Privacy Policy

Last updated: September 2026

1. Who we are

KOCOA ("we", "us", "our") operates kocoa.nl and the innerTIDE brand. We are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Dutch and EU privacy laws.

2. What data we collect

When you visit our website, place an order, or create an account, we may collect: name, email address, shipping and billing address, phone number, payment information (processed securely by our payment provider — we never store card details), and any information you provide when contacting us or submitting a wholesale inquiry.

Product reviews

If you write a product review, we publish the name you enter (we suggest a first name and initial), your rating and text, your skin type and location if you give them, the review's language and its date. We also keep, but never show, the order the review belongs to and your account if you have one, to verify the purchase and to give reward points. The legal basis is your consent, given when you submit the review (GDPR Art. 6(1)(a)), for reward points the rewards programme terms, which form a contract with you (Art. 6(1)(b)) and, to verify the purchase and prevent abuse, our legitimate interest (Art. 6(1)(f)). We keep a review while the product is on sale, or until you ask us to remove it: you can withdraw your consent at any time through the contact details in section 10 below. If you delete your account, your published reviews stay online under the name you entered unless you ask us to remove them. A review we exclude, or remove at your request, is deleted within 30 days; we keep only a record that it existed, with the reason and the date.

3. User accounts

When you create an account, we store your name, email address, saved addresses, and order history. You can view, update, or delete your account data at any time from your account settings. If you request account deletion, we will remove your personal data within 30 days, except where retention is required by law (e.g. tax records).

4. How we use your data

We use your data to: process and fulfil orders, manage your account, provide customer support, send transactional emails (order confirmations, shipping updates), send marketing communications (only with your explicit consent, which you confirm through the link in our confirmation e-mail), analyse website usage to improve our services, prevent fraud, and comply with legal obligations.

To show you the delivery cost for your country, we use your IP address once to estimate your country; we don't store it for this.

5. Cookies & tracking

We use cookies and similar technologies on our website. You can manage your preferences at any time via the cookie settings in the footer. We categorise cookies as follows:

Essential cookies

Required for the website to function (e.g. shopping cart, authentication, cookie consent preferences). These cannot be disabled.

Analytics cookies

Google Analytics 4, Microsoft Clarity and PostHog help us understand how visitors use our website, including page views, scroll depth, clicks (including repeated clicks and clicks that do nothing), page loading speed, click heatmaps and session recordings. We also use Google Analytics for our Google advertising, as described under Marketing cookies. You can disable these via cookie settings at any time. When an order is paid or refunded, our server also reports it to Google Analytics and PostHog, whatever your cookie choice: the order number, amount, currency, language and any referring affiliate, the products (to Google Analytics only), your account ID if you have an account and, for PostHog, the ID of your browsing session where one was recorded, as well as, for Google Analytics, the analytics ID of your browser and visit where one was recorded. These server reports do not include your name or e-mail address.

Marketing cookies

Meta Pixel (Facebook/Instagram) allows us to measure the effectiveness of our advertising campaigns and show you relevant ads. We also use Google Analytics 4 for Google advertising: the Google tag looks for e-mail addresses, phone numbers, names and addresses that are entered or shown on our pages, for example at checkout or in your account (including a delivery address you enter for someone else), turns them in your browser into a one-way code (a SHA-256 hash) and sends that code to Google. Your postcode and country are sent as they are. Google matches the codes with Google accounts to measure which ads led to a purchase and to show our ads on Google services, including to you. Google does not receive your e-mail address, phone number, name or street address in readable form from us. If you are signed in to a Google account and allow personalised ads, Google also links your visits to that account (Google signals) for cross-device reports and ad audiences. You can disable these via cookie settings at any time; for the Google part, switch off Analytics cookies, after which nothing more is sent to Google from your browser.

