Privacy Policy

This Privacy Policy explains how an individual trading as Barrzen IT Solutions ("Barrzen", "we"), of Dhaka, Bangladesh, collects, uses, and protects personal data when you use the Barrzen Mail service (the "Service"). Barrzen IT Solutions is a trading name, not a registered limited company. This Policy is designed to align with the EU General Data Protection Regulation (GDPR) and the UK GDPR.

Compliance status. We have not appointed a Data Protection Officer and have not appointed an EU or UK representative. Article 27 GDPR requires a representative for a non-EU operator that offers services to EU/UK data subjects unless the processing is occasional, low-risk, and does not involve large-scale special-category data. We will either appoint a representative or limit EU/UK sales before processing EU/UK personal data at scale.

1 · Who is responsible

Barrzen is the data controller for account data. Polar, as Merchant of Record, is an independent controller for payment and tax data. For mailbox content, your Organization is the controller and Barrzen is the data processor under the Data Processing Agreement (a signed copy is available on request). Our privacy contact is support@barrzen.com.

2 · What we process and why

Account data (name, contact email, domain) — to set up and run your account. Lawful basis: contract performance.

Billing data (handled by Polar as an independent controller) — to collect fees and taxes under Polar's terms.

Mailbox content (your email messages and attachments) — to provide the hosting service. Stored content is encrypted at rest with EU-managed keys; Barrzen staff cannot open or read stored mail and access requires audited break-glass. Your Organization determines the lawful basis for its mailbox content; Barrzen processes on the documented instructions of the controller.

Traffic and authentication logs (IP addresses, connection metadata, SPF/DKIM/DMARC results) — to route mail, prevent abuse, and maintain security. Lawful basis: legitimate interests.

Usage telemetry (quota usage, send counts, bounce and complaint rates) — to enforce quotas and protect deliverability. Lawful basis: legitimate interests.

Website analytics (Google Analytics 4, only after you opt in) — to understand site use. Lawful basis: consent.

3 · Subprocessors

We use Polar (billing) plus EU-region compute, object storage, an outbound relay, and (after opt-in) website analytics, as listed in the Subprocessor Disclosure. We authorize these subprocessors under GDPR Article 28 and require them to protect data under terms no less protective than these. You may subscribe to subprocessor change notifications at support@barrzen.com.

4 · International transfers

Compute runs in an EU region. Object storage, outbound relay, billing, and (after opt-in) analytics may process data in the EU or US under appropriate safeguards (Standard Contractual Clauses or equivalent). Subprocessor locations are listed in the Subprocessor Disclosure.

5 · Retention

We keep mailbox content for your plan term plus 30 days after termination to allow export, then delete it unless law requires longer retention. Traffic and authentication logs are kept for 12 months for abuse and security analysis. Polar keeps billing records for the period its tax law requires.

6 · Your rights

You may access, rectify, erase, port, object to, or restrict processing of your personal data, subject to legal exceptions. We can produce account data we hold. Mailbox content is encrypted at rest; we assist the Organization (the controller) in producing mailbox content in a portable format, and decrypt it only for that purpose or on the controller's documented instruction. We do not read stored mail for support. To exercise these rights contact support@barrzen.com. You may complain to your local data protection authority.

7 · Security

Stored mailbox content is encrypted at rest with EU-managed keys. Barrzen staff cannot open or read stored mail; access requires audited break-glass. This is encryption at rest, not end-to-end encryption; inbound MX and outbound relay may process mail in transit so interoperable email works. In a personal data breach likely to risk your rights, we notify you and the relevant supervisory authority without undue delay and, where feasible, within 72 hours.

8 · No ads, no data mining

We do not serve advertisements and do not mine mailbox content for advertising or third-party analytics.

9 · Cookies and tracking

Essential session cookies run the site. Google Analytics 4 runs only after you opt in. We do not use advertising trackers. You can refuse GA4 and still use the Service.

10 · Children

The Service is for business use and is not offered to individuals under 16. We do not knowingly process children's data.

11 · Changes and contact

We may update this Policy with 30 days' notice. Questions reach support@barrzen.com or +8801754730922.