Privacy Policy

Bloss lab. We respect your privacy and private life, but sometimes we need your Personal Data. We consider Personal Data to be any information relating to an identified or identifiable person, in conformity with the General Data Protection Regulation (the GDPR).

This policy explains which Personal Data we use and why (the Privacy Policy). Furthermore, you will read how we process, store and protect your Personal Data.

Finally, we outline what rights you have when we process your Personal Data.

This Privacy Policy applies to our Website www.blosslab.com (the Website), our online application https://app.blosslab.com/ (the App) and the services or products we provide (the Services).

We process your Personal Data in accordance with the GDPR and all other relevant legislation and regulations in the field of protection of Personal Data, like Dutch Telecommunications Act (Telecommunicatiewet) regarding the use of cookies (the Relevant Legislation).

Are you under the age of 16?

If you are younger than 16 years old, you need permission from your parents or legal guardian to use our Website, App and Services.

Processing of Personal Data

In order to provide you with our Website, App and Services, we process your Personal Data.

How do we receive your Personal Data?

We receive personal data directly from you when you register via our website.

Who is the controller of your Personal Data?

We are the controller of your Personal Data within the meaning of the Relevant Legislation. At the end of this Policy, you can find our contact details.

What Personal Data do we process?

We are allowed to process your Personal Data, because we comply with the Relevant Legislation. We lawfully process your Personal Data because we have legal bases for processing, only process data for specific purposes and no more than is necessary, and inform you about the processing.

Legitimate interest

To invoke the legitimate interest basis, we balance our interests against your interests, fundamental rights and freedoms. This data is valuable to us because it allows us to communicate effectively with our users, improve our platform and services, and ensure the best possible user experience.

How do we secure your Personal Data?

We make every effort to protect your Personal Data from loss, destruction, use, alteration or dissemination by unauthorised persons. We do this through:

• Encryption of digital files containing Personal Data
• Hosting providers reviewed against documented contractual and security requirements
• Access secured by confidentiality agreements (NDAs)
• Two-step authentication
• Access strictly limited on a "need to know" basis
• Secure network connections with TLS/SSL

How long do we store your Personal Data?

We shall not store your Personal Data longer than the period in which we need them for the stated purposes. Contact data and content data are retained as long as necessary to provide our Services. Payment data is retained to meet financial and tax obligations. Marketing data is retained as long as you wish to use these Services.

Connected services and ChatGPT

Eligible business users may choose to connect their Bloss lab account to ChatGPT. Connecting is optional and requires authentication, organisation selection and the user's approval of the requested permissions. Depending on the requested workflow, the structured result may include organisation and company names, action or target descriptions and owner or assignee names, sustainability policy and scorecard information, derived due-diligence summaries, and source or freshness dates. Bloss lab does not send authentication tokens, unrestricted uploaded documents or unrelated organisation data in tool results.

Creating or updating actions and targets through a connected service requires an explicit confirmation. Users can disconnect ChatGPT in Bloss lab settings. Disconnecting revokes the connection but does not remove business records or audit information that must be retained under the applicable Subscription or legal obligations.

We do not intentionally retain raw ChatGPT prompts in the MCP-specific operational audit. That audit stores the selected tool name, status, a one-way request fingerprint, timing and limited error metadata for up to 30 days for security, reliability and support. The connection record, OAuth-link lifecycle records, proposals and confirmed business changes have separate product, security, audit or legal retention rules; a 30-day operational-audit period does not apply to those records. Hosting, access, backup and connected-provider logs have separate controls that must be verified for the deployed service.

For this connection, Ory provides the OAuth/OIDC identity and authorisation service for authentication, consent, grant and revocation flows. The designated production project is configured for an EU region, although that setting alone does not establish every support, logging or onward-processing location. OpenAI/ChatGPT is the connected-service recipient: it handles the user's ChatGPT interaction and receives the selected tool request and result needed for that interaction. The exact controller, processor or subprocessor allocation for each provider is determined by the applicable customer agreement and provider terms.

The connection uses an OAuth authorisation-code flow with Dynamic Client Registration and PKCE, narrow authorised scopes, organisation and membership checks for each tool, and explicit confirmation before an action or target is changed. The embedded app accepts messages only from approved OpenAI parent origins. These controls reduce risk; they do not replace the final security, legal and provider review required before availability.

Disconnecting disables the local connection immediately and queues provider-grant cleanup with the identity provider. That queued cleanup runs only once the connected-service release gate is met, so until then a grant held at the provider may remain valid outside Bloss lab. Disconnecting does not automatically delete existing Bloss lab business records, audit records or data retained by a connected provider under that provider's terms. To exercise access, deletion or other data-subject rights, use the contact route below; we will verify the requester and coordinate the applicable Bloss lab and provider-held records.

With whom do we share your Personal Data?

We may share your Personal Data with data processors within the meaning of the Relevant Legislation. These include cloud hosting and storage providers, online platform and infrastructure services, Ory for identity and authorisation when a user connects ChatGPT, and OpenAI/ChatGPT as the connected-service recipient when the user enables that integration. The applicable agreement determines whether each supplier acts as a processor, subprocessor, controller or other recipient. We require the applicable vendor terms and data-processing safeguards before enabling a provider for an organisation. Current provider, region, retention and subprocessor details are available from our security and privacy team on request.

Depending on the features and deployment configuration an organisation enables, other recipient categories can include Microsoft Entra ID for normal user sign-in; OpenAI API or Anthropic for product generation and analysis; Perplexity for public research; Microsoft Azure AI Document Intelligence for optional document OCR; hosting, database and observability suppliers; Resend or another configured mail supplier; and HubSpot for public contact, newsletter or meeting routes. A supplier is not necessarily involved in every workflow, and the embedded ChatGPT display does not by itself enable the main application's optional analytics or session-replay code. The applicable agreement, approved provider register and enabled product configuration determine which recipients apply.

Cookies

We use cookies to improve the user experience on our Website. You can always delete or disable cookies yourself via the browser settings. However, please note that without cookies, our Website may not function as well as it should.

Transfer

The intended connected-service design uses an EU-region Ory project and EU-region primary application storage. Those configuration choices do not establish where every log, backup, support operation or provider subprocessor handles data. If an authorised user enables ChatGPT, the information required for that request may be processed outside the EEA or United Kingdom by OpenAI/ChatGPT. Before that availability is enabled for an organisation, the exact deployed database, logging, backup and provider routes, the applicable GDPR or UK GDPR transfer mechanism, supplementary safeguards and provider terms must be recorded in our approved provider register. Organisations whose contract restricts external AI processing must have the integration enabled by an authorised administrator before their users can connect it.

Your rights

• Right of access: You can request access to your Personal Data
• Right to withdraw consent: You can always withdraw your permission to process your Personal Data
• Right to file a complaint: You can file a complaint at the Dutch Data Protection Authority (Autoriteit Persoonsgegevens)
• Right to object: You can object to the processing of your Personal Data
• Right to data portability: You can request a copy of your Personal Data
• Right to rectification: You can request us to correct, limit or delete your Personal Data

Contact