Privacy policy

1. Controller and scope

The controller is BARIÉN — Bülent Saritürk, Blockwinkel 108, 27251 Scholen, Germany. E-mail: info@barien.com. Telephone: +49 4245 9190924.

This Privacy Policy applies to the BARIÉN website, online store, customer accounts, purchases, Client Services, Correspondence from BARIÉN, THE BARIÉN CIRCLE and related digital functions.

2. Website operation, security and server data

When the website is accessed, technical information may be processed to deliver content, maintain security, prevent misuse and diagnose errors. This may include IP address, device and browser information, date and time, requested resources, referring page and security events.

The legal basis is BARIÉN’s legitimate interest in secure and reliable website operation and, where required, compliance with legal obligations. Routine technical logs are retained only for the configured security period and longer only where an incident requires investigation.

3. Shopify store and customer accounts

BARIÉN uses Shopify to provide the storefront, customer-account environment, bag, checkout and order administration. Data processed may include account, contact, delivery, billing, order, transaction-status, device and usage information.

Processing is based on pre-contractual steps, contract performance, legal obligations and legitimate interests in operating and securing the store. Shopify and its authorised service providers may process data in countries outside the EEA or United Kingdom under the transfer safeguards applicable to the relevant service.

4. Orders, payment and fraud prevention

BARIÉN processes the information required to accept, administer, fulfil and document orders. Payment data is transmitted to the payment service selected at checkout. BARIÉN generally receives transaction references and status information rather than complete payment credentials.

At launch, credit and debit card payments with Visa, Mastercard and American Express, Klarna including invoice purchase, Pay Now/immediate payment and instalment payment, Apple Pay, Google Pay, Shop Pay, PayPal and bank transfer are intended to be available. The availability of individual payment methods may depend on the delivery country, currency, device and the customer’s eligibility. Depending on the delivery country, additional country-specific payment methods offered through Shopify Payments (such as Bancontact, BLIK, eps, MB WAY, MobilePay or Bizum) may be available.

Payment data is processed by the selected payment service and, where applicable, the payment infrastructure used by Shopify. For bank transfers, the information required to identify and allocate the payment is processed. Payment and fraud-prevention checks may be performed where necessary.

5. Fulfilment, delivery and returns

Information necessary for fulfilment, delivery and returns is shared with the appointed fulfilment and logistics providers. Versandmanufaktur GmbH acts as the operational fulfilment and returns provider to the extent engaged for the relevant order. Carriers may include DHL, GLS and UPS according to destination and the method selected.

The legal bases are contract performance, legal obligations and legitimate interests in reliable fulfilment and handling of service cases.

6. Gifts and information concerning another person

Where a customer provides a recipient name, delivery address or personal message, BARIÉN processes this information solely to prepare and deliver the selected presentation. The customer should provide only information necessary for that purpose and ensure that it may lawfully be supplied.

Where required, BARIÉN provides the recipient with the information applicable to data obtained from another person, taking account of statutory exceptions and the need to preserve the intended gift presentation.

7. Client Services and correspondence

When you contact BARIÉN, the information contained in the enquiry is processed to respond, administer the relevant relationship and document the communication. The legal basis is pre-contractual steps, contract performance or BARIÉN’s legitimate interest in handling correspondence. Legal obligations may also apply.

8. Correspondence from BARIÉN

Where you subscribe to Correspondence from BARIÉN, your e-mail address, subscription status and consent evidence are processed on the basis of consent. A Double Opt-In procedure is used. Consent may be withdrawn at any time with effect for the future, including through the unsubscribe route in each marketing message.

Correspondence from BARIÉN is sent through Shopify Email. Open and click measurement is not activated.

9. THE BARIÉN CIRCLE

For Circle consideration and membership, BARIÉN may process applicant and member identity and contact information, the assigned Circle relation and Circle Year, proposal and acceptance records, activation and term dates, payment and entitlement status, eligible acquisitions, correspondence and service history.

Processing is based on pre-contractual steps, contract performance, legal obligations and legitimate interests in administering admission capacity, member entitlements and the private Circle environment. A rejected consideration request is retained only for the defined review and claims period and is then deleted or anonymised unless another legal basis applies.

10. Création Privée and Private Archive

For HEREDITAS services, BARIÉN may process olfactory preferences, consultation notes, sample and selection history, production references, archive records and related correspondence. Information not necessary for the olfactory service is not requested. Health or allergy information is not collected as a routine part of the service and requires separate legal assessment if exceptionally necessary.

Private Archive information is retained for the period defined by the relevant Circle relationship and archive arrangement, and thereafter only where necessary for legal claims, agreed continuity or statutory obligations.

