Privacy and Cookies Notice

Last updated: 16 July 2026

1. About this notice

Barnes & Mullins Limited respects your privacy and is committed to protecting your personal information.

This notice explains how we collect, use, store and share personal information relating to:

• visitors to www.bandm.co.uk;
• trade account applicants and account holders;
• owners, directors and employees of our trade customers;
• suppliers, professional contacts and other business contacts;
• people who submit enquiries, registrations, warranty requests or other forms; and
• people who receive communications from us.

Barnes & Mullins is a trade-only musical instrument distributor. Although a business or company is not itself an individual, information about its owners, directors, employees and other contacts may be personal information and is protected by data protection law.

This notice does not cover personal information relating to Barnes & Mullins employees, workers or job applicants, which is covered by separate privacy information.

2. Who we are

Barnes & Mullins Limited is the controller responsible for the personal information described in this notice.

Company name: Barnes & Mullins Limited
Company number: 01305000
Registered office and principal business address:
Grays Inn House
Unit 14, Mile Oak Industrial Estate
Maesbury Road
Oswestry
Shropshire
SY10 8GA
United Kingdom

Telephone: +44 (0)1691 652449
Privacy email: [email protected]

Questions, requests and complaints concerning personal information should be addressed to our Data Protection Lead using the contact details above.

3. Personal information we collect

Depending on your relationship with us, we may collect and use the following categories of personal information.

Identity and business contact information

This may include:

• your name;
• job title or business role;
• business name and trading name;
• business, registered office, retail store and warehouse addresses;
• email address;
• telephone and mobile numbers; and
• the name and contact details of relevant directors, proprietors, partners and employees.

Trade account information

This may include:

• information included in a trade account application;
• company registration and VAT information;
• the legal structure and ownership of the business;
• contact information for accounts payable, purchasing, sales and other departments;
• delivery, invoice and statement preferences;
• authorised users of the online trade account;
• account status and credit limit; and
• records of changes made to the account.

Credit and financial information

This may include:

• trade references and information received from referees;
• credit reports, credit scores and other information supplied by credit reference agencies;
• payment history;
• outstanding balances;
• bank or BACS payment references; and
• information required to prevent fraud or manage financial risk.

Our trade website does not currently take card payments and we do not store complete payment-card details through www.bandm.co.uk.

Order and transaction information

This may include:

• products ordered;
• order values and dates;
• delivery and collection information;
• invoices, statements and credit notes;
• returns, shortages and claims;
• warranty, servicing and repair information; and
• your full trading history with Barnes & Mullins.

Correspondence and enquiry information

This may include:

• emails, letters and other communications;
• telephone call notes;
• contact-form submissions;
• customer-service enquiries;
• complaints;
• requests concerning personal information; and
• notes made by our staff in connection with our business relationship.

Marketing information

This may include:

• your marketing preferences;
• the types of products, brands or instruments relevant to your role;
• records of marketing emails sent, opened or interacted with;
• records of unsubscribes and objections; and
• information about your professional interests or areas of expertise where relevant to our trade relationship.

Website and technical information

This may include:

• IP address;
• browser type and version;
• device type;
• operating system;
• approximate location derived from an IP address;
• login and account activity;
• pages viewed and searches made;
• referring website;
• date, time and duration of visits;
• cookie and consent preferences; and
• information used to maintain the security and operation of the website.

Information submitted through specialist forms

Where available on our website, this may include information submitted through:

• product registration forms;
• warranty and repair forms;
• service-centre applications;
• extended-warranty forms;
• newsletter registrations; and
• other enquiry or support forms.

Please do not provide special-category information, such as medical information, unless it is genuinely necessary for your enquiry.

4. Where we obtain personal information

We may obtain personal information:

• directly from you;
• from your employer or another person within your business;
• from a trade account application;
• from trade referees supplied by you or your business;
• from credit reference and business-information agencies;
• from public sources, including Companies House and business websites;
• through your use of our website;
• through cookies and similar technologies, where permitted;
• from our sales representatives, customer-service staff and other employees;
• from delivery, warranty, service and logistics partners; and
• from manufacturers, suppliers or distributors where this is relevant to an enquiry, warranty claim or commercial relationship.

