Privacy Policy COSH!

COSH cares about your pri­va­cy and treats your per­so­nal data as confi­den­tial­ly as possible.

The pro­tec­tion of your pri­va­cy and your per­so­nal data is an extre­me­ly serious mat­ter for us. We col­lect, store and use your per­so­nal data only in accor­dance with the contents of this pri­va­cy sta­te­ment (“Pri­va­cy Sta­te­ment”) and the appli­cable regu­la­tions on data pro­tec­tion, in par­ti­cu­lar the pro­vi­sions of the Gene­ral Data Pro­tec­tion Regu­la­tion (“GDPR”) and the natio­nal data pro­tec­tion provisions.

This Pri­va­cy Sta­te­ment explains what per­so­nal data is col­lec­ted and pro­ces­sed, for what pur­poses, how long we keep per­so­nal data, what your rights are in this regard and how you can contact us.

This Pri­va­cy Sta­te­ment applies, inter alia, to (i) our web­sites: cosh.eco; screenmystore.cosh.eco; screenmybrand.cosh.eco; and asso­cia­ted dash­boards (herei­naf­ter our ​“Website(s)”) and the COSH! Digi­tal War­drobe appli­ca­tion (herei­naf­ter our ​“COSH App”), and the ser­vices and acti­vi­ties asso­cia­ted with it and (ii) all rela­tion­ships through any other means of com­mu­ni­ca­tion bet­ween you and us. The Website(s) and the COSH App are col­lec­ti­ve­ly refer­red to as our ​“Platform(s)”. 

COCREATE GOOD LIFE BV, a pri­vate limi­ted com­pa­ny, with regis­te­red office at Berg­jes­bos 19, 8310 Bruges, Bel­gium and regis­te­red in the Bel­gian Cross­roads Bank for Enter­prises under the num­ber 0697.686.059 (herei­naf­ter ​“COSH”, ​“we” or ​“us”), is res­pon­sible for pro­ces­sing your data as des­cri­bed in this Pri­va­cy Statement. 

Please note that COSH is a data control­ler, which means that we have a direct res­pon­si­bi­li­ty to you in rela­tion to the pro­ces­sing of your per­so­nal data. This Pri­va­cy Sta­te­ment relates sole­ly to our rela­tion­ship with you as a data controller.

Per­so­nal data is data that can be used to direct­ly or indi­rect­ly iden­ti­fy natu­ral per­son. We may col­lect and pro­cess per­so­nal data in various ways, e.g. when:

• you contact or have contac­ted us (e.g. via the contact form on one of our Platform(s), via e‑mail, etc.);
• we pro­vide or have pro­vi­ded any of our ser­vices to you;
• you wish to apply for a job at COSH;
• when you as a user create an account on the cosh.eco web­site and/​or via our COSH App;
• when you as a per­son com­plete sur­veys or enter our giveaways;
• etc.

Usual­ly, you give us your per­so­nal data your­self. Some­times we receive your contact details through third par­ties, e.g:

• pur­chase data pro­vi­ded by retai­lers with whom you have inter­ac­ted, where you have given your expli­cit consent to share this data with COSH in the app. 

We may also find, update, sup­ple­ment and improve your data through public sources (e.g. Cross­roads Bank for Enter­prises, etc.) and social networks. 

In prin­ciple, we use your per­so­nal data only for pro­vi­ding the ser­vices you request. If we use exter­nal ser­vice pro­vi­ders to pro­vide these ser­vices, these ser­vice pro­vi­ders also have access to your per­so­nal data exclu­si­ve­ly within the scope of their ser­vices. We have imple­men­ted neces­sa­ry tech­ni­cal and orga­ni­za­tio­nal mea­sures to ensure com­pliance with data pro­tec­tion regu­la­tions and also require exter­nal ser­vice pro­vi­ders to adhere to these pro­vi­sions. We have ente­red into data pro­ces­sing agree­ments with rele­vant third par­ties, which include neces­sa­ry safe­guards regar­ding the confi­den­tia­li­ty and pri­va­cy com­pliance of your per­so­nal data.

Not­withs­tan­ding the fore­going, it is pos­sible that COSH may dis­close your per­so­nal data to com­petent autho­ri­ties (i) if COSH is requi­red to do so by law or legal pro­cess and/​or (ii) to pro­tect and defend our rights.

In prin­ciple, we aim to store your per­so­nal data on IT sys­tems in the Euro­pean Eco­no­mic Area (“EEA”). 

If per­so­nal data are trans­fer­red to coun­tries or orga­ni­za­tions out­side the EEA, appro­priate safe­guards will always be pro­vi­ded. Any trans­fer of per­so­nal data out­side the EEA to a reci­pient in a coun­try not cove­red by a deci­sion of the Euro­pean Com­mis­sion to pro­vide an ade­quate level of pro­tec­tion, will be sub­ject to the pro­vi­sions of a data trans­fer agree­ment, which will include (i) the stan­dard contrac­tual clauses issued by the Euro­pean Com­mis­sion, or (ii) any other mecha­nism in accor­dance with the GDPR, or any other regu­la­tion rela­ting to the pro­ces­sing of per­so­nal data such as the EU‑U.S. Data Pri­va­cy Fra­me­work for trans­fers to the U.S. If you have any ques­tions regar­ding these safe­guards or their acces­si­bi­li­ty, please contact us by e‑mail or post using the details below (under title 2.5).

