CocoToro

Privacy policy

Last updated: October 2026

Important: fill in the real French seller identity (name/company, SIRET/VAT, address in France) in data/merchant.json.

1. Data controller

  • Controller: COMPLETAR_NOM_PRENOM_OU_RAISON_SOCIALE (CocoToro)
  • SIRET / VAT number: COMPLETAR_SIRET_OU_TVA
  • Registered address: COMPLETAR_ADRESSE, COMPLETAR_CP COMPLETAR_VILLE, France
  • Country: France
  • Email: hola@cocotoro.com

The controller is established in France. Processing is governed by the GDPR and applicable French data-protection law (loi Informatique et Libertés), under the supervision of the CNIL.

2. Data we process

  • Identity and contact details: name, email, shipping/billing address, phone if provided.
  • Order and payment data: products, sizes, amounts, payment status and Stripe identifiers.
  • Necessary technical data: IP address, server logs, technical cookies.
  • Admin panel credentials (authorised staff only).

3. Purposes and legal bases (GDPR)

  • Order, payment, delivery and after-sales — contract performance (Art. 6(1)(b)).
  • Legal obligations (invoicing, consumer, accounting) — legal obligation (Art. 6(1)(c)).
  • Site security and fraud prevention — legitimate interests (Art. 6(1)(f)).
  • Responding to contact requests — pre-contractual steps / legitimate interests.
  • Marketing emails only where a valid legal basis exists; you may object at any time.

4. Recipients

  • Stripe (payments) — https://stripe.com/privacy
  • Hosting / Site infrastructure providers
  • Carriers for delivery
  • Public authorities where legally required

We do not sell your personal data.

5. International transfers

Some providers (e.g. Stripe) may process data outside the EEA with appropriate GDPR safeguards.

6. Retention

Data is kept for as long as needed for the stated purposes and applicable legal retention periods (including tax and commercial rules).

7. Your rights

You may exercise access, rectification, erasure, objection, restriction and portability rights by emailing hola@cocotoro.com. You may also lodge a complaint with: French Data Protection Authority (CNIL) — https://www.cnil.fr.

8. Minors

The Site is intended for adults (18+).

9. Security and changes

We apply reasonable measures (HTTPS, secrets kept off the frontend, external payment processing). This policy may be updated; the current version is published on this page.