Controller (Art. 4(7) GDPR):
Julia Kalder, Bold Bloom
c/o Autorenglück #80461
Albert-Einstein-Str. 47, 02977 Hoyerswerda, Germany
Email: info@bold-bloom.com
We process personal data to provide the platform, ensure security, deliver support, and perform contracts. Legal bases are Art. 6(1)(b) GDPR (contract) and our legitimate interests under Art. 6(1)(f) GDPR (e.g., IT security, abuse prevention). Data categories include:
GeoIP lookups are performed only after explicit consent (Art. 6(1)(a) GDPR) and use the ip-api.com service. Consent can be withdrawn anytime in settings; cached location data is cleared on revocation.
Data is shared only where necessary for contract performance, security, or legal obligations. Processors are bound by Art. 28 GDPR agreements, including:
ai-session-proposal plan entitlement; transmission of coaching-related content occurs only after explicit consent under Art. 9(2)(a) GDPR (coaching notes default to "drop" in the privacy-first wizard).Bold Bloom maintains a Record of Processing Activities (ROPA) under Art. 30 GDPR documenting all processing purposes, data categories, recipients, third-country transfers, and retention periods. The ROPA is reviewed at least annually and is available on request to the controller contact listed above.
Each processor named above is bound by a written contract under Art. 28(3) GDPR. The contractual evidence (vendor standard DPA URL, DPA acceptance date, DPA version, internal contract owner, and next review date) is recorded in an internal Sub-Processor DPA Register that is reviewed at least annually and made available on a justified request.
Transfers to third countries (notably the USA) occur only when required for the purposes above. We rely on EU Standard Contractual Clauses or comparable safeguards; evidence is available on request.
Data is deleted when no longer needed for the stated purposes and when no legal retention applies. For a detailed overview of our retention periods, please see our Data Retention Policy. Typical periods: application logs after 14 days; app activity logs after 30 days; login activity logs retained for 90 days; fraud signals after 90 days; mail delivery events after 90 days; session data after 30 days; audit logs after 365 days; account data and content within 30 days after cancellation unless retention duties apply; billing records retained up to 10 years under commercial and tax laws; support requests after 365 days; backups deleted after 7 days.
We rely on essential cookies only (session, CSRF protection, language, consent storage). Optional analytics or tracking is loaded solely after you opt in via the cookie banner. Your choice is stored per locale and can be updated anytime in the banner or account settings.
You have the right to request access (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction of processing (Article 18 GDPR), data portability (Article 20 GDPR), and to object to processing based on legitimate interests (Article 21 GDPR). Consent, where given, can be withdrawn at any time with effect for the future.
Formal GDPR requests: To formally exercise your rights, you can submit a request through our GDPR request form. We will respond to your request within 30 days as required by Article 12(3) GDPR. If you already have an account, you can track your requests in your account settings.
If you need to rectify data you cannot edit directly (for example session notes, historical feedback, audit logs, or billing records), submit a rectification request with the current and desired values. We review the request and document the decision.
If you want to restrict processing, you can submit an Article 18 GDPR restriction request. While restricted, we keep data stored but limit processing to necessary purposes. You can also request lifting the restriction once the dispute is resolved.
You may lodge a complaint with any competent supervisory authority.
We protect data using TLS encryption, encryption at rest, role-based access, logging, hardened systems, backup and restore processes, and need-to-know access restrictions.
Coaching sessions may involve processing sensitive data, including session notes, mood tracking, and wellness feedback that may contain information about mental or physical health. The processing of these special categories of personal data is based on your explicit consent under Article 9(2)(a) GDPR, which you provide during registration.
This data is used exclusively for coaching purposes and is protected by additional technical measures (application-layer field-level encryption for Art. 9 GDPR data, role-based access controls, per-coach data isolation). You may withdraw your consent at any time with effect for the future by requesting deletion of your account.
This processing has been subjected to a Data Protection Impact Assessment (DPIA) under Article 35 GDPR. The DPIA documents the legal basis, risk and mitigation assessment, and the review schedule; it is made available on request to the controller contact listed above.
For business customers we provide a Data Processing Agreement. We update this notice when technical or legal changes require it. Last updated: 2026-05-20.
For privacy inquiries please contact info@bold-bloom.com.