Privacy Policy · Cozelia

This Privacy Policy explains how COZELIA SA collects, uses, discloses and protects your personal data when you visit the Cozelia website, place an Order or contact us, and how you can exercise your rights under Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and French Law No. 78-17 of 6 January 1978 (the "Loi Informatique et Libertés").

1. Who we are

The controller responsible for the processing of your personal data on the Cozelia website (the "Website") is:

Company name	COZELIA SA
Legal form	Société anonyme governed by French law
Registration	RCS Paris, SIREN 883 482 777
VAT number	FR55883482777
Registered office	141–219 Boulevard Macdonald, 75019 Paris, France
Email	info@cozelia.com
Telephone	+33 1 99 00 47 26

COZELIA SA has not appointed a Data Protection Officer, as it is not required to do so under Article 37 GDPR. All privacy questions are handled by the data-protection contact reachable at the addresses above.

2. Scope of this policy

This policy applies to all personal data processed by COZELIA SA through the Website, its order forms, customer service (email, telephone, contact form) and the advertising and measurement tools described below. It applies to visitors, Customers and any person who contacts us. It does not apply to third-party websites or services that may be linked from the Website, which are governed by their own policies.

3. Personal data we collect

Depending on how you interact with us, we may collect and process the following categories of personal data:

Category	Examples
Identity and contact details	First and last name, telephone number, email address (where provided), delivery address, postcode, city and country
Order and transaction data	Products ordered, quantity, offer, price, currency, Order number, Order status, delivery and return information, invoices, cash-on-delivery collection status
Communications	Content of messages, emails and contact forms, recordings or notes of customer-service and Order-confirmation calls where permitted and announced at the start of the call
Technical and device data	IP address, browser type and version, operating system, device type, language, screen settings, pseudonymous device identifier, time zone, server and security logs
Usage and navigation data	Pages viewed, products viewed, clicks, referring page, campaign parameters (such as UTM, gclid, fbclid), date and time of visits, interactions with order forms
Fraud-prevention signals	Browser and device characteristics, network information, Order-velocity and duplicate-Order indicators, a fraud-prevention token derived from technical signals
Preferences	Cookie choices, language and display preferences, marketing preferences

We do not request payment-card data on the Website for cash-on-delivery Orders, and we do not intentionally collect special categories of personal data within the meaning of Article 9 GDPR. Please do not include such information in your messages.

4. Sources of personal data

Directly from you, when you complete an order form, contact customer service, confirm an Order by telephone or exercise your rights.
Automatically, through your use of the Website, by means of server logs, cookies and similar technologies, as described in our Cookie Policy.
From our service providers, such as carriers and call-centre, logistics and order-management providers, which inform us of delivery attempts, Order confirmations, collection status and returns.
From advertising platforms, such as Google and Meta, which may provide us with aggregated or pseudonymous campaign and conversion information where you have consented to the relevant technologies.

5. Purposes and legal bases

We process your personal data only for specified, explicit and legitimate purposes and on one of the legal bases provided for in Article 6 GDPR:

Purpose	Data concerned	Legal basis
Receiving, confirming and managing Orders, delivery, cash-on-delivery collection, invoicing	Identity, contact, Order and transaction data	Performance of the contract or steps taken at your request before entering into it (Art. 6(1)(b))
Customer service, handling of returns, withdrawals, guarantees and complaints	Identity, contact, Order data, communications	Performance of the contract (Art. 6(1)(b)); compliance with legal obligations under consumer law (Art. 6(1)(c))
Accounting, tax and commercial record-keeping	Order, transaction and invoicing data	Compliance with legal obligations (Art. 6(1)(c))
Prevention of fraud, abusive or duplicate Orders and unpaid deliveries; security of the Website	Technical, device, usage and fraud-prevention signals, Order history	Legitimate interests in protecting our business, our Customers and the Website against fraud and abuse (Art. 6(1)(f))
Operation of the Website, storage of your preferences and cookie choices	Technical data, preferences	Legitimate interests (Art. 6(1)(f)); strictly necessary trackers are exempt from consent under Article 82 of the Loi Informatique et Libertés
Audience measurement and improvement of the Website	Usage and technical data, analytics identifiers	Consent (Art. 6(1)(a)), collected through our cookie banner
Advertising measurement, conversion attribution, remarketing and personalised advertising	Advertising identifiers, campaign parameters, conversion events and, for matching, pseudonymised (hashed) contact identifiers	Consent (Art. 6(1)(a)), collected through our cookie banner
Marketing communications about similar products	Contact details, Order history	Legitimate interests for existing Customers, or consent where required by law (Art. 6(1)(f) or (a)); you may object at any time
Establishment, exercise or defence of legal claims; responding to authorities	All relevant data	Legitimate interests (Art. 6(1)(f)); legal obligations (Art. 6(1)(c))

Where processing is based on consent, you may withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal. Where processing is based on our legitimate interests, we have assessed that those interests are not overridden by your interests, rights and freedoms, and you may object to the processing as described in Section 14.

