Privacy Policy.

Data controller

Bartr B.V. is the data controller for the personal data processed through the Service. You can reach us for all privacy matters at:

• Email: privacy@bartr.it.com
• Postal address: available on request
• EU representative: to be appointed where required under GDPR Article 27

We have not designated a Data Protection Officer (DPO) under GDPR Article 37 at this stage. You may escalate any privacy concern directly to the contacts above.

Data we collect

We collect personal data in the following categories. Each category is listed with the legal basis under GDPR Article 6 on which we rely, and (where applicable) the legal basis under PDPO.

2.1 Data you provide when you create an account

• Email address;
• Name or chosen display name;
• Profile photo (optional);
• Authentication tokens from Apple Sign-In or Google Sign-In (we do not receive your password).

Legal basis: necessary for the performance of the contract between you and us (GDPR Art. 6(1)(b)); lawful collection under PDPO DPP1.

2.2 Data you provide when you use the Service

• Listings — item descriptions, categories, photos, condition, asking value;
• Messages you send to other users;
• Ratings and reviews you submit after trades;
• Voice recordings and text inputs submitted to AI Buddy;
• Feedback, support requests, survey responses.

Legal basis: performance of the contract (GDPR Art. 6(1)(b)) and our legitimate interests in operating the Service (Art. 6(1)(f)); lawful collection under PDPO DPP1.

2.3 Data collected automatically

• Device information (device model, OS version, unique device identifier, language settings);
• IP address and approximate location derived from it;
• Precise location (GPS) — only with your consent, used to surface nearby trades;
• App usage data (screens viewed, features used, session duration, crash logs);
• Push notification tokens (when you enable notifications).

Legal basis: our legitimate interests in operating, securing, and improving the Service (GDPR Art. 6(1)(f)); your consent for precise location (Art. 6(1)(a)) and push notifications.

2.4 Data about your trades

• Trade records (what was offered, what was received, any cash top-up amount agreed via The Boot);
• Trust Score inputs and calculations;
• Completion confirmations and timestamps;
• Counterparty identifiers.

Legal basis: performance of the contract (GDPR Art. 6(1)(b)); legitimate interests in platform integrity and dispute resolution (Art. 6(1)(f)).

2.5 Data from third parties

• Authentication data from Apple and Google (where you sign in via those providers);
• Anti-fraud signals from our infrastructure and security providers.

Legal basis: legitimate interests in security and fraud prevention (GDPR Art. 6(1)(f)).

How we use your data

We use personal data for the following purposes:

1. To provide the Service — creating your account, showing you nearby listings, matching you with trades, delivering messages, calculating Trust Scores.
2. AI features — processing voice and text inputs to AI Buddy in order to generate listing suggestions, valuations, and match recommendations.
3. Safety and integrity — detecting fraud, abuse, spam, impersonation, prohibited items, and violations of our Terms.
4. Communications — sending you service notifications, security alerts, and operational emails. We may send marketing communications only with your consent, and you may opt out at any time.
5. Product improvement — analyzing aggregated, de-identified usage patterns to improve features, fix bugs, and design new functionality.
6. Legal compliance — responding to lawful requests from authorities, enforcing our Terms, preventing harm.

We do not:

• Sell your personal data to third parties;
• Use your data for targeted advertising on or off the Service;
• Profile you for purposes unrelated to the Service.

Automated decision-making and AI

AI Buddy uses machine-learning models (including third-party large language models) to process your voice and text inputs and generate helpful outputs — listing suggestions, item valuations, and match recommendations. These are decision-support tools, not automated decisions that produce legal or similarly significant effects about you within the meaning of GDPR Article 22.

Matching engine. Our matching engine uses bipartite graph algorithms to surface trade opportunities. This is algorithmic ranking, not automated decision-making with legal effects.

Trust Scores are algorithmically calculated from completed trades and ratings. You may contact us at privacy@bartr.it.com to request an explanation of how your Trust Score is calculated or to challenge any Trust Score that you believe is inaccurate.

Sharing and disclosure

We share personal data only in the following limited circumstances:

5.1 With other users (core Service function)

When you create a listing, other users can see:

• Your display name and profile photo;
• Your listing details, photos, and asking value;
• Your Trust Score;
• The approximate proximity of your listing (e.g., "Tower A, Floor 8" or "within 200m"), based on your precise location consent;
• Messages you send them.

Other users cannot see: your email address, precise GPS coordinates, raw IP address, or any authentication credentials.

5.2 With service providers (processors)

We rely on trusted providers to run the Service. Each is bound by a data processing agreement that restricts their use of your data to our instructions. Categories include:

• Cloud hosting — Amazon Web Services (EU and/or Asia-Pacific regions);
• Authentication — Apple, Google;
• Push notifications — Apple Push Notification service, Firebase Cloud Messaging;
• Analytics — privacy-conscious analytics providers that do not perform cross-site tracking;
• AI processing — providers of large language models and voice-to-text services, used to power AI Buddy. Inputs are transmitted for processing only, and we instruct providers not to retain inputs for training their models;
• Customer support — email and helpdesk tools;
• Fraud and abuse detection — security providers that help us identify bots, impersonators, and malicious accounts.

