Blooms Privacy Policy

Last updated: April 8, 2026

Blooms respects your privacy and processes personal data in accordance with the General Data Protection Regulation (GDPR). In this privacy policy, we explain what data we collect, why, how long we store it, and what rights you have.

1. Who is the data controller?

Blooms B.V.
Treubstraat 15A
2288 EG Rijswijk
Email: hello@blooms.nl
Chamber of Commerce: 75082136
VAT: NL002382377B45

2. What data do we process and why?

2.1 Orders and customer accounts

Data: name, address, email, phone number, payment details, order history.
Purpose: to fulfill your order, delivery, invoice, and customer service.
Legal basis: performance of a contract (GDPR art. 6(1)(b)).
Retention period: 7 years (tax retention obligation) for invoice data; other customer data up to 2 years after the last order.

2.2 Newsletter

Data: email address, first name (optional), click behavior in emails.
Purpose: sending newsletters, offers, product introductions.
Legal basis: consent (GDPR art. 6(1)(a)).
Retention period: until you unsubscribe via the link at the bottom of each email.

2.3 Contact form

Data: name, email, message.
Purpose: answering your question.
Legal basis: legitimate interest (GDPR art. 6(1)(f)).
Retention period: 12 months after the last correspondence.

2.4 Business subscriptions

Data: company name, Chamber of Commerce, billing address, contact person, delivery addresses, subscription preferences.
Purpose: fulfillment of the subscription and recurring delivery.
Legal basis: performance of a contract.
Retention period: for the duration of the subscription + 7 years (tax).

2.5 Website analytics and functional cookies

Data: IP address (anonymized), page visits, device/browser, referring site.
Purpose: website optimization, error analysis, conversion improvement.
Legal basis: consent (for tracking cookies) / legitimate interest (for functional cookies).
Retention period: see our cookie policy.

3. With whom do we share your data?

We only share personal data with processors who need it to provide their service to us, and only based on a data processing agreement. These include:

Shopify Inc. — webshop hosting and order processing (EU/US, adequacy decision + SCCs).
Payment service providers — Klarna, Mollie, Stripe, PayPal, Apple Pay, Google Pay.
Delivery services — PostNL and our florist's own delivery service, for package delivery.
Email marketing — Klaviyo.
Analytics — Google Analytics 4 and Google Tag Manager.

We never sell your data to third parties.

4. Transfer outside the EEA

Some processors (such as Shopify and Google) are located in the United States. Transfers take place based on the EU-US Data Privacy Framework (adequacy decision of July 10, 2023) and/or Standard Contractual Clauses (SCCs).

5. Your rights

You have the right to:

access your data (Art. 15 GDPR);
have inaccurate data corrected (Art. 16);
have data erased (Art. 17);
restrict processing (Art. 18);
transfer your data to another party (Art. 20);
object to processing based on legitimate interest (Art. 21);
withdraw previously given consent.

Send a request to hello@blooms.nl. We will respond within 4 weeks.

If you are dissatisfied with how we handle your data, you have the right to file a complaint with the Dutch Data Protection Authority.

6. Security

We take appropriate technical and organizational measures to protect your data against loss, misuse, or unauthorized access. The webshop operates via HTTPS, passwords are encrypted, and access to customer data is limited to employees who need it for their work.

7. Cookies

For the use of cookies, we refer to our cookie policy.

8. Changes

We may amend this privacy policy. The most current version will always be available on this page. For significant changes, we will inform active subscribers via email.

9. Contact

For questions about this privacy policy: hello@blooms.nl

Cart