Privacy Policy

1. Overview and who is responsible

This policy explains which personal data we process when you visit our website, contact us or buy from us, why we do so, which service providers help us, and what rights you have. Personal data is any information that relates to you as an identifiable person.

Controller

BLOOM Outdoor Möbel GmbH
Industriestr. 112
75417 Mühlacker, Germany
Phone: +49 7041 986 9020
Email: service@bloom-outdoor.com

BLOOM Outdoor Möbel GmbH is responsible for this website and for the processing described in this policy, unless a section names another company.

Enquiries from the United Arab Emirates and the Gulf region, and messages to BLOOM Dubai’s own channels, are handled by BLOOM Dubai, an independent company. Read the supplement for the United Arab Emirates

Questions about your data

For any question about your personal data and to exercise your rights, write to privacy@bloom-outdoor.com.

2. Hosting, infrastructure and security

Website and server functions

Our website runs on Vercel (Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA). When you open a page, Vercel processes technical data such as your IP address, browser, operating system and the page requested, and records it in server logs. The website’s server functions run in the USA; those of our customer-service system (section 4) run in Singapore. Files you send us are stored with Vercel in Frankfurt, Germany. Legal basis: Art. 6 (1) (f) GDPR – our legitimate interest in a reliable, secure website.

Database and cache

Contact details, messages and related records are stored in a PostgreSQL database run by Neon (Neon Inc., USA) on servers in Singapore. Some data is held for a short time in a cache run by Upstash (Upstash Inc., USA) in Frankfurt, with copies in Singapore and Ireland; our search index is also stored with Upstash, in Ireland.

Error monitoring and protection against misuse

To find and fix errors we use Sentry (Functional Software, Inc., USA), which stores data in the EU (Frankfurt). When an error occurs, Sentry receives technical details – browser, page and the course of the error – and, from your browser, a short recording of the screen before the error in which all text and entries are masked. We have configured Sentry not to collect IP addresses. Our firewall and the spam protection of our forms log the IP address, country and browser of rejected requests. Legal basis: Art. 6 (1) (f) GDPR – our legitimate interest in a secure, working website; no consent is asked for this.

3. When you contact us

When you contact us, we process the information you give us – usually your name, contact details, your message and any files – to answer your enquiry, prepare quotes and fulfil orders. Legal basis: Art. 6 (1) (b) GDPR where your enquiry concerns a contract or steps before one; otherwise Art. 6 (1) (f) GDPR – our legitimate interest in answering enquiries properly.

Forms on our website

Our contact, project, sample and quote forms store your entries in our content management system Sanity (Sanity AS, Oslo, Norway) and send them to our team by email via Resend (Resend, Inc., USA; servers in Ireland). Photos you upload with a quote request are stored in Sanity as well. To keep out spam, our forms check, among other things, how quickly they were filled in.

Showroom appointments

When you book a showroom visit, we store your name, email address, phone number, area of interest and message in Sanity, enter the appointment with these details in the showroom’s Google Calendar (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), and send you a confirmation and a reminder by email via Resend. The confirmation contains a personal link to change or cancel your appointment.

Email

Our mailboxes run on Google Workspace (Google Ireland Limited). Emails to our service addresses are also received and sent through Resend and stored in our customer-service system (section 4). If you write to an individual member of our team, threads about a customer enquiry are copied into the same system – either because the team member marks them or because your address already belongs to a customer record. Other correspondence is not copied. Emails also remain in the team member’s mailbox.

WhatsApp

If you message us on WhatsApp, we use the WhatsApp Business Platform. It is provided by WhatsApp Ireland Limited (Merrion Road, Dublin 4, Ireland) to businesses in the European region and by WhatsApp LLC (USA) elsewhere; other Meta companies support them as sub-processors. We receive your phone number, the profile name you use on WhatsApp, your messages and any media, and store them in our customer-service system. Because Meta keeps media only for a short time, we copy pictures, documents and voice messages into our own storage. WhatsApp’s own terms and privacy policy apply to your use of the app.

Instagram

If you send us a direct message on Instagram (Meta Platforms Ireland Limited), we receive your Instagram username and profile name, your messages and any media. We answer in Instagram itself or through our customer-service tools – GoHighLevel and our own system (section 4) – where your messages are stored like other enquiries.

