Privacy policy
Last updated: 7 May 2025
This privacy policy describes how Cofá (the “Website”, “we”, “us” or “our”) collects, uses and shares your personal data when you visit, use our services or purchase from www.cofaa.se (the “Website”), or otherwise communicate with us regarding the Website (collectively, the “Services”). The use of “you” and “your” in this privacy policy refers to you as a user of the Services, whether you are a customer, website visitor or other person about whom we have collected data in accordance with this privacy policy.
We recommend that you read this privacy policy carefully.
Changes to this privacy policy
We may update this privacy policy from time to time, for example to reflect new practices or for other operational, legal or regulatory reasons. The revised privacy policy will be posted on the Website, as indicated by the “Last updated” date, and we will take any other steps required by applicable law.
How we collect and use personal data
To provide the Services, we collect your personal data from a variety of sources as described below. The data we collect and use varies depending on how you interact with us.
In addition to the specific purposes set out below, we may use the information we have collected about you to communicate with you, to provide or improve the Services, to comply with any applicable legal requirements, to enforce any applicable terms of service, and to protect the Services, our rights and the rights of our users and others.
What personal data we collect
The types of personal data we collect about you depend on how you interact with our Website and use our Services. When we use the term “personal data”, we mean information that identifies you, relates to you, describes you or can in any way be linked to you. The sections below describe the categories and specific types of personal data we collect.
Data we collect directly from you
Data that you submit to us via our Services may include:
- Contact details such as your name, address, phone number and email address.
- Order information such as name, billing address, delivery address, payment confirmation, email address and phone number.
- Account information such as username, password, security questions and other information used to protect your account.
- Customer support information such as information you choose to share when you communicate with us, for example when you send a message via the Services.
Certain features of the Services may require you to provide us directly with certain information about yourself. You may choose not to share such information, but in that case it may be impossible for you to use or access those features.
Information we collect about your use
We may also automatically collect certain information about your interaction with the Services (“Usage Data”). For this purpose we may use cookies, pixels and similar technologies (“Cookies”). Usage Data may include information about how you access and use our Website and your account, including details about your device, browser, network connection, IP address and other information about your interaction with the Services.
Information we receive from third parties
Finally, we may also obtain information about you from third parties, including from suppliers and service providers who may collect information on our behalf, such as:
- Companies that support our Website and Services, such as Shopify.
- Our payment processors, who collect payment information (e.g. bank account, credit or debit card details, billing address) in order to process your payment so we can fulfil your orders and deliver the products or services you have requested, in order to perform our contract with you.
- When you visit our Website, open or click on emails we send you, or interact with our Services or advertising, we or third parties we work with may automatically collect certain information using online tracking technologies such as pixels, web beacons, SDKs, third-party libraries and cookies.
Any information we receive from third parties will be handled in accordance with this privacy policy. Please also read the section below, Third-party websites and links.
How we use your personal data
- Providing products and services. We use your personal data to provide you with the Services in order to perform our contract with you, including to process your payments, fulfil your orders, send you notifications related to your account, purchases, returns, exchanges or other transactions, to create, maintain and otherwise manage your account, to arrange shipping, facilitate returns and exchanges and other features related to your account. We may also improve your shopping experience by enabling Shopify to match your account with other Shopify services you may choose to use. In that case, Shopify will process your data in accordance with its privacy policy and consumer protection policy.
- Marketing and advertising. We may use your personal data for marketing and advertising purposes, such as sending marketing, advertising and promotional communications by email, text message or regular mail, and to show you ads for products or services. This may include using your personal data to better tailor the Services and advertising on our Website and other websites. If you reside in the EEA, the legal basis for this processing is our legitimate interest in selling our products, in accordance with Article 6(1)(f) GDPR.
- Security and fraud prevention. We use your personal data to identify, investigate or take action regarding any fraudulent, unlawful or harmful activity. If you choose to use the Services and register an account, you are responsible for keeping your login details secure. We strongly recommend that you do not share your username, password or other access information with anyone. If you believe your account has been compromised, please contact us immediately. If you reside in the EEA, the legal basis for this processing is our legitimate interest in keeping our Website secure for you and other customers, in accordance with Article 6(1)(f) GDPR.
- Communicating with you and improving the service. We use your personal data to offer you customer support and to improve our Services. This is a legitimate interest of ours so that we can be responsive to you, provide you with effective services and maintain our business relationship with you, in accordance with Article 6(1)(f) GDPR.
Cookies
Like many others, we use cookies on our Website. For more information about the cookies we use to run our store with Shopify, go to https://www.shopify.com/legal/cookies. We use cookies to operate and improve our Website and Services (including to save information about your activity and preferences), to carry out analytics and better understand how users interact with the Services (which concerns our legitimate interest in administering, improving and optimising the Services). We may also allow third parties and service providers to use cookies on our Website to better tailor the services, products and advertising on our Website and other websites.
Accepting cookies automatically is the default in most browsers, but you can change your browser settings to delete or reject cookies. Please note that your experience may be negatively affected if you delete or block cookies, and some services, such as certain features and general functionality, may stop working fully or partially. Blocking cookies may also not completely prevent our sharing of information with third parties, such as our advertising partners.
How we disclose personal data
In certain circumstances we may disclose your personal data to third parties for the purposes of performing contracts, for legitimate purposes and other reasons covered by this privacy policy. Some examples of such circumstances:
- Data may be shared with suppliers or other third parties that perform services on our behalf (e.g. IT management, payment processing, data analytics, customer support, cloud storage, distribution and delivery).
