PRIVACY POLICY
Effective date: 06.01.2022, Version: 1.0
This “Privacy policy” describes the way Bloomreach Inc., with postal mail address 82 Pioneer Way, Mountain View, CA 94041 (jointly “Bloomreach” or “Commerce experience“ or “we” or “us”) and its Affiliates collects, processes and protects your personal data. Bloomreach is committed to protecting your personal data in accordance with applicable privacy laws and regulations such as the General Data Protection Regulation (EU) 2016/679 (“GDPR”) or GDPR as saved into United Kingdom law by virtue of section 3 of the United Kingdom ́s European Union (Withdrawal) Act 2018 (the “UK GDPR”) and the The California Consumer Privacy Act of 2018 Assembly Bill No. 375 (“CCPA”). Bloomreach has appointed an EU representative in accordance with the GDPR, the representative is Bloomreach B.V., company ID: address at Oosteinde 11, 1017 WT Amsterdam, The Netherlands.
This Privacy policy applies to data processing within Commerce experience website available at www.commerceexperience.com operated by Bloomreach where personal data is processed, and which incorporate this Privacy policy or contain a reference hereto. This Privacy policy applies to processing of personal data of visitors of Commerce experience website, representatives of our business partners or individuals who contact us via our website.
In the event of any discrepancies between this Privacy policy and any specific privacy policy applicable to any Bloomreach product or services, the specific privacy policy prevails.
The provisions of this Privacy Policy shall apply from the Effective Date stated above.
I. What Data Do We Process?
When you visit our website and interact with the contact forms available on it, we may collect and process the following categories of data, including the personal data:
-
Identity data: first name, last name.
-
Company data: company name.
-
Contact data: company email address, phone number.
-
Location data: country.
-
Any further information you share with us.
II. How Do We Process Data?
On our website we provide you with option to fill out various forms, you can choose to fill out “participate in commX” form and we will contact you with further information in regard to your participation. You can also choose to contact us via our “contact form” with any question you want to address to as, that is also available on our website. Regardless on which form you decide to fill out, we will process data provided via forms on the legal ground of your consent.
Bloomreach may use your data for marketing purposes, i.e. if you sign up for our newsletter or other marketing communication. These communications shall strictly adhere to applicable legal regulations. Advertising and marketing materials of other parties shall be sent to you only if you opted in for these communications, via our website e-mail or otherwise. Legal ground for processing of your data for marketing purposes is consent.
Your decision about receiving marketing communication may be withheld in accordance with the opt-out rules described in each marketing email or other form of communication via the unsubscribe option in the footer of every email. Opting out can be done as well by directly contacting Bloomreach at dpo@bloomreach.com. If you opt out, Bloomreach shall retain only such data necessary that is necessary for provision of services to you in accordance with the rules set out in this Privacy policy.
If you use any of our services offered via the Commerce experience website, we will process your personal data on the legal grounds of performance of contract or precontractual relations.
Legal obligations
In some instances, legal regulations impose obligations on us under which we are obliged to process personal data, such cases are for instance tax and accounting laws, AML laws and provision of some data to public authorities based on law. That means we may process your personal data in order to ensure compliance with such obligations. Legal ground for processing such personal data is compliance with legal obligations.
III. Cookies and Other Tracking Technologies on Our Websites
Our websites use cookies to collect information about individuals who visit our website. Cookies are small, encrypted text files that are stored on your computer or other device. Cookies help us to operate our website, provide important features and functionality on our website. They help us to understand how our website is being used. At the same time, we use cookies for statistical and analytical purposes, for example to track and monitor, what country, what pages and what method, was used to visit our website as well as to enable personalisation.
Additionally, cookies help us deliver online advertising that we believe is most relevant to you. Cookies are also used for profiling. Cookies can help us to understand how our website is being used, for example, by telling us if you get an error message as you browse. For more information about cookies please visit http://www.allaboutcookies.org.
We use the following types of cookies:
-
essential (necessary) cookies, which are essential for the provision of access to our websites and for the provision of services explicitly requested by you, they enable core functionalities of the website such as marking your data inputs, network management and accessibility; (if these cookies are disabled, our website may not work properly);
-
analytical (performance) cookies help us to analyse how you navigate our websites and what content is relevant to our users, we are able to see user navigation in our website (we monitor automatic events, custom events and event logging and save them in real-time database). Analytical and performance cookies are as well used for performance measurement and improvement.
-
advertising cookies, which help delivering tailored and customized advertising.
We may collect the following data via cookies:
IP address, gender, time zone, browser settings, operating system, information about website visits including the URL, search terms, information about what you viewed or searched on our website, page response times, download errors, length of visits to certain pages, page interaction information, (such as scrolling, clicks, and mouse-overs).
When you visit our websites, you shall be informed through a cookie banner placed at the bottom of the website that we collect cookies. The banner allows you to manage what kind of cookies can be collected by Bloomreach. You can change the settings and withdraw your consent at any time through Privacy settings provided on the bottom of our websites.
