Privacy policy

BAYROL DEUTSCHLAND GMBH – BAYROL FRANCE SAS – BAYROL IBERICA SLU

KEY SUMMARY

This Privacy Notice applies to users of our websites and our digital services, including our mobile application "My Pool Expert" (iOS and Android) and related services, who (i) submit general inquiries, complaints or comments by telephone, e-mail or mail, (ii) create an account and use our application features, and/or (iii) subscribe to our e-mail newsletter. We process your personal information only for the purposes described in this Privacy Notice, including responding to your inquiries, providing and securing our digital services (including account management, personalised recommendations and support), and sending e-mail newsletters and other marketing communications where permitted and/or where you have consented.

We use cookies that collect information about your use of the website to improve the content and usability of our website. For more information about our cookies, please see our Cookie Policy: https://www.bayrol.com/cookies

Depending on your settings and applicable law, our mobile application may also use technologies similar to cookies (e.g., SDKs and device identifiers) to operate the service, ensure security, measure performance, and improve user experience. Where required by law, such technologies are subject to your consent and can be managed through the application settings and/or your device settings.

This Privacy Notice explains what data we process, why, the legality of this process and your rights.

ABOUT US AND ABOUT THIS NOTICE

This Privacy Notice is provided by BAYROL France SAS, BAYROL Deutschland GmbH and BAYROL Iberica SLU ("BAYROL" or "we"). BAYROL Deutschland GmbH also acts as the responsible entity for users of our Italian-language services. We are a "controller" for the purposes of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and any other applicable national data protection and privacy legislation (collectively the "Data Protection Law").

We take your privacy very seriously. We ask that you read this Privacy Notice carefully, as it contains important information about our processing and your rights.

This Privacy Notice covers processing carried out in connection with (i) the use of our websites and related contact channels and (ii) the use of our mobile applications and associated digital services, including "My Pool Expert".

How to Contact Us
If you have any questions about this Privacy Notice, how we process your personal data or if you wish to exercise any of your rights, please contact: [email protected].

Changes to the Privacy Notice
We may change this Privacy Notice from time to time. We will alert you on the website and/or within our digital services when changes are made. Current version: April 2026.

WHAT PERSONAL DATA DO WE COLLECT AND WHY?

Personal data provided by you

  • Visitors only
    If you are simply browsing our website, we will not collect any personal data, other than information collected through cookies or similar technologies as described in our Cookie Policy.
  • Information you submit
    We process personal information about you (such as your name, address, e-mail address and telephone number and anything else you provide to us) when you contact us by telephone, e-mail or mail to respond to your inquiry.
    We also collect personal information when you contact us, send us feedback or respond to surveys that we use to improve our services and products in the future.
  • Email newsletter and marketing communications
    If you subscribe to receive our e-mail newsletter, which contains information about our products, offers and news, we will use your name and e-mail address and, where you choose to provide it or where it is generated through your use of our services, information relating to your pool and/or spa (including hot tubs) (such as type, size/volume, filtration and treatment/disinfection method, and other configuration preferences). We use this information to tailor the content of our communications to your needs and interests (for example, maintenance tips, seasonal guidance, and product recommendations relevant to your pool/spa configuration). You can unsubscribe at any time by contacting us using the details above or by clicking the "unsubscribe" link in the e-mails you receive.
  • Users of the "My Pool Expert" application
    When you create an account and use the "My Pool Expert" application, we may process the following categories of personal data:
    • Account and identification data
      First name, last name, e-mail address, preferred language, user ID and account creation date, and data necessary for authentication (password stored in a secure hashed form and verification codes sent by e-mail). Account data is hosted on secure servers located in the European Union/EEA.
      Purpose: create and administer your user account; verify your e-mail address and enable login; provide core app features linked to your account (including saving your pool/spa setup and analysis history); and send strictly necessary service e-mails (e.g., verification codes and password reset instructions).
    • Pool / Spa configuration data
      Information you provide about one or more pools and/or spas (including hot tubs), such as type and subtype, volume/size, filtration type, disinfection/treatment method, automatic treatment equipment, and optional labels such as a pool/spa name.
      Purpose: personalised recommendations, dosage calculations, display of relevant content, and management of multiple pools/spas within your account.
    • Water analysis data and history
      Values you enter manually (e.g., pH, chlorine/bromine, alkalinity/TAC, salt, temperature and similar parameters) and measurement dates, including analysis history.
      Purpose: recommendations, monitoring and history features, and troubleshooting support.
    • Usage and technical data
      Information about your interactions with the application (e.g., features used, navigation) and technical information (e.g., device type, operating system version, app version), security logs, and diagnostic data such as crash and performance reports.
      Purpose: service improvement, maintenance, performance monitoring, security, fraud/abuse prevention, and statistics.
    • Location data (optional)
      If you enable location services, we may process approximate and/or precise location depending on your device permissions and settings.
      Purpose: contextual advice (e.g., weather/seasonal guidance) and locating nearby dealers (where offered). You can disable location at any time via your device settings and/or in-app settings.
    • Support interactions
      If you contact support through the application, help pages or e-mail, we process your messages and any relevant technical context and account identifiers needed to respond.
      Purpose: customer support, incident resolution, and service improvement.
    • AI-assisted digital assistant (where available)
      If you use the in-app assistant, we process the content of your questions and, where applicable, relevant context (such as pool/spa configuration and recent analysis information) to generate responses and provide troubleshooting guidance.
      Purpose: provide automated assistance for pool/spa water treatment (including troubleshooting guidance and product recommendations) and improve service quality. The assistant's recommendations are informational only and may be inaccurate or incomplete. You should always verify recommendations against the relevant product label and instructions for use and, where appropriate, seek advice from a qualified professional. Recommendations are not used to make binding decisions.

