What this covers
This notice covers the current Bar Bear website, waitlist, website analytics and privacy correspondence. It does not cover future app accounts, workouts, payments or coaching features.
Bar Bear does not sell personal data or share it for third-party advertising.
Data, purposes and legal bases
Website delivery and security
Cloudflare processes request data such as IP address, requested page, time, and browser or network information to deliver and secure the website. The legal basis, where applicable, is Bar Bear's legitimate interest in reliable delivery and security.
Waitlist and confirmation
Your browser submits the waitlist form directly to EmailOctopus. Bar Bear and EmailOctopus process your email address, consent choice, signup source, confirmation and subscription status, and related timestamps. EmailOctopus uses this information to protect and operate the form, send the confirmation email, maintain the waitlist, record your choices, and later send Bar Bear launch, product, and direct-marketing emails after confirmation. EmailOctopus uses Google reCAPTCHA to protect the form from abuse; Google may process request and connection information such as IP address, browser information and submission time. Pending address verification and form security rely on legitimate interests. Marketing relies on your consent after confirmation.
First-party Umami analytics
Bar Bear loads a first-party copy of the Umami tracker from its own domain and sends analytics to its self-hosted service at analytics.thoren.xyz. The data may include the website identifier, hostname, page title and path, referrer, browser language, screen size, event identifier, IP address and user agent, plus derived browser, operating system, device and approximate location. Query and search parameters are excluded. Waitlist form values and email addresses are not sent to Umami. The purpose is to understand and improve use of the public website. The legal basis is Bar Bear's legitimate interest in privacy-focused analytics.
Privacy correspondence
Bar Bear processes your email address, message and any information you provide to answer and document privacy requests. The legal basis is legitimate interests and, where applicable, legal obligations.
Confirmation and marketing
EmailOctopus sends the double opt-in confirmation email. Until you use its confirmation link, your address remains pending and Bar Bear does not use it for marketing.
Campaign delivery is not currently active. Confirmation records consent for future Bar Bear launch, product and direct-marketing emails sent through EmailOctopus. When those emails begin, each will provide an easy unsubscribe route. You may unsubscribe, withdraw consent or object to direct marketing at any time by using that route or emailing privacy@barbear.fit.
Recipients and international processing
- Cloudflare serves and secures the website and processes request and connection data on its global network.
- EmailOctopus stores waitlist and consent information, sends the double opt-in confirmation, and will deliver future Bar Bear marketing campaigns. EmailOctopus is operated by Three Hearts Digital Ltd in the UK. Contact lists are stored on AWS in Ireland; its email service providers and other subprocessors may process data in other countries under applicable transfer safeguards.
- Google reCAPTCHA protects the EmailOctopus form from abuse and may process request and browser information on Google's global infrastructure.
- Umami and Neon process and store website analytics. The analytics database is in Frankfurt, Germany.
- Apple iCloud hosts the privacy mailbox and may process correspondence internationally.
Johan Thorén and these providers may process data outside your country under applicable transfer arrangements.
If Bar Bear is incorporated, reorganized, merged, sold or otherwise transferred, the data and responsibility for it may pass to the company or successor operating Bar Bear. The successor must handle it under this notice and applicable law. The notice will identify the new controller, contact details and effective date, and any additional notice required by law will be provided.
Retention and deletion
- Pending, confirmed and unsubscribed waitlist records are retained in EmailOctopus until Bar Bear deletes them or you request deletion. An unsubscribe record may be retained as needed to honour that choice.
- Live Umami analytics has no fixed automatic deletion period. Nightly backups retain the seven latest sets.
- Privacy correspondence is kept as needed to answer and document requests and meet applicable obligations. Providers keep service and security logs under their own retention rules.
After a valid request, Bar Bear deletes data it controls unless it must be kept for an applicable legal or security reason.
Your rights and complaints
Depending on the law and processing that apply, you may request access, correction, deletion, restriction or portability; object to processing; and withdraw consent without affecting earlier processing. Email privacy@barbear.fit. Bar Bear may ask for information needed to verify that the request concerns you.
You may complain to a supervisory authority that covers you, including an EU data protection authority or the UK Information Commissioner's Office.