You have seve­ral rights:

• You have a right to access your per­so­nal data. This allows you to check what per­so­nal data we pro­cess about you;
• You have a right to cor­rect your per­so­nal data. This allows you to cor­rect or sup­ple­ment any incor­rect or incom­plete per­so­nal data we pro­cess about you;
• You have a right to era­sure of your per­so­nal data. This allows you to per­ma­nent­ly erase per­so­nal data that we pro­cess about you. We are not always obli­ged to erase your per­so­nal data at your request – this right only applies in the cases and to the extent pro­vi­ded by law;
• You have a right to res­trict the pro­ces­sing of your per­so­nal data. This allows you to freeze our use of your per­so­nal data without era­sing it. We are not always obli­ged to res­trict your per­so­nal data at your request – this right applies only in the cases and to the extent pro­vi­ded for by law;
• You have the right to object to the pro­ces­sing of your per­so­nal data. This allows you to object to the fur­ther pro­ces­sing of your per­so­nal data. We are not always obli­ged to honor your objec­tion – this right only applies when we pro­cess your per­so­nal data based on our legi­ti­mate interests;
• You always have the right to with­draw your consent when the pro­ces­sing of your per­so­nal data is based on your consent;
• You always have the right to object the pro­ces­sing of your per­so­nal data for direct mar­ke­ting purposes;
• You have the right to data por­ta­bi­li­ty. This allows you to trans­fer, copy or for­ward per­so­nal data smooth­ly from one control­ler to ano­ther. This right can only be exer­ci­sed if the pro­ces­sing is based on your consent or on an agree­ment with you.

If you wish to exer­cise any of the rights lis­ted above, please contact us by e‑mail or post using the details below (under title 2.5). 

When you make a request to exer­cise your rights, we will first veri­fy your iden­ti­ty through the appro­priate and least pri­va­cy-intru­sive means. We do this to prevent your data from fal­ling into the wrong hands.

The exer­cise of your rights is in prin­ciple free of charge. If your request is mani­fest­ly unfoun­ded or exces­sive, we may charge you a rea­so­nable fee in light of the admi­nis­tra­tive costs incur­red by us. In such cases, howe­ver, we may also choose not to com­ply with your request. You will be noti­fied of the rea­sons for this, if applicable.

In any case, we will always inform you of the out­come of your request no later than within one month. For com­plex or mul­tiple requests, this per­iod may be exten­ded by two months, but we will also inform you of this neces­sa­ry exten­sion within the ini­tial month.

For the exer­cise of your rights, for any ques­tions or com­plaints rela­ted to the pro­ces­sing of per­so­nal data, you can always contact us:

You can also file a com­plaint with the super­vi­so­ry autho­ri­ty in the loca­tion where you reside. For Bel­gium, this is the Data Pro­tec­tion Authority:

For more infor­ma­tion regar­ding com­plaints and reme­dies, we invite you to consult the Data Pro­tec­tion Autho­ri­ty’s web­site: gege​vens​bes​cher​ming​sau​to​ri​teit​.be/​b​u​r​g​e​r​/​a​c​t​i​e​s​/​k​l​a​c​h​t​-​i​n​d​ienen.

Under what cir­cum­stances COSH col­lects, uses or other­wise pro­cesses dif­ferent cate­go­ries of per­so­nal data from you, for what pur­pose, on what legal basis, for what per­iod and with whom it is sha­red, is des­cri­bed below. 

COSH pro­vides, with the COSH App, a smart war­drobe plat­form that gives you a com­plete over­view of your clo­thing items, helps you make smar­ter shop­ping and ren­tal deci­sions, offers dai­ly out­fit sug­ges­tions from your per­so­nal smart sty­list, and tracks what you wear to help reduce your cost per wear. 

COSH may col­lect and pro­cess one or more of the fol­lo­wing per­so­nal data:

• account data: e‑mail address, pass­word, first name, last name, date of birth (optio­nal), gen­der (optio­nal), pro­file pic­ture (optio­nal), coun­try, city (optio­nal), pre­fer­red lan­guage (optio­nal), style and war­drobe chal­lenges and goals (optio­nal), how you would like COSH to assist you in achie­ving these goals (optio­nal), and your satis­fac­tion level regar­ding your war­drobe (optio­nal);
• contact and contract infor­ma­tion: e.g. name, first name, e‑mail address;
• mobile phone num­ber (optio­nal);
• pro­file-buil­ding data (optio­nal): e.g. pre­fe­rences gathe­red via style quizzes, pre­fer­red fashion styles, body type data (e.g. cup size, height, weight, body shape, waist), shop­ping pro­file and habits (e.g. pre­fe­rences, fre­quen­cy), and colour preferences;
• war­drobe data: e.g. pho­tos of your clo­thing items and war­drobe content;
• shop­ping acti­vi­ty data: e.g. store visit infor­ma­tion based on ​‘my routes’ (i.e. stores you visit or plan to shop at);
• cor­res­pon­dence and com­mu­ni­ca­tion data: inclu­ding mes­sages, e‑mails, and any other forms of com­mu­ni­ca­tion with COSH;
• pur­chase data (optio­nal): details of your pur­chases at online and phy­si­cal retai­lers (e.g. what was pur­cha­sed, from which retai­ler, the loca­tion of the pur­chase, the price, etc.);
• your elec­tro­nic iden­ti­fi­ca­tion data: e.g. connec­tion times, etc. fol­lo­wing a visit to our Cosh App that uses cookies or simi­lar techniques.