When we collect essential cookies the legal ground for processing of this data is legitimate interest. It is not possible to disable these cookies through the Privacy settings as our websites might not function properly when you disable this type of cookies however if you still wish to do so you may follow the instructions below in the section Disabling cookies.
When we store data or gain access to data already stored in your terminal equipment such as your PC or mobile device for analytical, functional, or advertising purposes we only do so once you have given us your consent.
Disabling cookies
If you wish cookies not to be collected, you may restrict, block, or delete the cookies at any time by modifying your browser configuration. Although each browser is parameterized differently, cookie configuration is normally located on the “Preferences” or “Tools” menu. If you turn off cookies, the functionality of our website may be limited (in the case of essential cookies you may not be able to access our website).
If you wish to prevent new cookies from being installed or if you wish to delete existing cookies you can find the instructions on the links below. The exact procedure depends on which browser you are using:
For mobile devices you can limit tracking via the privacy setting on your device (disabling the advertising identifier), for instructions please see https://www.networkadvertising.org/mobile-choice/
Furthermore you can use a third party tool to opt out from targeted advertising, available third-party opt-out tools include the Digital Advertising Alliance, the Network Advertising Initiative, and the European Interactive Digital Advertising Alliance (Europe only).
To opt out from receiving cross-device site advertising (i.e. tracking a user across devices) you can access your device settings or visit and employ the controls described on the NAI’s Mobile Choices page.
IV. Data Retention
Generally, personal data shall be kept for as long as necessary for the purpose for which it was processed. For how long Bloomreach will hold your personal data will as well depend on the legal basis on which your data is processed. Shall the processing be based on legitimate interest your data will be processed for as long as the given legitimate interest of Bloomreach is in place. For data kept based on legal obligations the data retention period is prescribed by applicable legal regulations. For data processed based on performance of a contract the data is processed for the duration of the contractual relationship and for an applicable limitation period. Shall the processing be based on your consent your personal data shall be erased after you withdraw your consent. Please bear in mind that the same data may as well be processed based on more legal bases in which case your withdrawal of consent might not mean a full erasure of your data.
Bloomreach shall neither collect an excessive amount of personal data nor other information which is not relevant for the purposes for which the personal data is collected.
Bloomreach shall not store data provided by you or for a longer period than what is necessary, given the purposes for which they were provided or collected. Moreover, you can withdraw your consent to process your data at any time by sending the message to dpo@bloomreach.com in which case we will remove your data from our system.
V. Data Sharing, Processors and Transfers to Third Countries
Your personal data shall not be shared with any third party except for the following situations:
-
data is necessary for provision of Commerce experience website,
-
based on your consent,
-
entrusting of personal data to processors who process personal data on behalf of Bloomreach,
-
Bloomreach is obliged to provide the personal data on the basis of law or upon order by a public authority.
Categories of Processors
Bloomreach uses trusted third-party providers that in some instances process personal data on behalf of Bloomreach and based on instructions provided by Bloomreach. Bloomreach may use the following categories of providers (sub-processors under GDPR / UK GDPR):
-
hosting, data centre,
-
marketing tools,
-
analytical tools,
-
task management and communication tools,
-
IT tools / providers,
-
legal, tax accounting, and audit services,
Transfers to Third Countries
Bloomreach will transfer your data to countries outside the EU/European Economic Area/the UK only if such a transfer is compliant with applicable privacy laws. That means, for instance, the provider is seated in a country for which the European Commission issued a decision that it provides an adequate level of personal data protection, Standard Contractual Clauses issued by the European Commission and/or other transfer mechanisms are in place that ensure adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals and, if necessary, additional measures are applied to ensure that the data subject is granted a level of protection essentially equivalent to that guaranteed by the legislation.
You have a right to receive a copy of the Standard Contractual Clauses (“SCC”) we have concluded with our sub-processors that are established outside of the EU/EEA and that are used for transferring personal data outside of the EU/EEA. If you wish to obtain a copy of the SCCs applicable to a particular transfer of your personal data, please contact us via dpo@bloomreach.com.
VI. Data Security
We use appropriate administrative, organizational, technical and physical safeguards to protect the personal information we collect and process about you. The measure we use are designed to provide a level of security appropriate to the risk of processing your personal information and to help ensure that your data is safe, secure, and only available to you and to those you provided authorized access (e.g., your users).
These measures do not deprive you from your duties to undertake proper steps in order to secure your own personal data. You should, inter alia, regularly change your passwords. On the other hand, you should not, inter alia, use predictable usernames and passwords, share your password with other persons and disclose your personal data to other persons. Bloomreach will never ask you for your password in any unsolicited communication.
