Privacy Policy

barelyburn.com · Titanium Cookware · Confidential
Barely TITANIUM COOKWARE Burn
Privacy & Data Protection Policy
Including GDPR · CCPA · PIPEDA · PDPA Compliance
Effective Date: August 22, 2026
BarelyBurn Privacy & Data Policy
© 2026 BarelyBurn Titanium Cookware · barelyburn.com
Table of Contents

1. Who We Are
2. Information We Collect
3. How We Use Your Information
4. Legal Basis for Processing (GDPR)
5. Data Sharing & Third Parties
6. International Data Transfers
7. Data Retention
8. Your Rights
9. GDPR — European Users
10. CCPA — California Users
11. PIPEDA — Canadian Users
12. PDPA — Thai & Singapore Users
13. Cookies & Tracking
14. Children’s Privacy
15. Data Security
16. Changes to This Policy
17. Contact & Data Controller
    BarelyBurn Privacy & Data Policy
    © 2026 BarelyBurn Titanium Cookware · barelyburn.com
18. Who We Are
    BarelyBurn (BarelyBurn, we, us, or our) is a direct-to-consumer titanium cookware brand headquartered in
    Austin, Texas, USA, operating through barelyburn.com and associated digital channels.
    We are committed to protecting your personal information and your right to privacy. This Privacy and Data
    Protection Policy (“Policy”) explains how we collect, use, store, share, and protect your data when you visit our
    website, purchase our products, or interact with us in any way.
    If you have any questions or concerns about this Policy or our data practices, please contact us at the details
    provided in Section 17.
19. Information We Collect
    2.1 Information You Provide Directly

• Identity data: full name, username or similar identifier
• Contact data: billing address, delivery address, email address, telephone number
• Financial data: payment card details (processed securely via third-party payment processors; we do not
  store full card numbers)
• Transaction data: details about purchases, returns, and order history
• Profile data: account login credentials, purchase history, preferences, and reviews
• Communications data: messages, emails, live chat transcripts, and support tickets you send us
• Marketing preferences: your opt-in or opt-out choices for marketing communications
  2.2 Information Collected Automatically
• Technical data: IP address, browser type and version, device type, operating system, time zone, and location
• Usage data: pages visited, products viewed, time spent on pages, click paths, and referral sources
• Cookie data: session cookies, persistent cookies, and tracking pixels (see Section 13)
  2.3 Information From Third Parties
• Analytics providers: Google Analytics, Meta Pixel, and similar services
• Payment processors: Stripe, PayPal, or similar providers may share transaction confirmation data
• Social media platforms: if you interact with our social media pages or log in via social accounts
• Advertising partners: interest and demographic data to serve relevant ads

1. How We Use Your Information
   We use your personal data only for legitimate business purposes as outlined below:
   Purpose Type of Data Used Legal Basis
   Process and fulfil orders Identity, Contact, Financial, Transaction Contract
   Manage your account Identity, Contact, Profile Contract
   Send order confirmations & updates Identity, Contact, Transaction Contract
   Respond to customer service enquiriesIdentity, Contact, Communications Contract / Legitimate Interest
   Send marketing communications (opt-in)Identity, Contact, Marketing Prefs Consent
   BarelyBurn Privacy & Data Policy
   © 2026 BarelyBurn Titanium Cookware · barelyburn.com ·
   Purpose Type of Data Used Legal Basis
   Personalise your shopping experience Profile, Usage, Technical Legitimate Interest
   Improve our website and products Usage, Technical Legitimate Interest
   Prevent fraud and ensure security Identity, Technical, Transaction Legal Obligation / Legitimate Interest
   Comply with legal obligations All relevant data Legal Obligation
   Run promotions and competitions Identity, Contact, Marketing Prefs Consent
2. Legal Basis for Processing (GDPR)
   For users in the European Economic Area (EEA), United Kingdom (UK), and Switzerland, we rely on the following
   legal bases under the General Data Protection Regulation (GDPR) and UK GDPR:

• Contractual necessity: Processing required to fulfil your order or manage your account
• Consent: Marketing emails, cookies (non-essential), and promotional activities — you may withdraw consent
  at any time
• Legitimate interests: Fraud prevention, website improvement, and business analytics — we ensure these
  interests do not override your fundamental rights
• Legal obligation: Where we are required to process data to comply with applicable laws (e.g. tax, consumer
  protection)

1. Data Sharing & Third Parties
   We do not sell your personal data. We may share your data with trusted third parties only where necessary:
   5.1 Service Providers