Howe­ver, we will never col­lect more per­so­nal data from you than is strict­ly neces­sa­ry to achieve the pur­poses for which we have col­lec­ted your per­so­nal data.

COSH pro­cesses the above per­so­nal data for the fol­lo­wing purposes:

1. to pro­vide you with more infor­ma­tion about our ser­vices and pro­ducts at your request or at our ini­tia­tive, if dee­med neces­sa­ry to accu­ra­te­ly per­form our ser­vices for you;
2. to pro­vide you with the ser­vices as agreed with you;
3. to handle any com­plaint and/​or feedback;
4. to main­tain a busi­ness rela­tion­ship with you as a customer;
5. to per­so­na­lize your user expe­rience, inclu­ding out­fit recom­men­da­tions, war­drobe sug­ges­tions, and shop­ping advice tai­lo­red to your style pre­fe­rences and profile;
6. to improve our ser­vices, func­tio­na­li­ties, and user inter­face based on usage data and feedback;
7. to send you rele­vant ser­vice mes­sages or updates regar­ding your pro­file, war­drobe acti­vi­ty, or COSH’s fea­tures based on the set­tings you select in the app;
8. (regar­ding pur­chase data) to auto­ma­ti­cal­ly update your digi­tal war­drobe and pro­vide COSH with bet­ter aggre­ga­ted insights into brand popu­la­ri­ty, pur­cha­sing beha­viour, and pro­duct lon­ge­vi­ty to sup­port sus­tai­nable fashion research;
9. to allow you to join the COSH com­mu­ni­ty (e.g. via What­sApp group updates) where you can join a group of COSH! Digi­tal war­drobe enthu­siasts that help test new fea­tures and noti­fy us of bugs and sug­gest fea­tures for impro­ving the app;
10. for pla­cing and rea­ding cookies. More infor­ma­tion on our use of cookies can be found in our Cookie Sta­te­ment.

COSH pro­cesses the per­so­nal data lis­ted above on the fol­lo­wing legal grounds:

• the pro­ces­sing is neces­sa­ry for the per­for­mance of an agree­ment to which you are a par­ty or to take steps at your request prior to the conclu­sion of an agree­ment (pur­poses I to III above);
• the pro­ces­sing is neces­sa­ry for the pur­poses of the legi­ti­mate inter­ests pur­sued by COSH or a third par­ty (pur­poses IV to VI and X above). Our legi­ti­mate inter­ests are:
  • to serve you as a cus­to­mer even bet­ter by kee­ping you infor­med about our acti­vi­ties, ser­vices and pro­ducts (pur­pose IV above);
  • to offer you a more rele­vant and enga­ging expe­rience through per­so­na­li­zed content, recom­men­da­tions, and sty­ling advice that match your pre­fe­rences and pro­file (pur­pose V above);
  • to opti­mize and enhance the qua­li­ty, effi­cien­cy, and usa­bi­li­ty of the COSH App based on insights gai­ned from usage pat­terns, feed­back, and user inter­ac­tions (pur­pose VI above);
  • for strict­ly neces­sa­ry cookies, which are cookies that ensure func­tio­na­li­ties without which you would not be able to use our COSH App as inten­ded, we rely on the legal basis of legi­ti­mate inter­est. These cookies are requi­red pure­ly for tech­ni­cal rea­sons to be able to use the App. Given the tech­ni­cal neces­si­ty, there is only an obli­ga­tion to pro­vide infor­ma­tion, and we place these cookies as soon as you access the App (pur­pose X above);
• the cus­to­mer has given consent to the pro­ces­sing of his/​her per­so­nal data (pur­poses VII to X above). Regar­ding cookies, we request your consent for cate­go­ries of cookies other than strict­ly neces­sa­ry cookies (e.g., pre­fe­rence cookies, ana­ly­ti­cal cookies, etc.), inso­far as our App uses them. For more infor­ma­tion, we refer you to our Cookie Sta­te­ment;

If you delete the COSH App from your device but do not delete your account, your per­so­nal data will conti­nue to be sto­red in accor­dance with this Pri­va­cy Sta­te­ment, and you can re-acti­vate your account at any time.

If you delete your account, COSH will retain your per­so­nal data for a per­iod of 3 months after the account dele­tion to handle any post-dele­tion inqui­ries, com­plaints, or admi­nis­tra­tive fol­low-ups. After this per­iod, your per­so­nal data will be per­ma­nent­ly dele­ted or anonymized.

In cer­tain cases, we may retain your per­so­nal data for a lon­ger per­iod, inclu­ding but not limi­ted to the fol­lo­wing situations:

• if appli­cable laws require us to retain spe­ci­fic data, we will retain the data for the dura­tion of the legal­ly requi­red period;
• data neces­sa­ry to esta­blish, exer­cise, or defend legal claims will be retai­ned for the dura­tion of the appli­cable sta­tu­to­ry limi­ta­tion period. 

