Last updated: September 2026 · BarterBot Limited · Registered in England & Wales
1. Who we are
BarterBot Limited ("BarterBot", "we", "us", "our") is a company registered in England and Wales (Company No. 17344963; registered office: C/O Bishop Fleming LLP, 10 Temple Back, Bristol, United Kingdom, BS1 6FL). We operate the website at www.barterbot.co.uk and provide an AI-powered price negotiation service. BarterBot Limited is the data controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
For all data protection enquiries or to exercise your rights, contact our data protection lead at: admin@barterbot.co.uk. We aim to acknowledge all enquiries within 5 working days.
We are registered with the Information Commissioner's Office (ICO) as a data controller. Our ICO registration reference is 00014837448.
2. The data we collect
When you use BarterBot, we collect and process the following categories of personal data:
Identity and contact data: your name and email address, collected when you submit a negotiation request or contact us.
Deal data: the name, email address, company name and (if provided) the individual contact name of the seller's representative; the quoted price, description and reference number of the purchase you are seeking to negotiate; and any additional context you voluntarily share about the transaction.
Communications data: records of negotiation correspondence conducted on your behalf between BarterBot and the seller, and any direct communications between you and us.
Technical and usage data: your IP address, browser type and version, operating system, pages visited, time and date of access, and referring URLs, collected automatically when you visit our website. Where you consent to analytics, this data may be used to aggregate usage statistics.
Transaction data: records of any success fee payments made, including the amount, date and deal reference. Your payment receipt also shows your card brand and last 4 digits, which we retrieve from our payment provider at the time the receipt is generated — we do not store full payment card details, and the brand/last-4 digits themselves are not saved to our database.
We do not collect special category data (such as health, racial or ethnic origin, biometric or financial account data) and we do not knowingly collect personal data from individuals under the age of 18.
3. How and why we use your data
We process your personal data only where we have a lawful basis to do so. Our purposes and corresponding legal bases under UK GDPR are:
To deliver the negotiation service — processing your submission, conducting negotiations with the seller on your behalf, providing updates, issuing redemption codes and collecting the success fee. Legal basis: performance of a contract to which you are a party (Article 6(1)(b) UK GDPR).
To send you transactional communications — email updates about your active negotiation, outcome notifications and payment receipts. Legal basis: performance of a contract (Article 6(1)(b)); additionally, we rely on the transactional communications exemption under Regulation 22 of PECR 2003 as these messages are strictly necessary to provide the service you requested.
To comply with legal and financial obligations — retaining transaction records as required by HMRC and applicable tax and accounting law. Legal basis: compliance with a legal obligation (Article 6(1)(c) UK GDPR).
To maintain website security and prevent fraud — monitoring for abuse, detecting fraudulent submissions and maintaining the integrity of the service. Legal basis: legitimate interests (Article 6(1)(f) UK GDPR). Our legitimate interest is in protecting the service, our business and other users from harm; this interest is proportionate and does not override your fundamental rights.
To analyse aggregated website usage — understanding at an aggregate level how our website is used, in order to improve user experience and service performance. Legal basis: legitimate interests (Article 6(1)(f)), or consent (Article 6(1)(a)) where you have accepted analytics cookies. We do not use individual browsing data for profiling or targeted advertising.
To send you marketing communications (soft opt-in) — where you are an existing customer, we may contact you by email about BarterBot's own similar services, including: progress towards your next loyalty tier, suggestions for other purchase categories you may wish to negotiate, and timely market insights relevant to categories where you have previously used BarterBot. Legal basis: legitimate interests under Article 6(1)(f) UK GDPR, and the soft opt-in exemption under Regulation 22(3) PECR 2003 (existing customer relationship, own similar products/services, clear opportunity to opt out). Every marketing email includes a clear, one-click unsubscribe link. You can also opt out at any time by emailing admin@barterbot.co.uk.
We do not sell your data, build individual behavioural profiles for third-party advertising, or use your data to train third-party AI models.
