Privacy policy

Overview

This Privacy Policy applies to TBDx Europe GmbH (“Company”, “we”, “us”, or “our”), a German limited liability company operating the xBloom brand in the United Kingdom.

Registered Office: TBDx Europe GmbH Taunusanlage 8, 60329 Frankfurt am Main, Germany

This Privacy Policy explains how and why we collect, store, use, and share (“process”) your personal information when you:

  • use our services (“Services”);
  • visit our App named xBloom (“App”), website at europe.xbloom.com, or any of our websites that link to this Privacy Policy (the “Sites”);
  • engage with us in other related ways, including sales, marketing, or events.

This Policy is designed to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the EU General Data Protection Regulation (GDPR) where applicable.

Amendments to this Privacy Policy will be posted on the Sites and become effective upon posting. Your continued use of the Services after such changes constitutes your acceptance of the updated Policy. Please review it periodically.

Questions or Concerns?

By using our Services, you agree to this Privacy Policy. If you do not agree, please do not use the Services.

If you have any questions, concerns, or wish to exercise your data protection rights, please contact our Data Protection Officer at: support@xbloom.com.

Information We Collect

We collect the following categories of personal information:

  • Registration & Account Information: Name, email address, password, phone number, country (UK), date of birth, gender, company name (if applicable).
  • Profile Information: Profile image, social media details (if linked), birthday, gender and other optional profile data.
  • Recipe & Usage Data: In Quick Mode and Get Created Mode (e.g., Grand Size, Temperature, Grind Size, Pour settings, Pattern, Vibration, etc.).
  • Payment Information: Payment card or third-party payment details (processed via secure third-party providers).
  • Contact & Social Data: Phone contacts or social network contacts (only with your explicit permission).
  • Technical & Automatically Collected Data: IP address, device information, operating system, browser type, unique device identifiers, usage data, and approximate location data.
  • Other Information: Survey responses, correspondence, identity verification data, and communication preferences.

Legal Basis for Processing (UK GDPR / GDPR)

We process your personal data based on:

  • Contractual Necessity – to provide the Services you requested;
  • Legitimate Interests – to improve our Services, ensure security, conduct analytics, and develop products;
  • Consent – for marketing, non-essential cookies, and certain optional features (you may withdraw consent at any time);
  • Legal Obligations – to comply with tax, accounting, and other regulatory requirements.

How We Use Your Information

We use your data to provide and improve the Services, manage your account, process payments, send service-related communications, personalise your experience, conduct analytics, send marketing (with consent), prevent fraud, and comply with legal obligations.

You may unsubscribe from marketing communications at any time via the “unsubscribe” link or by contacting us.

Sharing Your Information

We share personal data only when necessary:

  • With trusted service providers (e.g., payment processors, hosting, analytics) under strict data processing agreements;
  • With our affiliates (including the US parent company), subject to appropriate safeguards;
  • When required by law, court order, or to protect rights and safety;
  • In the context of a merger, acquisition, or business transfer.

International Data Transfers

Your data may be transferred from the UK/Germany to other countries, including the United States (to our parent company). We ensure appropriate safeguards are in place, such as:

  • UK International Data Transfer Agreements (IDTA) or EU Standard Contractual Clauses (with UK Addendum);
  • Adequacy decisions where available;
  • Robust technical and organisational security measures.

Data Retention

We retain your personal data only as long as necessary. Typical retention periods include:

  • Active account data: For the duration of your account;
  • Transaction records: Up to 7 years for tax and accounting purposes;
  • Marketing data: Until you withdraw consent.

Upon expiry, data is deleted or anonymised.

Your Rights (UK GDPR / GDPR)

You have the following rights:

  • Right of access
  • Right to rectification
  • Right to erasure (“right to be forgotten”)
  • Right to restrict processing
  • Right to data portability
  • Right to object (including to direct marketing)
  • Right to withdraw consent at any time
  • Right to lodge a complaint with the UK Information Commissioner’s Office (ICO) or the competent German supervisory authority.

To exercise these rights, please email privacy@tbdx.design. We will respond within one month.

Account Deletion: You may delete your App account directly in the App. For web-registered accounts, please contact customer support. Some data may need to be retained for legal or legitimate business reasons (e.g., order history, active subscriptions).

Cookies and Tracking Technologies

We use necessary cookies for functionality and, with your consent, analytics and marketing cookies. You can manage your preferences through our cookie banner or browser settings.

Children’s Privacy

Our Services are not intended for children under 18. We do not knowingly collect data from minors. If we become aware that we have collected data from a child under 18, we will delete it promptly.

Security

We implement appropriate technical and organisational measures (including encryption) to protect your personal data. However, no system is 100% secure. You are responsible for keeping your account credentials confidential.

Contact Us

Data Protection Officer TBDx Europe GmbH c/o WeWork, Taunusanlage 8, 60329 Frankfurt am Main, Germany

Email: support@xbloom.com

We recommend contacting us first with any concerns before escalating to supervisory authorities.

This Privacy Policy is governed by the laws of Germany and England & Wales as applicable.