Privacy statement

COZO is the controller of your personal data. For any question about your data, write to contact@thecozo.be.

• When you order: your name, billing and delivery address, email address, phone number if you give it, the products you order, the amount, the payment method and the language you ordered in. Later we add the tracking code of your parcel and any notes about your order. The shop also keeps the IP address and browser type you used to order. We never see your card details: they go straight to our payment service.
• With an account: your name, the email address you log in with, your password (stored only in encrypted form, nobody can read it, us included), your saved billing and delivery address, your phone number if you give it, and your orders.
• On your wishlist: the products you save as favourites. If you are logged in, we keep the list with your account. If not, it stays only in your own browser.
• Through the contact form: your name, email address, subject, message and, if you fill it in, your order number.
• Through the return form: your name, email address, order number, the product, the reason for the return, your explanation, your statement that you bought as a consumer (for a withdrawal) and your agreement to the RMA terms (for a defect or a wrong product). You receive a confirmation by email.
• On every visit: technical data such as your IP address, browser type and the pages you request. Our hosting services keep these in log files.
• Web statistics: with Vercel Web Analytics we count, without cookies, how our website is used: the address of the page viewed, the website you came from, your country and region, operating system, browser and device type. We only use combined figures and build no personal profiles.
• Statistics, only with your consent: with Google Analytics and Microsoft Clarity we see which pages and products you view, what you put in your cart, when you go to checkout, where you click and scroll, and technical data such as your device, browser, screen size and (approximately) your country and city. For this your browser gets a random code in a cookie. Clarity also records your visit; what you type in forms and the pages of your account are masked in those recordings.
• On forms, login and checkout: with Cloudflare Turnstile we check that a person, not a bot, sends the form. This happens on the contact form, the return form, the withdrawal form, the order tracking form and our checkout page, and when you log in, register or reset your password. Turnstile processes your IP address, technical features of your browser and connection (such as the User-Agent and the TLS fingerprint) and the website the form is on. Turnstile does not read what you type in the form.

Messages from the contact and return forms reach us as email in our mailbox. If a return request belongs to an order, we also keep your explanation and the RMA number with that order, so we can follow up your return or warranty claim.

We use your data only for the purposes below. Each purpose has a legal basis under Article 6 GDPR.

Without your name, address and email address we cannot deliver your order. Without an email address we cannot answer your question. An account is optional: you can also order without one. We take no decisions about you based solely on automated processing, and we do not profile you. Our payment service does check payments for fraud automatically; see below.

We do not sell your data. We only pass it to parties we need to carry out your order or to run the webshop, and only the data they need for that. Most of them work on our behalf (processors) and have a data processing agreement with us. Some act as an independent controller; where that is the case, we say so.

To run the website and the webshop

• Vercel (Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, United States), processor. Vercel hosts the website thecozo.be. Everything you do on the site goes through Vercel: viewing pages, sending forms, logging in and your cart. The servers that handle forms, login and the cart are in Paris; pages are also delivered through Vercel servers worldwide, close to the visitor. Vercel also processes the web statistics (Vercel Web Analytics).
• Hostinger (Hostinger International Limited, Cyprus), processor. Hostinger hosts our shop software (WordPress and WooCommerce) and the database with orders, accounts, wishlists and return files, and the checkout page where you pay. The servers are in France (EU).

To send and receive email

• Brevo (Sendinblue SAS, France), processor. Brevo sends the shop’s emails: your order confirmation, invoice, shipping notice, confirmations of your return request and messages from our forms. For this Brevo sees your name, email address and the content of that email. Brevo stores the data on servers in the EU (France and Germany).
• Microsoft 365 (Microsoft Ireland Operations Limited, Dublin, Ireland), processor. Our mailbox contact@thecozo.be is hosted by Microsoft 365. If you email us or send a form, the message arrives there. The mailbox data is located in the European Union (EU/EFTA).

To handle your payment

• Mollie (Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, the Netherlands), our shop’s payment service. For Bancontact, card, iDEAL | Wero, KBC/CBC, Belfius and Apple Pay, Mollie receives your name, email address, billing address, the amount and your payment details. Mollie checks payments for fraud automatically and is also an independent controller for the payment itself, among other things to meet its legal anti money laundering duties. See Mollie’s privacy policy (https://www.mollie.com/privacy).
• Klarna (Klarna Bank AB, Stockholm, Sweden), only if you pay with Klarna. Klarna receives your name, contact details, address and order details, and decides itself, as controller, whether to offer you that payment method. This can include a credit check. Klarna’s privacy notice applies (https://www.klarna.com/be/en/privacy/).
• Apple, only if you pay with Apple Pay. The terms you agreed with Apple apply.

