transaction data,
Content data, in particular messages and information submitted via contact forms,
Usage data, in particular pages accessed, access times and interactions,
Device and browser information,
IP addresses and other technical log data,
Cookie and comparable identification data.
Data subjects include in particular visitors to our online services, customers, interested parties, business partners and other persons who communicate with us.
3. Legal Bases for Processing
We process personal data on the basis of the applicable statutory provisions.
Consent – Art. 6(1)(a) GDPR
Where you have given us consent to process personal data, the processing is carried out on the basis of that consent.
Consent that has been granted may be withdrawn at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.
Contract and Pre-Contractual Measures – Art. 6(1)(b) GDPR
Where processing is necessary for the performance of a contract with you or in order to take steps at your request prior to entering into a contract, processing is carried out on the basis of Art. 6(1)(b) GDPR.
This applies in particular to orders, payment processing, delivery, customer service and the handling of contract-related enquiries.
Legal Obligations – Art. 6(1)(c) GDPR
Where we are legally required to process personal data, processing is carried out on the basis of Art. 6(1)(c) GDPR.
This includes, in particular, obligations under commercial, tax, accounting and regulatory law.
Legitimate Interests – Art. 6(1)(f) GDPR
Processing may also be carried out where it is necessary for the purposes of our legitimate interests or those of a third party and where such interests are not overridden by the interests, fundamental rights or freedoms of the data subject.
Our legitimate interests include in particular:
The secure and economically efficient operation of our online services,
IT and information security,
The prevention of misuse and fraud,
The optimisation of internal business processes,
The handling of general business enquiries,
The establishment, exercise and defence of legal claims.
4. Access to End Devices, Cookies and Comparable Technologies
The requirements of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG) additionally apply to the storage of information on your end device or access to information already stored on your end device.
Where cookies or comparable technologies are strictly necessary to provide a digital service expressly requested by you, they may be used without consent in accordance with Section 25(2) TDDDG.
Where cookies or comparable technologies are used in particular for analytics, tracking, marketing or personalisation purposes, information is generally stored or accessed only after you have given your consent pursuant to Section 25(1) TDDDG. Where personal data is processed in this context, further processing is generally based on Art. 6(1)(a) GDPR.
5. Technical and Organisational Security Measures
Taking into account the state of the art, the costs of implementation, as well as the nature, scope, circumstances and purposes of processing, we implement appropriate technical and organisational measures to protect personal data.
These include in particular measures to protect the confidentiality, integrity and availability of data and to protect against loss, manipulation, unauthorised access and unauthorised disclosure.
Our online services are generally provided using TLS/SSL encryption via HTTPS. This ensures that information transmitted between your browser and our website is encrypted.
6. Recipients and Disclosure of Personal Data
As part of our business activities, it may be necessary to transmit personal data to other companies, service providers or other recipients.
These may include in particular:
Hosting and IT service providers,
Payment service providers and financial institutions,
Shipping, transport and logistics companies,
Communication and support service providers,
Analytics and marketing service providers, where corresponding consent has been given,
Tax advisers, accounting service providers and other professional advisers,
Authorities and public bodies where there is a legal obligation to disclose data.
Service providers that process personal data exclusively on our behalf are contractually bound in accordance with statutory requirements, in particular through data processing agreements pursuant to Art. 28 GDPR.
Personal data is disclosed only where there is a legal basis for doing so.
7. International Data Transfers
When using certain service providers, personal data may be processed outside the European Union or the European Economic Area.
Such transfers take place only in compliance with the legal requirements of Art. 44 et seq. GDPR.
Where the European Commission has adopted an adequacy decision for the relevant third country, the transfer may be based on that decision.
For transfers to companies in the United States, the EU-US Data Privacy Framework may in particular serve as a legal basis, provided that the relevant US company is appropriately certified.
Where no adequacy decision applies, the standard contractual clauses approved by the European Commission or other legally recognised safeguards may in particular be used.
Where relevant, we provide additional information below concerning possible processing in third countries in connection with the services described.
8. Storage and Deletion of Personal Data
We generally store personal data only for as long as necessary to fulfil the respective purpose of processing or for as long as statutory retention obligations apply.
If the purpose of processing no longer applies and there is no other legal basis for storage, the data will be deleted or anonymised.