Live chat

On some country pages we offer a live chat from HighLevel Inc., 400 N. St. Paul St., Suite 920, Dallas, TX 75201, USA (GoHighLevel). Where our cookie banner is shown, the chat only loads once you have allowed the “Functional” category. When it loads and when you use it, your entries and your IP address are transmitted to HighLevel’s servers in the USA. Legal basis: your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG) and, for the content of your enquiry, Art. 6 (1) (b) or (f) GDPR.

Our chat assistant

Where we offer our own chat assistant on the website, its replies are written by an AI and marked as such; our team takes over for quotes and anything that needs judgement. Conversations are stored in our customer-service system. Section 5 explains how the AI processing works.

Telephone

If you call us, we note your details and your request as far as needed to deal with it.

4. Our customer-service system

Enquiries from all channels – email, WhatsApp, Instagram and chat – come together in BLOOM Connect, a customer-service system we develop and operate ourselves. It stores your contact record (salutation, name, company, email address, phone number, country, language), your conversations with us including attachments, and notes and tasks our team adds. This lets everyone who helps you see the full picture and answer consistently.

Only the members of our team responsible for your market have access. In October 2026 we transferred the earlier correspondence of our German service mailbox, going back to January 2021 and including notes from our previous ticket system, into this system.

Legal basis: Art. 6 (1) (b) GDPR for enquiries about orders and quotes; otherwise Art. 6 (1) (f) GDPR – our legitimate interest in handling customer enquiries efficiently and consistently.

5. Artificial intelligence in customer service

We use AI models to support our team. The AI makes no decision about you on its own; no decision with legal or similarly significant effect is made automatically (Art. 22 GDPR). We use AI for:

• Reply drafts – at a team member’s request, the AI drafts a reply to your email or message. A team member checks it, edits it where needed and sends it. Emails are never sent automatically.
• Summaries and search – the AI summarises conversations and contact histories, including an assessment of how a conversation is going, so our team can find them and catch up quickly. Email addresses and phone numbers are removed before summaries go into our search index.
• Customer notes – from past conversations, the AI keeps short notes on each contact, for example orders and quotes, agreements, complaints, preferences such as language and form of address, and your project. Our team can correct or delete these notes; they are only used to help draft replies.
• Sorting – the AI recognises the language of a message and whether an enquiry is private or from a business.
• Automatic replies – in our website chat and on WhatsApp, the AI can reply to you directly where we have switched this on. These replies are marked as coming from an AI.

The AI models are provided by Anthropic PBC (USA) and, for search, Microsoft (Azure OpenAI Service). We reach them through the Vercel AI Gateway (Vercel Inc., USA) with zero data retention: the providers process the content only to produce the result, do not store it and do not use it to train their models.

Legal basis: Art. 6 (1) (f) GDPR – our legitimate interest in answering enquiries quickly, consistently and in your language. You can object to this processing, in particular to the customer notes, at any time (section 13).

6. Online shop and payment

Orders

We do not offer customer accounts. When you order or request a quote, we process your details to fulfil the contract (Art. 6 (1) (b) GDPR). What you enter at checkout is saved in your browser so that nothing is lost; you can remove it by clearing your browser’s site data.

Delivery

We deliver mostly with our own vehicles. If we use an external carrier, we pass on your name and delivery address; we only pass on your email address and phone number to arrange a delivery date if you have expressly agreed to this when ordering (Art. 6 (1) (a) GDPR).

Payment with PayPal

Where we offer PayPal, payment is processed by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, which receives the payment details it needs (Art. 6 (1) (b) GDPR).

7. Cookies, local storage and your consent

Consent

On our pages for Germany and the United Kingdom we ask for your consent before loading anything that is not strictly necessary. Our own consent tool stores your choice in the cookie “bloom_consent” for 12 months; no external consent service is involved. You can change or withdraw your choice at any time via “Cookie Settings” in the footer. Legal basis for storing your choice: Art. 6 (1) (c) in conjunction with Art. 7 (1) GDPR. Our pages for markets outside Europe do not show a consent banner.

Strictly necessary storage

Without asking, we only store what the website needs to work: your chosen country (“NEXT_LOCALE_COUNTRY”, 12 months), the country suggested from your location (“BLOOM_GEO_MARKET”, 24 hours), access to the planner for professionals (“bloom-pro-access”, until your access code expires) and whether you have seen the planner introduction (12 months). In your browser’s local storage we keep your cart, your planner designs, your checkout details and, if you use our chat assistant, a reference to your conversation. Legal basis: § 25 (2) TDDDG and Art. 6 (1) (f) GDPR.

