Data protection and privacy policy

Summary data protection statement for Barry Group

Last Updated: June 2026

Here is a brief summary of our Data Protection Statement. We encourage you to read it in full.

1. About us

We are James A. Barry & Company Limited trading as “Barry Group”, located in Upper Quartertown, Mallow, Co. Cork P51 X656, Ireland.

Email: dataprotection@barrys.ie
Telephone: +353 (0)22 30 100
Our website is: https://barrygroup.ie/

In order to provide our services, we need to process Personal Data. We are committed to protecting the rights and personal data of individuals in accordance with data protection legislation including the General Data Protection Regulation in Europe (the “GDPR”).

This Data Protection Statement applies to James A. Barry & Company Limited.

References in this statement to “we”, “us”, “our” “Company” or “Barry Group” shall apply to James A. Barry & Company Limited.

Barry Group is Ireland’s leading family run wholesale distribution company, servicing a diverse range of sectors including retail, foodservice, and hospitality. Through our various business channels, we service our customer retailers both domestically and internationally with an innovative offering of retail, food and alcohol solutions.

We work with retail store owners “Retailers” who we partner with to use our brands and benefit from collective resources supporting that brand such as marketing and sales. The main brands include:

For further information please see: https://barrygroup.ie/our-brands/

Where you provide personal data to a Retailer as a candidate or member of staff or as a member of the public, for example in the case of CCTV being operated in the store, the Retailer is the data controller of your personal data for the purposes of GDPR. You should refer to the Retailer’s data protection statement for further information.

This data protection statement provides information about our processing of personal data as part of our business where we are a controller of that personal data under the GDPR.

2. Contact details

We have appointed a Data Protection Officer. If you have any questions about this Data Protection Statement or the way in which your Personal Data is being used by us, please contact:

The Data Protection Officer
Barry Group
Upper Quartertown
Mallow
Co. Cork
P51 X656

Email: dataprotection@barrys.ie
Telephone: +353 (0)22 30 100

3. The structure of our data protection statements

For ease of use, we have layered our Data Protection Statements as follows:

• Our Summary Data Protection Statement provides brief summary information to help you to navigate to the information that is relevant to you
• Our General Data Protection Statement (this statement) describes how we process Personal Data of: (i) suppliers, retailers, wholesalers, partners, shareholders, investors and business prospects and (ii) Personal Data of end user customers of Retailers as well as visitors to our websites and social media followers where we are controllers of that personal data under the GDPR.
• Our Brands Data Protection Statements include information about our processing of personal data as owner and operator of certain brands including Costcutter and Carryout.ie where we are a controller of that personal data under the GDPR.

• Costcutter Brand GDPR Information
• Carry Out Off Licence Brand GDPR Information

• Our Recruitment Data Protection Statement informs candidates who are applying for jobs with our company how we process Personal Data through our employee selection process.

4. The purpose of this data protection statement

This Data Protection Statement applies to Personal Data that we process as part of our business. When we refer to “Personal Data” we mean any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

This Data Protection Statement provides information about how we manage personal data and sets out the basis on which any Personal Data we collect from you, or that you provide to us, will be used by us where we are controllers of that Personal Data for the purposes of the GDPR.

5. Who this data protection statement applies to

This Data Protection Statement provides specific information relating to the following individuals whose Personal Data we process:

• suppliers, retailers, wholesalers, partners, shareholders, investors and business prospects; and
• end user consumers and users/guests of websites that we operate including barrygroup.ie, www.costcutter.ie, and www.carryout.ie
• individuals who follow any of our social media sites “social media followers”.

This Data Protection Statement does not apply to Personal Data processed by any individual Retailer, unless referenced explicitly in here. The Retailer is a controller of personal data e.g. staff working for the Retailer or members of the public captured on CCTV being operated in the relevant Retailer store. You should refer to their data protection statement for further information.

We also have a separate Data Protection Statement covering candidates applying for jobs with Barry Group.

6. Sources of personal data

We receive Personal Data from a variety of sources, as follows:

• from you directly as part of our relationship;
• from visitors to our Barry Group websites including our Brand websites
• from Retailers;
• from “contact us” or feedback forms or from customer surveys;
• from third party websites or from a third party;
• from our network groups and partners;
• from our events;
• from social media followers;
• from visitors to Barry Group premises.

