Bloom ("Bloom", "we", "us") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect, why we collect it, and how it is used, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Bloom is the data controller for the personal data described in this policy. If you have any questions, you can contact us using the details on our Contact page.

1. What Data We Collect

Depending on how you interact with us, we may collect:

• Contact details you provide via our contact form or email (name, email address, business name, and message content);
• Information you provide when booking a discovery call or engaging Bloom's services;
• Payment and invoicing information processed via Stripe;
• Newsletter sign-up details, where you choose to subscribe;
• Technical and usage data collected automatically via cookies, Google Analytics, Google Search Console and Meta Pixel (see Section 4, Cookies).

2. Why We Collect It

We use personal data for the following purposes, and on the following legal bases under UK GDPR:

• To respond to enquiries and provide information about our services (legitimate interests / pre-contractual steps);
• To deliver services to clients under a signed agreement (performance of a contract);
• To process payments via Stripe (performance of a contract / legal obligation);
• To send newsletter or marketing communications, where you have opted in (consent);
• To understand how visitors use our Website, via Google Analytics and Search Console (legitimate interests, or consent where required for non-essential cookies);
• To measure the effectiveness of advertising via Meta Pixel, where you have consented to marketing cookies (consent).

3. Contact Forms

Information submitted via our contact form is used solely to respond to your enquiry and, where relevant, to follow up about our services. We do not add you to marketing communications unless you separately opt in.

4. Cookies & Tracking Technologies

Our Website uses cookies and similar technologies, including:

• Essential cookies, necessary for the Website to function correctly;
• Google Analytics, to understand how visitors use the Website;
• Google Search Console, to monitor Website performance in search results;
• Meta Pixel, to measure and improve the relevance of advertising, where consented to.

Full details of the cookies used, their purpose, and how to manage your preferences are set out in our separate Cookie Policy.

5. Stripe (Payment Processing)

Payments are processed securely by Stripe. Bloom does not store full card details. Stripe's use of your data is governed by Stripe's own privacy policy, available at stripe.com/privacy.

6. Newsletter

If you subscribe to Bloom's newsletter, we will use your email address to send you updates, tips and news about Bloom's services. You can unsubscribe at any time using the link in any email, or by contacting us directly.

7. Data Retention

We retain personal data only for as long as necessary for the purposes set out in this policy, including to meet legal, accounting or reporting obligations. Client contract and invoicing records are typically retained for 6 years in line with UK tax and accounting requirements. Enquiry data from contact forms that does not lead to a client relationship is retained for no longer than 12 months.

8. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you;
• Request correction of inaccurate data;
• Request deletion of your data, in certain circumstances;
• Object to or restrict certain processing;
• Request that your data be provided in a portable format;
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, please contact us using the details on our Contact page. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has not been handled in accordance with the law.

9. International Transfers

Some of the third-party services we use (such as Google and Meta) may transfer data outside the UK. Where this occurs, we rely on those providers' compliance with recognised safeguards, such as the UK's International Data Transfer Agreement or adequacy regulations, to ensure your data remains protected.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The version in force at the time of your visit will apply.

11. Contact Us

If you have questions about this Privacy Policy or how your data is handled, please get in touch via the details on our Contact page.