Privacy Policy
This page explains what personal data we process, why, on what legal basis, for how long and how you can exercise your rights. It covers this website, the enquiries you send us and the introductory emails we send to companies.
1. Who is the data controller
Bloom Media Agency is the trading name of Rafaela Freire, a sole trader (empresária em nome individual) in Portugal, who is the controller of the data described on this page.
- Tax number (NIF): 266 304 885
- Address: Rua da Liberdade, 113, 3045-180 Coimbra, Portugal
- Email for privacy matters: hello@bloomediagency.com
- Phone: +351 919 016 494
Given the size and nature of our activity, Bloom is exempt from appointing a data protection officer. Every privacy question goes to the email above and is handled directly by the controller.
2. Summary: what data, why and for how long
| Situation | Data | Purpose | Legal basis (GDPR) | How long |
|---|---|---|---|---|
| Contact form | Name, email and message; company, phone, project type and budget, if you provide them | Reply to your enquiry and, if you ask, prepare a proposal | Steps taken at your request before a contract (Art. 6(1)(b)) and legitimate interest in replying (Art. 6(1)(f)) | 12 months after the last contact, if no contract follows |
| WhatsApp, email and phone | Your number or address and what you write to us | Reply and follow up the conversation | Art. 6(1)(b) and (f) | 12 months after the last contact, if no contract follows |
| Meeting bookings (Calendly) | Name, email, answers to the booking form, date and time | Book and hold the meeting | Art. 6(1)(b) | 12 months after the meeting, if no contract follows |
| Clients | Contact details of the people we work with, billing details and whatever the service requires | Deliver the contracted service and invoice it | Performance of a contract (Art. 6(1)(b)) and legal tax obligations (Art. 6(1)(c)) | For the length of the contract; tax and accounting records for the legal period (currently 10 years) |
| Introductory emails to companies | Company name, published general email, website, sector and location | Introduce our services | Legitimate interest (Art. 6(1)(f)); see section 4 | 12 months after the last unanswered email |
| Website visits, with your consent | Cookie identifiers, pages viewed, device, approximate location and interactions | Measure visits and ad results | Consent (Art. 6(1)(a)), which you can withdraw at any time | See section 5 |
We use your data only for the purposes above. We never sell personal data. We share it only with the services listed in section 6, which process it on our behalf.
3. Contact form, WhatsApp, email and bookings
When you write to us through the website form, the message goes through Formspree, which delivers it to our inbox (Google Workspace). Only your name, email and message are required. The other fields help us give you a better answer and you can leave them blank.
If you prefer WhatsApp, the conversation takes place on the WhatsApp platform and is also subject to that service's rules. The button on our website simply opens the chat with a pre-written first message, which you can edit before sending.
The booking calendar is provided by Calendly. What you fill in there goes to Calendly and to our calendar, so we can schedule the meeting and send you the invitation. If your visit came from a campaign, we pass the campaign parameters (for example, which ad you came from) to Calendly, so we know which channel led to the booking.
If the conversation moves on to a proposal or contract, your data is then handled as client data, as shown in the table above.
4. Introductory emails to companies
To introduce our work, we occasionally send emails to companies. This section gives recipients the information required by Article 14 of the GDPR, which applies when data was not provided by the person themselves.
Where the data comes from
We only use the general email address that a company publishes itself, such as geral@, info@ or comercial@, on its official website or an official company profile. We record the page where we found it and the date we checked it, and we mention that source in the email itself. Addresses containing a person's name are only added to our contacts when that person gives them to us, for example by replying.
What we keep
Company name, general email address, website, business sector and location. If you reply, we also keep your name, the job title you give us and the conversation.
Purpose and legal basis
The purpose is to present Bloom's digital marketing services and, if there is interest, arrange a conversation. The legal basis is Bloom's legitimate interest in promoting its services to businesses (Article 6(1)(f) and Recital 47 of the GDPR), within the framework of Article 13-A(2) of Portuguese Law 41/2004, which allows these communications to addresses of legal persons until they object. You can ask us for more information on how we balanced this interest against your rights.
How we do it
- Before each email, we check that the address is absent from the national opt-out list managed by the Portuguese Directorate-General for Consumers (DGC) and from our own opt-out list.
- Emails are written and sent one by one from our own mailbox, at most three per company.
- Each email identifies Bloom, explains why you are receiving it and tells you how to stop receiving them.
To stop receiving our emails, simply reply «remover» (or «remove»). You can do this at any time, free of charge and with no need to give a reason. You can also write to hello@bloomediagency.com. The address is removed the same day and we stop contacting you on every channel.
