Privacy policy
PART 1 — PRIVACY POLICY
How Kom tot Bloom collects, uses, and protects your personal data
1. Introduction
Welcome to Kom tot Bloom ("we", "our", or "us"). We are committed to protecting your personal data and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application (the "App").
This policy complies with the General Data Protection Regulation (GDPR) and the Dutch Implementation Act (Uitvoeringswet AVG). If you do not agree with the terms of this Privacy Policy, please do not access the App.
2. Data Controller
The data controller responsible for your personal data is:
Kom tot Bloom
The Netherlands
​
3. Data We Collect
3.1 Information You Provide Directly
-
Full name and display name
-
Email address
-
Password (stored in encrypted form — we never see your plaintext password)
-
Profile information: gender, dietary preferences, health goals, family size
-
Language preference
-
Push notification preferences
3.2 Information Collected Automatically
-
Barcode scan history and scanned product data
-
Nutritional intake logs
-
App usage data (screens visited, features used, session duration)
-
Device information (device type, operating system version, unique device identifiers)
-
IP address and approximate location (country/region level only)
-
Crash reports and performance data
3.3 Information from Third Parties
-
Product data from the Open Food Facts API (openopenfoodfacts.org) — ingredient lists, NOVA groups, Nutri-Score grades, additives
-
If you sign in with Google or Apple: your name and email address as provided by those services
4. How We Use Your Data
We process your personal data for the following purposes and legal bases:
Purpose
Legal Basis (GDPR)
Retention
Provide and operate the App, authenticate users, and sync data across devices
Contract (Art. 6(1)(b))
Duration of account
Personalise nutritional recommendations and Bloom score based on your profile
Consent (Art. 6(1)(a))
Duration of account
Process subscription payments and manage billing
Contract (Art. 6(1)(b))
7 years (legal obligation)
Send push notifications about scan results, Academy content, and tips
Consent (Art. 6(1)(a))
Until consent withdrawn
Improve the App through analytics and crash reporting
Legitimate Interest (Art. 6(1)(f))
24 months
Comply with legal obligations (tax, accounting)
Legal Obligation (Art. 6(1)(c))
7 years
Respond to support requests
Legitimate Interest (Art. 6(1)(f))
3 years
5. Third-Party Services
We share data with the following third-party service providers who process data on our behalf:
Supabase
Database, authentication, and file storage (EU servers, GDPR compliant)
Firebase (Google)
Push notifications via Firebase Cloud Messaging (FCM)
Open Food Facts
Open-source product ingredient database — no personal data is sent
Stripe
Subscription payment processing (PCI-DSS Level 1 certified)
Apple / Google
In-app purchase processing for iOS and Android subscriptions
RevenueCat
Subscription management and analytics
We do not sell, rent, or trade your personal data to third parties for marketing purposes.
6. Data Storage and Security
Your data is stored on servers within the European Union (EU) operated by Supabase. We implement the following technical and organisational security measures:
-
End-to-end encryption of data in transit (TLS 1.3)
-
Encryption of data at rest (AES-256)
-
Row-level security policies ensuring users can only access their own data
-
Passwords hashed using bcrypt — plaintext passwords are never stored
-
Regular automated backups with point-in-time recovery
-
Access to production systems limited to authorised personnel only
-
Regular security audits and penetration testing
7. Your Rights Under GDPR
As a data subject under the GDPR, you have the following rights:
Right of Access
Request a copy of all personal data we hold about you (Art. 15)
Right to Rectification
Correct inaccurate or incomplete personal data (Art. 16)
Right to Erasure
Request deletion of your data ('right to be forgotten') (Art. 17)
Right to Restriction
Request that we restrict processing of your data (Art. 18)
Right to Portability
Receive your data in a machine-readable format (Art. 20)
Right to Object
Object to processing based on legitimate interest (Art. 21)
Right to Withdraw Consent
Withdraw consent at any time without affecting prior processing (Art. 7(3))
Right to Lodge Complaint
File a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl
To exercise any of these rights, contact us at info@komtotbloom.nl. We will respond within 30 days.
8. Cookies and Tracking
The App is a native mobile application and does not use browser cookies. We may use the following tracking technologies:
-
Firebase Analytics for anonymised usage statistics
-
Crash reporting via Firebase Crashlytics
-
In-app event tracking to improve user experience
You can opt out of analytics tracking at any time via Settings > Privacy in the App.
9. Children's Privacy
The App is not directed to children under the age of 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at info@jannevents.nl and we will delete such data.
10. International Data Transfers
Your data is primarily processed within the European Economic Area (EEA). Where we transfer data outside the EEA (for example, to Firebase services in the US), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you via a push notification and display an in-app notice. The updated policy will be effective as of the date stated at the top of this document. Your continued use of the App after the effective date constitutes acceptance of the updated policy.
12. Contact
For any privacy-related questions, data requests, or complaints, please contact:
Subject line
Privacy Request — Kom tot Bloom
Response time
Within 30 calendar days