4. Artificial intelligence and automated processing
BarterBot uses artificial intelligence to conduct price negotiations on your behalf. This involves automated analysis of your deal submission and the generation of negotiation communications sent to the seller you have identified. This automated processing is a core and necessary part of the service you have contractually engaged us to provide.
Article 22 UK GDPR (automated decision-making): the AI does not make decisions that produce legal or similarly significant effects about you as a data subject. It acts on your instructions to negotiate with a third party. You remain in control at all times: you choose whether to submit a deal, and you choose whether to accept or reject any negotiated outcome. No decision affecting your legal rights or financial obligations is taken without your active participation.
We use Anthropic, Inc. as our AI infrastructure provider (see Section 7). Anthropic processes deal data on our behalf under a Data Processing Agreement and is not permitted to use your data to train its models or for any purpose other than responding to API requests from BarterBot. We also use OpenAI, L.L.C. to generate text embeddings (numerical representations) of seller replies and deal summaries so that BarterBot can recall how similar negotiations went; OpenAI processes this data under a Data Processing Agreement on the same no-training, API-only terms.
We do not use your personal data to build individual profiles for marketing, credit scoring, insurance underwriting or any other purpose that would constitute significant automated decision-making under Article 22.
5. Seller data and PECR compliance
When you submit a negotiation request, you provide us with personal data about the seller's representative (name, email address, company name). By submitting this information, you warrant that:
The seller contact is a genuine commercial contact acting in a professional capacity in relation to the transaction you are negotiating; you have a legitimate basis for sharing their contact details with us; and sharing this information does not breach any confidentiality obligation or agreement between you and the seller.
BarterBot will contact the seller solely for the purpose of conducting the negotiation you have requested. This constitutes a legitimate interests basis for processing the seller's data (Article 6(1)(f)), as the seller, as a commercial entity, has a reasonable expectation of receiving commercial correspondence. We rely on the fact that Regulation 22 of PECR 2003 applies to individual subscribers only; as the seller contact is being approached in a professional and commercial capacity, the prior consent requirement under Regulation 22 does not apply to these communications. BarterBot will not retain seller contact data for any purpose beyond the negotiation and will not contact the seller for marketing or any unrelated purpose. The final message of a concluded negotiation may include a single line inviting the seller to register as a partner seller (below); no separate invitation email is sent.
Sellers who register as partners. A seller may register their business as a BarterBot partner seller at barterbot.co.uk/sellers. We then hold the business name, website, chosen contact and negotiation email addresses, the categories they sell, and (where matched) their Companies House number. Legal basis: consent (Article 6(1)(a)) given at registration and confirmed by clicking the verification link, and legitimate interests in routing enquiries to the address the seller has asked for. We use this data to send buyers' enquiries to the address the partner chose, to show buyers who enter that business that it is a BarterBot partner, to email the partner about their registration, and to record how promptly they respond to enquiries. Partners can change their details or withdraw at any time by emailing admin@barterbot.co.uk; withdrawal removes the partner mark immediately and we delete the registration within 30 days.
6. Marketing communications and your right to opt out
Where you are an existing BarterBot customer, we may send you marketing emails about BarterBot's own services under the soft opt-in provisions of Regulation 22(3) PECR 2003. These emails may include:
Loyalty tier progress notifications (e.g. when you are close to your next tier and a lower fee rate); suggestions for using BarterBot in additional purchase categories; and timely market insights drawn from publicly available ONS or seasonal data.
Unsubscribe: every marketing email contains a one-click unsubscribe link. Clicking it immediately records your opt-out and you will receive no further marketing emails. You can also opt out at any time by emailing admin@barterbot.co.uk. Unsubscribing from marketing does not affect transactional emails (deal updates, redemption codes, payment receipts) which are necessary for the service.
Re-subscribing: if you change your mind, a re-subscribe link is provided on the unsubscribe confirmation page, and you can re-subscribe at any time by emailing admin@barterbot.co.uk.