Where we obtain personal information from someone other than you, we will provide appropriate privacy information where required by law.

5. How and why we use personal information

We use personal information only where we have a lawful basis for doing so.

To assess and open trade accounts

We use account-application, identity, business and credit information to:

• assess whether an applicant qualifies for a trade account;
• verify business details;
• contact trade references;
• assess creditworthiness;
• set and review credit limits; and
• create and administer trade and website accounts.

Our lawful bases are:

• taking steps to enter into or perform a contract, where the account holder is an individual, sole trader or partner;
• our legitimate interests in assessing potential customers, managing commercial risk and operating a trade distribution business; and
• compliance with legal obligations where applicable.

To manage our trading relationship

We use contact, account, transaction and correspondence information to:

• process and fulfil orders;
• deliver products;
• issue invoices, statements and credit notes;
• collect and allocate payments;
• manage credit and outstanding balances;
• provide customer service;
• deal with returns, repairs and warranty claims;
• maintain accurate account records;
• communicate product, pricing, availability and operational information; and
• administer the online trade account.

Our lawful bases are:

• performance of a contract or taking steps before entering into a contract;
• compliance with legal obligations; and
• our legitimate interests in managing our customer relationships and operating our business.

Where our contract is with your employer rather than with you personally, we generally rely on our legitimate interests in communicating with the appropriate people within that business.

To assess credit and prevent fraud

We may obtain information from credit reference or business-information agencies and use it alongside payment history, trade references and other relevant information.

Credit information may be used to:

• decide whether to offer credit;
• set or amend a credit limit;
• review an existing account;
• prevent fraud;
• recover debts; and
• manage financial and commercial risk.

Our lawful basis is our legitimate interest in protecting our business, managing credit risk and preventing fraud. We may also process this information where necessary to establish, exercise or defend legal claims.

To respond to enquiries and provide support

We use enquiry and correspondence information to respond to questions, provide information, investigate problems and maintain appropriate records of our communications.

Our lawful bases are:

• performance of a contract or steps requested before entering into a contract; and
• our legitimate interests in responding to enquiries and providing effective customer service.

To operate and protect our website and systems

We use technical, account and security information to:

• deliver website functions;
• maintain logged-in sessions;
• secure online accounts;
• detect suspicious or unauthorised activity;
• diagnose technical problems;
• maintain backups;
• prevent fraud and misuse; and
• protect our systems, users and business.

Our lawful bases are:

• our legitimate interests in maintaining secure and reliable systems;
• performance of a contract where website access forms part of our service; and
• compliance with legal obligations where applicable.

To analyse and improve our website

Where you have given the required cookie consent, we may use analytics information to understand:

• how visitors find and use the website;
• which pages and products are viewed;
• how the website performs;
• where errors occur; and
• how the website and its content can be improved.

For non-essential analytics cookies and similar technologies, our lawful basis is your consent.

To advertise and measure marketing

Where you have given the required cookie consent, we may use advertising and measurement technologies, including the Meta Pixel or similar services, to:

• measure the performance of advertising;
• understand actions taken after viewing an advertisement;
• create relevant advertising audiences; and
• show more relevant advertising through third-party platforms.

Our lawful basis for using non-essential advertising cookies and similar technologies is your consent.

To comply with the law and protect our interests

We may use personal information to:

• maintain accounting and tax records;
• respond to regulators, courts and public authorities;
• comply with legal and regulatory duties;
• obtain legal, financial or professional advice;
• maintain insurance;
• investigate complaints or incidents;
• establish, exercise or defend legal claims;
• prevent or investigate crime; and
• protect the rights, property and safety of Barnes & Mullins and others.