- Data may be shared with business and marketing partners to deliver services and advertising to you. Our business and marketing partners will use your data in accordance with their privacy notices.
- When you request or otherwise consent to us disclosing certain data to third parties, for example to deliver products to you or when you use social media widgets or login-based integrations, we may also share your data.
- Data may be shared with our affiliates or within our group as part of our legitimate interests in running a successful business.
- Data may be shared in connection with a business event, such as a merger or bankruptcy, in order to comply with applicable legal obligations (for example in response to court orders or search warrants), to enforce applicable terms of service and to protect the Services, our rights and the rights of our users and others.
We disclose personal data of the following categories and sensitive data about users for the purposes described above in How we collect and use your personal information and How we disclose personal information:
| Category | Categories of recipients |
|---|---|
|
|
We do not use or disclose sensitive personal data without your consent or to draw inferences about you.
With your consent, we share personal data for the purpose of carrying out advertising and marketing activities as described below.
User-generated content
The Services may allow you to post product reviews and other user-generated content. If you choose to submit user-generated content to any public area of the Services, this content will be public and available to everyone.
We do not control who will have access to the information you choose to make available to others and cannot ensure that those who have access to such information will respect your privacy or keep it secure. We are not responsible for the privacy or security of such information that you make publicly available, nor for whether information you share with or receive from third parties is reliable, used or misused.
Third-party websites and links
Our Website may provide links to websites or other online platforms operated by third parties. If you follow links to websites that are not affiliated with or controlled by us, you should read their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such websites, including whether the information on these websites is accurate, complete and reliable. Information you provide in areas that are wholly or partly publicly accessible, including information you share on third-party social networking platforms, may also be seen by others who use the Services and/or those who use these third-party platforms without any restriction on how it may be used by us or third parties. The mere fact that we include links of this kind does not mean that we endorse the content on such platforms, nor their owners or activities, except as expressly clarified in the Services.
Data relating to children
The Services are not intended for use by children, and we do not knowingly collect personal data about children. If a child for whom you are a guardian has provided their personal data to us, you can contact us using the contact details below to request that it be deleted.
As of the effective date of this privacy policy, we are not aware of having “shared” or “sold” (as those terms are defined in applicable legislation) personal data relating to persons under the age of 16.
Security and retention of your data
Please note that no security measures are perfect or impossible to circumvent, and we cannot guarantee perfect security. In addition, any information you send to us may lack protection during transmission. We recommend that you do not use insecure methods to send sensitive or confidential information to us.
How long we retain your personal data depends on various factors, such as whether we need it to manage your account, provide the Services, fulfil legal obligations, resolve disputes or enforce other applicable contracts and policies.
Your rights
Depending on where you live, you may have some or all of the rights below regarding your personal data. However, these rights are not absolute, they may only apply in certain circumstances, and the law permits us to refuse your request in those cases.
- Right of access/to know: You may have the right to request access to the personal data we hold about you, including information about how we use and share your information.
- Right to erasure: You may have the right to request that we erase the personal data we hold.
- Right to rectification: You may have the right to request that we correct the personal data we hold if it is inaccurate.
- Right to portability: In certain circumstances and with certain exceptions, you may have the right to obtain a copy of the personal data we hold about you and to request that we transfer it to a third party.
- Right to opt out of sale, sharing or targeted advertising: You may have the right to instruct us not to “sell” or “share” your personal data or to specify that your personal data may not be used for purposes considered “targeted advertising”, as defined in applicable privacy laws. If you visit our Website with the GPC signal enabled (depending on your location), we will automatically interpret this as a request to refuse the “sale” or “sharing” of data for the device and browser you use to visit the Website.
- Restrict processing: You may have the right to request that we no longer process your personal data or restrict our processing of it.
- Withdraw consent: Where we rely on consent to process your personal data, you may have the right to withdraw your consent.
- Appeal: If we refuse your request, you may have the right to appeal our decision. You can do so by responding to our refusal notice.
- Manage communication preferences: We may send you promotional emails, and you can choose to stop receiving them by using the unsubscribe feature included in all our communications to you. If you choose to no longer receive such emails, we may still send you non-promotional messages, such as information about your account or your orders.
You may exercise these rights where indicated on our Website or by contacting us using the contact details below.
Your status with us is not affected by exercising your rights. We may need to collect information from you to verify your identity, such as your email address or account information, before providing a substantive response to your request. Under applicable law, you may appoint a representative to make requests on your behalf to exercise your rights. Before we accept such a request from a representative, the representative must provide evidence that you have authorised them to act on your behalf, and you may also need to personally verify your identity to us. We will respond to your request within the time specified by applicable law.
Complaints
If you have a complaint about how we process your personal data, please contact us using the contact details below. If you are not satisfied with how we have handled your complaint, you may, depending on where you live, have the right to appeal our decision by contacting us using the contact details below. You may also choose to submit your complaint to the Swedish Authority for Privacy Protection (IMY). Within the EEA, you can find a list of competent data protection supervisory authorities here.
International users
Please note that we may transfer, store and process your personal data outside the country where you live. Your personal data is also processed by staff and external service providers (third parties) and partners in these countries.
If we transfer your personal data out of Europe, we will rely on recognised transfer mechanisms, such as the European Commission’s standard contractual clauses, or equivalent agreements from the relevant competent authority in the UK (as applicable), unless the data transfer is to a country deemed to ensure an adequate level of protection.
Contact
If you have questions about our privacy practices or this privacy policy, or if you would like to exercise any of your rights, please email us at support@cofaa.se.
With respect to applicable data protection law, and unless otherwise expressly stated, we are the controller of your personal data.