Privacy policy

1. Controller and contact

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

For privacy questions you can reach us at [datenschutz@bloomda.de].

[Data protection officer: if a data protection officer must be or has voluntarily been appointed, enter name and contact details here; otherwise delete this sentence.]

2. Overview: processing, legal bases, retention

The following overview summarises which data we process for which purpose. Details are in the sections below.

3. Hosting and server log files

Our website (storefront) is hosted by [Hosting-Anbieter Storefront] ([Serverstandort]). Our shop backend (order and customer data) runs on a virtual server (VPS) from [Hostinger International Ltd.] ([Serverstandort, z. B. EU – bitte prüfen]). The providers process data on our behalf under a data processing agreement pursuant to Art. 28 GDPR.

When you visit our website, information transmitted by your browser is automatically stored in server log files: IP address, date and time of the request, page/file requested, referrer URL, browser type and version, operating system. This is necessary to deliver and secure the website. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation). Log files are deleted or anonymised after [7 days], unless needed to investigate a security incident.

We load fonts from our own server; no connection to Google Fonts is made.

4. Customer account

You can create a customer account but do not have to – you can also order as a guest. For the account we process e-mail address, password (only as a secure hash), name, delivery and billing addresses and your order history to provide the account and handle orders conveniently. The legal basis is Art. 6(1)(b) GDPR. You can have the account deleted at any time; statutory retention obligations for order and invoice data remain unaffected.

5. Orders and contract performance

When you place an order we process the data required for contract performance: name, delivery and billing address, e-mail address, optionally telephone number (for delivery queries), ordered items, shipping method, payment method, amounts and time of order. The legal basis is Art. 6(1)(b) GDPR. Without this information we cannot conclude the contract.

Transactional e-mails (order confirmation, dispatch confirmation, invoice, withdrawal acknowledgement, password reset) are part of contract performance and are not advertising.

6. Payment processing

We process payments via Stripe, specifically Stripe Payments Europe, Limited (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland) and its affiliates (Stripe). We embed the Stripe payment form (Payment Element) in the checkout. Your payment data (e.g. card number, IBAN) is sent directly to Stripe and does not reach our servers; we only receive the payment status, payment method, the last digits or a payment token, and fraud risk indicators.

Stripe acts as our processor (Art. 28 GDPR) for payment processing. In addition, Stripe processes data as an independent controller, for example for fraud prevention, to meet legal obligations (e.g. anti-money laundering) and to improve its services. Stripe informs about this in its privacy policy (stripe.com/privacy). Our legal basis is Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (fraud prevention and secure payment processing).

In the payment form, Stripe uses technologies (e.g. the cookies or identifiers __stripe_mid and __stripe_sid) to detect fraud and process the payment securely. They are necessary for the payment you expressly requested (§ 25(2) no. 2 TDDDG); see cookie policy.

Payment methods in detail

• Cards, Apple Pay, Google Pay: With Apple Pay and Google Pay, Apple or Google transmit a payment token of your card to Stripe; neither we nor Stripe receive your full card data. Apple and Google are independently responsible for the use of their wallets.
• SEPA direct debit: Via Stripe we process your IBAN, name and the SEPA mandate to collect the amount.
• PayPal: You are redirected to PayPal. PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) processes your data as an independent controller; we receive the payment confirmation, name and e-mail address from PayPal/Stripe.
• Klarna: If you choose Klarna (e.g. invoice, instalments, pay now), we transmit (via Stripe) the data required for payment processing (including name, address, e-mail, telephone number, cart contents, amount) to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden, which acts as an independent controller. Klarna may carry out an identity and credit check, also on the basis of probability values and involving credit agencies. For more information see Klarna’s privacy policy, which is shown to you during checkout.

7. Shipping

For delivery we pass your name and delivery address to the carrier DHL (Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany) (Art. 6(1)(b) GDPR). We only pass on your e-mail address or telephone number if you have [consented] (e.g. for DHL parcel notifications; Art. 6(1)(a) GDPR). For deliveries to Austria, delivery may be carried out by a DHL partner.

8. Sending e-mails

To send e-mails (transactional e-mails and – with your consent – newsletters) we use the service Resend (Resend, Inc., USA). Your e-mail address, the content of the e-mail and technical delivery data (e.g. delivery status) are transmitted to and processed by Resend. Resend is our processor (Art. 28 GDPR); a data processing agreement is in place.

As Resend stores data in the USA, the transfer relies on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework (Resend is certified under it) and, in addition, on standard contractual clauses (Art. 45, 46 GDPR).

9. Newsletter

If you subscribe to our newsletter, we process your e-mail address, the chosen language and the source of the sign-up. Sign-up uses the double opt-in procedure: after you register we send you an e-mail with a confirmation link. Only after confirmation is your address added to the mailing list.

To prove your consent we log the time of sign-up, the time of confirmation, the consent text stored and [the IP address at sign-up and confirmation]. The legal basis is Art. 6(1)(a) GDPR (consent); the logging is based on Art. 6(1)(c) in conjunction with Art. 7(1) GDPR and Art. 6(1)(f) GDPR (duty to provide evidence). You can withdraw your consent at any time with effect for the future, e.g. via the unsubscribe link in every e-mail or by e-mail to us. After unsubscribing we only keep your address as proof (and to exclude it from future mailings) for [3 years].