7. Our legal basis for processing personal data

We process all Personal Data lawfully and in accordance with the requirements of the law. The GDPR sets out the legal grounds for processing Personal Data.

When we process Personal Data it is generally on one of the following legal basis:

C ONTRACT

We will process Personal Data where necessary to perform our obligations relating to or in accordance with any contract that we may have with you or to take steps at your request prior to entering into that contract.

CONSENT

For certain processing activities we may rely on your consent.

Where we are unable to collect consent for a particular processing activity, we will only process the Personal Data if we have another lawful basis for doing so.

You can withdraw consent provided by you at any time by contacting us at dataprotection@barrys.ie.

LEGITIMATE INTEREST

At times we will need to process your Personal Data to pursue our legitimate business interests.

We will not process your Personal Data on a legitimate interest basis where the impact of the processing on your interests or fundamental rights and freedoms outweighs our legitimate interests.

You may object to any processing we undertake on this basis. If you do not want us to process your Personal Data on the basis of our legitimate interests, contact us at dataprotection@barrys.ie and we will review our processing activities.

LEGAL OBLIGATION

If we have a legal obligation to process Personal Data, such as the payment of taxes, we will process Personal Data on this legal ground.

DEFENCE OF LEGAL CLAIMS

We may process Personal Data in defence of legal claims or enforcing legal rights.

8. Categories of personal data

Depending on the scope of the relationship that we have with you we may collect some or all of the following Personal Data. We have outlined how we use the Personal Data in the next section.

Examples of Personal Data

• Contact Data may include a person’s email address, phone number, postal address, billing/delivery address, other communication details (e.g. Social Media links and contact information)
• Communication Data may include phone calls, texts, email correspondence and hard copy correspondence
• Financial Data may include payment related or transaction information or bank account details and financial data received as part of the services that we provide
• Identification Data includes information used to identify a person and may include a name, account number, date of birth, confirmation of being aged 18 or over, national tax identification number, driver’s license and passport information
• Marketing Data may include your name and Contact Data and any preferences in receiving marketing from us, your communication preferences and survey and competition responses.
• Media Data may include photographs, video data and recordings
• Web Data includes information that may be provided when you interact with our websites such as webforms and, to the extent that it includes Personal Data information on the type of device you’re using, its IP address, operating system, referral source, length of visit, page views and website navigation paths, as well as information about the timing, frequency and pattern of your service use.
• Recorded Data may include your image or your car number plate when you visit our premises or footage captured on CCTV. It may also include footage captured by dashcams on our delivery trucks. It may also include call recordings.
• Log Data may include logs of your visit to our premises where a visitor sign in system is in place (manual or electronic) – name, company and times of visit

9. How we use personal data

We want to ensure that Personal Data is used for the purposes that you would expect. Further information is included in the table below:

Website/End User Ecommerce Delivery

• to register you as a new website user
• to ask for your feedback in surveys and other forms
• to customise your experience on our website, or to serve you specific content that is relevant to you
• to process and respond to web forms completed by you
• to promote our products and services
• to process and deliver products and services that you order
• to improve and administer our website
• to process payments
• for internal operations, including support, troubleshooting, data analysis, testing, research, statistical and survey purposes
• to ensure the safety and security of our website and our services
• age verification/customer validation

Legal basis:

• Legitimate Interest in managing the security of our website and promoting our websites
• Contract
• Legal obligation

Retailer B2B Ecommerce Services

• to allow you to order products on the ecommerce section of the website
• to process and deliver your orders
• to process payments for products ordered
• to allow you to see previous orders
• to promote products that may be of interest to you
• to ensure the security of the ecommerce service
• age verification/customer validation

Legal basis:

• Contract
• Legitimate Interest in promoting our business and ensuring security of services
• Legal Obligation

Service Delivery activities

• to contact you about payments to and from you
• for customer relationship management and support
• to send notifications about changes/updates to our products and services
• to ensure deliveries are processed
• to fulfil our legal and contractual obligations

Legal basis:

• Contract
• Legal Claims
• Legitimate Interest in managing our relationships

Marketing & Promotion activities

• to respond to any requests from you
• to send newsletters and other information that may be of interest via available channels e.g. email/WhatsApp message
• to contact you as part of our business relationship or for lead generation and general administration
• to inform you of events that might be of interest
• to deliver and organise our conferences and events
• to operate competitions and surveys
• to facilitate the development of our business including to gain your insights to help optimise and develop our services and provide new offerings and improve existing offerings
• To provide insights for the purpose of marketing analytics