Providing the data marked as mandatory in the order form is necessary to conclude and perform the contract. If you do not provide it, we will not be able to process your Order.

6. Order confirmation, delivery and fraud prevention

Because Orders are paid in cash on delivery, we, or a call-centre provider acting on our behalf, contact you by telephone to confirm your Order, your identity and your delivery address before dispatch. Your Order data is then shared with the warehouse and the carrier responsible for delivering the parcel and collecting payment.

To protect our Customers and ourselves against fraudulent Orders, fake identities, repeated unjustified refusals of delivery and automated abuse of our order forms, we analyse technical signals associated with each Order (IP address, device and browser characteristics, a pseudonymous device identifier, Order frequency and consistency of the information provided). A fraud-prevention token is generated from these signals and transmitted with the Order. This analysis may lead to an Order being flagged for additional verification. An Order is never refused solely on the basis of automated processing: a member of staff reviews flagged Orders and you can always present your point of view.

7. Marketing communications

If you are a Customer, we may send you information about products similar to those you have purchased, unless you objected when your data was collected or have objected since. Where the law requires your prior consent (for example for SMS or email marketing to prospects), we only send such communications with your consent. Every message contains a simple, free means of unsubscribing. We do not sell your personal data.

You may register free of charge on the French Bloctel telephone-marketing opposition list (bloctel.gouv.fr). Calls made to confirm or deliver an Order you have placed are not marketing calls.

8. Analytics, advertising and measurement

The Website uses analytics and advertising technologies provided by Google Ireland Limited (Google Analytics 4, Google Tag Manager, Google Ads, Google Signals) and, where configured, Meta Platforms Ireland Limited (Meta Pixel and Conversions API). These technologies are activated only after you click "Accept all" on our cookie banner. If you click "Reject" or do not make a choice, they remain disabled or operate in Google Consent Mode without storing advertising or analytics cookies on your device.

Where you have consented, these technologies may be used to measure audience, attribute Orders to the advertising campaigns that generated them, limit how often you see the same advertisement, create remarketing or exclusion audiences, and show you more relevant advertising. For server-side conversion measurement, contact identifiers such as your telephone number or email address may be normalised and pseudonymised by one-way hashing before transmission; free-text messages and payment data are never transmitted. Google and Meta may act as independent controllers for some of their own processing; their privacy policies are available on their websites.

You may change your choice at any time using the "Change cookie settings" button on our Cookie Policy page. Full details of each technology, its purpose and duration are provided in that policy.

9. Recipients of your data

Your personal data is accessible only to authorised staff of COZELIA SA who need it to perform their duties, and to the following categories of recipients, strictly to the extent necessary:

call-centre and customer-service providers responsible for confirming Orders and answering requests;
order-management, warehousing, fulfilment and logistics providers;
carriers and courier companies responsible for delivery and cash-on-delivery collection;
banks and payment-service providers, for refunds;
hosting, cloud, database, email and IT-security providers, including Vercel Inc. (website hosting);
analytics and advertising providers (Google Ireland Limited and, where configured, Meta Platforms Ireland Limited), subject to your consent;
fraud-prevention and traffic-verification service providers;
our accountants, auditors, lawyers and other professional advisers, bound by professional secrecy;
courts, police, tax and other public authorities, where required by law or necessary to defend our rights.

Service providers acting on our behalf are processors within the meaning of Article 28 GDPR. They act only on our documented instructions and are bound by contractual obligations of confidentiality and security. Where a recipient determines its own purposes and means of processing, it acts as an independent controller and is responsible for its own compliance.

10. International transfers

We favour providers located in the European Economic Area (EEA). Some providers, such as Vercel Inc., Google LLC or Meta Platforms Inc., may process data in the United States or in other countries outside the EEA. In such cases, transfers are carried out on the basis of an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified companies), the Standard Contractual Clauses adopted by the European Commission, or another appropriate safeguard under Chapter V GDPR, supplemented where necessary by additional technical and organisational measures. You may obtain a copy of the relevant safeguards by contacting us.

