BARK AND BRAMBLE LTD
PRIVACY POLICY

PRIVACY POLICY

Version 2.0 – Website Launch

Effective date: 21 September 2026

Last updated: 11 September 2026

1. ABOUT THIS PRIVACY POLICY

Bark and Bramble Ltd (“Bark & Bramble”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains what personal data we collect, how and why we use it, the lawful bases we rely on, who we share it with, how long we keep it, how we protect it, and the rights available to you.

This policy applies when you visit or use www.barkandbramblepet.com, create an account, purchase products, use a subscription service, contact us, subscribe to marketing, use our Dog Food Finder or other recommendation tools, enter a competition, submit a review or survey, attend an event, buy from us in person, or otherwise interact with Bark & Bramble.

We process personal data in accordance with applicable UK data protection and privacy law, including the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), as amended. This policy should be read alongside our Cookie Policy and any other privacy information presented when we collect personal data.

2. WHO WE ARE

BARK AND BRAMBLE LTD is the controller of personal data covered by this policy. This means that we decide why and how that personal data is processed.

Company number: 17300411

Registered office: 128 City Road, London, EC1V 2NX, United Kingdom

Website: www.barkandbramblepet.com

Email: info@barkandbramblepet.com

Telephone: 07746 660 226

Our registered office is not our customer returns address. Our designated returns address is:

Bark and Bramble
PO Box 791
EASTLEIGH
SO50 0TX
United Kingdom

Customers wishing to return an item should follow our Returns, Refunds and Cancellation Policy and, where required, contact us before sending the return so that the correct return method and any prepaid return label can be provided.

We have not appointed a Data Protection Officer because we do not currently consider that we are legally required to do so. Privacy enquiries and requests should be sent to the email address above.

3. PERSONAL DATA WE COLLECT

The personal data we collect depends on how you interact with us. It may include:

Identity and contact data: your name, title, email address, telephone number, billing address, delivery address, account identifiers and, where relevant, business details.

Account data: account credentials or authentication information, saved addresses, preferences, order history, subscription settings, marketing choices and account activity. Passwords should be stored by the relevant website system in protected form rather than as readable plain text.

Order and transaction data: products purchased, quantities, prices, discounts, order and invoice references, delivery method, delivery instructions, tracking information, returns, refunds, cancellations, subscription history and customer-service records.

Payment-related data: payment status, transaction references, refund information, limited card information made available by a payment provider, and subscription billing status. Bark & Bramble does not intend to store complete payment-card numbers or card security codes. Card and other payment credentials are handled by the relevant payment provider.

Communications data: emails, contact-form submissions, social-media messages, complaints, enquiries, reviews, feedback, survey responses and other correspondence with us.

Marketing data: newsletter status, consent and opt-out records, marketing preferences and, where permitted, information about engagement with our communications.

Technical and usage data: IP address, browser and device information, operating system, session identifiers, website activity, referring pages, approximate location, diagnostic information, security logs and similar information generated when you use our website.

Pet information: information you choose to provide about your dog or other pet, such as name, breed, age, weight, sex, neuter status, activity level, body condition, dietary preferences, allergies or sensitivities, preferred proteins, feeding goals and existing diet. Information about an animal is not normally personal data in itself, but it may form part of a record linked to you.

We do not ask you to provide unnecessary special-category personal data about yourself, such as information about your health, ethnicity, religion, political opinions, trade-union membership, genetics, biometrics, sex life or sexual orientation. Please do not include such information in free-text forms or communications unless it is genuinely necessary. If sensitive information is provided to us, we will only process it where a lawful basis and, where required, an additional UK GDPR condition applies.

4. HOW WE COLLECT PERSONAL DATA

We collect personal data directly from you when you create an account, place an order, contact us, subscribe to marketing, complete a form, use the Dog Food Finder, submit a review, enter a promotion or interact with us at an event.

We also collect some information automatically through our website, including through essential technologies and, where permitted by your choices, analytics or similar technologies.

We may receive information from service providers involved in your transaction or our website, including payment providers, couriers, returns carriers and website or technology providers. For example, we may receive payment confirmation from Stripe or Klarna and delivery or tracking information from a courier.

We may receive information that you make available to us through social-media platforms. In limited circumstances, we may also use information from lawful public sources, such as Companies House or public business directories, where relevant to a genuine business purpose.

Where we obtain personal data about you from another source and UK law requires us to provide privacy information to you, we will do so within the applicable period.

5. WHY WE USE PERSONAL DATA AND OUR LAWFUL BASES

We only process personal data where we have a lawful basis.

Contract. We process information where necessary to take steps at your request before entering into a contract or to perform our contract with you. This includes creating and administering your customer account, processing orders and payments, arranging delivery, managing subscriptions, sending service communications, handling returns and refunds, and providing purchase-related customer support.

Legal obligation. We process information where necessary to comply with legal duties, including tax and accounting requirements, consumer-law obligations, product-safety obligations, lawful regulatory requests and record-keeping requirements.

