This privacy policy explains how The Bloom collects, uses, and protects your personal data when you visit thebloom.rest, sign up for launch updates, or (from January 2027 onward) place an order with us. It is written to meet the requirements of the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Finnish Data Protection Act (Tietosuojalaki 1050/2018).
1. Who is responsible for your data
The data controller is:
- Digital Luthier (Eerik Semen), trading as The Bloom
- Business ID: 3639616-6
- c/o Semen Eerik, Mantyrinne 7 C 19, 55800 Imatra, Finland
- Email: contact@thebloom.rest
For any question about this policy or your personal data, contact us at the email address above. We aim to respond within one month, as required by the GDPR.
2. What we collect today: the launch notification list
Right now, thebloom.rest is a pre-launch page. If you enter your email address in the "Notify me" form, we collect and store:
- your email address;
- the date and time you signed up;
- a record of the consent you gave (what the sign-up form said at the time), kept so we can demonstrate compliance if ever asked.
We do not currently require or collect your name, address, or any other detail to join this list.
3. Why we process this data, and your consent
We process your email address on the basis of your consent (GDPR Article 6(1)(a)). When you sign up, the form asks you to agree to the following, or something materially equivalent to it:
"By signing up, you agree that The Bloom may email you about the product launch and, afterward, about new products, restocks, and offers. You can unsubscribe at any time using the link in any email we send, or by contacting contact@thebloom.rest."
We ask for consent in these broader terms - covering both the pre-launch notification and ongoing marketing after launch - so that you do not need to sign up twice, and so that we do not need to re-contact you for fresh consent the moment the product ships. You are free to withdraw this consent at any time, free of charge, and withdrawing it will not affect the lawfulness of anything we did before you withdrew.
4. How long we keep your email address
We keep your email address on the launch/marketing list until you unsubscribe, or until it has been more than 24 months since you last opened or clicked one of our emails, whichever comes first. We keep a record that consent was given (not the marketing content itself) for 5 years after your last activity, in line with guidance from the Finnish Transport and Communications Agency (Traficom) on retaining proof of consent for direct marketing.
5. What happens once we launch and start taking orders (from January 2027)
Once The Bloom starts selling products, we will also collect, for anyone who places an order:
- name, delivery address, and contact details, to fulfil and ship your order;
- order and payment details (payment itself is handled by our payment provider - see section 7 - we do not store full card numbers ourselves);
- correspondence relating to your order, returns, or warranty claims.
The legal basis for this processing is performance of a contract with you (GDPR Article 6(1)(b)), and, for accounting records, our legal obligation to keep them under the Finnish Accounting Act (Article 6(1)(c)) - Finnish law requires accounting records to be kept for 6 years from the end of the relevant financial year.
6. Cookies and similar technology
See our separate Cookie Policy for details on cookies. In short: as of the date above, thebloom.rest does not set any non-essential cookies. If that changes - for example if we add analytics - we will ask for your opt-in consent first, via a cookie banner, before any such cookie is set.
7. Who we share your data with
We do not sell your personal data. We may share it with:
- an email marketing/newsletter platform, once we choose one, to send the emails described above;
- a payment processor and, once we are shipping physical orders, a delivery/courier company, solely to complete your order;
- our accountant or bookkeeping service, for statutory financial record-keeping;
- Finnish authorities, where we are legally required to disclose information to them (for example, tax authorities).
If any of these providers is located outside the European Economic Area, we will only use one that is certified under the EU-US Data Privacy Framework (for US providers) or that we have a valid safeguard in place for (such as the European Commission's Standard Contractual Clauses), and we will name the specific providers here once they are chosen.
8. Your rights
Under the GDPR, you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased, where applicable;
- restrict or object to our processing of your data;
- receive your data in a portable format;
- withdraw consent at any time, without affecting past processing;
- lodge a complaint with the Finnish Office of the Data Protection Ombudsman (tietosuoja.fi) if you believe we have mishandled your data.
To exercise any of these rights, email contact@thebloom.rest. We may ask you to verify your identity before acting on a request.
9. Security
We take reasonable technical and organisational measures to protect your data against unauthorised access, loss, or misuse, appropriate to the small scale of our operation today. We will review and expand these measures as the business grows, particularly once we begin processing payment and shipping data.
10. Changes to this policy
We may update this policy as the business grows - in particular once we launch sales and select the specific third-party tools named in section 7. We will post the updated version here with a new "last updated" date, and for material changes affecting how we use your marketing consent, we will notify the launch list by email before the change takes effect.