Referral sharing: when you use BarterBot's share feature to tell a friend about the service, you are initiating a personal communication using your own messaging application. BarterBot is not the sender of that communication. We record a click-tracking reference (ref_code) for our own analytics; this constitutes a legitimate interest in understanding how users discover BarterBot. No personal data about the recipient of your share is collected by BarterBot.
7. Who we share your data with
We do not sell, rent or trade your personal data. We may share your data with the following categories of recipient:
Sub-processors — third-party companies that process personal data on our behalf and under our documented instructions. Each sub-processor is bound by a Data Processing Agreement (DPA) that restricts them from using your data for any purpose other than providing the contracted service to BarterBot. Our current sub-processors are:
| Sub-processor |
Purpose |
Location |
Safeguard |
| Anthropic, Inc. |
AI model hosting & negotiation inference |
USA |
UK IDTA / SCCs |
| Railway Corp. |
Cloud hosting & database (PostgreSQL) |
EU (Amsterdam) |
EU-based processing |
| Resend, Inc. |
Transactional & negotiation email delivery |
USA / EU (Ireland) |
UK DPF |
| Stripe, Inc. |
Payment processing & success fee collection |
EU (Ireland) |
EU-based processing |
| OpenAI, L.L.C. |
Text embeddings for negotiation memory (seller reply excerpts and deal summaries, which may include the seller's company name) |
USA |
UK DPF |
| Tavily, Inc. |
Web search for seller reputation and market pricing (seller company name and item description only — no buyer data) |
USA |
UK IDTA / SCCs |
Other service providers that do not receive personal data — we use Ayrshare, Inc. (USA) to publish BarterBot's own social media posts. Those posts are generated from aggregate, anonymised statistics only (for example, the typical discount achieved in a category) and never contain any buyer, seller or deal information, so Ayrshare does not process personal data on our behalf. We also query the Companies House public register to verify seller businesses; this involves only publicly available company information.
Professional advisers — lawyers, accountants and insurers where necessary for our business operations, each subject to duties of confidentiality.
Regulators and law enforcement — where we are required to do so by law or a binding legal obligation.
8. International transfers
Two of our sub-processors process personal data within the European Union — Railway in Amsterdam and Stripe in Ireland — and no international transfer mechanism is required for those processors. Four sub-processors process data in the United States: Anthropic, Inc. (our AI infrastructure provider), Resend, Inc. (our email delivery provider, which routes emails via an EU relay but stores account data and metadata in the US), OpenAI, L.L.C. (text embeddings used for negotiation memory) and Tavily, Inc. (web search used for seller research). The USA does not currently hold a UK adequacy decision under Article 45 UK GDPR. For transfers to Anthropic and Tavily, we rely on the International Data Transfer Agreement (IDTA), issued by the ICO, or the UK Addendum to the EU Standard Contractual Clauses. For transfers to Resend and OpenAI, we rely on their certification under the UK Extension to the EU-US Data Privacy Framework (DPF). Both mechanisms ensure equivalent data protection standards apply to your personal data.
9. How long we keep your data
We retain personal data only for as long as is necessary for the purposes described in this policy, in accordance with the storage limitation principle under Article 5(1)(e) UK GDPR. Our retention schedule is as follows:
| Data type |
Retention period |
Legal basis |
| Completed deal records (won or lost) |
6 years from deal close date |
Limitation Act 1980; HMRC record-keeping (Finance Act 1998) |
| Abandoned deals (no outcome reached) |
90 days from last activity |
Storage limitation — no ongoing purpose |
| Support / help reports (resolved) |
2 years from submission |
Legitimate interests — dispute resolution |
| Support / help reports (unresolved) |
1 year from submission |
Storage limitation |
| Technical / server logs |
90 days |
Legitimate interests — security monitoring |
| Deletion audit log |
Indefinite (reference only — no PII) |
Accountability principle (Article 5(2) UK GDPR) |
Deletion is performed automatically by our systems on a 24-hour cycle. At the end of each retention period, deal records and support reports are permanently deleted from our database. Only a minimal deletion audit log entry (containing the deal reference and deletion reason, but no personal data) is retained indefinitely as evidence of compliance.
