Question 1

Business inquiries (contact form)

Accepted Answer

Data categories: full name, email, phone (optional), company or role (optional), message. Purpose: responding to the business or informational inquiry submitted via the contact form; pre-contractual steps at the data subject's request. Legal basis: GDPR Art. 6(1)(b) — steps taken at the data subject's request prior to entering into a contract. Nature of provision: name, email, message, and acknowledgement of the privacy notice are mandatory to submit the request; phone and company/role are optional. Consequences of not providing data: the request cannot be submitted or answered, for the mandatory fields only. Recipients: the message follows the path form → the site's application endpoint → email delivery → the support@toobloom.com mailbox, hosted on Artera infrastructure and managed personally by the data controller. Saving to a dedicated site database is disabled: no copy of the message is ever written to a database. Place of processing: Artera (DHH Switzerland SA) servers and mailbox, Switzerland. Transfer outside the EEA: yes, to Switzerland — a country recognized by the European Commission as ensuring an adequate level of protection (European Commission adequacy decision of 26 July 2000, confirmed by subsequent periodic reviews). Retention: up to 12 months from the last communication, for general and commercial inquiries. If the inquiry develops into a contractual relationship, data is handled according to the documentation and obligations applicable to that customer relationship. If needed to protect a right or handle a dispute, data is kept for as long as necessary for that purpose. Applicable rights: access, rectification, erasure, restriction, portability, objection (GDPR Art. 15-21) — see the dedicated section below.

Question 2

Support requests (support form)

Accepted Answer

Data categories: name, email, current plan (optional), description of the problem or question. Purpose: providing technical or commercial support to whoever requests it. Legal basis: GDPR Art. 6(1)(b) (pre-contractual steps or performance of a contract, if already a customer) or legitimate interest in responding to support requests (Art. 6(1)(f)). Nature of provision: name, email, problem description, and acknowledgement of the privacy notice are mandatory; current plan is optional. The description field is free text: please do not include passwords, tokens, credentials, sensitive data, or personal information that isn't necessary to handle your request. Consequences of not providing data: unable to receive support on the mandatory fields. Recipients: same path as the contact form — form → application endpoint → email delivery → the support@toobloom.com mailbox, hosted on Artera infrastructure and managed personally by the data controller. There is no dedicated ticketing system, and no database stores these requests. Place of processing: Artera (DHH Switzerland SA) servers and mailbox, Switzerland. Transfer outside the EEA: yes, to Switzerland, covered by a European Commission adequacy decision. Retention: up to 12 months from when the request is closed. Further retention only applies if there are disputes, legal obligations, or documented needs. Applicable rights: access, rectification, erasure, restriction, portability, objection (GDPR Art. 15-21).

Question 3

Email mailbox backups

Accepted Answer

Contact and support form messages arrive in the mailbox hosted with Artera (DHH Switzerland SA). The provider runs rotating backups of its own infrastructure (3 daily copies, 2 weekly, 4 monthly). Data may therefore temporarily remain in backup copies managed by the hosting/email provider, following that rotation cycle, even after a message is manually deleted from the mailbox. These copies are used by Artera for security, business continuity, and disaster recovery purposes, and are overwritten according to the provider's own rotation schedule — they are not additional retention decided by TooBloom. The duration of any technical or infrastructure-level logs Artera may keep beyond these backups is not verifiable from the site's code: NOT CERTIFIABLE — to be verified directly with the provider.

Question 4

Newsletter and email marketing

Accepted Answer

TooBloom does not currently run any newsletter or direct email marketing activity through this site, and does not collect email addresses for that purpose. The contact form has no marketing consent checkbox: the only data collected is what's needed to respond to your inquiry (see the "Business inquiries" card above). If TooBloom starts this kind of communication in the future, this notice will be updated before any consent is collected, stating the purpose, legal basis, and the actual provider used.

Question 5

Security and technical logs

Accepted Answer

Data categories: IP address (hashed with a daily salt, never stored in clear text), user agent, request timestamp, referring page. Purpose: preventing abuse and spam on forms (rate limiting) and ensuring the technical security of the site. Legal basis: the controller's legitimate interest in the security of its own systems (GDPR Art. 6(1)(f)). Nature of provision: necessary for the site to run securely; no consent required. Consequences of not providing data: not applicable — this is an automatic technical process. Recipients: no external recipient beyond the hosting infrastructure (Artera, DHH Switzerland SA). The daily IP hash is kept only in server memory and is cleared on every restart. Place of processing: Artera (DHH Switzerland SA) servers, Switzerland. Transfer outside the EEA: yes, to Switzerland, covered by a European Commission adequacy decision. Retention: the daily IP hash changes every 24 hours and cannot be correlated beyond that window; the rate-limiting bucket is kept only in server memory and is cleared on every restart. Any retention of technical logs at the hosting infrastructure level (e.g. server access logs) is not verifiable from the site's code: NOT CERTIFIABLE — to be verified directly with Artera's hosting panel. Applicable rights: access and objection (GDPR Art. 15, 21), within the technical limits of data that is already pseudonymized.