Legal basis:

• Consent
• Legitimate Interest in developing and promoting our business

Administration of Customer Relationship

• to manage/respond to a complaint/appeal
• to notify you of updates to this Data Protection Statement

Legal basis:

• Contract
• Legitimate Interest in managing customer relationships

Managing payments and administration of contract

• to process payments to and from our business
• to manage and administer our contracts

Legal basis:

• Contract
• Legitimate Interest in managing our business and administering contracts

Management of Buildings and Vehicles

• to ensure we manage health and safety and security of our premises, vehicles and staff including through the use of CCTV and other devices
• to register and manage your use and access to our buildings

Legal basis:

• Legal Obligation
• Legitimate interest in managing our business and ensuring health, safety and security

Regulatory and Legal

We may need to process certain Personal Data as part of our legal obligations, and to ensure our practices are in line with regulatory requirements. We may use Personal Data for the following purposes:

• to comply with our regulatory and professional requirements
• to prevent and detect fraud, money laundering or other offences
• to support investigation of incidents/accidents occurring in or around our premises or our vehicles e.g. damage to vehicles, complaints or injuries
• to comply with health and safety obligations;
• to exercise our right to defend, respond or conduct legal proceedings
• to ensure compliance with government regulations
• to comply with our legal obligations in respect of: the collection of taxes, levies, contributions; the detection of crime; labour standards; anti-bribery legislation; and industry specific legislation
• to consider any conflict of interests
• to comply with the law in certain jurisdictions

Legal basis:

• Legal Obligation
• Legitimate Interest in meeting our regulatory and legal obligations

Management of Corporate Affairs

• to take minutes at board meetings
• to contact shareholders/investors
• to enter into partnerships and other commercial relations
• to undertake appropriate due diligence

Legal basis:

• Contract
• Legitimate Interest in managing our corporate affairs
• Legal Obligation

10. Disclosure of personal data

In certain circumstances, we may disclose Personal Data to third parties as follows:

• to business partners and subcontractors for the performance of any contract relating to our services, including email, Communication Platforms, Customer Relationship Management system, web developers, payment processors, data aggregators, hosting service providers, external consultants, auditors, IT consultants and lawyers;
• to our Retail Partners for the purposes of managing our business and ensuring process improvement and customer satisfaction, or deal with complaints or other issues arising
• to analytics and search engine providers that assist us in the improvement and optimisation of our websites;
• if we or substantially all of our company is merged with another company or acquired by a third party, in which case Personal Data held by us will be one of the transferred assets;
• Credit reference, fraud-prevention or business-scoring agencies, or other credit scoring agencies; Debt collection agencies or other debt-recovery organisations;
• if we are under a duty to disclose or share Personal Data in order to comply with any legal obligation (including tax, audit or other authorities), or in order to enforce or apply any contracts that we have;
• to protect our rights, property, or safety, or that of our Business Contacts or others. This may include exchanging Personal Data with other companies and organisations for the purpose of fraud protection. When we engage another organisation to perform services for us, we may provide them with information including Personal Data, in connection with the performance of those functions. We do not allow third parties to use Personal Data except for the purpose of providing these services.

11. Security measures

We will take all steps reasonably necessary to ensure that all Personal Data is treated securely in accordance with this Data Protection Statement and the relevant law, including the GDPR. In particular, we have put in place appropriate technical and organisational procedures to safeguard and secure the Personal Data we process. We monitor for and do everything we can to prevent security breaches of the Personal Data that we process.

Once we have received your Personal Data, we will use strict procedures and security features for the purpose of preventing unauthorised access and ensuring that only those who need to have access to your Personal Data can access it.

We also use secure connections to protect Personal Data during its transmission. Where you have been given (or where you have chosen) a password which enables you to access services, you are responsible for keeping this password confidential. Please do not share your password with anyone.

If you think that there has been any loss or unauthorised access to Personal Data of any individual, please let us know immediately.

12. International transfers

In order to provide our products and services we may need to transfer Personal Data outside the European Economic Area (EEA). We ensure that any transfer of Personal Data outside the EEA is undertaken using legally compliant transfer mechanisms and in accordance with the GDPR.

