Privacy Policy

At Bloomis we take your privacy seriously. This policy explains, in plain language, what personal data we collect, what we use it for, how long we keep it and what rights you have. We apply the strictest data-protection standard among those applicable to us.

1. Data controller

The controller of your personal data is Bloomis, with registered address at Sentier de la Cour-de-Chaulin 2, Chamby, Montreux / Vaud and contact email: hello@bloomis.ch.

2. Data we collect

Account data: name, email and password. Your password is stored irreversibly encrypted: nobody can see it, not even our team. When you create your account or purchase a service we record the date and time you accept the terms and this policy.
Contact and billing data: phone, postal address, city, postal code, country, tax ID and, where applicable, company name. We need them to issue your invoices; the tax ID is only requested when you ask for an invoice, because the law requires a full invoice to include it.
Shipping data (only if you buy in the shop): recipient, phone, delivery address and the recipient's identity document number, recorded on your order. The carrier needs the document to deliver the order and, if you choose to invoice with the shipping details, it is the tax ID on the invoice. If you have an account, it is saved in your profile for your next purchase.
Photo (optional): if you add a photo to your profile, it is shown next to your name on the pages where you appear (for example, the team or appointments). You can change or remove it at any time from your profile.
Service usage data: bookings, attendance, membership history and credit movements.
Appointments (only if you request one): name, email, phone and the reason you provide. If your request arrives by email, we keep that email in order to handle it. When you send an appointment request from the website we ask you to accept this policy and we record the date and time of your acceptance. If the reason you provide includes sensitive information (for example, about your health), we process it only to handle your request and with the reinforced confidentiality required by law.
Messages and emails: internal platform messages and a copy of the emails we send you (confirmations, reminders, invoices), so we can handle claims and resends.
Chat assistant (only if you use it): conversations are stored to provide continuity; you can delete them from the chat itself and they are always deleted when you delete your account.
Technical visit data: to measure our own announcements and protect the site we record the IP address, browser and device, approximate location (country/city) and a random visitor identifier that does not reveal your identity (see the Cookie Policy).
Record of acceptances: when you accept terms, a notice or a consent, we keep a record of that acceptance solely as part of our audit operations, and we do not use it for any other purpose.

3. What we do NOT store

We do not store card numbers or bank details. Payments are made directly on the secure pages of the payment gateway (for example Stripe or PayPal): you enter your card there and we only receive a reference of the charge to issue your invoice.
We do not use your data for advertising, nor do we sell it or share it with third parties for commercial purposes. We do not send newsletters or marketing emails: all our emails are operational (confirmations, reminders, account notices).

4. Purposes of processing

Managing your account, membership and credits
Managing bookings and appointments
Charging for services and issuing the invoices required by law
Sending you operational communications about your account and services
Protecting the platform and measuring the use of our own announcements

5. Legal basis

Performance of the contract: providing the services you purchase or book, and handling your appointment request (steps prior to providing the service)
Consent: if you are part of the team, the voluntary publication of your professional profile on the website; you can withdraw consent at any time
Legal obligation: issuing and keeping invoices
Legitimate interest: site security and first-party statistics of our announcements

6. Data retention

Account and usage data: while your account is active. When you delete it, your personal data is deleted or irreversibly anonymised.
Invoices and credit notes: kept for the years required by tax law, even if you delete your account (this is a legal obligation).
Chat assistant conversations: deleted after the configured retention period and, in any case, when you delete your account.
Technical visit logs: kept only for as long as they are needed for security and first-party statistics.

7. Who we share data with

Payment gateways (for example Stripe or PayPal): they process your payments on their own secure pages, under their privacy policies.
Analytics tools (for example Google Analytics): only if the site operator has enabled them; see the Cookie Policy.
IP geolocation service: if the site operator enables announcement measurement, the IP address may be shared with an external geolocation provider to estimate the country/city of the visit.
Technology providers: companies that provide us with hosting, platform maintenance and email delivery services, which process data only under our instructions.

International transfers: some of these providers (for example Stripe, PayPal or Google) may process data in countries outside the European Union and Switzerland, mainly in the United States. These transfers rely on the safeguards provided by law, such as adequacy decisions or standard contractual clauses.

We do not sell your data or share it with third parties for advertising purposes.

7 bis. Processing specific to the shop

When you buy in our online shop we also process the following data:

Shipping and billing data (name, address, telephone and, where applicable, tax identification): to prepare, deliver and invoice your order. Legal basis: performance of the contract.
Communication to the logistics operator: the data strictly needed for delivery is communicated to Fulfillment-Box (Alicante), which processes it only to deliver your order. Legal basis: performance of the contract.
Payment data: handled by Stripe on their own secure pages; we only receive the payment confirmation and, at most, the last digits of the means used. Legal basis: performance of the contract.
Orders and invoices: kept for the periods required by tax and accounting regulations, even if you close your account. Legal basis: legal obligation.

7 ter. Email communications

Bloomis uses the email address of your account to communicate with you through the platform. We distinguish three kinds of communications:

1. Communications essential to use the platform. Security and access messages (email verification, password reset and change, invitations), validations and acknowledgements of the requests you have just made, and the welcome when you sign up. Legal basis: performance of the contract between us (art. 6.1.b GDPR); in Switzerland, art. 31.2.a FADP. They cannot be turned off while you have an account: without them you could not access or use the platform.

2. Service communications. Confirmations and changes of your appointments, classes and bookings; reminders and notices (absences, inactivity, validity of your membership); invoices, credit notes, payments and membership; and notices about your credits. Legal basis: performance of the contract (art. 6.1.b GDPR) and, for invoicing, compliance with legal obligations (art. 6.1.c GDPR); in Switzerland, art. 31 FADP. You can turn them all off, or by type, at any time from Settings → My profile → Email communications; we will stop sending them immediately and your invoices and documents will remain available in your private area. In addition, Bloomis decides which types it sends. They never include the reason or the content of your appointments: to see it you must sign in to your private area.

3. News and offers. We will only send them if you have expressly accepted, and you may withdraw your acceptance at any time by the same means. Bloomis does not currently send this kind of communication.

Sending log. We keep a log of the emails sent and of those not sent because you had turned off service notices, as proof that we respected your choice. It is kept for 24 months and then deleted.

Confidentiality. Emails are transmitted encrypted (TLS) and do not include health data or other special-category information. Email is not a secure channel for that kind of information: you will always find it in your private area.

Who processes your data. Bloomis is the data controller; the Moduler platform acts as processor on behalf of the controller (art. 28 GDPR; art. 9 FADP). You may object to service notices by the means indicated and exercise your rights by writing to hello@bloomis.ch. If you consider that we have not handled your request, you may lodge a complaint with the data protection authority of your country.

8. Your rights

Access: knowing which personal data we process about you
Rectification: correcting inaccurate or incomplete data
Erasure: requesting the deletion of your data
Objection: objecting to a specific processing
Portability: receiving your data in a structured format
Restriction: asking us to restrict processing
Withdrawal of consent: where processing is based on your consent, you can withdraw it at any time, without affecting the lawfulness of prior processing

You can edit your data from your profile. To request the deletion of your account or exercise any other right, write to us at hello@bloomis.ch and we will handle it without undue delay. You can also lodge a complaint with the competent data protection authority.

As a registered user, a User Manual is available in the "Help" section of the user panel with instructions to manage your account, your data and your membership.

9. Security

We apply technical and organisational measures to protect your data: encrypted passwords, role-based access control and regular backups.

10. Changes to this policy

If we change this policy we will notify you through the platform or by email. Each version is recorded with its date.

Last updated: 14/10/2026