Our lawful bases are compliance with legal obligations and our legitimate interests in protecting and administering our business.

6. Direct marketing

We may send trade news, product information, pricing information, availability updates, offers and other business-to-business marketing that we believe is relevant to your professional role.

Contacts at limited companies and other corporate bodies

We may send relevant electronic marketing to contacts at limited companies, limited liability partnerships and other corporate bodies. We generally rely on our legitimate interests in promoting relevant products and maintaining our trade relationships.

Sole traders and certain partnerships

Sole traders and certain types of partnership are treated differently under the Privacy and Electronic Communications Regulations. We will send electronic marketing to these contacts only where:

• we have appropriate consent;
• the existing-customer or “soft opt-in” provisions apply; or
• another lawful permission is available.

Your marketing choices

Every marketing email will provide a clear way to unsubscribe.

You can also object to direct marketing at any time by:

• using the unsubscribe link in an email; or
• emailing [email protected].

Service, account, safety, product-recall, order and other necessary operational messages are not marketing and may still be sent after you unsubscribe from promotional communications.

We keep a minimal suppression record after an unsubscribe or objection so that we can ensure the person is not accidentally added to marketing again.

7. Cookies and similar technologies

Cookies are small data files stored on or accessed from your device. Our website may also use similar technologies, including pixels, tags, scripts, local storage and embedded content.

We do not treat continued use of our website as consent to non-essential cookies.

Strictly necessary cookies

These cookies and technologies are required for the website to function. They may be used to:

• maintain secure login sessions;
• remember essential account or security settings;
• provide shopping or ordering functions;
• balance website traffic;
• protect the website from fraud or attack; and
• remember your cookie choices.

Strictly necessary cookies do not require consent.

Functionality cookies

Functionality cookies remember choices or provide enhanced website features. Where a functionality cookie is not strictly necessary or otherwise exempt under applicable law, we will request consent before using it.

Analytics cookies

Where you consent, we may use services such as Google Analytics to measure and analyse use of our website.

Analytics cookies will not be activated before the required permission has been obtained, unless we use a specific legal exception and provide the controls and information required by law.

Advertising cookies and pixels

Where you consent, we may use advertising technologies such as the Meta Pixel to measure advertising, understand campaign performance and support relevant advertising.

Advertising and retargeting technologies will not be activated before consent.

Embedded content

Some pages may include content supplied by third parties, such as YouTube videos. Third-party content may use cookies or similar technologies. Where required, this content will remain blocked until you provide the relevant consent.

Current cookie list

The current cookie list available through our cookie consent tool forms part of this notice. It identifies the cookies and similar technologies detected on our website, including their:

• name;
• provider;
• purpose;
• category; and
• normal duration.

Because website technologies change, this live declaration is more reliable than a permanently fixed list within this notice.

Changing your cookie choices

You can accept, reject or manage non-essential cookies through the cookie banner when you first visit the website.

You can change or withdraw your choices at any time by selecting Cookie Settings on our website.

You can also delete or block cookies through your browser. Blocking strictly necessary cookies may prevent parts of the website, including account login and ordering functions, from working properly.

8. Who we share personal information with

We do not sell personal information.

Where necessary for the purposes described in this notice, we may share information with the following categories of recipient.

Technology and service providers

These may include organisations providing:

• website hosting and development;
• Magento or Adobe Commerce services;
• accounting and business-management systems;
• cloud storage and backup;
• cybersecurity;
• email and communication services;
• analytics;
• cookie-consent management;
• marketing distribution, including Mailchimp;
• data cleansing; and
• technical support.

These organisations may process personal information on our behalf under contractual obligations.

Delivery and logistics providers

We may provide names, business addresses, telephone numbers, email addresses and delivery information to couriers, freight companies, postal operators and logistics providers where necessary to deliver or collect goods.

Credit reference, debt and financial-service providers

We may share information with:

• credit reference and business-information agencies;
• banks and payment-service providers;
• credit insurers;
• debt-recovery providers; and
• fraud-prevention services.

