Privacy Policy
Blossom AIR

PRIVACY POLICY FOR USER DATA PROCESSING BLOSSOM AIR pursuant to the current legislation on personal data processing

Dear Users of the Blossom Air Platform, with this privacy policy, Blossom S.r.l., as the owner of the platform named Blossom Air, wishes to explain to you how it manages and processes your personal data and what measures it takes to secure your information.

Data Controller Blossom S.r.l., with its registered office at -20831- Seregno (MB), via Milano 8, tax code and VAT number 07445910966 (hereafter “Blossom ” or the “Controller ”), can be contacted via email at hello@blossom.it . The Controller has appointed a data protection officer (DPO), Attorney Diego Dimalta, who can be reached at the following email address: dpo@blossom.it , and can be contacted for all matters regarding personal data processing and exercising rights under the GDPR.

Categories and Source of Personal Data Processed The Controller will process the following data:

1. Browsing Data The computer systems responsible for the operation of the Platform acquire, during their normal activity, certain personal data whose transmission is implicit in the communication between the User and the Platform. This category of data includes IP addresses used by Users, some parameters related to the Platform's resources (URI/URL, requested file format and request methods), log files, and others related to the User’s operating system. Such data are necessary for the use of the Platform's functionalities and are processed to monitor the correct functioning of the systems and the services offered by the Platform (e.g., diagnostics), as well as for security reasons.
2. Platform Access Credentials To access the Platform, the User must authenticate via social login (Microsoft or Google). The communication of data by the User is always optional, explicit, and voluntary; however, without such communication, the User's request cannot be fulfilled, and the Platform will not be able to provide the related services. These data will be processed solely to carry out a contractual negotiation with the User and/or with the company to which the User belongs.

Purpose of Data Processing, Legal Basis, and Retention Period Processing Activity Purpose Legal Basis for Processing Personal Data Legal Basis for Processing Special Categories of Data

1. User access to the Blossom Air Platform via social login (Microsoft or Google) · Contract and execution of contractual and pre-contractual measures (art. 6, par. 1, letter b) for User access to the Platform. · Pursuit of the legitimate interest of the data controller (art. 6, par. 1, letter f) for the storage of registration cookies, IP, user device. N/A
2. Management of User log files · Pursuit of the legitimate interest of the data controller (art. 6, par. 1, letter f and recital 49). N/A
3. Personal profile deletion and User offboarding · Pursuit of the legitimate interest of the data controller (art. 6, par. 1, letter f). N/A

Retention Period of Personal Data Personal data collected during the creation of the User's personal profile and access to the Blossom Air Platform, as well as during the subsequent management of the personal profile by the User, are deleted after the period of 1 (one) year from the deletion of the personal profile by the User. The data and access credentials are retained by the Controller until the User decides to delete their account. After the above retention periods, the collected personal data will be destroyed or anonymized, respecting the technical procedures for deletion and backup.

Data Provision The provision of data is mandatory for the conclusion and/or execution of the contract. The refusal to provide the data therefore prevents the establishment of the contractual relationship and/or the fulfillment of related obligations.

Data Processors, Authorized Persons for Processing, and Personal Data Recipients Exclusively for the above purposes, the User's personal data may be transmitted to:

AUTHORIZED PERSONS FOR PROCESSING : these are internal figures, specifically employees of the Controller, who collect or process Personal Data of the User based on their respective duties and according to the profiles assigned to them.

DATA PROCESSORS : these are third-party collaborators who process personal data on behalf of the Controller, through a specific appointment agreement as a Data Processor, which defines the operations delegated to the third party and the security measures they must adopt to best protect the information obtained from the Controller.

Specifically, Blossom Air uses Time4VPS as a Data Processor, hosting the Platform with a data center located in Lithuania, European Union.

RECIPIENTS : these are those who receive communications of personal data from the Controller but who, following such communication, act as independent Controllers. Among these: the Revenue Agency, the Judicial Authority and/or Public Security Authorities, in cases expressly provided for by law.

Transfer of Personal Data Outside the European Union Personal Data will not be transferred to entities based in third countries, i.e., outside the European Union and the European Economic Area, without your explicit consent or in the absence of the guarantees provided for that purpose by the GDPR (adequacy decisions, signing standard clauses).

Rights of Data Subjects By contacting the Controller via email at dpo@blossom.it , data subjects can request Blossom access to their Personal Data, its deletion, correction of inaccurate Personal Data, integration of incomplete Personal Data, deletion of Personal Data, restriction of processing in cases provided for by art. 18 GDPR, as well as object, for reasons related to their particular situation, to processing carried out for the legitimate interest of the controller.

The data subject also has the right, where processing is based on consent or contract and is carried out by automated means, to receive their Personal Data in a structured, commonly used, and machine-readable format and, where technically feasible, to transmit it to another controller without hindrance.

The data subject has the right to object at any time, easily and free of charge, for reasons related to their particular situation, to the processing of Personal Data in cases of the controller's legitimate interest.

Sincerely,
Blossom S.r.l.