In pur­suit of these pur­poses, we may dis­close your per­so­nal data to:

• sub­con­trac­tors who pro­cess per­so­nal data on our behalf (pro­ces­sors), e.g. in rela­tion to hos­ting, mai­ling, mar­ke­ting ini­tia­tives, etc.. They only pro­cess your per­so­nal data under our writ­ten ins­truc­tions and in accor­dance with an agreed pro­ces­sing agreement;
• judi­cial, police or admi­nis­tra­tive autho­ri­ties, if requi­red by law or court proceedings;
• govern­ments and com­pa­nies, but only in rela­tion to war­drobe data and shop­ping activity/​location data, and under the fol­lo­wing conditions:

(i) in a pseu­do­ny­mi­zed form, for the pur­pose of gene­ra­ting aggre­ga­ted insights and sta­tis­tics to sup­port sus­tai­na­bi­li­ty and cir­cu­lar fashion repor­ting, as well as research into the lifes­pan of gar­ments, repair trends, and sus­tai­nable consump­tion prac­tices. This pro­ces­sing is based on COSH’s legi­ti­mate inter­est in contri­bu­ting to evi­dence-based sus­tai­na­bi­li­ty tran­si­tions and pro­mo­ting a more cir­cu­lar, trans­pa­rent, and social­ly res­pon­sible fashion ecosystem;

(ii) in a non-pseu­do­ny­mi­zed form, but only where you have given your expli­cit and infor­med consent e.g. to par­ti­ci­pate in a pre­de­fi­ned uni­ver­si­ty research which is avai­lable in your settings.

When you create an account on the COSH Web­site (cosh.eco), we col­lect and pro­cess cer­tain per­so­nal data to create and manage your account, offer tai­lo­red content, and pro­vide you with the ser­vices and func­tio­na­li­ties avai­lable on the Website.

COSH may col­lect and pro­cess one or more of the fol­lo­wing per­so­nal data:

• account data: e‑mail address, pass­word, first name, last name; 
• pro­file and pre­fe­rence data: your favou­rite shops and brands, as well as shop­ping routes crea­ted by you (optio­nal);
• cor­res­pon­dence and other forms of com­mu­ni­ca­tion: e‑mails and other (forms of) communication;
• your elec­tro­nic iden­ti­fi­ca­tion data: e.g. your IP address, connec­tion times, etc. fol­lo­wing a visit to our Web­site that uses cookies or simi­lar techniques.

Howe­ver, we will never col­lect more per­so­nal data from you than is strict­ly neces­sa­ry to achieve the pur­poses for which we have col­lec­ted your per­so­nal data.

COSH pro­cesses the above per­so­nal data for the fol­lo­wing purposes:

1. to create and manage your account on the COSH Website;
2. to pro­vide you with the ser­vices as agreed with you;
3. to handle any com­plaint and/​or feedback;
4. to main­tain a busi­ness rela­tion­ship with you; to keep you infor­med about, among other things, COSH acti­vi­ties, pro­ducts and services;
5. for pla­cing and rea­ding cookies. More infor­ma­tion on our use of cookies can be found in our Cookie Sta­te­ment.

COSH pro­cesses the per­so­nal data lis­ted above on the fol­lo­wing legal grounds:

• the pro­ces­sing is neces­sa­ry for the per­for­mance of an agree­ment to which you are a par­ty or to take steps at your request prior to the conclu­sion of an agree­ment (pur­poses I to III above);
• the pro­ces­sing is neces­sa­ry for the pro­tec­tion of the legi­ti­mate inter­ests of COSH or a third par­ty (pur­poses IV and V above). Our legi­ti­mate inter­ests are:
  • to serve you as a regis­te­red user even bet­ter by kee­ping you infor­med about our acti­vi­ties, ser­vices and pro­ducts (pur­pose IV above);
  • for strict­ly neces­sa­ry cookies, which are cookies that ensure func­tio­na­li­ties without which you would not be able to use our Web­site as inten­ded, we rely on the legal basis of legi­ti­mate inter­est. These cookies are requi­red pure­ly for tech­ni­cal rea­sons to be able to use the Web­site. Given the tech­ni­cal neces­si­ty, there is only an obli­ga­tion to pro­vide infor­ma­tion, and we place these cookies as soon as you access the Web­site (pur­pose V above);
• the regis­te­red user has given consent for the pro­ces­sing of his/​her per­so­nal data (pur­pose V above). Regar­ding cookies, we request your consent for cate­go­ries of cookies other than strict­ly neces­sa­ry cookies (e.g., pre­fe­rence cookies, ana­ly­ti­cal cookies, etc.), inso­far as our Web­site uses them. For more infor­ma­tion, we refer you to our Cookie Sta­te­ment;

COSH will not retain your per­so­nal data for lon­ger than neces­sa­ry for the pur­poses for which they were col­lec­ted. The fol­lo­wing reten­tion per­iods apply:

• 12 months after dele­tion of your account, unless COSH is legal­ly requi­red to retain the data for a lon­ger period;
• COSH will retain your per­so­nal data until you with­draw your consent to the use of your data. You may with­draw your consent at any time using the pro­ce­dure des­cri­bed under titles 2.4 and 2.5 of this Pri­va­cy Sta­te­ment (pur­pose V above);
• the reten­tion per­iod for cookies varies depen­ding on the type of cookie. More infor­ma­tion on our use of cookies can be found in our Cookie Sta­te­ment (pur­pose V above). 

