1. Who we are
NoBarz operates the NoBarz website and hosted business-management platform. For information used to register accounts, administer the service, respond to enquiries, enforce plan allowances and protect the platform, NoBarz is the data controller.
Privacy questions can be sent to hello@nobarz.co.uk.
2. Information we collect
Depending on how you use NoBarz, we may collect:
- account details, including your name, business name, email address, password hash, role and acceptance of our terms;
- business profile, plan, usage, invoice-branding and subscription-administration information;
- customer, contact, appointment, service, order, invoice, payment, custom-field and file information entered into a workspace;
- contact-form, support and plan-enquiry messages;
- technical and security information, such as login activity, IP address, browser information, timestamps and audit records; and
- information required to investigate faults, prevent misuse and maintain the service.
Please do not enter personal information that your business does not need, or special-category information unless you have a lawful reason and appropriate safeguards for doing so.
3. Workspace data and our role
A business using NoBarz normally decides what customer and operational information is entered into its workspace and why it is used. For that information, the business is normally the controller and NoBarz acts as its processor, handling the information to provide and secure the service. Workspace administrators are responsible for their own privacy notices, lawful bases, retention decisions and responses to people whose information they hold.
We do not routinely use one business's customer records for another business, and tenant controls are designed to keep workspaces separate.
4. How and why we use information
| Purpose | Usual lawful basis |
|---|---|
| Create and administer accounts, provide platform functions, apply plan limits and support users. | Performance of our contract and steps requested before entering a contract. |
| Operate, troubleshoot, improve and secure NoBarz; prevent fraud, abuse and unauthorised access. | Our legitimate interests in running a reliable and secure service. |
| Respond to contact, support, migration and plan enquiries. | Contractual steps or our legitimate interests in responding to enquiries. |
| Maintain accounting, legal, audit and compliance records. | Legal obligation and legitimate interests. |
| Use information for another optional purpose clearly presented to you. | Consent where consent is the appropriate basis. |
Where we rely on legitimate interests, we consider whether the use is necessary and proportionate and whether your rights override those interests.
5. Cookies and session information
NoBarz uses essential session and security information needed to keep users signed in, protect forms and operate the service. We do not use that essential information for third-party advertising. If optional analytics or marketing cookies are introduced, this notice and the site's cookie controls will be updated before they are used.
6. Who we share information with
We may share information only where reasonably necessary with:
- hosting, database, infrastructure, backup and security suppliers that help us operate NoBarz;
- professional advisers, insurers, auditors and contractors who are subject to appropriate confidentiality obligations;
- payment or billing providers if a paid service is arranged;
- public authorities, regulators, courts or law-enforcement bodies where disclosure is required or legally justified; and
- a buyer, investor or successor as part of a genuine business reorganisation, subject to appropriate safeguards.
We do not sell personal information. Suppliers acting as processors are required to handle information only for agreed purposes and with appropriate safeguards.
7. International transfers
We aim to use UK-based or appropriately protected services. If information is transferred outside the United Kingdom, we will use a lawful transfer mechanism and appropriate safeguards where required, such as adequacy regulations or approved contractual protections.
8. How long we keep information
We keep information only for as long as it is reasonably needed for the purpose for which it was collected. Relevant factors include whether an account remains active, the workspace administrator's deletion choices, contractual and legal obligations, security requirements, dispute periods and the need to maintain reliable backups. Backup copies may remain for a limited cycle before being overwritten.
Unless a longer period is required to investigate misuse, resolve a dispute or comply with law, workspace audit events are normally retained for up to 730 days and authentication logs, including attempted sign-ins and IP addresses, for up to 365 days. These periods may be reduced as the service develops. Some audit entries can retain a final snapshot of a directly deleted item so that authorised administrators can establish what was removed, by whom and when. When a workspace administrator permanently deletes a customer record, NoBarz removes that customer and its linked operational history and retains only a minimal deletion event, such as the internal record identifier, acting user, time and counts of linked items removed; the deleted customer's contact and address fields are not retained in that deletion event.
Workspace administrators can delete many records within the service. A business that closes its account may contact us to arrange an export and deletion of its remaining workspace information, subject to information we must retain by law or for the establishment, exercise or defence of legal claims.
9. Security
We use technical and organisational measures intended to protect information, including authenticated access, role controls, tenant-scoped database queries, password hashing, protected file delivery, audit records and form-security controls. No internet service can guarantee absolute security, so users must also protect their passwords, devices and authorised-user access.
10. Your rights
Depending on the circumstances, UK data-protection law may give you rights to request access, correction, erasure, restriction, portability or objection, and to withdraw consent where processing is based on consent. Some rights are subject to legal conditions and exemptions.
For information held in a business workspace, contact that business first because it normally controls the information. We will assist business customers with appropriate requests concerning information we process for them. For information controlled directly by NoBarz, contact hello@nobarz.co.uk. We may need to verify your identity.
You may also complain to the UK Information Commissioner's Office. We would appreciate the opportunity to address your concern first.
11. Automated decisions and children
NoBarz does not make decisions about people based solely on automated processing that produce legal or similarly significant effects. The service is intended for business users aged 18 or over and is not directed at children.
12. Changes to this notice
We may update this notice when the service, our suppliers or the law changes. The current version and update date will remain available on this page. Material changes affecting registered users may also be highlighted within the service.