Privacy Policy

Bloomience is a technology company based in Riyadh, Saudi Arabia. Bloomience is responsible for the personal data described in this policy. For any question about this policy or your personal data, contact us at hello@bloomience.com.

We only collect the information you choose to give us and the minimum technical information needed to keep the website secure:

• Contact form: your name, email address, company (optional), phone number (optional), the topic of your enquiry and your message.
• Job applications: your full name, email address, phone number, current location, LinkedIn profile (optional), current job title and company, years of experience, expected salary and currency, expected joining date, notice period, work authorization, your motivation, and your CV file.
• Security information: to protect our forms from spam and abuse, we create a one-way cryptographic hash of your IP address. We do not store your raw IP address, and the hash cannot be used on its own to identify you.
• Website usage information: our own first-party, cookieless website analytics, described in the next section.

We do not use third-party analytics, advertising or tracking tools on this website.

To understand how visitors find and use our website, we run our own analytics on our own servers. It does not use cookies, advertising identifiers or device fingerprinting, and it never records what you type into our forms.

• What we record: the pages you visit, the language, the time you actively spend on a page, how far you scroll, and clicks on important buttons and links (identified by fixed internal labels, for example "Talk to us" or a WhatsApp link — never your own email address or phone number). For our forms we only record that a form was started, submitted or showed an error, never the content.
• How you reached us: the address of the website that referred you (without its query string), campaign tags in the link (UTM parameters), and whether an advertising click identifier was present (not its value).
• Technical information: device type (desktop, mobile or tablet), browser family and operating-system family, and — only when our network provider supplies it — your country. We do not store your full browser identification string, your city or your precise location.
• Visit identifier: a random identifier kept in your browser’s session storage groups the pages of one visit. It is deleted when you close the tab, is replaced after 30 minutes of inactivity, and is not used to recognise you on later visits.
• IP address: we do not store your IP address for analytics. To count daily unique visitors we keep a one-way hash of your IP address combined with your device, browser and operating-system type, calculated with a key that changes every day, so visits on different days cannot be linked. This hash is deleted after 7 days.

We use this information only in aggregate, to see which pages, services and campaigns interest visitors and to improve our website and marketing. Detailed analytics records are deleted after 90 days; after that we keep only daily totals that do not relate to individual visitors. Analytics data is not shared with advertising or analytics companies.

When you submit our contact form or a job application, the random visit identifier of your current visit is sent with it, and we link your submission to that visit. From then on, the analytics information of that visit (for example, how you reached our website, which pages you viewed and which of our services or buttons you clicked before submitting) is connected to your submission and is therefore no longer anonymous. We do this to understand which website journeys and marketing sources lead to genuine enquiries and applications. The link never includes the content of your form in our analytics, and it does not change what we collect: no cookies, no advertising pixels, no device fingerprinting and no stored IP address.

For each enquiry or application we keep a short summary of how that visit reached us (such as the traffic source, campaign, landing page, language, country when available, device type, and the last service and button you interacted with). This summary is deleted when the enquiry or application is deleted, and in any case after about 26 months; the detailed analytics records of the visit are deleted after 90 days as described above. If analytics is unavailable or blocked, your submission works exactly the same way.

No advertising or third-party tracking tools (such as Google Analytics, Google Ads, Meta Pixel or LinkedIn Insight Tag) are active on this website. If we decide to use any in the future, we will ask for your consent first and update this policy.

The share buttons on our blog articles are plain links, not social-media plugins: nothing is sent to LinkedIn, Facebook, X or WhatsApp when you open an article. Only if you choose to share does your browser open that platform with the article’s public address, and the platform’s own privacy policy then applies. Our analytics records only that a share button was used (the platform and the article), as with other button clicks.

• To respond to your enquiries and communicate with you about them.
• To review your application, assess your suitability for a role and communicate with you about the recruitment process.
• To keep the website secure, prevent spam and abuse, and limit repeated submissions.
• To understand, in aggregate, how the website is used and how visitors find us, so we can improve our content and measure our marketing — including which journeys and marketing sources lead to enquiries and applications.
• To comply with our legal and regulatory obligations.

We do not sell your personal data, and we do not make decisions about you based solely on automated processing.

We process your personal data on the basis of the consent you give when you submit a form, our legitimate interest in responding to enquiries, protecting our website and understanding how it is used, the steps needed before entering into an employment relationship with you, and compliance with applicable law. You may withdraw your consent at any time by contacting us.

Your data is stored on secured servers operated by our hosting provider. CV files are stored separately from our database in a location that is not publicly accessible. Access is limited to authorised Bloomience staff through a protected administration area.

We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS), access controls and rate limiting. No method of transmission or storage is completely secure, but we work to protect your information and review our measures regularly.

We do not sell or rent your personal data. We only share it:

• With service providers who host and operate our website on our behalf, under confidentiality and data protection obligations.
• With competent authorities when we are required to do so by law.

Our website links to external services such as WhatsApp and our social media pages. When you use them, your data is handled under those services’ own privacy policies.

We keep personal data only for as long as it is needed for the purpose it was collected for. Enquiries are kept for as long as needed to handle them and any related follow-up. Applications are kept for the duration of the recruitment process and for a reasonable period afterwards so we can consider you for future opportunities, unless you ask us to delete them sooner. After that, data is securely deleted. Website analytics data is kept as described in "Website analytics" above.

Under the PDPL, you have the right to:

• Be informed about how your personal data is collected and used.
• Access your personal data and obtain a copy of it.
• Request the correction of inaccurate or incomplete data.
• Request the destruction of your data when it is no longer needed.
• Withdraw your consent at any time.

To exercise any of these rights, email hello@bloomience.com. We will respond within the period required by law. You also have the right to file a complaint with the Saudi Data & AI Authority (SDAIA).

If your personal data is processed outside the Kingdom of Saudi Arabia, we will only do so as permitted by the PDPL and with appropriate safeguards in place.

Our website and services are not directed at individuals under 18, and we do not knowingly collect their personal data.

We may update this policy from time to time. The "Last updated" date at the top of this page shows when it was last changed.