In pur­suit of these pur­poses, we may dis­close your per­so­nal data to:

• sub­con­trac­tors pro­ces­sing per­so­nal data on our behalf (pro­ces­sors);
• judi­cial, police or admi­nis­tra­tive autho­ri­ties, if requi­red by law or court proceedings;

the third par­ties lis­ted in the Cookie Sta­te­ment;

If you are a pro­fes­sio­nal B2B COSH mem­ber – such as a retai­ler, store, or other busi­ness or a public orga­ni­za­tion (e.g. cities, muni­ci­pa­li­ties) – whe­ther or not you are a paying mem­ber, COSH may col­lect and pro­cess your per­so­nal data in the context of our col­la­bo­ra­tion, com­mu­ni­ca­tion, ser­vice pro­vi­sion, or your use of COSH’s B2B tools and plat­forms (e.g. screenmystore.cosh.eco, screenmycity.cosh.eco and other asso­cia­ted dashboards).

COSH may col­lect and pro­cess one or more of the fol­lo­wing per­so­nal data:

• contact and account data: name, first name, job title and/​or role, phone num­ber, mobile num­ber, e‑mail address, address details, and other contact infor­ma­tion; data nee­ded to create and manage your B2B account(s);
• cor­res­pon­dence and com­mu­ni­ca­tion data: inclu­ding let­ters, emails, and other forms of com­mu­ni­ca­tion with COSH;
• billing and admi­nis­tra­tive data: such as bank account num­bers and all other infor­ma­tion rela­ted to payments.

Howe­ver, we will never col­lect more per­so­nal data from you than is strict­ly neces­sa­ry to achieve the pur­poses for which we have col­lec­ted your per­so­nal data.

COSH pro­cesses the above per­so­nal data for the fol­lo­wing purposes:

1. to pro­vide you with more infor­ma­tion about our ser­vices and pro­ducts, either at your request or at our ini­tia­tive, when neces­sa­ry to accu­ra­te­ly pro­vide our ser­vices to you;
2. to deli­ver the agreed B2B ser­vices to you;
3. to handle any com­plaints and/​or feed­back you may submit;
4. to pro­cess or receive payments;
5. to main­tain a pro­fes­sio­nal busi­ness rela­tion­ship with you as a B2B COSH member;

COSH pro­cesses the per­so­nal data lis­ted above on the fol­lo­wing legal grounds:

• the pro­ces­sing is neces­sa­ry for the per­for­mance of an agree­ment to which you are a par­ty or to take steps at your request prior to the conclu­sion of an agree­ment (pur­poses I to IV above);
• the pro­ces­sing is neces­sa­ry for the pro­tec­tion of the legi­ti­mate inter­ests of COSH or a third par­ty (pur­pose V above). Our legi­ti­mate inter­est is to serve you as a B2B cus­to­mer even bet­ter by kee­ping you infor­med about our acti­vi­ties, ser­vices and products;

COSH will retain your per­so­nal data for a per­iod of 12 months after the com­ple­tion of the ser­vice or ter­mi­na­tion of the agree­ment. This reten­tion per­iod allows us to handle any post-ser­vice inqui­ries, com­plaints, or admi­nis­tra­tive follow-ups.

In cer­tain cases, we may retain your per­so­nal data for a lon­ger per­iod, inclu­ding but not limi­ted to the fol­lo­wing situations:

• if appli­cable laws require us to retain spe­ci­fic data, we will retain the data for the dura­tion of the legal­ly requi­red period;
• data neces­sa­ry to esta­blish, exer­cise, or defend legal claims will be retai­ned for the dura­tion of the appli­cable sta­tu­to­ry limi­ta­tion period. 

In pur­suit of these pur­poses, we may dis­close your per­so­nal data to:

• sub­con­trac­tors who pro­cess per­so­nal data on our behalf (pro­ces­sors), e.g. in rela­tion to hos­ting, mai­ling, mar­ke­ting ini­tia­tives, etc.. They only pro­cess your per­so­nal data under our writ­ten ins­truc­tions and in accor­dance with an agreed pro­ces­sing agreement;
• judi­cial, police or admi­nis­tra­tive autho­ri­ties, if requi­red by law or court proceedings;
• other B2B COSH mem­bers: your data may be dis­clo­sed to other B2B COSH mem­bers only in the context of our match­ma­king ser­vice (only appli­cable to paying B2B COSH mem­bers), and only where there is a confir­med pro­fes­sio­nal match. The pur­pose of this dis­clo­sure is to connect com­pa­tible busi­nesses as part of COSH’s B2B ser­vice offe­ring. The legal basis for this pro­ces­sing is that it is neces­sa­ry for the per­for­mance of a contract to which you are a party.

COSH may col­lect and pro­cess one or more of the fol­lo­wing per­so­nal data:

• contact infor­ma­tion: name, title, func­tion, tele­phone and mobile num­ber, e‑mail address, office address and other contact and/​or com­pa­ny information;
• cor­res­pon­dence and other forms of com­mu­ni­ca­tion: let­ters, e‑mails and other (forms of) com­mu­ni­ca­tion; and
• infor­ma­tion on the deli­ve­ry of the product/​service and any infor­ma­tion on our enga­ge­ment with the supplier/​subcontractor, bank account num­bers and any other infor­ma­tion on payments.

