Privacy policy.

Bioom B.V. (the data controller) processes your personal data only when there is a clear lawful basis under the EU General Data Protection Regulation (GDPR) and Dutch Uitvoeringswet AVG. This policy explains what we collect, why, and how to exercise your rights.

1. 01Who we are

   Bioom B.V., a private company registered in the Netherlands. For the purposes of this policy and the GDPR, Bioom B.V. is the data controller for the personal data we process about you. You can reach our privacy team at privacy@bioom.app.

2. 02What we collect

   When you submit a pre-launch waitlist application we collect: your name, email address, organization, professional role, region (NL province or country), primary crop, intended sampling timing, the role-specific profile fields you provide (e.g. farm size, research focus), your consent flags, your selected language, and the UTM parameters and referrer of the page that brought you to /apply. We also use Vercel Web Analytics to measure aggregate site usage (such as page views, referrers, country-level location, and device/browser type). It is privacy-friendly by design: it sets no cookies, uses no third-party identifiers, and does not track you across other sites. Visits are recorded anonymously and are not tied to your IP address or to any individual. The only personal data we hold about you is what you actively submit through the waitlist form.

3. 03Why we collect it (lawful basis)

   Pre-launch application data — lawful basis: consent (Article 6(1)(a) GDPR). You actively confirm consent before submission. You can withdraw consent at any time by emailing privacy@bioom.app. Aggregate site analytics (Vercel Web Analytics) — lawful basis: legitimate interest (Article 6(1)(f) GDPR) in understanding, at an aggregate level, how the site is used so we can improve it. Because the data is anonymous, cookieless, and not tied to any individual, the impact on your privacy is minimal. You can object to this processing by emailing privacy@bioom.app.

4. 04Who we share it with

   We share the strict minimum needed to operate: • Neon (Postgres database, EU region) — stores your application record at rest in the EU. • Vercel (hosting, EU edge) — serves the website pages and provides privacy-friendly, aggregate Vercel Web Analytics (no cookies, no third-party identifiers, no cross-site tracking). We never sell your data. We never share it with advertising networks. We never use it for purposes other than running the pre-launch program.

5. 05How long we keep it

   Waitlist application data: retained for 24 months from your application date, unless you request earlier deletion. After 24 months we either delete or fully anonymize the record (you cannot be re-identified from anonymized records). If you become a paying customer, your data migrates to our customer-data system under separate retention terms — covered by the customer agreement.

6. 06Your rights under GDPR

   You have the right to: • Access the personal data we hold about you (Art. 15) • Correct inaccurate data (Art. 16) • Request deletion of your data (Art. 17 — 'right to be forgotten') • Object to processing (Art. 21) • Receive your data in a portable format (Art. 20) • Withdraw consent at any time (Art. 7(3)) To exercise any of these rights, email privacy@bioom.app. We will respond within 30 days. If you are not satisfied with our response, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, https://autoriteitpersoonsgegevens.nl).

7. 07Security

   Application data is encrypted in transit (TLS 1.3) and at rest (Neon Postgres encryption). Access to the database is restricted to Bioom employees with a documented need. We log all administrative access and rotate credentials regularly. We have not, to date, suffered a breach. If we ever do, we will notify affected individuals and the AP within 72 hours, as required by Article 33 GDPR.

8. 08Changes to this policy

   We may update this policy as Bioom evolves — for example, when we add a feature that processes new categories of data. The 'last updated' date at the top will reflect any change. For material changes that affect your rights, we will email everyone with a current waitlist application.