• Payment processors: Stripe, PayPal (for secure transaction processing)
• Shipping & fulfilment: FedEx, UPS, USPS, DHL, and regional carriers
• Email marketing: Klaviyo, Mailchimp, or similar platforms
• Customer support: Zendesk, Gorgias, or similar platforms
• Analytics: Google Analytics, Hotjar, and similar tools
• Cloud hosting: Amazon Web Services (AWS) or similar infrastructure providers
  5.2 Legal & Regulatory Disclosure
  We may disclose your data to law enforcement, government authorities, or other third parties where required by
  law, court order, or to protect the rights, property, or safety of BarelyBurn, our customers, or others.
  5.3 Business Transfers
  In the event of a merger, acquisition, or sale of assets, your data may be transferred to the new entity. We will
  notify you via email and/or prominent notice on our website prior to any such transfer.
  All third-party service providers are contractually required to maintain the confidentiality and security of your data and may
  only use it for the purposes we specify.

1. International Data Transfers
   BarelyBurn is based in the United States. If you are located outside the US — including in the EU, UK, Canada, or
   Asia — your data may be transferred to and processed in the United States or other countries.
   BarelyBurn Privacy & Data Policy
   © 2026 BarelyBurn Titanium Cookware · barelyburn.com ·
   Where we transfer data from the EEA or UK, we ensure appropriate safeguards are in place including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• UK International Data Transfer Agreements (IDTAs)
• Adequacy decisions where applicable
• Binding Corporate Rules where relevant
  By using our website or purchasing our products, you acknowledge that your data may be processed in countries
  outside your own.

1. Data Retention
   We retain your personal data only for as long as necessary to fulfil the purposes outlined in this Policy, unless a
   longer retention period is required by law.
   Data Type Retention Period Reason
   Order & transaction records 7 years Tax and legal compliance
   Customer account data Duration of account + 3 years Customer service & dispute resolution
   Marketing preferences Until opt-out or account deletion Consent management
   Website usage & analytics 26 months Performance analytics
   Customer support records 3 years Dispute resolution
   Fraud prevention records 5 years Legal obligation
   Cookie consent records 1 year GDPR compliance
2. Your Rights
   Depending on your location, you have the following rights regarding your personal data. We will respond to all
   verified requests within 30 days (or as required by applicable law).
   Right What It Means
   Right to Access Request a copy of the personal data we hold about you
   Right to Rectification Request correction of inaccurate or incomplete data
   Right to Erasure Request deletion of your data (‘Right to be Forgotten’)
   Right to Restriction Request that we limit how we process your data
   Right to Portability Receive your data in a structured, machine-readable format
   Right to Object Object to processing based on legitimate interests or direct marketing
   Right to Withdraw Consent Withdraw consent at any time without affecting prior processing
   Right to Complain Lodge a complaint with your local data protection authority
   To exercise any of these rights, please contact us at privacy@barelyburn.com. We may need to verify your
   identity before processing your request.
   BarelyBurn Privacy & Data Policy
   © 2026 BarelyBurn Titanium Cookware · barelyburn.com ·
3. GDPR — European Users
   If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the following additional
   provisions apply under the General Data Protection Regulation (EU) 2016/679 and UK GDPR.
   9.1 Data Controller
   BarelyBurn acts as the Data Controller for personal data collected through barelyburn.com. Our contact details
   are listed in Section 17.
   9.2 Data Protection Officer
   We have appointed a Data Protection Officer (DPO). You may contact our DPO at dpo@barelyburn.com for any
   data protection matters.
   9.3 Your GDPR Rights
   In addition to the rights listed in Section 8, EU/UK users have the right to:

• Not be subject to solely automated decision-making that produces legal or significant effects
• Lodge a complaint with your local Supervisory Authority (e.g. ICO in the UK, CNIL in France, BfDI in
  Germany)
• Receive notification within 72 hours if your data is involved in a breach that poses a risk to your rights
  9.4 Lawful Bases Summary
  We document our lawful bases for all processing activities. Our full Record of Processing Activities (RoPA) is
  available upon request to privacy@barelyburn.com.

