This Privacy Policy describes how and why TBDx Europe GmbH and TBDx Inc. (collectively "Company", "we", "us", or "our") process your personal data when you visit europe.xbloom.com, use the xBloom mobile application ("App"), or operate our coffee machinery shipped within the United Kingdom.
We process your personal data strictly in compliance with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 ("DPA 2018"), and the Privacy and Electronic Communications Regulations ("PECR").
1. DATA CONTROLLER & CONTACT INFORMATION
The Data Controller responsible for processing your personal data in relation to UK operations is:
TBDx Europe GmbH
c/o WeWork, Taunusanlage 8, 60329 Frankfurt am Main, Germany
Commercial Register: Amtsgericht Frankfurt am Main
UK Support Email: support@xbloom.com
Data Protection Officer: privacy@tbdx.design
2. INFORMATION COLLECTION AND USE
We collect personal data actively provided by you during account creation and purchase, as well as data gathered automatically during machine operation.
2.1 Personal Data You Provide Voluntarily
- (1) Account Registration Data: Name, email address, phone number, shipping address, and encrypted account credentials.
- (2) xBloom App Quick Mode Recipe Data: Grind Size, Water Temperature, and Ground:Water Ratio selected during Quick Mode brewing.
- (3) xBloom App Get Created Mode Recipe Data: Custom parameters including Pour Numbers, Grind Size, Water Volume per pour, Temperature, Water Pour Pattern, Pause Duration, and Vibration settings.
- (4) Transaction & Payment Information: Payment details handled by accredited PCI-DSS partners (Shopify Payments, Klarna, Stripe, PayPal). Raw credit card numbers are never stored on our servers.
2.2 Information Collected Automatically
- (1) Device Diagnostics & Machine Pairing: Machine serial number, firmware version, error logs, Wi-Fi pairing parameters, and total brew counts.
- (2) Technical & Usage Data: IP address, browser type, operating system, session duration, and cookie consent logs.
3. LAWFUL BASES FOR PROCESSING UNDER UK GDPR
| Processing Purpose | Categories of Data | Lawful Basis under UK GDPR |
|---|---|---|
| Order fulfillment from UK Warehouse | Identity, Address, Payment | Performance of a Contract (Art. 6(1)(b) UK GDPR) |
| App machine pairing & recipe execution | App Account, Recipe Parameters | Performance of a Contract (Art. 6(1)(b) UK GDPR) |
| Customer service & UK warranty repairs | Order History, Support Chats | Contract / Legal Obligation (Art. 6(1)(b) & (c) UK GDPR) |
| Marketing newsletters & offers | Name, Email address | Consent (Art. 6(1)(a) UK GDPR / PECR) |
4. YOUR LEGAL RIGHTS UNDER UK GDPR
As a UK resident, you hold statutory rights under UK GDPR:
- (1) Right of Access: Request a free copy of your personal data.
- (2) Right to Rectification: Request correction of inaccurate records.
- (3) Right to Erasure ("Right to Be Forgotten"): Request deletion of data when purpose expires.
- (4) Right to Object & Revoke Consent: Stop marketing or processing based on legitimate interest at any time.
To exercise your rights, email privacy@tbdx.design.
5. COMPLAINT TO UK SUPERVISORY AUTHORITY
You have the right to lodge a complaint with the UK data protection supervisory authority:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113 | Website: ico.org.uk
6. DATA RETENTION SCHEDULES
- (1) Transaction & Tax Records: Retained for 6 years following order completion under UK tax law.
- (2) App Account & Recipe Data: Deleted within 30 days of account deletion request.
Have Questions About Your Privacy?
Our Privacy Officer and Support Team are here to assist you with any questions regarding your personal data or exercising your data subject rights.