Howe­ver, we will never col­lect more per­so­nal data from you than is strict­ly neces­sa­ry to achieve the pur­poses for which we have col­lec­ted your per­so­nal data.

COSH pro­cesses the above per­so­nal data for the fol­lo­wing purpose:

1. to buy goods or services.

COSH pro­cesses the per­so­nal data lis­ted above on the fol­lo­wing legal basis:

• the pro­ces­sing is neces­sa­ry for the per­for­mance of an agree­ment to which the supplier/​subcontractor is a par­ty or to take steps at the request of the supplier/​subcontractor prior to the conclu­sion of a contract (pur­pose I above). 

We keep your per­so­nal data for 7 year after com­ple­tion of the ser­vice, unless COSH is requi­red by law to keep the data longer.

In pur­suit of this pur­pose, we may dis­close your per­so­nal data to:

• sub­con­trac­tors pro­ces­sing per­so­nal data on our behalf (pro­ces­sors);
• judi­cial, police or admi­nis­tra­tive autho­ri­ties, if requi­red by law or court proceedings;

COSH may col­lect and pro­cess one or more of the fol­lo­wing per­so­nal data:

• contact infor­ma­tion: e.g. name, first name, e‑mail address, com­pa­ny name, role in your com­pa­ny, address;
• cor­res­pon­dence and other forms of com­mu­ni­ca­tion: e‑mails and other (forms of) communication;
• your elec­tro­nic iden­ti­fi­ca­tion data: e.g. your IP address, connec­tion times, etc. fol­lo­wing a visit to our Web­site that uses cookies or simi­lar techniques.

Howe­ver, we will never col­lect more per­so­nal data from you than is strict­ly neces­sa­ry to achieve the pur­poses for which we have col­lec­ted your per­so­nal data.

COSH pro­cesses the above per­so­nal data for the fol­lo­wing purposes:

1. to ans­wer your ques­tion or request for infor­ma­tion, or to sche­dule an explo­ra­to­ry meeting;
2. for direct mar­ke­ting, to keep you infor­med about, among other things, COSH acti­vi­ties, pro­ducts and services;
3. for pla­cing and rea­ding cookies. More infor­ma­tion on our use of cookies can be found in our Cookie Sta­te­ment.

COSH pro­cesses the per­so­nal data lis­ted above on the fol­lo­wing legal grounds:

• the pro­ces­sing is neces­sa­ry to take pre-contrac­tual mea­sures at your request (pur­pose I above);
• the subscriber/​visitor has given consent for the pro­ces­sing of his/​her per­so­nal data (pur­poses II and III above). Regar­ding cookies, we request your consent for cate­go­ries of cookies other than strict­ly neces­sa­ry cookies (e.g., pre­fe­rence cookies, ana­ly­ti­cal cookies, etc.), inso­far as our Plat­form uses them. For more infor­ma­tion, we refer you to our Cookie Sta­te­ment;
• the pro­ces­sing is neces­sa­ry for the pro­tec­tion of the legi­ti­mate inter­ests of COSH or a third par­ty (pur­pose III above). For strict­ly neces­sa­ry cookies, which are cookies that ensure func­tio­na­li­ties without which you would not be able to use our Plat­form as inten­ded, we rely on the legal basis of legi­ti­mate inter­est. These cookies are requi­red pure­ly for tech­ni­cal rea­sons to be able to use the Plat­form. Given the tech­ni­cal neces­si­ty, there is only an obli­ga­tion to pro­vide infor­ma­tion, and we place these cookies as soon as you access the Platform.

COSH will not retain your per­so­nal data for lon­ger than neces­sa­ry for the pur­poses for which they were col­lec­ted. The fol­lo­wing reten­tion per­iods apply:

• COSH will retain your per­so­nal data for up to 10 years after the last contact you had with us as a pros­pect (pur­pose I above);
• COSH will retain your per­so­nal data until you with­draw your consent to the use of your data. You may with­draw your consent at any time using the pro­ce­dure des­cri­bed under titles 2.4 and 2.5 of this Pri­va­cy Sta­te­ment (pur­poses II and III above);
• the reten­tion per­iod for cookies varies depen­ding on the type of cookie. More infor­ma­tion on our use of cookies can be found in our Cookie Sta­te­ment (pur­pose III above). 

In pur­suit of these pur­poses, we may dis­close your per­so­nal data to:

• sub­con­trac­tors pro­ces­sing per­so­nal data on our behalf (pro­ces­sors);
• judi­cial, police or admi­nis­tra­tive autho­ri­ties, if requi­red by law or court proceedings;

the third par­ties lis­ted in the Cookie Sta­te­ment.

COSH may col­lect and pro­cess one or more of the fol­lo­wing per­so­nal data:

• contact infor­ma­tion: name, first name, func­tion, tele­phone and mobile num­ber, home address, e‑mail address, and other contact information;
• cor­res­pon­dence and other forms of com­mu­ni­ca­tion: let­ters, e‑mails and other (forms of) com­mu­ni­ca­tion; and
• other recruit­ment-rela­ted infor­ma­tion: gen­der, date of birth, pho­to­graph, appli­ca­tion form, CV, inter­view notes, and other employ­ment his­to­ry information.

