Privacy policy

Who we are

BlueBloom is the trading name of K2026679039 (SOUTH AFRICA), a private company registered in South Africa, registration number 2026/679039/07. The company is the responsible party under the Protection of Personal Information Act, 4 of 2013 (POPIA). Direct privacy and Information Officer enquiries to us at info@bluebloom.co.za or +27 78 394 7226.

What we collect

• Historical scorecard submissions: email addresses, submission dates, answers, scores, bands and category results previously provided or calculated to request a report. The scorecard is no longer advertised on the site. Existing records are retained under the retention rules below and are not converted into newsletter subscriptions.
• Enquiries and engagements: your name, contact details, organisation or school details where relevant, correspondence, learning goals and information you provide when enquiring or learning with us. Please do not include learner names or sensitive information in an initial school enquiry.
• Newsletter requests: your email address, name if provided and your request to receive the newsletter. The website link opens your email app; it does not automatically subscribe you. We use this information to handle your request and send updates you ask for. You can withdraw that request at any time by emailing us.
• Payments: payer details, invoice information, transaction references, amount, currency and payment status. When you use an offered Paystack payment link, Paystack processes payment credentials; BlueBloom does not receive or store your complete card or bank-account credentials.

Technical information: our hosting infrastructure processes request information, which can include IP addresses, requested pages, browser details and access or error logs, to deliver and protect the website. Where Sentry is enabled, it receives technical error and sampled performance diagnostics.

We do not use advertising trackers. Where enabled, Sentry receives technical error and performance diagnostics to help us maintain the site; session replay is disabled and default personal-information collection is turned off. Paystack's own site and payment environment are governed by its privacy policy.

Cookies and browser storage

Our public pages do not store enquiries or newsletter requests in cookies or browser storage. See the cookie policyfor the site's current use of cookies and your browser choices.

Why we process it

We process personal information to handle historical report requests, respond to enquiries and newsletter requests, conclude and perform training engagements, process and reconcile payments, prevent fraud, keep legally required business records, resolve disputes and protect our legal rights. We do not sell personal information, share it for third-party marketing, or add you to a mailing list unless you ask.

The basis depends on the purpose: steps you request before a contract and performance of the engagement; legal obligations for required records; consent for requested newsletters; and legitimate interests in responding to enquiries, maintaining security and resolving disputes where those interests are lawful. Supplying information is voluntary, but we may be unable to answer a request or arrange a session without the details reasonably needed for it. We do not use automated decision-making to determine your access to training.

Who receives it

We disclose only what is reasonably necessary to service providers that support the engagement, including our hosting and business-email providers, Sentry for technical diagnostics and Paystack when used for payment processing; to professional advisers under duties of confidentiality; or to regulators, courts and law-enforcement bodies where law requires it. We remain accountable for processors we appoint and require appropriate confidentiality and security.

The historical scorecard interface can forward an aggregate submission count to our internal business dashboard. That count contains no email address, answers or individual score. For online training, we agree the joining platform and any necessary participant information before the session; recording is not assumed and must be separately agreed.

Retention and location

Historical scorecard submissions are kept while relevant to a possible or active engagement and deleted on request unless law requires retention. Client, invoice and transaction records are kept for the periods required by tax, accounting, fraud-prevention and other applicable laws. Working copies of client material are deleted when no longer needed for the engagement or a legal purpose. Newsletter contact details are used while you request updates; if you unsubscribe, we retain only records needed to respect that preference or meet a legal obligation.

Technical logs and diagnostics are kept only as needed for operating and securing the service, investigating faults or meeting a legal obligation, subject to the relevant provider's retention settings.

Our hosting and service-provider infrastructure, including payment-data processing and storage by Paystack and its service providers, may be located outside South Africa. Information may also be disclosed where applicable law requires it. Where personal information crosses borders, we apply the safeguards required by POPIA section 72, including using recipients subject to substantially similar protections or binding contractual safeguards.

School and learner sessions

Learner sessions are arranged through the school. We agree the minimum information required, the lawful basis for processing, any necessary consent from a legally competent person, supervision and suitable tools before delivery. We use anonymised examples for practice and do not require learner personal information in an initial enquiry.

Security

We use reasonable technical and organisational safeguards appropriate to the information and the risk. Payments are completed in Paystack's payment environment. No internet transmission or storage system can be guaranteed completely secure, so please do not email passwords, complete payment-card details or information that the engagement does not require.

Your rights

Under POPIA you may ask what we hold about you, request correction or deletion, object to processing, withdraw consent where consent is the basis, and complain to the Information Regulator (South Africa) at POPIAComplaints@inforegulator.org.za. To exercise a right, email info@bluebloom.co.za. We respond within one business day and action valid requests within a reasonable time, subject to identity verification and any lawful reason to retain information.