How we handle your data

Bloom Technologies is the data controller for the personal data collected through this website. We are a software company operating from Bole, Addis Ababa, Ethiopia.

For anything to do with your personal data — a question, a copy of what we hold, a correction, or a deletion request — write to privacy@bloom.et. A person reads that address; it is not an autoresponder.

We have not appointed a Data Protection Officer. Under the Personal Data Protection Proclamation that requirement applies to public bodies and to organisations whose core work involves large-scale monitoring or large-scale processing of sensitive data, and none of those describe us. The address above is the contact point instead.

Almost everything we hold is what you type into one of the three forms on this site. There is no account system and no advertising network here, and nothing on this site follows you to another one. The one thing we collect without you typing it is an anonymous count of which pages get opened, described in §10.

• Contact form — your name, email address, phone number, the company or industry you mention, and your message.
• Newsletter sign-up — your email address.
• Careers application — your name, email address, phone number, the role you are applying for, where you are based, the links you give us to your CV and any other documents, and what you write about yourself.

The careers form asks for a linkto your CV rather than a file upload. We store the link, not the document. The file itself stays with whichever service you host it on — Google Drive, OneDrive, Dropbox or another — under that service's own terms and your own sharing settings, which you can revoke at any time without asking us.

Please do not send us sensitive personal data — health information, ethnic origin, religious or political views, or criminal records. We do not need any of it to assess an application, and the Proclamation places strict conditions on processing it. If you include it anyway, we will delete it.

Every purpose below is paired with the lawful ground we rely on under article 7(2) of the Proclamation.

• Answering your enquiry — because you asked us to, and because it is a step taken at your request before any contract. Consent, and pre-contractual necessity.
• Assessing your job application — to decide whether to invite you to a conversation, and to come back to you if a suitable role opens within the retention period below. Consent.
• Sending the newsletter — only ever to an address that asked for it. Consent, withdrawable at any time.
• Keeping the forms usable — blocking automated spam so real messages reach us. Legitimate interest.
• Knowing which pages are read, and which are slow — counting page views and measuring loading speed, so we can write about what people actually come here for and fix what performs badly. No cookie, no identifier, and nothing that singles you out. Legitimate interest.

We do not sell personal data, we do not share it for anyone else's marketing, and we do not use what you send through one form for a different purpose without asking you first.

All of it is voluntary. Nothing on this site is a legal or contractual obligation to supply personal data, and you are free to contact us by phone or post instead.

The practical consequence of not filling a field in is simply that we cannot do the thing it exists for: with no email address we cannot reply, and with no link to your work we cannot assess an application. Fields marked as required on a form are required for that reason and no other.

Bloom is a small team, and internally your data is seen only by the people who need to act on it. Outside Bloom, these are the services that necessarily handle it:

We will also disclose personal data where a court or a competent authority lawfully requires it of us, and we will tell you if that happens unless we are prohibited from doing so.

You should know this plainly, because it affects you. This website is hosted by Vercel in the United States and served from its network of edge locations around the world, and the services that carry its forms — Web3Forms and hCaptcha — also operate from the United States. Ethiopia is not among the places any of them keeps servers.

Two different things follow from that, and they deserve separating. Simply loading a page sends your IP address to the host, because that is how a request reaches a server at all; we rely on that being necessary to deliver the site you asked for. Submitting a form is a choice you make, and it sends everything you typed abroad with it.

The United States has not been determined by the Ethiopian Communications Authority to provide an equivalent level of protection to Ethiopian law. It follows that your data is handled there under a different legal regime, in which the remedies available to you may be weaker and foreign authorities may have powers of access that Ethiopian law would not grant.

Because of that, each form asks you to tick a box confirming you understand and agree to the transfer before it will send. That consent is the basis on which the transfer is made, it is specific to the message you are sending, and you can withdraw it afterwards by writing to privacy@bloom.et and asking us to delete what you sent. If you would rather your data did not leave the country at all, do not use the forms — call us or email us directly, and we will take your details another way.

• Job applications — 12 months from the date you send it. If you would rather we did not keep yours that long, say so and we will delete it as soon as we have replied.
• Enquiries through the contact form — 24 months from our last exchange with you, so we have the history if you come back to us. Where an enquiry becomes a project, the records that belong to that contract are kept for as long as our commercial and tax obligations require.
• Newsletter subscriptions — until you unsubscribe.

These are the periods we hold ourselves to. At the end of one, the data is deleted, and email threads containing it are deleted with it.

The Proclamation gives you the following rights, and we will honour every one of them free of charge:

• To know and to see — to be told whether we hold data about you, and to be given a copy.
• To correct — to have anything inaccurate or incomplete put right.
• To delete — to have your data erased when it is no longer needed for the purpose you gave it for, or when you withdraw consent.
• To object, and to restrict — to object to processing in writing at any time, and to ask us to hold the data without further processing while a dispute is resolved.
• To take it with you — to receive what you gave us in a structured, commonly used electronic form.
• To withdraw consent — at any time, without giving a reason. Withdrawing it does not undo processing that was lawful before you withdrew, but it stops everything after.

To exercise any of these, write to privacy@bloom.et. We will not charge you, we will not ask you to justify the request, and we aim to complete it within 30 days — sooner where we can. We may need to confirm you are who you say you are before we hand over a copy of anything.

We make none. No application to Bloom is screened, scored, ranked or rejected by software, and we do not profile you. Every application is read by a person, and every decision about it is made by a person.

This website sets no analytics cookies and no advertising cookies. We do not use Google Analytics, and there is nothing here that follows you to another site.

• Your theme choice— whether you picked light or dark is kept in your browser's local storage so the site remembers it. It never reaches us.
• Page counting — we use Vercel Web Analytics and Speed Insights, which record the page you opened, the site that sent you here, your browser and device type, a country derived from your IP address, and how fast the page loaded. They set no cookie and store no identifier, so there is nothing that recognises you on a later visit, links your visits together, or follows you off this site. What we see is a count, not a person.
• hCaptcha — sets its own cookies and reads your IP address in order to tell a person from a bot. It loads only once you begin filling in the contact or careers form, so simply reading this site does not involve it.

Because none of this identifies you or tracks you across sites, there is no consent banner to click through. That is deliberate. If we ever adopt something that does track you, this notice will say so before it runs, and you will be asked first.

The site is served over an encrypted connection, submissions travel over encrypted connections, and access to the inbox that receives them is limited to the people who need it.

No such arrangement is perfect. If personal data we hold is breached, the Proclamation requires us to notify the Ethiopian Communications Authority within 72 hours of becoming aware of it, and to tell the people affected within 72 hours as well. We will tell you what happened, what it means for you, and what we have done about it.

When this notice changes, the date at the top of the page changes with it. If a change materially affects how we handle data you have already given us, we will not apply it to that data without contacting you first.

Come to us first if you can — write to privacy@bloom.et and we will try to put it right.

You do not have to. You have the right to complain directly to the Ethiopian Communications Authority, which supervises compliance with the Personal Data Protection Proclamation, and you can do so whether or not you have raised it with us.