Blossom | Privacy Policy

At Blossom Energy, we attach great importance to your privacy and do everything we can to deal with it in a caring and responsible way.
We also want to communicate clearly about this, which is why we have bundled all relevant information regarding the collection and use of your data (we call “personal data”) in this privacy policy.

The collection and use of your personal data by Blossom Energy is in accordance with applicable laws and regulations. This mainly concerns the General Data Protection Regulation (AVG), also known as GDPR[1] mentioned, and other applicable legislation such as, for example, the Electronic Communications Act. Legislation refers to the collection and use of your data as “processing of personal data”.

Cookies are always processed in accordance with our privacy policy. For more information about cookies and how to manage your cookie preferences, please refer to our Cookie Policy.

[1] GDPR = General Data Protection Regulation

What does the privacy policy cover?

Who are we?
Who is protected by this privacy policy?
What personal data does Blossom Energy process and why?
1. What personal data do we process?
2. How do we obtain this personal data?
3. Why do we process this personal data?
4. Summary table
How do we protect your personal data?
How long do we keep your personal data?
What are your privacy rights and how can you exercise them?
1. Overview of your privacy rights
How can I contact Blossom Energy about my privacy?
Stay up to date with changes
Escalation with the supervisory authority

1. Who are we?

We are Blossom Energy with registered office at, and registered with, the KBO under number, hereinafter referred to as “Blossom Energy”.

We are responsible for collecting and using your personal data and we take good care of this. We determine what information we collect and use, how we do it and why, always in line with applicable laws and regulations. We are responsible for processing.

2. Who is protected by this privacy policy?

Everyone who uses our products and services is protected by this privacy policy. By “everyone”, we mean natural persons (not companies or offices) who we know who they are (you are identifiable, an individual).

3. What personal data does Blossom Energy process and why?

In order to carry out its activities, Blossom Energy processes various categories of personal data. In this chapter, we want to give you insight into the categories of personal data we collect, how we obtain it and for what purposes we process it.

Depending on which Blossom Energy service you use, we collect and use different types of personal data. Below, we describe what that information is, how we obtain it and why we collect and use it (this is what we call the processing purposes). More information about the retention periods of this personal data can be found in section 6 of this privacy policy.

3.1 What personal data do we process?

The data that we process can be divided into four types, namely user data, transactional data, derivative data and sensitive data:

User data

This is data that is directly linked to you, regardless of your products or services.

Identification information: personal data that can identify you as a user of our products and services, such as your name and address, date of birth, contact details: personal data that allows us to contact you such as your phone number, email address, ... ;

Contract details: personal data related to your contract such as the products you have with us, your customer number, billing and payment details, contract and order confirmation;

Financial information: bank account number, external creditworthiness assessment, information related to your financial position (e.g. homeowner, etc.);

Communication data: data related to our communication with you, such as the interactions you have had with our customer service (email, phone, live chat, social media, etc.), audio recordings of customer service conversations, etc.

Transaction details

This is data that is linked to the use of your Blossom Energy services and data created by your use of the Blossom Energy services.

Consumption data: personal data that our systems create when you consume our products, such as consumption data from your home charging point and charging card.

Installation details

This is data that Blossom Energy uses to install an electric charging station.

Installation and maintenance details: information related to the installation of your electric charging station: whether you own your home, where the charging station is being installed, whether it has a digital meter, cable length, footage of the installation location, preferred brand and model of HCP, installation progress.

3.2 How do we obtain this personal data?

This can be done in various ways:

We receive your professional email address from your employer.
We receive the data directly from you, such as when you conclude a contract, when you contact our customer service, enter a competition, fill out a survey or a contact form, etc.
We assign personal data to you for the use of our products and services, such as user number, email address, home charging point number, customer number, login code (s) and passwords.
In addition, our systems record personal data that is generated during your use of our products and services, such as using your home charging point or charging card.

3.3 Why do we process this personal data?

We process personal data for various purposes, each time processing only the data that is necessary to achieve the goal. Below we list the purposes. We also explain our legal basis for collecting and using your personal data.

In general, we process your personal data when necessary:

in the context of preparing, executing or terminating a contract;
to comply with a legal obligation; and/or
to protect our legitimate interests, in which case we will always strive to balance that interest with respecting your privacy.