Special categories of personal data provided by you
We do not request or intentionally collect any special categories of personal data about you. Please do not provide sensitive information (e.g., health data) in free-text fields or support messages unless strictly necessary. If you choose to provide such information, we will process it only to the extent necessary to respond to your request and in accordance with Data Protection Law.

Personal information about other people
If you give us information on behalf of someone else, you confirm that the other person has appointed you to act on their behalf and has consented to you doing so.

HOW IS THE PROCESSING OF YOUR PERSONAL DATA LEGAL?

We are allowed to process your personal data on the following legal grounds:

Performance of a contract (service delivery)
When you create an account and use our application or other digital services, we process the data necessary to provide the service you request, such as managing your account, storing your pool/spa setup and analysis history, generating recommendations, and providing support.

Legitimate interest
It is in our legitimate interest to:

  • respond to inquiries to serve our customers and provide product support;
  • generate statistical data, to the extent that anonymised data ceases to be personal data;
  • monitor the use of our website in order to improve it. To do this, we use aggregated data so that it does not affect your privacy;
  • ensure the security of our websites, applications and digital services (including preventing fraud/abuse and managing incidents); and
  • measure and improve the performance of our applications and services (e.g., diagnostics and bug fixing), to the extent permitted by applicable law.

Please note that you have the right to object to the processing of your data in relation to the identified legitimate interests and that we must cease the relevant processing activities if we cannot demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Consent
We will only send you our newsletter and other marketing communications by e-mail if you have given us your consent where necessary. You can withdraw this consent at any time.

We also rely on your consent where required for optional features such as enabling geolocation services, receiving certain types of notifications, and the use of certain cookies/SDKs or similar technologies where such consent is required by law.

WHO WILL HAVE ACCESS TO YOUR PERSONAL DATA?

Like any business, we use service providers to operate our websites and digital services. Some of these service providers will process your data as part of the services they provide to us. We take steps to ensure that our service providers process your data in accordance with the law, use it only in accordance with our contract with them and keep it secure.

The following is a list of our processors and sub-processors who will have access to your personal data:

  • KIK Custom Products Inc. (United States) – IT system support
  • HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin, Germany – CRM (account/contact data management, consent records, customer communications management, and marketing segmentation where applicable)
  • Scalahosting (United States) – website and application hosting and server infrastructure
  • Cloudflare, Inc. (United States) – content delivery network (CDN) and web application firewall
  • CrowdStrike, Inc. (United States) – security monitoring and intrusion detection
  • Mailchimp / Intuit Inc. (United States) – e-mail newsletter delivery
  • Bakino (France) – application development, maintenance and technical access to My Pool Expert application data
  • Brevo SAS (France) – transactional e-mail delivery (e.g. verification codes, password reset instructions, and customer service forwarding)
  • Firebase / Google LLC (United States) – push notification delivery
  • Botpress Inc. (Canada) – AI assistant platform and conversation infrastructure
  • OpenAI, L.L.C. (United States) – AI language model powering certain assistant responses
  • Google LLC (Gemini) (United States) – AI language model powering certain assistant responses
  • Google LLC (Google Forms / Google Workspace) (United States) – collection and hosting of responses to online surveys and forms
  • Jotform Inc. (United States) – collection and hosting of responses to online surveys and forms
  • Google Maps API / Google LLC (United States) – dealer locator and mapping services
  • Google Analytics / Google LLC (United States) – audience measurement and performance analytics
  • Axeptio (France) – cookie consent management
  • Open Weather Ltd. (OpenWeatherMap) (United Kingdom) – weather data services

We also share data with our affiliates (for the purpose of making strategic group decisions) and as necessary to enforce our legal rights, defend legal claims and, if required by law, disclose to courts, police, law enforcement or regulators.

