Privacy policy

1. Controller

Bloomly e.U., Landstraßer Hauptstraße 148a/2/20, 1030 Wien, Österreich, e-mail office@bloomly.at.

2. What we process

• Account data: name, e-mail address, sign-in information, phone number if you provide it.
• Order data: goods, prices, vouchers, seller and location, status, delivery or pickup details, invoices.
• Delivery and recipient data: recipient name, address, delivery notes, contact details where needed for delivery.
• Payment data: the payment provider processes your card or account details; we receive the payment status and references.
• Messages and cases: order messages, help requests, complaints, uploaded photos, decisions and their audit trail.
• Technical data: IP address, browser and device information, security and server logs.
• Our partners’ data for the DAC7 report (Digitale Plattformen-Meldepflichtgesetz): name, address, tax number and the state that issued it, VAT ID, company register number, financial account, and the number, consideration and fees of sales per quarter; for a sole trader, the proprietor’s first and last name, home address and date of birth. We report them every year to the Austrian tax office (Finanzamt Österreich), which may pass them on to the tax authorities of other EU Member States. Before each report the partner receives a statement with exactly these details.

3. Purposes and legal bases

• Performing the contract and steps before it (Art. 6(1)(b) GDPR): account, order, delivery, pickup, payment, refund, messages and support.
• Legal obligations (Art. 6(1)(c) GDPR): tax and accounting records, invoices, platform reporting duties (DAC7).
• Legitimate interests (Art. 6(1)(f) GDPR): security, fraud and abuse prevention, evidence, operating the platform reliably.
• Consent (Art. 6(1)(a) GDPR): only where we ask for it. We currently use no analytics, tracking or advertising technologies.

4. Sharing with partners

The partner fulfilling your delivery receives what it needs for that: the goods, delivery or pickup details, recipient details and your messages about the order. Partners do not receive your payment details.

5. Service providers

Hosting and technical infrastructure providers

Operation of the website and background service, database, sign-in, file storage, real-time notifications, backups, delivery of images and videos, sending our e-mails

Stripe Payments Europe, Ltd., Ireland

Payment processing and payouts to partners; independently responsible for payment data and fraud prevention

Mapbox, Inc., USA

Address suggestions when you enter delivery and billing addresses (your browser sends the characters typed and your IP address)

Google Ireland Ltd. / Apple Distribution International Ltd.

only if you sign in with them: confirmation of your identity and e-mail address

We have data processing agreements with our processors. Where data reaches countries outside the EEA – for example providers based in the USA –, this is based on an adequacy decision (EU-U.S. Data Privacy Framework) where the provider is certified, otherwise on the EU standard contractual clauses.

6. Retention

We keep personal data only as long as needed for its purpose. Order, invoice and tax records are kept for the statutory retention period (generally seven years under § 132 BAO). Messages and case records are kept as long as needed to fulfil and evidence the order and then deleted or anonymised, unless the law requires longer. Information we have reported under the Digitale Plattformen-Meldepflichtgesetz is deleted ten years after the end of the reporting period it relates to (§ 15(3) DPMG).

7. Cookies and local storage

Bloomly uses only strictly necessary cookies and storage. We therefore do not ask for consent; if we ever add optional technologies, we will ask first.

sb-… (Supabase)

Sign-in and session — strictly necessary; until you sign out

bloomly_session_id

Basket without an account — strictly necessary; 30 days

bloomly_order_grants

Access to your orders as a guest — strictly necessary; 60 days

auth_next

Return after signing in with Google or Apple — strictly necessary; 5 minutes

bloomly-market

Chosen city/region — needed for the offers shown; 1 year

bloomly-locale

Chosen language — needed for display; 1 year

Stripe

Payment fraud prevention, set by Stripe only during payment — strictly necessary

During checkout, your progress is kept in your browser's session storage only for the current session.

8. Guest orders

If you order without an account, we process the data needed for that order. Access to it is limited to that order, through a secured link or the order number together with your e-mail address.

9. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection, and you can withdraw a consent at any time with effect for the future. Write to office@bloomly.at. We answer within one month; where the law allows, this can be extended.

10. Right to complain

You can complain to a data protection supervisory authority; in Austria: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, www.dsb.gv.at.

11. Security

We use appropriate technical and organisational measures, including encrypted connections, access controls per role and branch, and row-level access rules in our database.

12. Our partners’ data

• Application: shop name, legal name, contact person, e-mail address and the optional details you give (phone, city, website, Instagram, description) – to review the application and contact you (Art. 6(1)(b) GDPR).
• Partner Area: name, e-mail address, sign-in information and role of the owners and invited team members, and a log of important changes – to run the Partner Area and perform the Partner Agreement (Art. 6(1)(b) GDPR; for invited team members point (f): secure access for the partner’s team).
• Payouts: Stripe collects the details for the Stripe account itself and processes them as a controller in its own right. We pass on the partner’s name and legal form and receive the status of the account and its payouts.
• Business and tax details for invoices, commission statements and the DAC7 report (section 2; Art. 6(1)(b) and (c) GDPR). Retention follows section 6.
• Personal invitation: when we invite a shop with a personal link, we keep the shop’s name, the contact person and their e-mail address, our line of invitation, and whether and when the link was opened – to attribute the invitation and follow it up (Art. 6(1)(f) GDPR: our interest in approaching selected shops directly). If the invitation leads to no application, we delete these details twelve months after the invitation.
• Sales notes: for shops we would like to approach, our internal sales tool records whom we contacted, when, by which channel and what was discussed – to coordinate the approach (Art. 6(1)(f) GDPR). The shop’s details come from public sources; notes about persons are deleted once we no longer approach the shop.