Right to erasure and retention obligations: where you exercise your right to erasure under Article 17 UK GDPR, we will delete your data promptly unless we are required to retain it by law (for example, under the HMRC 6-year accounting record obligation, which takes precedence over erasure requests in relation to financial records). We will always tell you if this applies.
10. Cookies and tracking
Essential cookies — we use a session cookie to maintain your authenticated login state. This cookie is strictly necessary for the service to function and does not require your consent under Regulation 6(4) PECR 2003.
Analytics cookies (optional) — if you consent, we may use aggregated analytics data about how our website is used (page views, feature usage, session duration) to improve the product. Any analytics tool we use is configured in a privacy-respecting mode — never for advertising, retargeting or individual-level profiling. You can withdraw consent at any time via the Cookie Preferences link in our footer.
We do not use advertising, tracking or third-party marketing cookies. If we introduce any new cookies that require consent, we will update this policy and our cookie consent mechanism before deploying them.
11. Your rights under UK GDPR
Subject to applicable exemptions, you have the following rights in relation to your personal data. These rights are provided by Chapter III of the UK GDPR and are free of charge unless a request is manifestly unfounded or excessive:
Right of access (Article 15) — to obtain confirmation of whether we process your data and to receive a copy of it, along with supplementary information about how it is used.
Right to rectification (Article 16) — to require us to correct inaccurate personal data or complete incomplete data without undue delay.
Right to erasure (Article 17) — to request deletion of your personal data where it is no longer necessary, where you have withdrawn consent, or where there is no overriding legitimate ground for retention. Note: we may be required to retain certain records under our legal obligations (see Section 9); we will always inform you if this applies.
Right to restriction of processing (Article 18) — to ask us to suspend processing of your data in certain circumstances, for example while the accuracy of data is contested.
Right to data portability (Article 20) — to receive your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV) where processing is based on consent or contract and is carried out by automated means, and to transmit it to another controller.
Right to object (Article 21) — to object at any time to processing of your personal data based on legitimate interests or for direct marketing (if applicable). We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.
Rights in relation to automated decision-making (Article 22) — to request human review of, or to contest, any decision based solely on automated processing that produces legal or similarly significant effects on you.
Right to withdraw consent — where processing is based on your consent (e.g. analytics cookies), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
To exercise any of these rights, contact us at admin@barterbot.co.uk. We will respond within one calendar month of receiving your request. Where a request is complex or numerous, we may extend this period by a further two months, in which case we will notify you within the first month and explain why. We will not charge a fee unless your request is manifestly unfounded or excessive, in which case we will inform you before proceeding.
12. How we protect your data
We implement appropriate technical and organisational security measures (TOMs) proportionate to the risks posed by our processing, including: encryption of all data in transit using TLS 1.2 or above; encryption at rest for database storage; role-based access controls restricting personal data access to authorised personnel only; automated data retention and deletion as described in Section 9; and regular review of our security posture.
No method of transmission over the internet is entirely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach (Article 33 UK GDPR). Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay (Article 34 UK GDPR).
13. Children
Our service is directed at adults and is not suitable for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data relating to a minor, please contact us immediately at admin@barterbot.co.uk and we will take prompt steps to delete it.
14. How to complain
If you are dissatisfied with how we have handled your personal data or responded to a rights request, please contact us first at admin@barterbot.co.uk — we will acknowledge your concern within 5 working days and endeavour to resolve it within 30 days.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).
15. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology or applicable law. The "Last updated" date at the top of this page will always reflect the most recently published version.
This policy applies to www.barterbot.co.uk and all BarterBot services. It is governed by the laws of England and Wales. For any queries: admin@barterbot.co.uk