Statutory retention periods may in particular amount to:
Ten years for certain books, records, annual financial statements, inventories and other documents relevant under tax or commercial law,
Eight years for accounting records and invoice documents,
Six years for certain commercial and business correspondence and other business documents relevant for tax purposes.
In addition, data may be stored for the establishment, exercise or defence of legal claims until the expiry of the applicable statutory limitation periods. The regular civil-law limitation period is generally three years and normally begins at the end of the year in which the claim arose and the statutory requirements were met.
Where data is processed exclusively on the basis of consent, it will generally be deleted once the consent has been withdrawn and there is no other legal basis for further storage.
9. Rights of Data Subjects
Subject to the applicable statutory requirements, you have in particular the following rights:
Right of Access
You may request information as to whether and which personal data we process about you.
Right to Rectification
You may request the correction of inaccurate personal data and the completion of incomplete personal data.
Right to Erasure
Subject to the statutory requirements, you may request the deletion of your personal data.
Right to Restriction of Processing
Subject to the statutory requirements, you may request that the processing of your personal data be restricted.
Right to Data Portability
Where the statutory requirements are met, you may receive personal data that you have provided to us in a structured, commonly used and machine-readable format or request that such data be transmitted to another controller.
Withdrawal of Consent
You may withdraw any consent you have given at any time with effect for the future.
Right to Object
Where personal data is processed on the basis of Art. 6(1)(e) or (f) GDPR, you have the right, on grounds relating to your particular situation, to object to such processing at any time.
Where personal data is processed for direct marketing purposes, you may object to such processing at any time. This also applies to profiling insofar as it is related to such direct marketing.
Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority concerning the processing of your personal data.
You may in particular contact the data protection supervisory authority responsible for our registered office or any other supervisory authority competent pursuant to Art. 77 GDPR.
10. Provision of Our Online Services and Web Hosting
In order to provide our website, technically necessary data is processed. This includes in particular the IP address, as the content of the website could not be transmitted to your browser without processing it.
The following data may in particular be processed:
IP address,
Date and time of access,
Pages and files accessed,
Amount of data transferred,
Browser type and browser version,
Operating system,
Referrer URL,
Hostname or requesting provider,
Technical error and security information.
Processing is carried out in particular to provide and maintain the stability of our online services, to analyse errors and to ensure IT security.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing secure, stable and functional online services.
Hosting by IONOS
For hosting, domain and, where applicable, related technical services, we use IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany.
As part of providing the hosting services, IONOS processes in particular technical access and server data.
Where IONOS processes personal data on our behalf, this is done on the basis of a data processing agreement.
Server log files are generally stored only for the period required for technical and security purposes. Unless longer storage is necessary to investigate security-related incidents, log data is regularly deleted or anonymised within a limited period.
11. Consent Management and Cookie Settings
We use a solution for managing your privacy and cookie settings.
In particular, information is stored about whether and for which categories or services you have granted or refused consent.
The processing serves to:
Technically implement your selection,
Avoid requesting your choice again each time you access a page,
Document consent that has been granted,
Allow you to withdraw consent or change your selection at a later date.
In this context, a pseudonymous identifier, the time and scope of your decision and technical information about your browser and end device may in particular be processed.
Where information is stored on or read from your end device for this purpose, this is carried out, where technically necessary, pursuant to Section 25(2) TDDDG. The processing of personal data is carried out in particular on the basis of Art. 6(1)(c) GDPR and Art. 6(1)(f) GDPR.
Consent for non-essential services is granted only after you have made the corresponding selection.
You may change your cookie and privacy preferences at any time via the privacy or cookie settings provided on our website.
12. Contact and Contact Form
If you contact us by email, telephone, contact form or by other means, we process the data you provide in order to handle your enquiry.
The following data may in particular be processed:
Name,
Email address,
Telephone number,
Subject,
Order number, where provided,
Content of your message,
Time and technical metadata of the communication.
Where your enquiry relates to entering into or performing a contract, processing is carried out on the basis of Art. 6(1)(b) GDPR.
For other business enquiries, processing is carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the proper handling and documentation of enquiries and communications.
Statutory retention obligations for business correspondence remain unaffected.
13. Orders and Contract Processing
When you place an order through our online shop, we process personal data necessary to process and fulfil the order.
This may in particular include:
First and last name,
Billing address,
Delivery address,
Email address,
Telephone number, where necessary or voluntarily provided,
Products and quantities ordered,
Order value,
Time of order,
Payment method,
Payment status,
Shipping and delivery information,
Information concerning returns, complaints and refunds,
Business communications relating to the order.