Legitimate interests. We may process information where necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and interests. These interests may include operating and improving our business and website, securing our systems, preventing fraud and misuse, providing customer service, analysing business performance, managing disputes, establishing or defending legal claims, maintaining appropriate records, and developing our products and services. Where appropriate, we consider necessity, proportionality and the impact on individuals before relying on this basis.

Consent. We rely on consent where required, including for certain electronic marketing and non-essential cookies or similar technologies. You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

We do not use “vital interests” or “public task” as routine lawful bases for our retail activities.

6. ORDERS, PAYMENTS AND SUBSCRIPTIONS

When you order from us, we use the information necessary to accept and fulfil the order, communicate with you, arrange delivery, deal with returns or refunds and maintain appropriate business records.

Payments are processed through authorised payment providers. We currently expect to use Stripe, including Stripe Billing for subscriptions, and may offer Klarna where available. These providers may process identity, contact, billing, delivery, transaction and fraud-prevention information in accordance with their own legal obligations and privacy notices. Klarna is responsible for its own eligibility or credit-related decisions where its services are selected; Bark & Bramble does not make those decisions.

We may conduct proportionate transaction or fraud checks, or rely on checks performed by our providers, to protect customers and our business. We may retain evidence relevant to payment disputes, refunds and chargebacks where necessary.

7. DELIVERY AND RETURNS

We share the minimum personal data reasonably necessary with delivery and returns providers. Depending on the service used, this may include your name, delivery or collection address, email address, telephone number, delivery instructions, parcel details and order or return reference.

Our intended delivery providers include DPD and Royal Mail. Royal Mail and/or Parcelforce may also be used for authorised returns. Providers may send us tracking events, proof of delivery, failed-delivery information, return tracking and other information required to administer the service.

Where we issue a prepaid returns label, information required to create and administer that label may be shared with the relevant carrier. Our designated returns address is:

Bark and Bramble
PO Box 791
EASTLEIGH
SO50 0TX
United Kingdom

Customers should use this address only in accordance with our Returns, Refunds and Cancellation Policy and any return instructions supplied by our customer service team.

8. WEBSITE, DOTGO, ANALYTICS AND COOKIES

Our website is designed, hosted, maintained and supported by DotGo. To provide those services, DotGo and its authorised technology providers may process limited personal data required for hosting, maintenance, troubleshooting, security, backups and website administration. Where a provider acts as our processor, we require it to process personal data under appropriate contractual and data-protection safeguards.

We use or intend to use Google Analytics to understand website usage and performance. Analytics may involve information such as device and browser data, approximate location, pages viewed, navigation and conversion information. Where UK law requires consent for the relevant analytics technology, it will not be activated until the required consent has been obtained.

Our website uses cookies and similar technologies. Strictly necessary technologies may operate where required for the website or a service you request. Non-essential cookies or similar technologies will be handled in accordance with applicable consent requirements. Further details, including available controls and cookie durations, are set out in our Cookie Policy.

9. DOG FOOD FINDER AND RECOMMENDATION TOOLS

If you choose to use our Dog Food Finder or another recommendation tool, we may process information you provide about your dog, such as age, breed, weight, activity level, allergies, sensitivities, diet and feeding goals, to generate relevant product suggestions.

The tool is intended to assist product selection. It is not veterinary advice, diagnosis or treatment. We do not intend to use the Dog Food Finder to make decisions about you that produce legal or similarly significant effects.

Where information from these tools is used to improve our service, we will seek to use aggregated or anonymised information where reasonably practicable. If we materially change how an AI-assisted tool uses personal data, we will assess the privacy implications and update our information before beginning any materially different processing where required.

10. MARKETING

We may send electronic marketing where we have the permission required by PECR or another applicable rule. Where legally available, this may include the “soft opt-in” for existing or prospective customers in relation to our own similar products or services, provided the legal conditions are met.

You will be given a clear opportunity to opt out when required and in each marketing communication. You can unsubscribe at any time using the unsubscribe facility provided or by contacting info@barkandbramblepet.com.

If you opt out, we may keep limited suppression information, such as your email address and opt-out status, so that we can respect your choice. Opting out of marketing does not prevent us from sending necessary service messages about an order, account or subscription.

11. WHO WE SHARE PERSONAL DATA WITH

We do not sell or rent your personal data.

Where necessary and lawful, we may share personal data with: DotGo and relevant website or hosting providers; Stripe, Stripe Billing and Klarna where applicable; DPD, Royal Mail, Parcelforce and other delivery or returns providers used for an order; analytics and technology providers; email or communications providers if introduced; professional advisers such as accountants, insurers, lawyers or auditors; regulators, courts, law-enforcement bodies or public authorities where disclosure is legally required or justified; and a buyer, investor or professional adviser involved in a genuine sale, merger, restructuring or transfer of all or part of our business, subject to appropriate confidentiality and data-protection safeguards.