Transfers of your information outside the European Economic Area ("EEA")
Some of our service providers may be located outside the EEA or may process personal data outside the EEA. Where we transfer personal data outside the EEA, we implement appropriate safeguards in accordance with Data Protection Law, including the European Commission's Standard Contractual Clauses and, where necessary, supplementary technical and organisational measures. 

If you would like to know more about how personal data is transferred and to obtain an overview of the safeguards used, please contact us using the contact details in the section entitled "How to Contact Us".

How we protect your data
We endeavour to implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, accidental loss or alteration, unauthorised disclosure or access and any other form of unlawful processing. We ensure that the level of security and measures adopted to protect your personal data are appropriate to the risks presented by the nature and use of your personal data. We follow accepted industry practices to protect our computing environment and physical facilities.

WHEN WILL WE DELETE YOUR DATA?

The table below provides details of how long we will process your data.

Data we process How long it will be kept
Information from inquiries Until the inquiry is completed and no further response is received for 3 years.
Email newsletter / marketing communications 3 years from your last purchase or other meaningful contact with us (or until you tell us you no longer wish to receive the e-mail newsletter/marketing communications, as applicable). Where required, we may retain evidence of your consent and/or your opt-out (suppression record) for a longer period to demonstrate compliance and/or in accordance with applicable limitation periods.
Application account data (e.g., identity details, e-mail address, language, user ID, authentication-related data) For as long as your account is active. If your account is inactive for 2 years, we may contact you and/or deactivate it in accordance with applicable guidance. Following account deletion, data will be deleted or irreversibly anonymised within a reasonable period, unless we are required to retain certain information to comply with legal obligations or to establish, exercise or defend legal claims.
Pool/spa configuration data and water analysis history For as long as your application account is active. This data is deleted when your account is deleted, unless we need to keep certain information to comply with legal obligations or to establish, exercise or defend legal claims.
Support interactions (including support messages and related technical context) For as long as necessary to handle your request and then retained for up to 12–24 months for quality assurance, dispute handling and compliance purposes, unless a longer period is required by law or in connection with a legal claim.
Security logs and technical diagnostics (including crash and performance reports) For as long as necessary for security, troubleshooting, fraud/abuse prevention, and service improvement purposes, typically up to 6–12 months, unless a longer retention is necessary to comply with legal obligations or in connection with a security investigation or legal claim.
Records relating to the exercise of your data protection rights (e.g., access, rectification, erasure, restriction, objection, portability, withdrawal of consent) For as long as necessary to process and document your request. We then retain a limited record of the request and our response for up to 5 years for compliance and legal defence purposes, unless a longer period is required due to an ongoing dispute or legal obligation.

YOUR RIGHTS

As a data subject, you have the following legal rights:

  • Right of access to your personal data
  • Right to correct any errors in your information
  • Right to ask us to stop contacting you with direct marketing
  • Right to prevent the processing of your personal data in certain circumstances
  • Right to object to the processing of your data where it is processed for legitimate interests
  • Right to erasure in certain circumstances
  • Right to withdraw consent
  • Right to data portability (where applicable)

If you wish to exercise your rights, please contact us at the contact details listed above in the section entitled "How to contact us".

We will respond to any rights you exercise within one month of receiving your request, unless the request is particularly complex and/or we receive a large number of requests, in which case we will respond within three months.

Please note that there are exceptions to some of these rights which we will enforce in accordance with the law.

Where national law provides for post-mortem instructions regarding personal data, you may contact us to inform us how you wish your personal data to be handled after your death.

What happens if your rights are violated?
You may be entitled to compensation for damages caused by non-compliance with Data Protection Laws.

Complaints to the regulator
If you believe that we have not processed your data in accordance with this Privacy Notice, you should inform us as soon as possible. You also have the right to complain to the competent supervisory authority in your country. Information on how to do this is available on the website of each supervisory authority as indicated below:

Share