To deliver your order

• Carriers (bpost, DPD and UPS): the data needed to deliver your parcel, such as your name and delivery address.
• Suppliers and logistics partners who prepare and ship your order: your name and delivery address.

Statistics and security

• Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), only if you consent to statistics: Google Analytics.
• Microsoft (Microsoft Corporation, One Microsoft Way, Redmond, United States), only if you consent to statistics: Microsoft Clarity.
• Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, United States), which checks with Turnstile, on our behalf, that a form is sent by a person. Cloudflare also uses the same technical data itself, as controller, to improve its bot detection, relying on its legitimate interest. See Cloudflare’s privacy policy (https://www.cloudflare.com/privacypolicy/) and the Turnstile privacy addendum (https://www.cloudflare.com/turnstile-privacy-policy/).

Others

• Our accountant Fisco-Gesti, for invoices and bookkeeping.
• Public authorities, where the law requires it.

Data outside the European Union

Some of these parties are US companies or may process data in the United States: Vercel, Google, Microsoft (Clarity), Cloudflare and, through access by group companies outside the EU, Brevo. On 10 July 2023 the European Commission adopted an adequacy decision for the EU-U.S. Data Privacy Framework. Vercel Inc., Google LLC, Microsoft Corporation and Cloudflare, Inc. are certified under that framework, and the transfer relies on it. Vercel and Cloudflare also use the European Commission’s standard contractual clauses, which would apply if the framework lapsed (for Vercel: https://vercel.com/legal/privacy-policy and https://vercel.com/legal/dpa). Brevo stores the data in the EU, but Brevo group companies in the United States, India and Canada may access it when needed. That access is protected by the European Commission’s standard contractual clauses and, where applicable, the EU-U.S. Data Privacy Framework (https://help.brevo.com/hc/en-us/articles/15403782599570-Where-can-I-find-the-Data-Processing-Agreement-DPA). Google’s advertising features are switched off.

After that we delete the data or make it anonymous.

The whole website runs over a secure connection (https). We store passwords only in encrypted form. Login is protected against too many attempts in a row. Only those who need your data to handle your order or question can access it. If something still goes wrong with your data and it puts you at high risk, we will tell you.

We use cookies that the webshop needs to work, such as your cart and login. Which cookies these are and what they do is in our cookie policy. We only set statistics cookies (Google Analytics and Microsoft Clarity) if you consent. You can change your choice or withdraw your consent at any time through Cookie settings at the bottom of every page, or here: Cookie settings. Withdrawal applies to the future: what has already been collected, we erase on request.

• Access: you ask what data we hold about you and what we do with it, and you get a copy.
• Rectification: you have wrong or incomplete data corrected. You can also change the addresses in your account yourself.
• Erasure: you have your data or your account erased, except what the law requires us to keep, such as invoices and orders for accounting.
• Restriction: you ask us to stop using your data for a while, for example while we check a request for rectification.
• Objection: you object at any time to processing based on our legitimate interest.
• Portability: you receive the data you gave us in a common digital format, or we send it, where technically possible, to another party.
• Withdrawing consent: for statistics, through Cookie settings at the bottom of every page.

How to do it: send an email to contact@thecozo.be and say which right you want to use. If it concerns an order, include your order number. It costs you nothing, unless your request is manifestly unfounded or excessive. We reply within one month. If your request is complex, this can be extended by two months; we will tell you so within the first month. To stop someone else from requesting your data, we may ask you to confirm who you are, for example with your order number or by replying from the email address of your account. In principle we do not ask for a copy of your identity card. If we erase your data, we also ask the parties above that store it for us to erase it.

If you are not happy with how we handle your data, please tell us first at contact@thecozo.be. You also have the right to lodge a complaint with the Belgian Data Protection Authority (GBA/APD), Drukpersstraat 35 / rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, www.dataprotectionauthority.be.

If anything changes in how we process your data, we update this statement. Last updated on 18 November 2026: full list of the parties that process your data for us (hosting, email, payments), account data, retention periods completed, and clarified that return requests are kept with your order. Earlier, on 9 November 2026: Cloudflare Turnstile against bots, and statistics with Google Analytics and Microsoft Clarity, only with your consent.