Some providers act as processors on our instructions. Others, particularly certain payment, courier, analytics or platform providers, may act as independent controllers for some of their activities. Their own privacy notices explain those activities.

12. INTERNATIONAL TRANSFERS

Some service providers or their group companies, infrastructure or support operations may be located outside the United Kingdom. This means personal data may in some circumstances be transferred internationally.

Where UK data-protection law restricts an international transfer, we will take steps intended to ensure that an appropriate transfer mechanism is in place. Depending on the destination and circumstances, this may include UK adequacy regulations or appropriate contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum, together with any additional measures considered necessary.

You may contact us for further information about the safeguards relevant to transfers of your personal data. Because providers and hosting arrangements can change, we will review this section when material changes occur.

13. HOW LONG WE KEEP PERSONAL DATA

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, tax, fraud-prevention, complaint and dispute-resolution requirements.

Rather than applying one period to every record, retention depends on the type of information and the reason it is held. Transaction, invoice and accounting records may be retained for the period required by applicable tax and company-record obligations. Order, return, refund and customer-service records may be retained for an appropriate period after the transaction to deal with complaints, disputes, product-safety matters and legal claims. Active account and subscription information is generally retained while the account or subscription is active and afterwards only where there is a continuing lawful reason.

Marketing information is retained while relevant to our marketing relationship. If you opt out, limited suppression information may be retained to ensure that your preference continues to be respected. Security and technical logs are kept for a proportionate period based on security and operational need. Cookie durations are described in our Cookie Policy.

When personal data is no longer required, we will delete it, anonymise it, or allow it to be removed through an appropriate backup-retention cycle, unless continued retention is required or permitted by law.

14. SECURITY

We use appropriate technical and organisational measures designed to protect personal data against accidental loss, destruction, alteration, unauthorised disclosure, access or misuse.

Measures may include access controls, individual user accounts, password protection, multi-factor authentication where available and appropriate, encrypted connections, secure payment processing, backups, software updates, monitoring, supplier controls and limiting access to people who need it for legitimate business purposes.

We review security in proportion to our size, systems, risks and the sensitivity of the information involved. No internet transmission or storage system can be guaranteed to be completely secure, so we cannot promise absolute security.

If we become aware of a personal-data breach, we will assess it and take appropriate containment, investigation and remedial action. Where the law requires notification to the Information Commissioner's Office (“ICO”) or affected individuals, we will make the required notification within the applicable legal timeframe.

15. YOUR DATA-PROTECTION RIGHTS

Depending on the circumstances and lawful basis, UK data-protection law may give you the right to: request access to personal data we hold about you; ask us to correct inaccurate or incomplete data; ask us to erase personal data in certain circumstances; ask us to restrict processing in certain circumstances; receive certain personal data in a portable format and transmit it to another controller; object to certain processing; and withdraw consent where processing is based on consent.

You also have an absolute right to object to your personal data being used for direct marketing.

Not every right applies in every situation. For example, legal record-keeping requirements may prevent us from deleting some transaction information immediately. We may need reasonable information to verify your identity before acting on a request.

To exercise a right, contact info@barkandbramblepet.com. We will respond within the period required by applicable law. We do not normally charge a fee, although the law permits a reasonable fee or refusal in limited circumstances, such as where a request is manifestly unfounded or excessive.

16. COMPLAINTS

Please contact us first if you have concerns about how we use your personal data so that we can investigate.

You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection. Current contact and complaint information is available from the ICO at ico.org.uk. Your right to complain to the ICO is not affected by contacting us first.

17. CHILDREN

Our website and retail services are directed at adults purchasing pet products and are not designed to collect personal data from children. We do not knowingly seek to profile children or direct data-driven marketing at them.

If we become aware that personal data relating to a child has been collected in circumstances where it should not have been, we will assess the situation and take appropriate steps, which may include deletion.

18. THIRD-PARTY WEBSITES AND SOCIAL MEDIA

Our website may contain links to websites, services or social-media platforms operated by third parties. Those organisations control their own processing and privacy practices. This Privacy Policy does not replace their privacy notices. We recommend reviewing the relevant third-party notice before providing personal data to an external service.

19. BUSINESS CHANGES AND LEGAL DISCLOSURES

We may disclose personal data where reasonably necessary to comply with law, enforce or defend legal rights, prevent fraud or protect the rights, property or safety of customers, Bark & Bramble or others.

If our business or assets are reorganised, sold, transferred or merged, relevant personal data may be disclosed to genuine prospective parties and their advisers and, if the transaction completes, transferred as part of the business, subject to applicable data-protection requirements.

20. CHANGES TO THIS POLICY

We will review this Privacy Policy periodically and update it where our services, suppliers, technologies, legal obligations or processing activities materially change.

The current version will be published on our website with its last-updated date. Where a change materially affects how we use existing personal data, we will take appropriate steps to bring the change to your attention before the new processing begins where required by law.

21. CONTACT US

For privacy questions, requests or concerns, contact:

BARK AND BRAMBLE LTD