1. CCPA — California Users
   If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) and California
   Privacy Rights Act (CPRA).
   10.1 Your California Rights

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have
  collected about you in the past 12 months
• Right to Delete: Request deletion of your personal information, subject to certain exceptions
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out: Opt out of the sale or sharing of your personal information
• Right to Limit: Limit the use and disclosure of sensitive personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights
  10.2 Categories of Data Collected (Last 12 Months)
• Identifiers (name, email, IP address)
• Commercial information (purchase history, products considered)
• Internet or electronic network activity (browsing history on our site)
• Geolocation data (general location from IP address)
  10.3 Do Not Sell or Share
  BarelyBurn does not sell your personal information. To opt out of sharing for cross-context behavioural advertising,
  visit our Cookie Preference Centre on our website or email privacy@barelyburn.com.
  10.4 Submitting Requests
  BarelyBurn Privacy & Data Policy
  © 2026 BarelyBurn Titanium Cookware · barelyburn.com ·
  California residents may submit requests by emailing privacy@barelyburn.com or writing to our address in
  Section 17. We will verify your identity and respond within 45 days.

1. PIPEDA — Canadian Users
   If you are located in Canada, your personal information is protected under the Personal Information Protection and
   Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

• We collect personal information only for identified purposes with your knowledge and consent
• We limit collection to what is necessary for the identified purpose
• You may withdraw consent at any time, subject to legal or contractual restrictions
• You have the right to access your personal information and challenge its accuracy
• We protect your data with security safeguards appropriate to the sensitivity of the information
• Our Privacy Officer is contactable at privacy@barelyburn.com
  To make a PIPEDA access or correction request, contact our Privacy Officer. We will respond within 30 days.

1. PDPA — Thailand & Singapore Users
   12.1 Thailand PDPA
   If you are located in Thailand, your data is processed in accordance with the Personal Data Protection Act B.E.
   2562 (2019) (Thailand PDPA). You have the right to access, rectify, delete, restrict processing, and data portability.
   To exercise your rights, contact privacy@barelyburn.com.
   12.2 Singapore PDPA
   If you are located in Singapore, your data is processed in accordance with the Personal Data Protection Act 2012
   (Singapore PDPA). We collect, use, and disclose personal data only with your consent and for purposes that a
   reasonable person would consider appropriate. You have the right to withdraw consent and to access and correct
   your personal data.
2. Cookies & Tracking Technologies
   We use cookies and similar tracking technologies on barelyburn.com. You can manage your cookie preferences
   through our Cookie Preference Centre available on our website.
   Cookie Type Purpose Duration
   Strictly Necessary Essential for website functionality (cart, login, checkout) Session
   Performance / Analytics Understand how visitors use our site (Google Analytics) Up to 2 years
   Functional Remember your preferences (language, currency, size) Up to 1 year
   Marketing / Targeting Serve relevant ads and measure campaign performance Up to 2 years
   Third-Party Social Enable social sharing and social login features Varies
   You can set your browser to refuse all or some browser cookies. However, if you disable cookies, some parts of
   our website may not function correctly.
3. Children’s Privacy
   BarelyBurn Privacy & Data Policy
   © 2026 BarelyBurn Titanium Cookware · barelyburn.com ·
   Our website and products are not directed at children under the age of 13 (or 16 in the EEA/UK). We do not
   knowingly collect personal data from children. If you believe we have inadvertently collected data from a child,
   please contact us immediately at privacy@barelyburn.com and we will delete that information promptly.
4. Data Security
   We implement appropriate technical and organisational security measures to protect your personal data against
   accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

• SSL/TLS encryption for all data transmitted via our website
• Encrypted storage of sensitive data including payment information
• Access controls limiting employee access to personal data on a need-to-know basis
• Regular security assessments and penetration testing
• Incident response procedures including breach notification protocols
• Third-party security audits of our service providers
  In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected individuals and
  relevant supervisory authorities as required by applicable law (within 72 hours under GDPR).

1. Changes to This Policy
   We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal
   requirements, or other factors. When we make material changes, we will:

• Post the updated Policy on our website with the new effective date
• Send an email notification to registered customers (for material changes)
• Display a prominent notice on our website for 30 days following the change
  We encourage you to review this Policy periodically. Your continued use of our website and services after changes
  become effective constitutes your acceptance of the updated Policy.

1. Contact & Data Controller
   If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact
   us:
   Company BarelyBurn Titanium Cookware
   Website barelyburn.com
   Privacy Email privacy@barelyburn.com
   DPO Email dpo@barelyburn.com
   Address Austin, Texas, USA
   Response Time Within 30 days of receipt
   This policy was last updated on August 22, 2026. BarelyBurn is committed to protecting your privacy and complying with all
   applicable data protection laws globally. For the most current version of this policy, visit barelyburn.com/privacy.