To make sure your request is respected, we keep only the address on our opt-out list.
How long
If there is no reply, we delete the data 12 months after the last email. If a conversation follows, the periods in section 2 apply.
Your rights
You have the rights described in section 7, including the right to object (Article 21 of the GDPR) and the right to lodge a complaint with the Portuguese data protection authority (CNPD).
5. Cookies and visit measurement
The first time you visit, we show a cookie notice. Analytics and advertising tools only load after you click «Accept». If you click «Decline», the website works just the same and we store only that choice.
Before you choose, the website uses only what it needs to work: hosting (Netlify), which logs technical data for each request, such as the IP address, to keep the site secure; and Google Analytics in consent mode, which receives only basic cookieless signals and stores no identifiers on your device.
| Name | Service | Purpose | When | Duration |
|---|---|---|---|---|
bloom_consent_v1 | Bloom (browser local storage) | Remember your cookie choice | Whenever you choose | Until you delete it |
bloom_utms | Bloom (session storage) | Keep the source of the visit (campaign parameters) to pass on to the Calendly booking | Visits from campaigns | Until you close the tab |
_ga, _ga_JTYVJ7K7P9 | Google Analytics 4 | Count visits and understand where they come from | With consent | 2 years |
_fbp | Meta Pixel | Measure ad results on Instagram and Facebook | With consent | 3 months |
_clck, _clsk | Microsoft Clarity | Understand how the site is used (click maps and session recordings, with text typed into fields hidden) | With consent | 1 year and 1 day |
__oppref, __obref | OpenAI | Measure ad results on ChatGPT | With consent | 30 days and 1 year |
| Metricool | Metricool | Visit statistics | With consent | Sends one measurement request per visit; no own cookie detected on 30 September 2026 |
| Calendly | Calendly | Running the booking calendar | When the booking section appears on screen | Set by Calendly |
Changing your mind. You can change your choice at any time. The button below deletes the stored choice and this website's measurement cookies; the notice will appear again on the next page you open.
You can also delete or block cookies in your browser settings.
6. Services we use
These services process data on Bloom's behalf, only for the stated purpose:
| Service | Company | Purpose |
|---|---|---|
| Netlify | Netlify, Inc. (USA) | Website hosting |
| Formspree | Formspree, Inc. (USA) | Delivery of contact form messages |
| Google Workspace | Google (Ireland and USA) | Bloom's email, documents and calendar |
| Google Analytics | Google (Ireland and USA) | Visit measurement |
| Meta Pixel | Meta Platforms Ireland | Ad measurement on Instagram and Facebook |
| WhatsApp Ireland | Conversations you choose to start with us | |
| Microsoft Clarity | Microsoft (Ireland and USA) | Website usage analysis |
| OpenAI Measurement Pixel | OpenAI | Ad measurement on ChatGPT |
| Metricool | Metricool Software (Spain) | Visit statistics |
| Calendly | Calendly LLC (USA) | Meeting bookings |
| Supabase | Supabase, Inc. (USA) | Internal client and project management app |
Some of these services are located outside the European Economic Area, mainly in the United States. In those cases, the transfer relies on the EU-US Data Privacy Framework, where the company is certified, or on the standard contractual clauses approved by the European Commission.
The links to our Instagram and LinkedIn pages take you to those platforms, which follow their own privacy policies.
7. Your rights
At any time, you can ask us for:
- Access to the data we hold about you and where it came from;
- Rectification of inaccurate or incomplete data;
- Erasure of your data, when it is no longer needed or processed without a legal basis;
- Restriction of processing while we look into a request;
- Portability of the data you gave us, in a commonly used format;
- Objection to processing based on legitimate interest, including introductory emails, at any time;
- Withdrawal of consent to cookies, without affecting what was done before.
Just write to hello@bloomediagency.com. We reply within one month at most. If we need to confirm your identity, we ask only for the minimum required.
You also have the right to lodge a complaint with the supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisbon, Portugal, www.cnpd.pt, or with the authority in your country of residence.
8. Security, minors and changes
Security. We keep data in services with protected access, and only the team members who need it for their work can access it.
Automated decisions. Every decision involving your data goes through a person on our team. We never take decisions with legal or similarly significant effects on you by automated means.
Minors. Our website and services are aimed at companies and adult professionals.
Changes. When we change this policy, we update the date at the top of this page. If a change matters to existing clients, we also let them know by email.