6. Third-party services

We share data with these service providers. Most process it only on our instructions, under a data processing agreement; the carriers and Mollie also act as independent controllers for delivery and payment law, and Meta is our joint controller for the Meta Pixel:

  • Mollie — payment processing (iDEAL, PayPal, Bancontact, credit cards)
  • Supabase — user authentication and storage of account and order data (EU: Frankfurt, Germany)
  • Cloudflare — encrypted off-site backups of our database and copies of our invoices, stored in the EU and encrypted before upload with a key only we hold, so Cloudflare cannot read them
  • Resend (via Amazon SES) — transactional and marketing emails
  • Netlify — website hosting
  • MyParcel, PostNL and DHL — delivery of your orders
  • PostHog — website analytics and session recordings (data stored in the EU; you can switch it off in cookie settings)
  • Sentry — error monitoring, including recordings of a sample of visits and of visits in which an error occurs, with all text masked and images hidden (data stored in the EU)
  • Slack — internal order and error notifications for our team
  • Upstash — rate-limit counters that include IP addresses or account IDs (kept for at most one hour; 24 hours for the data-download limit) and short-lived keys derived from e-mail addresses that stop us sending duplicate internal alerts (kept for 24 hours)
  • tawk.to — live chat (loads on every page)
  • Google Analytics 4 — website analytics and Google advertising, including hashed e-mail addresses, phone numbers, names and addresses found on our pages, postcodes and countries, and, for visitors signed in to Google, the link to their Google account (Google signals); you can switch it off in cookie settings. For measurement Google acts on our instructions; when it uses the data to show ads in its own services, and when it uses Analytics data in aggregated form to improve its services, Google is an independent controller and its privacy policy applies.
  • Microsoft Clarity — heatmaps and session recordings (you can switch it off in cookie settings)
  • Meta Pixel — advertising measurement (you can switch it off in cookie settings)
  • Google Maps Places — address suggestions at checkout
  • Google Customer Reviews — if you choose to review your purchase on Google, we pass your e-mail address, order number, delivery country, expected delivery date and the products' GTINs to Google, which sends you its survey as an independent controller (Google's privacy policy applies). Basis: your consent; you can decline in the dialog.
  • PDOK (Kadaster) — Dutch postcode lookup at checkout (a public body)
  • Our accountant — bookkeeping and tax returns

7. Data retention

We retain your personal data only as long as necessary: order data is kept for 7 years to comply with Dutch tax obligations, account data is kept until you delete your account, and analytics data is automatically deleted after 14 months. For our newsletter: a sign-up you don't confirm is deleted after 30 days. When you unsubscribe, we stop sending marketing e-mails at once and mark your subscription as ended. We keep the record of your subscription and consent (when and how you subscribed, confirmed and unsubscribed) for 3 years after you unsubscribe, to be able to show that we had your consent, and then delete it. We also keep your e-mail address on a do-not-mail list for as long as needed to respect your choice. Encrypted backups of our database are kept for up to 6 months, and backup copies of invoices for 7 years. Data you have had deleted stays in these backups until they expire; we do not use it, and if we ever have to restore a backup, we delete it again before the restored data is used.

8. International data transfers

Some of our service providers are based outside the EU/EEA: Netlify, Resend with Amazon SES, Slack, Google, Meta and Microsoft are based in the United States. Transfers to them rely on the EU-U.S. Data Privacy Framework or on Standard Contractual Clauses (SCCs). PostHog and Sentry store our data in the EU; access by their US parent companies relies on the Data Privacy Framework or SCCs. Cloudflare stores our encrypted backups in the EU; access by Cloudflare, Inc., which is based in the United States, relies on the Data Privacy Framework or SCCs. Supabase stores our data in the EU (Frankfurt, Germany); access by Supabase, which is based in Singapore, from outside the EU relies on SCCs.

9. Your rights

Under the GDPR, you have the right to: access your personal data, correct inaccurate data, request deletion of your data, restrict or object to processing, data portability, and withdraw consent at any time. To exercise any of these rights, contact us at the address below. We will respond within 30 days. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

10. Contact

For any privacy-related questions or to exercise your rights, please contact us at privacy@kocoa.nl.