Howe­ver, we will never col­lect more per­so­nal data from you than is strict­ly neces­sa­ry to achieve the pur­poses for which we have col­lec­ted your per­so­nal data.

COSH pro­cesses the above per­so­nal data for the fol­lo­wing purposes:

1. to assess the sui­ta­bi­li­ty of the (poten­tial) appli­cant and to start an appli­ca­tion pro­cess and for the eva­lua­tion of the application;
2. to keep appli­cants infor­med of our job ope­nings; and
3. to invite appli­cants to our COSH acti­vi­ties and have them par­ti­ci­pate in our activities.

COSH pro­cesses the per­so­nal data lis­ted above on the fol­lo­wing legal grounds:

• the pro­ces­sing is neces­sa­ry to take steps at the appli­cant’s request prior to the conclu­sion of an agree­ment to which the appli­cant becomes a par­ty (pur­pose I above);
• the appli­cant has given consent to the pro­ces­sing of his/​her per­so­nal data (pur­poses II and III above).

COSH will delete appli­cants’ per­so­nal data no later than 4 weeks after the end of the appli­ca­tion pro­cess unless the appli­cant has given his/​her express consent to keep his/​her data for a lon­ger per­iod. In that case, COSH will keep the per­so­nal data for a per­iod of 1 year, after which the appli­cant will be asked whe­ther he/​she wishes to renew his/​her consent. 

In pur­suit of these pur­poses, we may dis­close your per­so­nal data to:

• sub­con­trac­tors pro­ces­sing per­so­nal data on our behalf (pro­ces­sors);
• judi­cial, police or admi­nis­tra­tive autho­ri­ties, if requi­red by law or court proceedings;

COSH may col­lect and pro­cess one or more of the fol­lo­wing per­so­nal data:

• contact infor­ma­tion: name, first name, com­pa­ny name, func­tion, address, tele­phone and mobile num­ber, e‑mail address, pay­ment details (in case of paid activity);
• cor­res­pon­dence and other forms of com­mu­ni­ca­tion: inclu­ding ques­tions asked via chat func­tion at webinars;
• in case of events: busi­ness cards, die­ta­ry res­tric­tions, pho­tos, videos, etc.

Howe­ver, we will never col­lect more per­so­nal data from you than is strict­ly neces­sa­ry to achieve the pur­poses for which we have col­lec­ted your per­so­nal data.

COSH pro­cesses the above per­so­nal data for the fol­lo­wing purposes:

1. orga­ni­zing the COSH activity;
2. conduc­ting surveys;
3. direct mar­ke­ting: to invite par­ti­ci­pants to our COSH acti­vi­ties and engage them in our acti­vi­ties; and
4. mar­ke­ting: post­ing pho­tos and videos on COSH’s Website(s) and social media (e.g. Lin­ke­dIn, etc.) to pro­mote our ser­vices and activities. 

COSH pro­cesses the per­so­nal data lis­ted above on the fol­lo­wing legal grounds:

• the pro­ces­sing is neces­sa­ry for the per­for­mance of an agree­ment to which you are a par­ty or to take steps at your request prior to the conclu­sion of an agree­ment (pur­pose I above);
• the pro­ces­sing is neces­sa­ry for the pro­tec­tion of the legi­ti­mate inter­ests of COSH or a third par­ty (pur­poses II and III above). Our legi­ti­mate inter­ests include impro­ving the qua­li­ty of COSH acti­vi­ties (pur­pose II) and ser­ving you even bet­ter by kee­ping you infor­med about other COSH acti­vi­ties (pur­pose III); and
• the data sub­ject has given consent to the pro­ces­sing of his/​her per­so­nal data (pur­pose IV).

COSH will not retain your per­so­nal data for lon­ger than neces­sa­ry for the pur­poses for which they were col­lec­ted. The fol­lo­wing reten­tion per­iods apply:

• COSH will retain your per­so­nal data for up 5 years after the com­ple­tion of the acti­vi­ty, unless COSH is legal­ly requi­red to retain the data for a lon­ger per­iod (pur­poses I to III above);
• COSH will retain your per­so­nal data until you with­draw your consent to the use of your data. You may with­draw your consent at any time using the pro­ce­dure des­cri­bed under titles 2.4 and 2.5 of this Pri­va­cy Sta­te­ment (pur­pose IV above).

In pur­suit of these pur­poses, we may dis­close your per­so­nal data to:

• sub­con­trac­tors pro­ces­sing per­so­nal data on our behalf (pro­ces­sors);
• judi­cial, police or admi­nis­tra­tive autho­ri­ties, if requi­red by law or court proceedings;

If you pur­chase COSH pro­ducts via our online shop or at our phy­si­cal points of sale, COSH may col­lect and pro­cess your per­so­nal data in order to manage your order and pro­vide after-sales service.

COSH may col­lect and pro­cess one or more of the fol­lo­wing per­so­nal data:

• contact infor­ma­tion: name, first name, phone and/​or mobile num­ber, e‑mail address, pos­tal address and other contact details;
• order, ship­ping and return infor­ma­tion: pro­ducts orde­red, deli­ve­ry/­pick-up details;
• billing and pay­ment infor­ma­tion: invoice details, com­pa­ny name and form (if appli­cable), pay­ment sta­tus and method;
• cor­res­pon­dence and other forms of com­mu­ni­ca­tion: let­ters, e‑mails, calls and other com­mu­ni­ca­tions rela­ting to your purchase.