11. Legacy Nomination

Where a HEREDITAS member nominates another person for future consideration, BARIÉN processes the nominee’s limited identification and contact information only for that purpose. A nomination creates no admission right. The nominee receives the required privacy information at the legally required time unless an exception applies.

12. Necessary technologies and consent management

Strictly necessary technologies are used to operate the website, store, account, checkout, security, language, market and consent functions. Where access to or storage of information on a device is strictly necessary, the applicable statutory exception is relied upon.

Analytics, advertising, personalisation and comparable non-essential technologies are not activated before the legally required consent. Consent choices are granular, recorded and withdrawable at any time through the Cookie Settings route.

Language selection

We use country information provided by Shopify to suggest a suitable language version of our website. Shopify may determine the likely country of access from your IP address for this purpose. This may differ from your actual location, for example when you use a VPN.

A suggested language change takes place only after you actively select it. We store your explicitly selected language on your device for 30 days so that your preference can be respected on subsequent visits. You can change your selection at any time using the language selector.

Further information about Shopify’s data processing is provided in Section 3 of this Privacy Policy.

13. Google Analytics 4, Google Tag Manager and Google Ads

Subject to the required consent, BARIÉN uses Google Analytics 4 to measure and analyse website use. At launch, the integration is implemented through the Google & YouTube app.

BARIÉN also intends to use Google Tag Manager for the central management of approved analytics and marketing tags. Until it is technically activated, no processing takes place through Google Tag Manager. Following activation, any non-essential tags managed through Google Tag Manager will be triggered only in accordance with the consent provided through the consent management platform.

Google Ads is used at launch to display advertisements and measure their effectiveness. This may include measuring conversions following an advertisement impression or click. Advertising-related cookies, identifiers and other data used for personalised advertising are processed only where the required consent has been provided.

Consent is managed through Consentik. Non-essential analytics and marketing tags remain blocked until consent has been provided. Google Signals, remarketing, advertising personalisation, Enhanced Conversions, Customer Match or comparable features will be used only if they are actually activated, reflected in the Consentik configuration and documented in this Privacy Policy.

14. Recipients and processors

Personal data may be disclosed where necessary to providers in the categories e-commerce and hosting, payment processing, fulfilment and logistics, communications, consent management, analytics and advertising, IT and security, professional advisers and public authorities. BARIÉN enters into data-processing arrangements where legally required.

15. International transfers

Where data is transferred outside the EEA or United Kingdom, BARIÉN uses the mechanism applicable to the provider and destination, such as an adequacy decision, recognised certification framework, standard contractual clauses, the UK International Data Transfer Agreement or UK Addendum, together with supplementary safeguards where required.

16. Retention

BARIÉN applies a documented retention schedule. Data is retained only for the relevant purpose, statutory commercial and tax periods, the establishment or defence of legal claims and evidence of consent. Contract, invoice and accounting records are generally retained for the applicable statutory period, usually six to ten years depending on record type. Consent evidence may be retained for the applicable limitation period after withdrawal. Technical, analytics, application, account and correspondence data is deleted or anonymised according to the configured service-specific period.

17. Legal bases and legitimate interests

Depending on the activity, processing is based on consent, steps requested before entering a contract, contract performance, compliance with legal obligations and legitimate interests. Legitimate interests may include secure operation, fraud prevention, service quality, enforcement and defence of legal rights and appropriate relationship management. Where consent is required, legitimate interests are not used to bypass that requirement.

18. Your rights

Subject to the statutory conditions, you may request access, rectification, erasure, restriction and data portability and may object to processing. Where processing is based on consent, you may withdraw it at any time with effect for the future.

Right to object: where processing is based on legitimate interests, you may object on grounds relating to your particular situation. You may object to direct marketing at any time without giving reasons.

19. Complaints

You may lodge a complaint with a competent supervisory authority. For BARIÉN in Germany, the competent authority is the State Commissioner for Data Protection of Lower Saxony (Die Landesbeauftragte für den Datenschutz Niedersachsen). Individuals in the United Kingdom may also contact the Information Commissioner’s Office where the UK GDPR applies.

20. Required information and automated decisions

Information marked as required in account, order, payment or Circle processes is necessary to administer the requested relationship. Without it, BARIÉN may be unable to process the request or perform the contract. BARIÉN does not use solely automated decisions producing legal or similarly significant effects unless this is separately disclosed and legally supported.

21. Privacy requests and updates

Privacy requests may be submitted to info@barien.com. BARIÉN may request information reasonably necessary to verify identity and protect personal data. This Privacy Policy is updated before any materially new service or processing activity is activated.