If processing your personal data is not necessary for one of these three reasons, we will always ask for your permission to process your personal data.

3.4 Summary Table

The table below provides an overview of all the purposes and legal grounds for which we process your personal data with the respective retention periods.

| Purposes | Description | Legal Basis | Retention Period | | --------:| -----------:| -----------:| ----------------:| | Sales
After-sales service
Customer support | Your employer provides your professional email address to Blossom Energy so we can contact you to initiate the contract.
When you decide to become a customer of Blossom Energy, we will ask you for certain personal data for managing our contractual relationship, such as your name, address, telephone number, email address, location of the home charging point, choice of charging point model, etc. | Contract execution | 1 year after account termination | | | The personal data we request when entering into a contract are also used by Blossom Energy with the aim of preventing and combating fraud. These data are also used to identify existing customers, as we need to be sure we are in contact with the right person (e.g., to make a change to a subscription). | Legitimate interest | As long as you are a customer with Blossom Energy | | Product and Service Provision
Billing
Dispute Management | We use your data to set up, maintain, and support your products and services, for example, to establish your home charging point and calculate your consumption for billing and reimbursement, and to handle fault notifications or complaints.
We may send you communications for service reasons, e.g., to send you documents about your billing.
We keep your billing data in accordance with legal obligations. | Legal obligation | 7 years | | Quality Improvement | We may use your data to evaluate and improve our products and services.
We also try to improve our products and services based on customer feedback about our services (e.g., through market research), data obtained during our maintenance or interventions with customers.
Certain phone calls with our Customer Service are recorded (this is mentioned at the beginning of the call) for the purpose of quality improvement and to support training objectives. | Legitimate interest | 1 year after account closure | | Commercial Use (marketing and direct marketing) for products of Blossom Energy and affiliated companies | Direct Marketing involves sending advertising and performing analyses for a commercial purpose. We may use your data to offer you new products, services, or special actions that we think might be of interest to you. For example, you might receive an email with a promotion for a Blossom Energy product you do not yet have. This advertising can be sent via various channels (by mail, email, SMS or telephone, app notifications).
It is also possible that we approach you when you are no longer a customer of Blossom Energy.
You can unsubscribe from such direct marketing at any time. | Legitimate interest | 1 year after your last interaction with Blossom Energy, unless you unsubscribe | | | We may approach you with an offer as a prospective customer of Blossom Energy, for example, if you have given your consent when signing up for a contest.
We may also send current customers newsletters and invitations to events, webinars, contests. | Consent | 1 year after giving your consent, unless you withdraw it | | Anonymized Reporting | We use your data to report internally and externally on the use of our services, for example. These reports are anonymized and thus cannot be traced back to an individual.
For internal reporting purposes, we generate anonymous reports to analyze and extract statistical insights. For instance, reports are generated on the use of our services, on the use of our applications, on the workload of our customer service. | Legitimate interest | These data are irreversibly anonymized and fall outside the GDPR. |

4. Do we share your personal data? And to whom?

In order to offer you our services, we sometimes use third parties who have access to your personal data. A transfer to third parties only takes place for the purposes described above. Below, we list who we transfer data to.

‍Transfer of personal data to third parties working on our behalf

We make some of our databases accessible to third parties who work on our behalf and who assist us in delivering our products and services. A few examples:

Companies and independent technicians who provide the installation and maintenance of your home charging point;
Equipped with Home Energy Management Systems
Management of our external legal archive (for invoices, for example), both digitally and on paper;
Companies that provide our outbound paper document flow (e.g. invoices);
Cloud providers;
Companies associated with Blossom Energy (that are part of the Liberty Global or Blossom Energy group if they manage technical platforms or software applications for us);
Market research agencies;
Marketing agencies that assist us with all kinds of advertising campaigns;
Specialized cookie analytics companies (such as Google and Adobe);
Social media platforms such as Meta, Google, LinkedIn... in the context of direct marketing campaigns via these channels (they are not allowed to further use this data for their own purposes, e.g. to enrich their own data).

The transfer of your data is limited to the data that they need to perform their task on our behalf. We ensure that, like us, they manage your data securely, respectfully and with due care, and we provide adequate contractual guarantees for this.

Transfer of personal data in the context of a legal obligation

The law requires us to transfer certain personal data to a number of competent authorities.