11. Retention periods

We keep your personal data only for as long as necessary for the purposes for which it was collected, in accordance with the recommendations of the French data-protection authority (CNIL):

Data	Retention period
Customer data used to manage Orders	For the duration of the commercial relationship, then archived for five (5) years from the end of the relationship for evidential purposes (limitation period under Article 2224 of the French Civil Code)
Invoices and accounting records	Ten (10) years from the end of the financial year (Article L.123-22 of the French Commercial Code)
Contracts of EUR 120 or more concluded electronically	Ten (10) years from delivery (Articles L.213-1 and D.213-2 of the French Consumer Code)
Prospect and marketing data	Three (3) years from collection or from the last contact initiated by the person
Customer-service communications	For the time needed to handle the request, then up to five (5) years for evidential purposes
Call recordings (where made)	Six (6) months; analysis documents up to one (1) year
Fraud-prevention data and alerts	Up to one (1) year from the alert if unconfirmed; up to five (5) years after closure of a confirmed fraud case
Server and security logs	Up to twelve (12) months
Cookies and similar trackers	Up to thirteen (13) months from being placed, unless a shorter duration is stated in the Cookie Policy; information collected by them is kept for up to twenty-five (25) months
Proof of consent or refusal of cookies	For as long as the choice is valid and up to six (6) months after its expiry, for evidential purposes
Requests to exercise rights	For the time needed to answer, then up to five (5) years for evidential purposes; a copy of the identity document, if requested, is deleted once your identity has been verified

At the end of these periods, data is deleted or irreversibly anonymised.

12. Security

COZELIA SA implements appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, in accordance with Article 32 GDPR. These measures include encryption of communications (HTTPS/TLS), access controls and authentication, the principle of least privilege, logging, the separation of environments and the contractual supervision of our processors. In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify the CNIL and inform you in accordance with Articles 33 and 34 GDPR.

13. Children's data

The Website is intended for adults. We do not knowingly collect personal data from persons under eighteen (18) years of age. If you believe that a minor has provided us with personal data, please contact us so that we can delete it.

14. Your rights

Under the GDPR and the Loi Informatique et Libertés, you have the following rights regarding your personal data:

Right of access (Art. 15 GDPR): to obtain confirmation that we process your data and a copy of it;
Right to rectification (Art. 16): to have inaccurate or incomplete data corrected;
Right to erasure (Art. 17): to have your data deleted, subject to our legal retention obligations;
Right to restriction of processing (Art. 18): to have the processing of your data temporarily frozen;
Right to data portability (Art. 20): to receive the data you have provided to us in a structured, commonly used and machine-readable format, or to have it transmitted to another controller, where processing is based on consent or contract and carried out by automated means;
Right to object (Art. 21): to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests, and to object at any time and without giving reasons to processing for direct-marketing purposes;
Right to withdraw consent (Art. 7(3)): at any time, for processing based on consent, including cookies;
Right to define post-mortem directives (Art. 85 of the Loi Informatique et Libertés): to set general or specific directives concerning the storage, deletion and communication of your data after your death;
Right to lodge a complaint with a supervisory authority, in particular the Commission Nationale de l'Informatique et des Libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (www.cnil.fr), or the authority of your Member State of residence.

15. How to exercise your rights

You may exercise your rights free of charge by email at info@cozelia.com or by post to COZELIA SA, Data Protection, 141–219 Boulevard Macdonald, 75019 Paris, France. To help us find your data, please state your name, the telephone number or email address used for your Order and, where possible, your Order number.

If we have reasonable doubts about your identity, we may ask you for additional information to confirm it. We will reply without undue delay and in any event within one (1) month of receipt of your request. This period may be extended by two (2) further months where necessary, taking into account the complexity and number of requests, in which case we will inform you within the first month. Manifestly unfounded or excessive requests may be refused or give rise to a reasonable fee, as permitted by Article 12(5) GDPR.

16. Automated decision-making

We do not take decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing, including profiling, within the meaning of Article 22 GDPR. The fraud-prevention analysis described in Section 6 only flags Orders for human review. Advertising personalisation carried out with your consent does not produce legal or similarly significant effects.

17. Third-party websites

The Website may contain links to websites, plug-ins or services operated by third parties. COZELIA SA is not responsible for the privacy practices of those third parties. We invite you to read their privacy policies before providing them with any personal data.

18. Changes to this policy

We may update this Privacy Policy to reflect changes in our processing, in our service providers or in the law. The effective date at the top of this page indicates the latest version. Where changes are significant, we will inform you by a notice on the Website or, where appropriate, by email.

19. Contact and complaints

For any question about this Privacy Policy or the processing of your personal data, contact COZELIA SA at info@cozelia.com, by telephone at +33 1 99 00 47 26 or by post to 141–219 Boulevard Macdonald, 75019 Paris, France. If you are not satisfied with our reply, you may lodge a complaint with the CNIL or with the supervisory authority of your country of residence.

Related documents