Processing is carried out for the performance of the contract, including order processing, payment processing, delivery, customer service and, where applicable, reversals and warranty claims.
The legal basis is Art. 6(1)(b) GDPR.
Where data must be retained due to commercial or tax-law requirements, further storage is carried out on the basis of Art. 6(1)(c) GDPR.
14. Shipping and Delivery
For the purpose of carrying out delivery, the personal data necessary for this purpose may be transmitted to the shipping, transport or logistics company commissioned with the delivery.
This includes in particular:
Recipient’s name,
Delivery address,
Telephone number or email address where required for the specific delivery,
Information about the shipment.
The data is transmitted on the basis of Art. 6(1)(b) GDPR insofar as this is necessary for the performance of the contract.
Any further transmission of contact information, for example for additional shipping notifications from a service provider, will take place only where there is an appropriate legal basis.
15. Payment Processing
For the processing of payments, we process payment and transaction data and transmit the information required for this purpose to the payment service provider selected by you.
Payment service providers may process personal data partly under their own responsibility under data protection law. The respective payment service provider’s privacy policy therefore also applies.
Bank Transfer
When paying by bank transfer, the data necessary for payment processing is processed by the participating financial institutions.
We process in particular the incoming payment, account holder, amount, payment reference and the transaction information required to allocate the payment.
The legal basis is Art. 6(1)(b) GDPR and, with regard to statutory accounting and documentation obligations, Art. 6(1)(c) GDPR.
PayPal
If you select PayPal as your payment method, data necessary to process the payment will be transmitted to PayPal.
For users in Germany, the provider is generally:
PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg
The data processed may in particular include your name, address, email address, payment amount, order information, account information, device information and other information required for payment processing, fraud prevention and risk assessment.
The transfer by us is carried out for the purpose of processing the payment method selected by you on the basis of Art. 6(1)(b) GDPR.
PayPal may process personal data under its own responsibility in connection with its own legal obligations and for fraud, risk and anti-money laundering prevention.
Stripe
We use Stripe for certain payment methods.
For European business customers or payment processing, companies of the Stripe Group based in Ireland may in particular be involved, including Stripe Payments Europe, Limited and Stripe Technology Europe, Limited.
The following data may in particular be processed in connection with a payment:
Name,
Billing address,
Email address,
Payment amount,
Payment method,
Card or payment information,
IP address,
Device information,
Transaction information,
Information relating to fraud and risk assessment.
For card payments, we generally do not receive all complete payment details, but rather the information required to confirm and allocate the payment.
The transfer is carried out for the purpose of executing the payment order on the basis of Art. 6(1)(b) GDPR.
Stripe may additionally process certain data under its own responsibility under data protection law, in particular for fraud prevention, risk assessment, compliance with regulatory obligations and the security of its payment services.
Where data is processed outside the EU or EEA in this context, the requirements described in the section “International Data Transfers” apply.
16. Web Analytics
We may use services to analyse the use of our online services. This enables us in particular to determine which pages and content are used, how visitors reach our online services and how our online services can be improved technically and in terms of content.
Analytics and tracking services that are not necessary for the operation of the online services and that access or store information on the user’s end device are activated only after consent has been given.
The legal bases are Section 25(1) TDDDG for accessing or storing information on the end device and Art. 6(1)(a) GDPR for the subsequent processing of personal data.
17. Google Analytics
We use Google Analytics to analyse the use of our online services.
The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Further companies of the Google group may be involved in providing the services.
Google Analytics may in particular process information relating to:
Pages and content visited,
Time and duration of page views,
Source of the visitor,
Approximate geographical information,
Device and browser information,
Interactions with our online services,
Pseudonymous identifiers,
Technical network and connection information.
Google Analytics is activated only if you have previously given your consent via our consent management solution.
The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR.
You may withdraw your consent at any time via our privacy or cookie settings.
When using Google services, processing by companies of the Google group outside the EEA may take place. Where required, such transfers are carried out in accordance with the statutory provisions governing international data transfers.
18. Google Ads and Conversion Tracking
We may use Google Ads to advertise our offers through Google’s advertising services and to measure the success of our advertising activities.
In particular, it may be determined whether a user performed certain actions on our website after viewing or clicking on an advertisement, such as making a purchase or carrying out another defined conversion.