Manufacturers, suppliers and service partners

We may share relevant information with a manufacturer, supplier, repairer, approved service centre or distributor where necessary to:

• answer a technical enquiry;
• arrange a repair;
• process a warranty claim;
• provide product support; or
• resolve a product or delivery issue.

We will limit the information shared to what is reasonably necessary.

Professional advisers and insurers

We may share information with our accountants, auditors, lawyers, insurers, insurance brokers and other professional advisers.

Public authorities and legal recipients

We may disclose information where required or permitted by law, including to:

• HM Revenue & Customs;
• courts and tribunals;
• law-enforcement agencies;
• regulators; and
• other public authorities.

Business reorganisations

If Barnes & Mullins or part of its business is sold, reorganised, financed or transferred, relevant personal information may be disclosed to prospective purchasers, investors, lenders and their professional advisers, subject to appropriate confidentiality and data-protection controls.

9. International transfers

Some of our service providers, including providers of email marketing, analytics, advertising, cloud or technical services, may process personal information outside the United Kingdom.

Where personal information is transferred outside the UK, we use an appropriate legal mechanism. Depending on the recipient and destination, this may include:

• UK adequacy regulations;
• the UK Extension to the EU–US Data Privacy Framework, where the US recipient has an active and applicable certification;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved contractual clauses; or
• another safeguard or exception permitted by data protection law.

We also take reasonable steps to ensure that the recipient is subject to appropriate security and confidentiality requirements.

You may request further information about the safeguards used for a particular transfer by contacting [email protected].

10. How long we keep personal information

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, including legal, accounting, tax, reporting, warranty and dispute-resolution requirements.

Our general retention periods are as follows:

Trade account and customer records

Core account, contact and trading records are generally retained while the account remains active and for up to six years after account closure or the final transaction.

Orders, invoices and accounting records

Orders, invoices, credit notes, payment records and related accounting information are generally retained for at least six years from the end of the relevant financial year, or longer where a legal, tax or regulatory requirement applies.

Credit reports and trade references

Credit-assessment information is retained while relevant to an active account and may be retained for up to six years after account closure or the relevant credit decision where necessary for risk management, audit or legal claims.

Credit information may be refreshed during an ongoing trading relationship so that decisions are based on reasonably current information.

Enquiries and correspondence

General enquiries that do not lead to an account or transaction are normally retained for up to two years after the last meaningful communication.

Correspondence connected to an account, transaction, warranty, complaint or legal matter may be kept with the relevant underlying record.

Marketing information

Marketing contact information is retained while the person remains a relevant business contact or until they object or unsubscribe.

We periodically review marketing information and remove or suppress details that are no longer relevant. A minimal suppression record may be retained for as long as necessary to respect an unsubscribe or objection.

Website security records

Website and security logs are generally retained for up to 12 months, unless they are required for longer to investigate an incident, prevent fraud or establish a legal claim.

Cookies

Cookie durations vary. The applicable duration for each cookie is shown in our current Cookie Settings or cookie declaration.

Data-protection requests and complaints

Records relating to information-rights requests and data-protection complaints may be kept for up to six years after the matter is closed so that we can demonstrate how it was handled.

We may retain information for longer where:

• required by law;
• a dispute or investigation is ongoing;
• legal proceedings are reasonably anticipated;
• the information is required to establish, exercise or defend legal rights; or
• deletion is prevented by a necessary backup or technical retention cycle.

When information is no longer required, we will delete it, anonymise it or securely place it beyond normal use.

11. Information security

We use appropriate technical and organisational measures designed to protect personal information against:

• unauthorised access;
• accidental loss;
• misuse;
• alteration;
• disclosure; and
•  

Measures may include access controls, passwords, multifactor authentication, system monitoring, backups, staff training and contractual security requirements for relevant service providers.

Access to personal information is limited to employees, contractors and service providers who have an appropriate business need. They are required to handle the information securely and confidentially.

