Privacy Policy
At Bloom, we take your privacy seriously. In this policy, we clearly and honestly explain what data we collect, why we do so, and what your rights are.
Last updated: June 7, 2026 • Effective from: June 7, 2026 • GDPR Compliant
Summary — the short version
- We only collect data that is necessary for processing your order or to keep you informed (if you wish).
- We will never sell your data to third parties and will not use it for advertising purposes without your consent.
- Your email address will only be used to deliver your order and — if you have subscribed — to send the newsletter.
- You can request access to, modification of, or deletion of your data at any time.
- We do not store data longer than necessary.
Article 1 — Who are we?
Bloom is a Dutch company that sells digital e-books for mothers. We are the data controller within the meaning of the General Data Protection Regulation (GDPR).
| Trade name | Bloom |
| Website | www.bloom-moeders.nl |
| privacy@bloom-moeders.nl | |
| Chamber of Commerce no. | [to be filled in upon registration] |
| VAT number | [to be filled in upon registration] |
Article 2 — What data do we collect?
We only collect data that is necessary for the service we offer.
2.1 Data you provide to us
| Data | When collected | Why |
|---|---|---|
| Email address | Upon purchase or newsletter subscription | Confirm order & deliver download |
| Name | Upon purchase (optional) | Personal invoice and salutation |
| Payment details | Upon purchase | Payment processing — we do not store this |
| Billing address | Upon purchase (optional) | Invoice issuance upon request |
| Messages | Via contact form | Answer your question or complaint |
2.2 Data collected automatically
When you visit our website, we automatically collect certain technical data: IP address (anonymized), browser type and version, operating system, pages visited, date and time of visit, and referring website.
No special categories: We deliberately do not collect special categories of personal data such as health data, race, political opinions, or religion.
Article 3 — Why do we process your data?
3.1 Performance of the agreement
If you purchase an e-book from Bloom, we process your data to fulfill the order: email confirmation, delivery of the download link, provision of an invoice, and handling of questions or complaints.
3.2 Newsletter and marketing
If you have subscribed to our newsletter, we will send you a maximum of one email per week. You can unsubscribe at any time via the link at the bottom of each newsletter.
3.3 Security and fraud prevention
We process certain technical data to prevent misuse of our website and to ensure the security of transactions.
3.4 Legal obligations
We are legally obliged to retain certain data, such as transaction data for the tax authorities.
3.5 Improvement of our service
We use anonymized and aggregated data to improve our website. No individual persons are identifiable in this process.
Article 4 — Legal basis for processing
| Processing | Basis |
|---|---|
| Processing your order | Performance of a contract (Art. 6 para. 1 lit. b GDPR) |
| Sending the newsletter | Consent (Art. 6 para. 1 lit. a GDPR) |
| Retention periods for tax authorities | Legal obligation (Art. 6 para. 1 lit. c GDPR) |
| Website security and fraud prevention | Legitimate interest (Art. 6 para. 1 lit. f GDPR) |
| Website usage analysis (anonymous) | Legitimate interest (Art. 6 para. 1 lit. f GDPR) |
| Answering your message | Legitimate interest (Art. 6 para. 1 lit. f GDPR) |
Article 5 — Sharing with third parties
We will never sell your personal data to third parties. We only share data when it is strictly necessary for the performance of our service.
| Party / Category | Purpose | Country |
|---|---|---|
| Payment provider (e.g., Mollie) | Secure processing of payments | Netherlands / EU |
| Email provider (e.g., Mailchimp) | Sending confirmation email & newsletter | USA — standard contractual clauses |
| Hosting provider | Storage of the website and files | EU |
| Analytics platform (e.g., Plausible) | Anonymized website statistics | EU |
In exceptional cases, we may be obliged to provide data to government authorities if legally required to do so.
Article 6 — Retention periods
| Category of data | Retention period | Reason |
|---|---|---|
| Order details & invoices | 7 years | Legal retention obligation for tax authorities |
| Email address (newsletter) | Until unsubscribe + 30 days | Execution of subscription |
| Messages via contact form | 2 years | Handling and potential follow-up |
| Technical log files | 90 days | Security and troubleshooting |
| Analysis data (anonymized) | 26 months | Trend analysis of website usage |
Article 7 — Cookies
Our website uses cookies. We only use functional and analytical cookies; we do not place tracking or advertising cookies without your consent.
| Type | Purpose | Consent required |
|---|---|---|
| Functional cookies | Session management, shopping cart, language preference | No — necessary |
| Analytical cookies (anonymized) | Visitor statistics | No — anonymized |
| Marketing/tracking cookies | Personalize advertisements | Yes — only after explicit consent |
Article 8 — Security
We have taken appropriate technical and organizational measures to prevent misuse, loss, and unauthorized access:
- SSL/TLS encryption — all connections are encrypted (HTTPS)
- Encrypted storage — data in databases is stored encrypted
- Secure payments — processed by PCI DSS certified providers
- Access security — access limited to authorized employees with strong authentication
In the event of a data breach, we will report this to the Dutch Data Protection Authority (if legally required) within 72 hours and will inform you as soon as possible.
Article 9 — Your rights
Under the GDPR, you have the following rights:
- Right of access — request what data we process about you
- Right to rectification — have inaccurate or incomplete data corrected
- Right to erasure — have data deleted ("right to be forgotten")
- Right to restriction of processing — have processing temporarily suspended
- Right to data portability — request data in a machine-readable format
- Right to object — object to processing based on legitimate interest
- Withdraw consent — withdraw consent (e.g., newsletter) at any time
- Lodge a complaint — lodge a complaint with the Dutch Data Protection Authority
Send an email to privacy@bloom-moeders.nl or use our contact form. We will respond within 30 days.
Complaint to the supervisory authority: Dutch Data Protection Authority — autoriteitpersoonsgegevens.nl — 088 - 1805 250
Article 10 — Minors
Our website and services are not aimed at children under the age of 16. We deliberately do not collect personal data from individuals younger than 16 years. If you are a parent or guardian and suspect that your child has left data, please contact us.
Article 11 — Changes to this policy
We may amend this privacy policy from time to time. The most recent version will always be available on this page. For significant changes that affect your rights, we will actively inform you by email.
Article 12 — Contact & questions
Do you have questions about this privacy policy or wish to exercise a right? Feel free to contact us:
- Email: privacy@bloom-moeders.nl
- Response time: Within 2 business days
- GDPR requests: Answered within 30 days