Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

For any privacy-related queries, please contact us at the email address above with the subject line “GDPR Request”.

2. What Data We Collect and Why

2a. Contact Form

When you submit our B2B enquiry form, we collect:

• Full name
• Company name
• Country
• Partnership type (Distributor / Shop / Private Label)
• Email address
• Phone number (optional)
• Your message

Legal basis: Article 6(1)(b) GDPR — processing necessary for taking steps at your request prior to entering a contract, and Article 6(1)(f) GDPR — our legitimate interest in responding to business enquiries.

Retention: Contact enquiry data is retained for up to 24 months from the date of submission, or until you request deletion.

2b. Server Logs

Our servers automatically record standard access logs, including IP address, browser type, pages visited, and timestamps. This data is used solely for security and operational purposes.

Legal basis: Article 6(1)(f) GDPR — legitimate interest in maintaining website security.

Retention: Server logs are retained for a maximum of 6 months.

3. Cookies

We use cookies to ensure the basic functionality of our website. You are presented with a cookie consent banner on your first visit, and your preference is stored locally in your browser for 12 months.

You can withdraw or change your cookie consent at any time by clicking “Cookie Settings” in the footer of any page.

4. Data Processors

We use the following third-party service to process contact form submissions:

• Resend (resend.com) — email delivery service used to route your enquiry to our team. Resend processes your submitted data solely to deliver the email. Their privacy policy is available at resend.com/privacy.

We do not sell, rent, or share your personal data with third parties for their own marketing purposes.

5. International Transfers

Our website is hosted on infrastructure that may operate within the EU/EEA or in countries with an adequacy decision by the European Commission. Any transfers outside the EEA are governed by appropriate safeguards, including Standard Contractual Clauses (SCCs).

6. Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — ask us to correct inaccurate or incomplete data.
• Right to erasure — request deletion of your personal data (“right to be forgotten”).
• Right to restriction — ask us to restrict processing of your data in certain circumstances.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email us at info@cosset.com.ua with the subject line “GDPR Request”. We will respond within 30 days.

7. Right to Lodge a Complaint

If you believe your data has been processed unlawfully, you have the right to lodge a complaint with your national supervisory authority. A list of EU data protection authorities is available at edpb.europa.eu.

8. Changes to This Policy

We may update this Privacy Policy from time to time. The “last updated” date at the top of this page reflects the most recent version. We encourage you to review this page periodically.