8. Newsletter

If you subscribe to our newsletter, we store your email address and the time of sign-up in Sanity and inform our team by email. We send the newsletter with GoHighLevel (HighLevel Inc., USA), to which your address is added for this purpose. Legal basis: your consent (Art. 6 (1) (a) GDPR). You can withdraw it at any time via the unsubscribe link in every newsletter or by writing to privacy@bloom-outdoor.com.

9. Analytics, tracking and advertising

Where our cookie banner is shown, the following tools only run after you have given your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). They are loaded through Google Tag Manager (Google Ireland Limited). Tag Manager itself loads on every visit, but with Google Consent Mode it keeps these tools switched off until you consent.

• Google Analytics 4 (Google Ireland Limited) – web analytics.
• Google Ads conversion tracking and remarketing (Google Ireland Limited) – measuring and improving our advertising.
• Meta Pixel (Meta Platforms Ireland Limited) – measuring and improving our advertising on Facebook and Instagram.
• Microsoft Clarity (Microsoft Ireland Operations Limited) – heatmaps and session recordings that show how the website is used.
• LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company) – measuring our advertising on LinkedIn.

In addition, Vercel Web Analytics and Speed Insights count page views and measure loading times without cookies and without identifying you. On our pages for Germany and the United Kingdom, they too only send data with your consent.

10. Embedded content

• Google Maps (Google Ireland Limited): our contact and showroom pages show maps. Where our cookie banner is shown, a map only loads if you have allowed the “Functional” category or click “Show map”. Loading a map transmits your IP address to Google.
• YouTube (Google Ireland Limited): we embed videos in privacy-enhanced mode. The video player only loads when you click play; the preview image is loaded from Google’s servers before that.

11. Recipients and transfers outside the EU

We share your data only with the service providers named in this policy, who process it on our behalf under data processing agreements, with carriers for deliveries (section 6), and – where your enquiry concerns them – with the BLOOM company responsible for your market. Our main service providers are:

• Vercel Inc., USA – hosting, server functions (USA, Singapore), file storage (Frankfurt), AI gateway
• Neon Inc., USA – database (Singapore)
• Upstash Inc., USA – cache (Frankfurt, Singapore, Ireland) and search index (Ireland)
• Sanity AS, Norway – content management, form entries and appointments
• Resend, Inc., USA – sending and receiving email (Ireland)
• Google Ireland Limited – Google Workspace, Calendar, Maps, YouTube, Tag Manager, Analytics, Ads
• Meta Platforms Ireland Limited (Instagram, Meta Pixel) and WhatsApp Ireland Limited or WhatsApp LLC (WhatsApp)
• Anthropic PBC, USA, and Microsoft (Azure OpenAI Service) – AI models, with zero data retention
• Functional Software, Inc. (Sentry), USA – error monitoring (data stored in the EU)
• HighLevel Inc., USA – live chat and newsletter
• Microsoft Ireland Operations Limited (Clarity) and LinkedIn Ireland Unlimited Company – analytics and advertising, only with your consent
• PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg – payment

Some of these providers are based in, or process data in, countries outside the EU – in particular the USA and Singapore. Where there is no EU adequacy decision for the country or the provider, the transfer is protected by the European Commission’s standard contractual clauses, which are part of our agreements with these providers; for US providers certified under the EU-U.S. Data Privacy Framework, it is based on that adequacy decision.

12. How long we keep your data

We keep personal data only as long as we need it for the purpose for which it was collected. Enquiries that do not lead to a contract are deleted once they are no longer needed to deal with your request and any follow-up. Where your data relates to a contract, we keep it as long as commercial and tax law require – six to ten years depending on the type of document (§ 257 HGB, § 147 AO). Data we process on the basis of your consent is kept until you withdraw it.

13. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), erased (Art. 17) or its processing restricted (Art. 18), and to receive it in a portable format (Art. 20). You can withdraw any consent at any time with effect for the future (Art. 7 (3)).

Right to object (Art. 21 GDPR): where we process your data on the basis of our legitimate interests, you can object at any time on grounds relating to your particular situation – this includes the AI customer notes described in section 5. You can object to direct marketing at any time without giving reasons.

Write to privacy@bloom-outdoor.com or to the address in section 1. We may ask you to confirm your identity. A request to erase your data covers all channels – website, email, WhatsApp, Instagram and chat – including copies in our team members’ mailboxes. Messages you sent on WhatsApp or Instagram also remain with Meta under its own policies; you can delete them in the app.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the one responsible for us: the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

14. Changes to this policy

We update this policy when our services or the law change. The current version is always available on this page; the date at the top shows the last change.