VII. Your rights
Where GDPR / UK GDPR applies to the processing of your personal data you are entitled to the following rights:
Right of access
You are entitled to be informed inter alia about what personal data Bloomreach processes about you, for what purposes, who are the recipients of your personal data. If you would like to obtain such information, please contact us via our email dpo@bloomreach.com. If your personal data is processed by us we will provide with the following information:
-
purposes of processing such data,
-
the categories of personal data concerned,
-
the recipients or categories of recipients of your personal data,
-
where possible the period for which your personal data will be stored, or at least criteria that determine that period,
-
the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing,
-
the right to lodge a complaint with the supervisory authority,
-
information about the source of your personal data, that are not collected directly from you and
-
information about existence of automated decision-making, including profiling.
Right to rectification
You have a right for any of your incomplete, inaccurate, or out-of-date personal data to be rectified. If you would like to exercise this right, please contact us at dpo@bloomreach.com.
Right to erasure (‘right to be forgotten’)
You are entitled to erasure of certain personal data that we have collected and processed about you without undue delay. Please be aware that Bloomreach might be allowed or even obliged to keep some of the personal data despite your deletion request. This includes mainly situations where we need to process your personal data for compliance with legal obligations or for the establishment, exercise and defence of legal claims. If you wish to exercise this right, please contact as via following email address dpo@bloomreach.com.
Right to restriction of processing
In given cases such as
-
where the accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of personal data,
-
the processing is unlawful, and you oppose the erasure of your personal data and request the restriction of their use instead,
-
we no longer need your data for the purposes of processing, but your personal data are required for the establishment, exercise, or defence of legal claims,
-
you have objected to processing in connection with the profiling pending the verification whether our legitimate grounds override yours
you may ask for a restriction of the processing. If you would like to exercise this right contact us at dpo@bloomreach.com.
Right to data portability
You have a right to receive personal data you provide us with in a structured, commonly used, and machine-readable format and have it transmitted to another controller where technically feasible. Please be aware that only data you have provided us with, and we process as a controller on the basis of your consent or performance of contract is covered by the right to data portability. If you would like to obtain your personal data in such form, please contact us via our email dpo@bloomreach.com.
Right to object
You are entitled to object, on grounds relating to your particular situation, at any time to processing of personal data that concerns you and is carried out in public interest or for the purposes of legitimate interests pursued by Bloomreach, including profiling.
The exercise of your rights may be limited shall Bloomreach be obliged to keep any of your personal data for the purpose of compliance with legal obligations, for the establishment, exercise or defence of legal claims or any other compelling reasons as provided by the relevant data protection law. If you would like to exercise this right contact us at dpo@bloomreach.com.
Right to not be subject to automated decision making
You have a right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision:
-
is necessary for entering into, or performance of, a contract between you and Bloomreach
-
is authorised by law and the law lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
-
is based on your explicit consent.
Bloomreach does not make decisions based solely on automated processing that would have significant effects for its users. For completeness, Bloomreach uses cookies and similar technologies which’s use may amount to profiling. For information on how to withdraw your consent for use of cookies or disable cookies, please see chapter III. Cookies of this Privacy Policy. If you would like to exercise this right contact us at dpo@bloomreach.com.
Right to file a complaint
If you feel that your data has been processed unlawfully, contact us and we will undertake to resolve the problem. Under GDPR you have the right to lodge a complaint with your local supervisory authority (for contact details please see: https://edpb.europa.eu/about-edpb/board/members_en).
If you are a resident of the United Kingdom, you may contact the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/.
VIII. CCPA Notice
Consumers residing in California have some additional rights in respect to their personal information under the CCPA. If you are a California resident, this section applies to you and supplements the above policy.
Your Californian Consumer Rights
Where the CCPA applies to the processing of your data you are entitled to the following rights:
Right to notice
You have the right to be informed about how your personal information will be used. We have gone into detail of how we process your personal information in chapter II. How Do We Process Data? of this Privacy policy.
Right of access
You are entitled to be informed about what personal data Bloomreach processes about you, for what purposes and who are the recipients of your personal data.
Right to request deletion
You are entitled to the erasure of certain personal data that we have collected and processed about you. Please be aware that Bloomreach might be allowed or even obliged to keep some of the personal data despite your deletion request.
Right to receive equal services
You have a right to not be discriminated against even if you exercise any of your CCPA rights.
IX. Changes of Privacy Policy
Bloomreach shall, from time to time, change and update the terms of this Privacy policy. You shall be informed of any changes to this Privacy policy by publishing an updated version on Commerce experience website, you may also obtain a copy of the amended Privacy policy either via the email address you have provided to Bloomreach.
X. Contact Details
Should you wish to know more about Bloomreach, its protection of your privacy, or about this Privacy policy, you can contact Bloomreach at the address listed below or via email at dpo@bloomreach.com.
Please help Bloomreach ensure that your data is up to date. If you believe that some of the data processed by Bloomreach is incorrect or if you fell that Bloomreach does not abide this Privacy Policy, please contact us at email address dpo@bloomreach.com or postal mail address:
Attn: Data Protection Officer
BloomReach, Inc.
82 Pioneer Way
Mountain View, CA 94041
If you are an EEA resident:
Attn: Data Protection Officer
BloomReach, B.V.
Oosteinde 11
1017 WT Amsterdam
The Netherlands