Transfer of personal data to third parties in the context of an acquisition or merger

We may transfer your personal data to third parties in the context of an acquisition or merger transaction. This also applies to the preparatory phase of the transaction. Here, too, the data processing agreements are contractually laid down in a data processing agreement between the respective companies.

International data transfers

Your personal data is also processed outside the European Union (the European Economic Area, also known as the EEA). It is a fact that many major IT suppliers, infrastructure providers and technology companies are not located in the European Union, e.g. Cloud providers.

When transferring your personal data outside the EEA, we always respect the requirements of the privacy legislation with regard to international transfers:

We may transfer personal data to countries that the European Commission has determined to provide an adequate level of data protection in accordance with European privacy laws (GDPR), and
We may transfer personal data based on the relevant modules of the European Commission's standard contractual clauses.

In addition, we have aligned ourselves with the guidelines concerning international data transfers issued by the European Data Protection Board. Before each international transfer, we conduct a Data Transfer Impact Assessment to assess the laws of the third countries and determine whether there are practices that are incompatible with the obligations of the transfer mechanism. This analysis also allows us to identify additional security, contractual and organizational measures to protect the data against unauthorised access by the third country's government agencies.

5. How long do we keep your personal data?

See table 3.4

6. What are your privacy rights and how can you exercise them?

To give you more control over your personal data, you can easily manage it by submitting a request to exercise your privacy rights.

6.1 Overview of your privacy rights

Your right of access‍

You have the right to request access to your personal data. We will then provide you with an overview of the personal data that we process about you.

Your right to adapt

You have the right to have incomplete, incorrect, inappropriate or outdated personal data corrected.

In any case, to keep your information up to date, we request that you notify us of any changes, such as a move or a change in your email address.

Your right to delete

‍You have the right to have your personal data deleted if:

your personal data is no longer necessary for the purposes for which it was collected or otherwise processed by Blossom Energy;
you withdraw your previous consent to the processing and there is no other legal basis that Blossom Energy can rely on for (further) processing;
you object to the processing of your personal data and there are no overriding, legitimate grounds for (further) processing by Blossom Energy;
your personal data is being processed unlawfully;
your personal data must be deleted to comply with a legal obligation;
your personal data was collected when you were still a minor.

Please note that we are not always able to delete all the personal data requested, for example when processing it is necessary to provide your service, to exercise legal claims or because the data is necessary to comply with a legal obligation or to fulfil an assignment in the public interest.

Your right to restrict processing

In specific cases, you have the right to obtain the restriction of the processing of your personal data. This is the case, among other things, when you dispute the accuracy of personal data or when your data is no longer necessary to achieve the purposes of the processing, but you need it to assert, exercise or defend legal claims.

Your right to portability of personal data/data forwarding

You have the right to 'recover' your personal data, for example to make it easier to change services and suppliers. This is only possible for the personal data that you have provided to Blossom Energy yourself, based on consent or after agreement.

Your right to object to the processing of your personal data

You have the right to object when Blossom Energy uses your personal data for purposes other than necessary for the execution of an agreement or necessary for complying with a legal obligation. You always have the right to oppose the use of your personal data for Direct Marketing purposes without having to give a reason.

Mind you: the fact that you no longer wish to receive commercial communications from us does not affect our right to contact you in the context of the execution of your contract or if the law requires us to do so.

7. How can I contact Blossom Energy about my privacy?

For any question, complaint or request, you can contact our Data Protection Officer via

privacy@blossom.be
‍
Blossom Energy BV
Liersesteenweg 4
2800 Mechelen

8. Stay up to date with changes

Blossom Energy may change this privacy policy from time to time, for example in response to market developments and new Blossom Energy processing activities. We therefore invite you to always consult the latest version of this policy on our website via this link. Of course, we will inform you of any significant change in advance via our websites or other current communication channels and, if required by law, we will ask for your prior consent for our (new) processing activities.

In case of conflict, our terms and conditions and the special terms applicable to specific Blossom Energy products and services take precedence over this privacy policy.

9. Escalation with the supervisory authority

The Data Protection Authority is an independent body that ensures that your personal data is processed in accordance with the law. If you have a complaint regarding the processing of your personal data by Blossom Energy or if you want to initiate a mediation procedure, you can contact the Data Protection Authority via this link.

‍

Last modified: March 18, 2024