In this context, technical device and browser data, cookie or comparable identifiers, content visited and information concerning interactions and conversions may in particular be processed.
The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Ads and conversion tracking are activated only after you have given your consent insofar as information is stored on or read from your end device or personal data is processed for marketing purposes.
The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR.
You may withdraw your consent at any time via the privacy or cookie settings on our website.
19. LinkedIn Insight Tag
Where used, we use the LinkedIn Insight Tag to measure the success of our LinkedIn advertising campaigns, analyse website visits and create target audiences.
The provider is:
LinkedIn Ireland Unlimited Company
Wilton Plaza
Wilton Place
Dublin 2
Ireland
The data processed may in particular include information concerning the website visited, time of visit, URL, referrer URL, IP address, device and browser information and pseudonymous identifiers.
If a user is logged in to LinkedIn, LinkedIn may, where applicable, associate the information collected with the user’s LinkedIn account.
The service is activated only after prior consent has been given.
The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR.
Consent may be withdrawn at any time via our privacy or cookie settings.
20. Social Media Presences
We may maintain company profiles on social networks, in particular Instagram, Facebook, LinkedIn and XING.
When you visit our profiles, the operators of the respective platforms may process personal data. This may in particular include usage data, device data, contact and profile data as well as information about your interactions.
Platform operators may create usage profiles and use information for purposes including analytics, market research and advertising.
Where we ourselves process personal data in connection with our social media presences, this is carried out in particular to communicate with users, respond to enquiries and present our company.
The legal basis for this is generally Art. 6(1)(f) GDPR. Our legitimate interest lies in public relations and communication.
Where the platform operators carry out their own data processing, their respective privacy policies additionally apply.
Facebook and Instagram
For users in the EEA, the provider is generally Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
When operating Facebook Pages and certain statistical analyses, in particular so-called Page Insights, Meta and we may, to the extent provided by law, be jointly responsible for certain processing operations.
Any further processing by Meta is generally carried out under Meta’s own responsibility.
The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
For certain statistical functions of LinkedIn company pages, joint responsibility may exist for the collection and transmission of certain data.
Further processing by LinkedIn is generally carried out under LinkedIn’s own responsibility.
The provider is New Work SE, Am Strandkai 1, 20457 Hamburg, Germany.
Processing by XING is additionally governed by the privacy provisions of New Work SE.
21. Embedded Content and External Services
We may integrate content or functions from external providers into our online services, for example maps or videos.
For the technical provision of such content, at least the transmission of the IP address to the relevant provider is generally required. Device information, usage data, cookies or comparable identifiers may additionally be processed.
Where such integration is not strictly necessary for the use of our online services, such services will be loaded only after you have given your consent.
The legal bases in these cases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR.
22. Google Maps
Where we use Google Maps, this is for the purpose of displaying maps and geographical information.
For Google Maps Platform, Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland, may in particular be the contractual partner for customers in the EEA. Further companies of the Google group may be involved in the processing.
When using Google Maps, the IP address, device information and – depending on the settings of your end device and your consent – location information may in particular be processed.
Google Maps is loaded on our website only after prior consent has been given insofar as the specific technical integration requires such consent.
The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR.
23. YouTube
We may embed videos from the YouTube platform in our online services.
For users in the EEA, the provider is generally Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
When an embedded video is loaded, the IP address, device and browser information, usage data and cookie or identification data may in particular be transmitted to Google or YouTube.
Where YouTube is not strictly necessary for the operation of our online services, a connection to YouTube is established only after you have given your consent.
The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR.
24. Obligation to Provide Data
The provision of personal data is generally neither legally nor contractually required unless otherwise stated in this Privacy Policy.
However, in order to enter into and perform a contract or place an order, you must provide us with the personal data necessary for entering into the contract, processing the payment and carrying out delivery.
Without this data, we may not be able to process an order or perform the relevant contract.
25. Automated Decision-Making
As a general rule, we do not use decision-making based solely on automated processing that produces legal effects concerning you or similarly significantly affects you.
Payment service providers used by us may carry out automated security, fraud or risk assessments under their own responsibility. The privacy information of the respective payment service provider applies additionally in this regard.
26. Changes to this Privacy Policy
We may amend this Privacy Policy if statutory requirements, our online services or the services and data processing activities used by us change.
The version currently published on our website shall apply.
Where an amendment requires renewed consent or any other action on your part, we will take the necessary measures.
Last updated: 9 September 2026