Bloom-IT Sàrl
Website controller
Switzerland · FADP · GDPR
Applicable legal framework
01.09.2026
Effective date
Privacy policy
Compliant with the FADP (SR 235.1) and the GDPR (EU 2016/679)
Dual compliance
Federal Act on Data Protection (FADP)
General Data Protection Regulation (GDPR)
Art. 1: Data controller
| ROLE | CONTACT DETAILS |
|---|---|
| Data controller | Bloom-IT Sàrl PO Box 169, 1001 Lausanne, Switzerland hello@bloom-it.swiss |
| EU representative (GDPR ART. 27) | Not applicable. The business is operated from Switzerland and no EU representative is required within the meaning of art. 27 GDPR. |
| Data protection officer (DPO) | Not required (SME with no large-scale processing) |
* An EU representative is mandatory if you regularly process the data of individuals in the EU without being established there (GDPR art. 27). It is not required for occasional processing or where there is no high risk to individual rights.
Art. 2: Data collected and purposes
We collect only the data strictly necessary for the purposes described below (principle of minimisation: FADP art. 6 para. 2 / GDPR art. 5.1.c):
| DATA CATEGORY | PURPOSE | LEGAL BASIS | RETENTION |
|---|---|---|---|
| Name, e-mail, message (contact form) | Responding to your enquiries | (FADP ART. 6) Legitimate interest (GDPR Art. 6.1.f) | 3 years max |
| IP address, browsing logs | Security, fraud detection, statistics | (FADP ART. 6) Legitimate interest | 12 months |
| Analytics browsing data (where analytics are used) | Improvement of the Site | (GDPR ART. 6.1.A) Consent | 13 months |
| Order data (name, address, payment) | Performance of the contract, invoicing | (GDPR art. 6.1.B) Contract (Legal obligation art. 6.1.C) | 10 years (Code of Obligations) |
| Newsletter data (e-mail) | Marketing communications | (GDPR ART. 6.1.A) Consent | Until unsubscription |
Sensitive data
Art. 3: Data recipients
Your data may be passed to the following categories of recipient, strictly within the declared purposes:
- Technical service providers: hosting provider (Infomaniak), e-mail delivery service (Microsoft Cloud, hosted in Switzerland), analytics tools ([name])
- Competent authorities: where required by law or by court order
- No sale of data: your data is never sold or transferred to third parties for commercial purposes
Transfers outside Switzerland and outside the EU/EEA
Where data is transferred to third countries (for example servers in the United States), we guarantee an adequate level of protection through:
- Standard contractual clauses (SCCs) approved by the European Commission;
- An adequacy decision of the Federal Data Protection and Information Commissioner (FDPIC);
- Or the explicit consent of the data subject.
FADP art. 16 & GDPR art. 46
Art. 4: Your rights
Under the FADP (art. 25 to 27) and the GDPR (art. 15 to 22), you have the following rights:
| RIGHT | DESCRIPTION | BASIS |
|---|---|---|
| Access | Obtain a copy of the data we process about you | FADP 25 / GDPR 15 |
| Rectification | Have inaccurate data corrected | FADP 32 / GDPR 16 |
| Erasure | Request the deletion of your data | FADP 32 / GDPR 17 |
| Restriction | Restrict processing in certain circumstances | GDPR 18 |
| Portability | Receive your data in a structured format | GDPR 20 |
| Objection | Object to processing based on legitimate interest | FADP 30 / GDPR 21 |
| Withdrawal of consent | Withdraw any consent given, without retroactive effect | FADP 6 / GDPR 7.3 |
To exercise your rights: hello@bloom-it.swiss
Response time: 30 days (extendable to 3 months for complex requests, with reasons provided).
If you believe your rights are not being respected, you may lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch, or with the supervisory authority of your country of residence in the EU.
Art. 5: Data security
We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction or disclosure (FADP art. 8 / GDPR art. 32):
- Encrypted HTTPS / TLS connection across the whole Site;
- Access to personal data restricted on a need-to-know basis;
- Hashed passwords, with no storage in plain text;
- Regular backups and a post-incident recovery procedure.
Data breach
Art. 6: Automated decisions and profiling
We do not carry out any automated decision-making producing significant legal effects concerning you, nor any profiling within the meaning of the GDPR (art. 22) or the FADP.
Art. 7: Updates
This policy may be updated to reflect legislative changes or changes in our practices. The version in force is always available on this page. In the event of a substantial change, we will inform you by e-mail (if you are a subscriber) or through a banner on the Site.