10. Cart reminder (only with separate consent)

We only send you e-mails reminding you of an unfinished cart if you expressly and separately agreed to this during checkout (Art. 6(1)(a) GDPR, § 7(2) no. 3 UWG). For this we process your e-mail address and cart contents. You can withdraw your consent at any time; without consent, no reminder is sent.

11. Consent management (cookie banner)

We store your choice on optional cookies and similar technologies in your browser (local storage, key bloomda_consent): consent status per category, policy version, time and expiry date. No identifier for recognising you is generated. The legal basis is § 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(c), (f) GDPR (proof of consent). The choice is valid for [12 months]. You can change or withdraw it at any time via “Cookie settings” in the footer.

12. Statistics and marketing only with consent

We load optional services only after you have consented to the respective category (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). Without consent, no scripts from these providers are loaded and no data is sent to them. We use Google Consent Mode v2 in basic mode: until you consent, all consent parameters (“analytics storage”, “ad storage”, “ad user data”, “ad personalisation”) are set to “denied” and no Google tags are loaded.

• Google Analytics 4 (statistics; Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA): measurement of page views and purchases using online identifiers (cookies _ga, _ga_*). We only use events we trigger ourselves (product view, cart, checkout, purchase) and do not transmit contact, address or payment data.
• Google Ads (conversion measurement/advertising; Google Ireland Limited and Google LLC): attribution of ad clicks to purchases (cookies _gcl_*).
• Meta Pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, and Meta Platforms, Inc., USA): measurement of conversions and building audiences (cookies _fbp, _fbc). For collecting data via the pixel and transmitting it to Meta, we and Meta are joint controllers according to the case law of the CJEU (Case C-40/17); for Meta’s further processing, Meta is solely responsible.

Transfers to the USA rely on the adequacy decision for the EU-U.S. Data Privacy Framework (Google LLC and Meta Platforms, Inc. are certified) and, in addition, on standard contractual clauses. You can withdraw your consent at any time via “Cookie settings” in the footer; withdrawal does not affect the lawfulness of processing carried out until then. Which cookies are set and for how long is listed in the cookie policy.

13. Processing withdrawals

If you withdraw from your contract using the “Withdraw from contract” function, we process your name, e-mail address (for the acknowledgement of receipt), order number, selected items (if any) and an optional message, as well as the date and time of receipt. We promptly send you an acknowledgement of receipt on a durable medium (e-mail). The legal bases are Art. 6(1)(b) GDPR (performance of the contract/withdrawal) and Art. 6(1)(c) GDPR in conjunction with § 356a BGB (legal obligation). We store the data as proof and to defend claims [until the end of the third year after the year of withdrawal] (Art. 6(1)(f) GDPR); tax-relevant records are kept longer (section 17).

14. Contacting us

If you contact us by e-mail, telephone or contact form, we process your details and the content of your enquiry to handle it (Art. 6(1)(b) or (f) GDPR). We delete the data once the enquiry is resolved and no retention obligations apply, usually after [two years].

15. Data security

Data between your browser and our servers is transmitted encrypted (TLS/HTTPS). We take technical and organisational measures to protect your data, e.g. access restrictions and regular backups.

16. Recipients and transfers to third countries

Recipients of your data are – as described above – hosting providers, Stripe, Klarna, PayPal, the carrier, Resend and (only with consent) Google and Meta. We may also use service providers for accounting/tax advice and IT support who are bound by instructions. Transfers to countries outside the EU/EEA (in particular the USA) rely on an adequacy decision (EU-U.S. Data Privacy Framework) or on standard contractual clauses under Art. 46 GDPR. You can obtain a copy of the safeguards on request.

17. Retention for legal reasons

Under commercial and tax law we must retain certain records (Art. 6(1)(c) GDPR):

• Accounting records and invoices: 8 years (§ 147(3) sentence 1 no. 4 AO, § 257(4) HGB, § 14b UStG; shortened from 10 to 8 years by the Fourth Bureaucracy Relief Act),
• commercial books, inventories, annual accounts: 10 years,
• commercial and business letters received and sent: 6 years.

The period starts at the end of the calendar year in which the record was created. During this time, the data is restricted for other purposes. Irrespective of this, data may be kept longer as long as it is relevant for claims or tax assessments that have not yet become time-barred.

18. Your rights

You have the following rights against us regarding your personal data:

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• objection to processing (Art. 21 GDPR),
• withdrawal of consent given, with effect for the future (Art. 7(3) GDPR).

To exercise your rights, an e-mail to [datenschutz@bloomda.de] is sufficient.

19. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: [zuständige Datenschutz-Aufsichtsbehörde, z. B. Landesbeauftragte/r für den Datenschutz des Bundeslandes des Unternehmenssitzes]. You can also contact the supervisory authority at your place of residence.

20. Necessity of the information

Providing the data for ordering, payment and delivery is necessary to conclude the contract; without it we cannot fulfil the order. Information for the newsletter and marketing services is voluntary.

21. Automated decision-making

We ourselves do not make decisions based solely on automated processing that produce legal effects concerning you (Art. 22 GDPR), and we do not carry out profiling for advertising purposes without your consent.

Please note, however: our payment provider Stripe may automatically decline or hold payments for review based on risk scores as part of fraud prevention (e.g. Stripe Radar), and Klarna decides automatically on the admission of its payment methods. In such cases you can have the decision reviewed by a person, express your point of view and contest the decision; please contact us or – for Klarna – Klarna.

22. Changes to this privacy policy

We update this privacy policy when our processing or the legal situation changes. The current version applies. As of: 2026-11-03.