A current list of key sub-processors is available on request from privacy@bartr.it.com.

5.3 For legal reasons

We may disclose personal data where required by law, court order, or valid request from a competent public authority, or to establish or defend our legal rights.

5.4 In a business transfer

If Bartr is acquired, merged, reorganized, or enters insolvency, your data may be transferred to a successor entity. You will be notified of any such transfer and given a meaningful opportunity to object.

5.5 With your consent

For any other purpose, we will ask for your consent first.

International data transfers

Bartr is headquartered in the Netherlands. The Service is operated globally, including for users in Hong Kong. Your data may be transferred to and processed in countries outside your country of residence, including:

• Within the European Economic Area (our primary hosting region);
• In the United Kingdom (deemed adequate by the European Commission);
• In Hong Kong, the United States, and other jurisdictions where our service providers operate.

For transfers outside the EEA to countries without an adequacy decision, we rely on:

• Standard Contractual Clauses (SCCs) as adopted by the European Commission;
• Supplementary technical, contractual, and organizational measures where required;
• Your explicit consent in limited cases.

You may request a copy of the relevant safeguards by contacting privacy@bartr.it.com.

Retention

We retain personal data only for as long as necessary for the purposes described in this Policy. Specifically:

When retention ends, data is securely deleted or irreversibly anonymized.

Your rights

Under GDPR (if you are in the EEA) and under PDPO (if you are in Hong Kong), you have the following rights:

• Access — request a copy of the personal data we hold about you;
• Rectification — have inaccurate data corrected;
• Erasure ("right to be forgotten") — request deletion of your data, subject to legal retention obligations;
• Restriction — ask us to limit our processing in certain cases;
• Portability — receive your data in a structured, machine-readable format, and ask us to transmit it to another controller where technically feasible;
• Objection — object to processing based on our legitimate interests;
• Withdraw consent — at any time, where we rely on consent (this does not affect processing already carried out);
• Not be subject to solely automated decisions that produce legal or similarly significant effects (GDPR Art. 22).

Hong Kong users additionally have the data access and correction rights set out in DPP 6 of the PDPO.

How to exercise your rights

Send a request to privacy@bartr.it.com. Please include enough information for us to verify your identity — we may ask for additional verification to prevent fraudulent requests.

We will respond within 30 days (GDPR) or 40 days (PDPO), whichever is applicable. For complex or multiple requests, we may extend by a further 60 days and will notify you.

There is no fee for reasonable requests. We may charge a reasonable fee or refuse to act only where a request is manifestly unfounded or excessive.

Cookies and similar technologies

The Bartr mobile application does not use browser cookies. It uses:

• Local storage on your device — for session management and offline caching;
• Device identifiers — to recognize your device across sessions;
• SDKs from our service providers — for crash reporting, analytics, and push notifications.

The Bartr website (bartr.it.com) uses only strictly necessary cookies for basic functionality and security. We do not use advertising, profiling, or cross-site tracking cookies.

Children's privacy

The Service is intended for users 18 years and older. We do not knowingly collect personal data from children under 18. If we discover that we have collected data from a child, we will delete it promptly.

If you are a parent or guardian and believe your child has provided us with data, contact privacy@bartr.it.com and we will take action.

Security

We implement reasonable technical and organizational measures to protect personal data, including:

• Encryption in transit (TLS 1.2+) for all data exchanged between your device and our servers;
• Encryption at rest for databases and backups;
• Access controls — employee and contractor access to personal data is limited, logged, and reviewed;
• Authentication — strong authentication requirements for our internal systems;
• Security reviews — regular code reviews, dependency scanning, and periodic penetration testing;
• Secure development practices across engineering.

No system is perfectly secure. If you suspect your account has been compromised, contact support@bartr.it.com immediately.

Data breach notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority (the Autoriteit Persoonsgegevens in the Netherlands, and other relevant authorities including the Hong Kong Privacy Commissioner where applicable) within 72 hours of becoming aware, as required by GDPR Article 33;
• Notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms, as required by GDPR Article 34.

Marketing communications

We may send you occasional emails about new features, expansions, and Bartr news. We will only do this where:

• You have opted in during signup or in the app settings; or
• You are a user and we are sending service-related communications (in which case marketing opt-out does not apply).

You may opt out at any time via the unsubscribe link in any marketing email or by emailing privacy@bartr.it.com.

Complaints

You have the right to lodge a complaint with a supervisory authority if you believe our processing of your data violates applicable law.

• Netherlands (lead supervisory authority under GDPR): Autoriteit Persoonsgegevens — autoriteitpersoonsgegevens.nl
• Hong Kong: Privacy Commissioner for Personal Data — pcpd.org.hk
• Your local EU Member State supervisory authority, if you are in the EU.

We encourage you to contact us first at privacy@bartr.it.com so we can address your concern directly.

Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the app or email at least 30 days before they take effect. The "Last updated" date at the top will always reflect the latest version.

Contact

For any question about this Policy or about your personal data:

• Privacy team: privacy@bartr.it.com
• General contact: admin@bartr.it.com
• Support: support@bartr.it.com