Howe­ver, we will never col­lect more per­so­nal data from you than is strict­ly neces­sa­ry to achieve the pur­poses for which we have col­lec­ted your per­so­nal data.

COSH pro­cesses the above per­so­nal data for the fol­lo­wing purposes:

1. to pro­cess and ful­fil your order (inclu­ding deli­ve­ry/­pick-up, returns and refunds);
2. to handle any com­plaint and/​or after-sales request;
3. to issue invoices and manage payments;
4. to main­tain a cus­to­mer rela­tion­ship with you and keep you infor­med about simi­lar pro­ducts and services.

COSH pro­cesses the per­so­nal data lis­ted above on the fol­lo­wing legal grounds:

• the pro­ces­sing is neces­sa­ry for the per­for­mance of a contract to which you are a par­ty or to take steps at your request prior to ente­ring into a contract (pur­poses I – III above);
• the pro­ces­sing is neces­sa­ry for the pur­poses of the legi­ti­mate inter­ests pur­sued by COSH or a third par­ty (pur­pose IV above). Our legi­ti­mate inter­est is to serve you bet­ter as a cus­to­mer by infor­ming you about simi­lar pro­ducts or ser­vices you have alrea­dy pur­cha­sed. You can object at any time to such com­mu­ni­ca­tions (see titles 2.4 and 2.5).

COSH will not retain your per­so­nal data for lon­ger than neces­sa­ry for the pur­poses for which they were col­lec­ted. The fol­lo­wing reten­tion per­iods apply:

• order, contact and cus­to­mer ser­vice data: up to 24 months after your last inter­ac­tion rela­ting to the order (e.g. deli­ve­ry, return, refund, com­plaint clo­sure), unless a lon­ger per­iod is nee­ded for war­ran­ty or dis­pute handling;
• invoi­cing and pay­ment data: up to 7 years to com­ply with tax and accoun­ting obligations;
• where COSH is requi­red by law to retain spe­ci­fic data, or where data are neces­sa­ry to esta­blish, exer­cise or defend legal claims, the reten­tion per­iod will be exten­ded for the dura­tion of the appli­cable legal reten­tion or limi­ta­tion period.

In pur­suit of these pur­poses, we may dis­close your per­so­nal data to:

• sub­con­trac­tors pro­ces­sing per­so­nal data on our behalf (pro­ces­sors), such as e‑commerce plat­form pro­vi­ders, pay­ment ser­vice pro­vi­ders, shipping/​postal part­ners, hos­ting, mai­ling and cus­to­mer sup­port tools. They only pro­cess your per­so­nal data under our writ­ten ins­truc­tions and in accor­dance with an agreed pro­ces­sing agreement;
• judi­cial, police or admi­nis­tra­tive autho­ri­ties, if requi­red by law or legal process.

COSH main­tains a press list contai­ning the contact details of jour­na­lists and other mem­bers of the press in order to main­tain pro­fes­sio­nal media rela­tions and keep the press infor­med on topics rele­vant to COSH’s mis­sion and activities.

COSH may col­lect and pro­cess one or more of the fol­lo­wing per­so­nal data:

• contact infor­ma­tion: name, first name, e‑mail address, media out­let, func­tion, and other publi­cly avai­lable pro­fes­sio­nal contact details;
• cor­res­pon­dence and other forms of com­mu­ni­ca­tion (e.g. press mai­lings, replies).

Howe­ver, we will never col­lect more per­so­nal data from you than is strict­ly neces­sa­ry to achieve the pur­poses for which we have col­lec­ted your per­so­nal data.

COSH pro­cesses the above per­so­nal data for the fol­lo­wing purposes:

1. to main­tain and manage a press list of rele­vant jour­na­lists and media contacts;
2. to send press releases, event invi­ta­tions and other media communications;
3. to manage cor­res­pon­dence with the press.

COSH pro­cesses the per­so­nal data lis­ted above on the fol­lo­wing legal grounds:

• the pro­ces­sing is neces­sa­ry for the pur­poses of the legi­ti­mate inter­ests pur­sued by COSH or a third par­ty. COSH has a legi­ti­mate inter­est in com­mu­ni­ca­ting with the media to pro­mote its acti­vi­ties and inform the public (pur­poses I‑III above).

COSH will not retain your per­so­nal data for lon­ger than neces­sa­ry for the pur­poses for which they were col­lec­ted.
The fol­lo­wing reten­tion per­iods apply:

• up to 1 year after the moment we detect that the e‑mail address bounces, or imme­dia­te­ly after a request for dele­tion has been received.

In pur­suit of these pur­poses, we may dis­close your per­so­nal data to:

• sub­con­trac­tors pro­ces­sing per­so­nal data on our behalf (pro­ces­sors), e.g. in rela­tion to mai­ling or hos­ting tools;
• judi­cial, police or admi­nis­tra­tive autho­ri­ties, if requi­red by law or court proceedings;

We may update this Pri­va­cy Sta­te­ment from time to time. The­re­fore, we encou­rage you to consult it regu­lar­ly so that you are aware of any changes.

Last upda­ted at 14 Octo­ber 2025