Legal
Privacy policy
How Barclo collects, uses and protects personal information, and the choices you have.
On this page
Last updated 25 October 2026
1.About this policy and who we are
1.1 This policy explains how Barclo handles personal data through the web application at app.barclo.co.uk, the Barclo mobile application, and the website at barclo.co.uk (together, “Barclo” or “the Service”).
1.2 Barclo is operated by Barclo Ltd, a company registered in England and Wales under company number 17533891, with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom (“we”, “us”, “our”).
1.3 We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2.Our two roles: controller and processor
Barclo handles personal data in two different roles, and which one applies changes who is responsible for what.
2.1 We are the controller for personal data about the businesses that subscribe to Barclo and the people who run them: account details, billing information, website visitors, and our own use of usage data to run and improve the Service. Part A of this policy covers that data.
2.2 We are the processor for the personal data that a subscribing business puts into Barclo about its own clients and their pets. In that relationship the business is the controller and decides why and how that data is used; we only process it on the business's instructions to provide the Service. Part B of this document sets out the terms of that arrangement.
2.3 If you are a pet owner whose details are held in Barclo by a pet-care business, that business is the controller of your data. To exercise your rights, or to ask how your data is used, contact the business directly. We will help that business respond, but we cannot make decisions about your data ourselves.
3.The personal data we collect, and why
As controller, we collect and use the following.
Account and profile data. Your name, business name, email address, phone number, role, and login credentials (passwords are stored only in hashed form). We use this to create and run your account, authenticate you, and provide the Service. Lawful basis: performance of our contract with you.
Billing data. Subscription status, plan, and billing records. Your payment card details are collected and processed directly by our payment processor, Stripe, and are not stored by us. We use billing data to take payment for your subscription and keep accounting records. Lawful basis: performance of our contract, and our legal obligation to keep financial records.
Usage and technical data. IP address, device and browser information, log data, and information about how you use the Service. We use this to operate, secure, troubleshoot and improve the Service, and to prevent fraud and abuse. Lawful basis: our legitimate interests in running a secure and functioning service.
Location data (Barclo app). When a team member starts a walk in the Barclo mobile app and allows location access, the app collects the phone's precise location (GPS) to record the route of that walk, its distance and its duration. This continues while the walk is in progress even when the app is closed, in the background or the phone is locked, so the route keeps recording in a pocket. Location is collected only during a walk the team member has started, and stops when the walk is ended. It is not collected at any other time, is not used for advertising, and is not sold. The recorded route is stored with the walk record and can be seen by the business the walk was for; the business may choose to include a map of the route in the visit report it sends to its client. To draw that map, the route is sent to our mapping provider, Geoapify. Team members can refuse or withdraw location permission at any time in their phone's settings; walks can still be recorded without a route. Walk routes are part of the business's records, so we process them as the business's processor (see section 4 and Part B), and they are kept and deleted with those records. Lawful basis: performance of our contract with the business, and the business's legitimate interests in showing clients where their pet was walked.
Analytics data. If you agree to analytics cookies, we record how you use our website and the Barclo web app: the pages and screens you visit, the features you use (for example adding a client, sending an invoice or starting a subscription), and technical details such as browser, device type and approximate location (town or region, worked out from your IP address). When you have an account, our servers also record account events, such as signing up, starting or cancelling a subscription, or a payment failing, so we can see how people use Barclo and where it needs to improve. We send this data to Google Analytics, through Cloudflare. We identify you there only by a scrambled code made from your account number, never by your name, email address or business name, and we never send any data about your clients or their pets. If you use the Barclo mobile app and agree to share usage data, the app records which screens you use, the actions you take and any errors you hit; we keep this on our own servers and send it to Google Analytics in the same way. You can change your mind at any time with the Cookie settings link at the bottom of every page of our website, in the web app under Settings, Account, or in the mobile app's settings. Lawful basis: consent.
Support data. The content of messages you send us when you ask for help. We use this to respond to you and improve our support. Lawful basis: our legitimate interests, and performance of our contract.
Marketing data. Where you have opted in, or where you are an existing customer and have not opted out, your contact details for sending you information about Barclo. You can opt out at any time using the unsubscribe link or by contacting us. Lawful basis: consent, or our legitimate interests in marketing to existing customers.
