Privacy Policy

Last updated: October 2026

1. Who We Are

Black Barrel Armouries Ltd (“BBA”, “we”, “us”, Company No. 14516011) is the data controller for personal data collected through bbauk.co. We are registered with the Information Commissioner’s Office under registration number ZC087445. We are based at Suite A, No.82 James Carter Road, Mildenhall, Bury St. Edmunds, IP28 7DE. Contact: info@bbauk.co.

2. Data We Collect

We collect the following categories of personal data:

  • Contact information: name, email address, postal address
  • Enquiry content submitted through contact forms
  • Order information for product purchases
  • Firearms certificate data for storage customers: certificate number, issuing constabulary, expiry date only
  • Investor applicant data: name, email, company, address, investment notes, and digital signature (investor data room applications only)
  • Website usage data via cookies (see Cookie Policy)

We do not retain physical copies of firearms licences or shotgun certificates.

3. Legal Basis for Processing

We process your data on the following legal bases under UK GDPR:

  • Contractual necessity — to process orders and provide storage services
  • Legal obligation — RFD register entries are required by UK firearms legislation
  • Legitimate interests — responding to enquiries, improving the website, assessing investor suitability, and maintaining records of signed NDAs

4. Data Retention

Contact and order data is retained for six years in line with HMRC requirements. RFD register entries are retained for a minimum of five years as required by the Firearms Act 1968 and subsequent amendments. Firearms certificate data for storage customers is deleted upon termination of the storage agreement, subject to statutory minimum retention periods. Investor applicant data (including signed NNN agreements) is retained for the duration of the fundraising campaign plus six years, in accordance with the Limitation Act 1980 (contractual claims period).

5. Your Rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you
  • Rectify inaccurate data
  • Request erasure (where legally permissible)
  • Restrict processing
  • Data portability
  • Object to processing based on legitimate interests

To exercise your rights, contact info@bbauk.co. You may also complain to the Information Commissioner’s Office at ico.org.uk.

6. Third-Party Processors

We share personal data with the following processors only to the extent necessary to operate the site and fulfil orders. We do not sell personal data.

  • Stripe — Payment processing. Processed in: USA (UK–US Data Bridge).
  • Clerk — User authentication and session management. Processed in: USA (UK–US Data Bridge).
  • Resend — Transactional email delivery. Processed in: USA (Standard Contractual Clauses).
  • Vercel — Website hosting and server-side request logs. Processed in: USA (Standard Contractual Clauses).
  • Upstash — Session and cache data storage. Processed in: USA (Standard Contractual Clauses).

Data may also be disclosed to the police or Home Office as required by UK firearms legislation.

7. International Transfers

Some of our processors are based in the United States. Transfers to US-based processors are made under one of the following safeguards: the UK–US Data Bridge (where the processor is certified), or UK Standard Contractual Clauses (SCCs) where the Data Bridge does not apply. You may request a copy of the relevant safeguards by contacting info@bbauk.co.

8. Security

Personal data is encrypted at rest. Access is restricted to authorised personnel. We maintain appropriate technical and organisational measures to protect against unauthorised access, loss, or disclosure.