No internet or information-storage system can be guaranteed to be completely secure. You should keep your website login credentials confidential and contact us promptly if you believe an account has been accessed without authorisation.

12. Automated decisions and credit scoring

Credit reference agencies may use automated systems to produce business credit scores and risk indicators.

Barnes & Mullins may take those scores into account, but we do not normally make decisions about an individual that have legal or similarly significant effects based solely on automated processing. Credit decisions are subject to review using relevant account, trading and business information.

Please contact us if you would like further information about a credit decision relating to you or your business.

13. Your information rights

Depending on the circumstances and the lawful basis being used, you may have the right to:

• request access to your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to delete personal information;
• ask us to restrict how information is used;
• object to particular uses of your information;
• receive certain information in a portable, machine-readable format;
• withdraw consent where our use is based on consent; and
• complain about how your information has been used.

These rights are not absolute. We may sometimes need to retain or continue using information for legal, contractual, regulatory or legitimate business reasons.

Your right to object

You have an absolute right to object to the use of your personal information for direct marketing. If you object, we will stop using your personal information for that purpose.

Where we rely on legitimate interests for another purpose, you may object on grounds relating to your particular situation. We will stop the relevant processing unless we have compelling legitimate grounds to continue or the information is required for legal claims.

Withdrawing consent

Where processing is based on consent, you can withdraw consent at any time. Withdrawal does not affect processing that took place before consent was withdrawn.

You can withdraw cookie consent through Cookie Settings and marketing consent through the unsubscribe link or by contacting us.

Exercising your rights

To exercise a right, contact:

Email: [email protected]
Post: Data Protection Lead, Barnes & Mullins Limited, Grays Inn House, Unit 14, Mile Oak Industrial Estate, Maesbury Road, Oswestry, Shropshire, SY10 8GA.

You do not normally have to pay a fee. We may ask for information needed to confirm your identity and understand your request.

We will respond without undue delay and normally within one month, subject to any lawful extension or pause permitted by data protection law.

14. Data-protection complaints

If you are unhappy with how we have collected or used your personal information, you can make a data-protection complaint by emailing [email protected] or writing to our Data Protection Lead at the address above.

Please provide:

• your name and contact details;
• a description of your concern;
• relevant dates, account details or correspondence; and
• what you would like us to do to resolve the matter.

We will:

• acknowledge your complaint within 30 days;
• take appropriate steps to investigate it without undue delay;
• keep you appropriately informed about its progress; and
• tell you the outcome of our investigation.

You may also complain to the UK supervisory authority:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

You can also use the complaint facilities available through the Information Commissioner’s Office website.

We would appreciate the opportunity to address your concern directly, but you are not required to contact us before approaching the Information Commissioner’s Office.

15. Children’s information

Our trade account services are intended for businesses and for people acting in a professional capacity. They are not directed at children.

We do not knowingly open trade accounts for people under 18. If you believe that a child has supplied personal information through our website without appropriate authority, please contact [email protected] so that we can investigate and take appropriate action.

16. Third-party websites

Our website may include links to websites operated by manufacturers, brands, service providers, social-media platforms and other third parties.

We do not control those websites or their privacy practices. You should read the applicable privacy notice before providing personal information to a third-party website.

17. Changes to this notice

We may update this notice when:

• our processing activities change;
• we introduce a new system or service;
• the law or regulatory guidance changes; or
• we identify that further explanation would be helpful.

The latest version will be published on this page with an updated revision date. Where a change materially affects how we use personal information, we will take reasonable steps to bring it to the attention of affected people.

18. Contact us

For questions about this notice, to exercise an information right or to make a data-protection complaint, contact:

Data Protection Lead
Barnes & Mullins Limited
Grays Inn House
Unit 14, Mile Oak Industrial Estate
Maesbury Road
Oswestry
Shropshire
SY10 8GA
United Kingdom

Telephone: +44 (0)1691 652449
Email: [email protected]