Question 6

Consent preferences

Accepted Answer

Data categories: choice status (accepted/rejected), whether the "analytics" category is enabled, date and time of the choice, version of the consent text shown. Purpose: remembering and honoring your choice about loading Google Tag Manager. Legal basis: a technical process necessary to respect the choice you expressed; no further consent is required. Nature of provision: necessary for the cookie banner to function. Consequences of not providing data: not applicable — this data is created automatically on your first choice. Recipients: none; the data stays exclusively in your browser (localStorage) and is never sent to the server. Place of processing: your device. Transfer outside the EEA: none; the data never leaves your device. Retention: indefinite in the browser, until you clear it manually or until a new version of the consent text is published, which automatically invalidates the previous choice. Applicable rights: immediate, direct erasure at any time by clearing your browser data, or by clicking "Cookie e privacy" to change your choice.

Question 7

Analytics (only after consent)

Accepted Answer

Data categories: pseudonymous client identifier generated by Google Analytics 4, page viewed, interaction event, attribution parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term, fbclid, msclkid) if present in the landing URL. Purpose: statistical measurement of site usage via Google Analytics 4, delivered through Google Tag Manager (container GTM-NNCLBGMZ, GA4 property G-Z5JN8KW4QV). Legal basis: explicit consent (GDPR Art. 6(1)(a)), collected via the cookie banner before any Google Tag Manager load. Nature of provision: optional; can be withdrawn at any time with no impact on using the site. Consequences of not providing data: none — the site remains fully functional without measurement. Recipients: Google Ireland Limited, as provider of Google Analytics and Google Tag Manager. Place of processing: Google's global infrastructure, including processing in the United States. Transfers outside the EEA: yes, to the United States. The transfer takes place on the basis of the European Commission adequacy decision of 10 July 2023 concerning the EU-US Data Privacy Framework, to which Google LLC adheres. In the alternative, and should that decision be suspended or annulled, the contracts signed with Google include the Standard Contractual Clauses adopted by the European Commission in implementing decision (EU) 2021/914, supplemented by the additional measures described in the provider's contractual documentation. Retention: setting verified in the linked Google Analytics 4 property — event-level data kept for 2 months, user-level data kept for 14 months. The "Reset user data retention period on new activity" option is active (ON) in the linked property. Standard GA4 reports mostly use aggregated data and are not determined solely by these retention settings. Applicable rights: withdraw consent at any time via the "Cookie e privacy" button; for requests directly to Google, see Google's own privacy policy.

Question 8

Advertising campaign measurement (only after consent)

Accepted Answer

Data processed: Google advertising identifier (_gcl_au), the gclid parameter of the originating ad, landing page, conversion event (trial activation). No directly identifying personal data is sent to the advertising network. Purpose: measuring how many trial activations originate from an advertising campaign, in order to assess its effectiveness and avoid wasting budget. Legal basis: the data subject's consent, art. 6(1)(a) GDPR and art. 122 of the Italian Privacy Code, given through the "marketing" category of the banner. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal. Recipient: Google Ireland Limited, acting as processor for measurement services. Place of processing: Google's global infrastructure, including processing in the United States. Transfer basis: as stated in the previous point. Personalised advertising: not performed. The ad_personalization signal always remains denied and no data is used for advertising profiling or remarketing. Retention: the advertising identifier lasts 90 days; attribution data stored on our systems is deleted within 90 days of collection, or immediately upon withdrawal of consent. Provision: optional. Refusal does not restrict access to the website or the service in any way.

Question 9

How to exercise your rights

Accepted Answer

You have the right to access, correct, delete, restrict, export (portability), or object to the processing of the data we hold about you and, where applicable, not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (GDPR Art. 15-22). To submit a request, write to support@toobloom.com specifying which processing activity you're referring to. We aim to respond within 30 days.

Question 10

Right to lodge a complaint

Accepted Answer

If you believe the processing of your data breaches the GDPR, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it), or to bring the matter before the competent court.

Question 11

Governing law

Accepted Answer

This privacy policy is governed by Italian law and EU Regulation 2016/679 (GDPR).

Question 12

Who the service is for, and minimum age

Accepted Answer

TooBloom is a service aimed at professionals, businesses and VAT-registered individuals. Registration is reserved to adults acting within the scope of their professional activity. The service is not intended for minors and does not knowingly collect data relating to minors. Should a parent or guardian believe that a minor has provided personal data, they may report it to support@toobloom.com: the data will be deleted without undue delay.

Privacy Policy — Marketing Site

This policy applies exclusively to the marketing site published at `www.toobloom.com`. It covers the contact form, the support form, consent for email marketing, and the consent management for Google Tag Manager.

Who is responsible for this data

How we process your data, feature by feature

How to exercise your rights

Version of this policy

SITE

APP

API

Business inquiries (contact form)+

Support requests (support form)+

Email mailbox backups+

Newsletter and email marketing+

Security and technical logs+

Consent preferences+

Analytics (only after consent)+

Advertising campaign measurement (only after consent)+

How to exercise your rights+

Right to lodge a complaint+

Governing law+

Who the service is for, and minimum age+