If we transfer Personal Data outside of the EEA, we generally rely on the Standard Contractual Clauses under Article 46.2 of the GDPR adopted by the EU Commission. We may also rely on some of the other legally compliant transfer mechanisms provided under the GDPR.

13. Cookies

Cookies are small text files placed on your computer or mobile device by websites that you visit, and they help us improve the products and services that we offer you. They are used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site. Cookies may allow a website to remember your activity over a period of time. Some cookies are optional and you do not have to accept them.

Further information on the cookies we use on our website and the purpose behind their respective uses is included in our Cookie Management Tool available on our website.

14. Third party websites

Our websites may contain links to and from third party websites. If you follow a link to any of these websites, please note that these websites have their own privacy settings, and these are not endorsed by us. We do not accept any responsibility or liability for these third-party websites. Please undertake the appropriate due diligence before submitting any Personal Data to these websites.

15. Retention

We will store your Personal Data only for as long as necessary for the purpose(s) for which it was obtained. The criteria used to determine our retention periods include:

1. the length of time we have an ongoing relationship and/or provide our services;
2. the type of services that you are receiving,

• whether there is a legal requirement to which we are subject; and

1. whether the retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation, or regulatory investigations).

Please contact us at dataprotection@barrys.ie if you wish to obtain further information concerning our retention periods.

16. Your rights

You have various rights relating to how your Personal Data is used.

Right of access to Personal Data

You have the right to ask for all the Personal Data we have about you. When we receive a request from you in writing, we must give you access to everything we’ve recorded about you as well as details of the processing, the categories of Personal Data concerned and the recipients of the Personal Data.

We cannot give you access to a copy of your Personal Data in some limited cases including where this might adversely affect the rights and freedoms of others.

Right of rectification of Personal Data

You should let us know if there is something inaccurate in your Personal Data.

We may not always be able to change or remove that Personal Data, but we will correct factual inaccuracies and may include your comments in the record to show that you disagree with it.

Right of erasure of Personal Data (right to be forgotten)

In some circumstances you can ask for your Personal Data to be deleted, for example, where:

• your Personal Data is no longer needed for the reason that it was collected in the first place
• you have removed your consent for us to use your Personal Data (where there is no other lawful basis for us to use it)
• there is no lawful basis for the use of your Personal Data
• deleting the Personal Data is a legal requirement

Where your Personal Data has been shared with others, we will do what we can to make sure those using your Personal Data comply with your request for erasure.

Please note that we can’t delete your Personal Data where:

• we are required to have it by law
• it is used for freedom of expression
• it is used for public health purposes
• it is used for scientific or historical research or statistical purposes where deleting the Personal Data would make it difficult or impossible to achieve the objectives of the processing
• it is necessary for legal claims.

Right to restrict what we use your Personal Data for

You have the right to ask us to restrict what we use your Personal Data for where:

• you have identified inaccurate Personal Data, and have told us of it
• where we have no legal reason to use the Personal Data, but you want us to restrict what we use it for rather than erase the Personal Data altogether

When Personal Data is restricted, it can’t be used other than to securely store the Personal Data and with your consent to handle legal claims and protect others, or where it’s for important public interests.

Right to object

You have the right to object to processing of your Personal Data which is based on public interest or legitimate interest processing. We will no longer process the Personal Data unless we can demonstrate a compelling ground for the processing.

Right not to be subject to automated decision-making

You have the right not to be subject to a decision based solely on automated processing. This right shall not apply where the processing is necessary for a contract with you, or the processing is undertaken with your explicit consent, or the processing is authorised by law.

You can make a complaint

You have the right to lodge a complaint with the local supervisory authority for data protection in the EU member state where you usually reside, where you work or where you think an infringement of data protection law took place.

17. Questions or complaints

Thank you for reading our Data Protection Statement. Please contact us at dataprotection@barrys.ie if you have any questions.

If we are unable to resolve your concerns, you have the right to contact the supervisory authority in the country where you live or work, or where you consider that the data protection rules have been breached.

Online Form: https://forms.dataprotection.ie/contact

Address: 6 Pembroke Row, Dublin 2, D02 X963, Ireland

Tel: +353 (0)1 7650100 or 1800 437 737