Feedback when you cancel. If you cancel your subscription we may ask, optionally, why you are leaving, and whether you would like us to call you. We use your answer only to improve Barclo and, if you ask us to, to call you. Lawful basis: consent.
4.Client and pet data
When you use Barclo to manage your business, you enter personal data about your clients (for example names, contact details, addresses and notes) and information about their pets. We process this only as your processor, on your instructions, to provide the Service. We do not use it for our own purposes. Part B governs this processing. You, as the controller, are responsible for having a lawful basis and for giving your clients the privacy information they are entitled to.
5.Automated decision-making
Barclo automates tasks such as reminders, recurring bookings, invoices and reports. These help you run your business but do not make decisions that produce legal or similarly significant effects about any individual within the meaning of Article 22 of the UK GDPR. We do not carry out that kind of solely automated decision-making.
7.International transfers
7.1 Where personal data is transferred outside the UK, we make sure it is protected by an approved safeguard.
7.2 Transfers to Stripe in the United States are protected by the UK Extension to the EU-US Data Privacy Framework where Stripe is certified, and otherwise by the International Data Transfer Agreement (IDTA) or UK Addendum.
7.3 Brevo processes data within the European Union, which the UK recognises as providing an adequate level of protection.
7.4 Transfers to Google and Cloudflare in the United States are protected by the UK Extension to the EU-US Data Privacy Framework, under which both are certified, and otherwise by the IDTA or UK Addendum.
8.How long we keep personal data
8.1 We keep account and profile data for as long as your account is active, and for 3 months after it closes, after which we delete or anonymise it, unless we need to keep it longer.
8.2 We keep billing and accounting records for 6 years to meet our legal obligations.
8.3 We keep usage and log data for 3 months. Analytics data is kept in Google Analytics for 14 months, and app usage data on our own servers for 14 months. When an account is closed we ask Google Analytics to delete the data linked to it.
8.4 Client and pet data is kept and deleted as set out in Part B and on the instructions of the controlling business.
9.How we keep personal data secure
We use appropriate technical and organisational measures to protect personal data, including encryption of data in transit, access controls and role-based permissions, separation of each business's data, restricted administrative access, and regular backups. No system can be guaranteed to be completely secure, but we work to protect your data and to deal quickly with any issue. Our security measures are described further in Annex 2.
10.Your rights
10.1 Under UK data protection law you have the right to: be informed about how your data is used; access your data; have inaccurate data corrected; have your data erased in certain circumstances; restrict or object to processing; data portability; and, where we rely on consent, to withdraw it at any time.
10.2 To exercise any of these rights over data we control, contact us using the details in section 13. We will respond within one month.
10.3 If your data is held in Barclo by a pet-care business, that business is the controller. Send your request to that business. We will assist them in responding.
10.4 You have the right to complain to the ICO at ico.org.uk or on 0303 123 1113. We would appreciate the chance to address your concern first.
12.Children
Barclo is a tool for businesses and is not directed at children. We do not knowingly collect personal data from children.
13.Contact and changes
13.1 For any privacy question or to exercise your rights, contact:
Barclo Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
Email: support@barclo.co.uk
13.2 We may update this policy. If we make a material change we will give reasonable notice, for example by email or a notice in the app, before it takes effect.
14.Part B: Data Processing Agreement
This Data Processing Agreement (“DPA”) forms part of the agreement between us and a business that subscribes to Barclo (the “Customer”). It applies where we process personal data on the Customer's behalf. In this Part, “you” and “your” mean the Customer.
1. Roles and scope
1.1 For personal data about your clients and their pets that is processed through Barclo, you are the controller and we are your processor.
1.2 This DPA, together with our Terms of Service and your configuration and use of the Service, sets out your documented instructions to us. We will process the personal data only to provide and support the Service, and as set out in this DPA, unless the law requires otherwise, in which case we will tell you first unless the law prevents us.
1.3 The subject matter, duration, nature and purpose of the processing, the types of personal data, and the categories of data subjects are set out in Annex 1.
1.4 If we believe an instruction from you breaches data protection law, we will tell you.
2. Our obligations as processor
We will:
2.1 Process only on your documented instructions, as described in clause 1.2, including for any transfer of personal data outside the UK.
2.2 Confidentiality. Ensure that the people we authorise to process the personal data are bound by a duty of confidentiality.
2.3 Security. Take appropriate technical and organisational measures to protect the personal data, as required by Article 32 of the UK GDPR. Our current measures are set out in Annex 2.
2.4 Sub-processors. Only engage another processor (a “sub-processor”) under your authorisation, as set out in clause 3.
2.5 Assist with individuals' rights. Taking into account the nature of the processing, help you by appropriate technical and organisational measures, so far as possible, to respond to requests from individuals exercising their rights. Where a client contacts us directly about data we hold for you, we will refer them to you.
2.6 Assist with your wider obligations. Taking into account the nature of processing and the information available to us, help you meet your obligations around security of processing, notifying personal data breaches, communicating breaches to individuals, and data protection impact assessments and prior consultation (Articles 32 to 36).
2.7 Breach notification. Notify you without undue delay after becoming aware of a personal data breach affecting your data, and provide the information you reasonably need to meet your own breach-reporting obligations.
2.8 Deletion or return. At the end of the provision of the Service, delete or return all the personal data to you at your choice, and delete existing copies unless the law requires us to keep them. You will be able to export your data for 30 days after termination, after which we may delete it.
2.9 Audits and information. Make available to you the information reasonably necessary to demonstrate compliance with Article 28, and allow for and contribute to audits, including inspections, conducted by you or an auditor you appoint. Audits may be subject to reasonable notice, frequency, confidentiality and cost conditions, and must not unreasonably disrupt our business. We may satisfy this by providing relevant certifications or third-party reports where available.
2.10 Nothing in this DPA relieves us of our own direct responsibilities and liabilities as a processor under the UK GDPR.
3. Sub-processors
3.1 You give us general written authorisation to engage the sub-processors listed in Annex 3.
3.2 If we intend to add or replace a sub-processor, we will give you at least 14 days notice, for example by email or a notice in the app, so you have the chance to object on reasonable data protection grounds. If you object, we will work with you in good faith to find a resolution. If we cannot, you may terminate the affected part of the Service.
3.3 We will put a contract in place with each sub-processor imposing the same data protection obligations as in this DPA, and we remain liable to you for a sub-processor's performance of those obligations.
4. Your obligations as controller
You confirm that:
4.1 You have a lawful basis to collect and process the personal data you put into Barclo, and to instruct us to process it.
4.2 You have given your clients the privacy information required by the UK GDPR, including that their data is processed using Barclo, and have obtained any consents needed.
4.3 Your instructions to us are lawful, and the data you provide does not infringe anyone's rights.
5. International transfers
We will not transfer your data outside the UK except as needed to provide the Service through the sub-processors in Annex 3, and where an approved transfer safeguard is in place, as described in section 7 of Part A.
6. General
6.1 This DPA is part of the Terms of Service. If there is a conflict between this DPA and the rest of the Terms about the processing of personal data, this DPA prevails.
6.2 This DPA is governed by the law of England and Wales.
Annex 1: Details of processing
Subject matter: provision of the Barclo pet-care business management service.
Duration: for as long as the Customer's subscription is active, plus any export and deletion period afterwards.
Nature and purpose: hosting, storing, organising, displaying and transmitting personal data so the Customer can manage clients, pets, bookings, scheduling, communications, invoicing and payment requests.
Types of personal data: client names, contact details (email, phone, address), notes and messages, booking and scheduling records, invoice and payment records, information about pets that may be linked to an identifiable owner, and the routes of walks recorded by the Customer's team members in the Barclo app (location collected during a walk). The data is ordinary personal data. The Customer must not use free-text fields to record special category data unless it has a lawful basis to do so.
Categories of data subjects: the Customer's clients (pet owners), and any other individuals the Customer chooses to record, such as emergency contacts.
Annex 2: Security measures
Our current technical and organisational measures include:
- encryption of data in transit using TLS;
- access controls and role-based permissions, so users only see what their role allows;
- separation of each business's data so one business cannot access another's;
- restricted and logged administrative access on a least-privilege basis;
- secure password storage using hashing;
- regular backups and a documented restore process;
- hosting on a managed, access-controlled server environment; and
- monitoring and logging to detect and respond to issues.
Annex 3: Authorised sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Stripe | Payment processing for subscriptions and client payments | UK and EU, with transfers to the United States under the UK Extension to the Data Privacy Framework or the IDTA |
| Brevo (Sendinblue) | Sending transactional and notification emails | European Union (France) |
| Geoapify | Drawing route maps of walks from their recorded routes | European Union (Germany) |