COOMS Privacy Policy
COOMS (Crispy Cookies SARL) (“COOMS,” “we,” and “our”) collects and processes personal data about you and other individuals. Personal data refers to any information relating to an identified or identifiable natural person (“personal data” or “data”). In this Privacy Policy (“Policy”), we explain how we process your data when you use our website, place orders for Products, participate in contests or promotions, subscribe to our marketing communications, or communicate with us.
When you provide us with information about other people (such as your family members), we assume that you are authorized to do so and that the information is accurate. Please ensure that these individuals have been informed of this Policy.
This Policy is primarily based on the Swiss Federal Data Protection Act (“FADP”). Where the European Union’s General Data Protection Regulation (“GDPR”) applies in a specific case, its provisions also apply to the extent required.
1. Who is responsible for processing your data?
Crispy Cookies SARL, 8 Rue de la Terrassière, 1207 Geneva, Switzerland, is the data controller responsible for processing your personal data under this Policy, unless we indicate otherwise in a specific case.
If you have any questions about this Policy or the processing of your personal data, or if you wish to exercise your rights in accordance with Section 13, please contact us at the following email address: maurice@coomscookies.com.
2. What data do we process?
We process various categories of personal data about you. The main categories are as follows:
Basic Data: Basicdata refers to fundamental information about you, such as your last name, first name, and contact details. It also includes data related to any customer account you may have, information regarding your participation in contests, marketing communications, and, where applicable, information about third parties involved (e.g., contact persons, service recipients, or representatives). We collect basic data in particular when you create a COOMS account, order products via the Site, participate in one of our contests, or subscribe to our marketing communications.
Contractual data:Contractual data refers to personal data collected in connection with the conclusion and performance of contracts, such as information about the relevant contracts, information regarding the performance and administration of contracts (e.g., contact details, shipping addresses, completed and unfulfilled deliveries, and payment method information), acquired rights and claims, as well as information regarding customer satisfaction. In the context of an order on our Site, this data may include, in particular, the contents of the shopping cart, the Products ordered, the date and time of the order, pickup or delivery instructions, the order status, billing information, the payment method, any discounts or coupons used, as well as communications regarding the fulfillment of the order. We primarily enter into contracts with customers, suppliers, and business partners.
Communication data:When you communicate with us—for example, when you write to us or call us—we process the content of those communications (e.g., the content of emails and phone calls, messages sent through our forms or social media platforms, and responses to our customer surveys), as well as the metadata associated with those communications (e.g., the type, time, and location of the communication). This data may also include information about third parties. In certain situations, we may also ask you to provide identification to verify your identity.
Preference data:Depending on our relationship with you, we strive to better understand your interests and tailor our products and services to your needs. We may therefore process preference data, such as information about your behavior when you use our Site or place orders through our Site (e.g., pages viewed, search terms and search results, shopping carts placed, interactions with our content, and preferences expressed), information regarding your use of electronic communications (e.g., whether and when you opened an email or clicked on a link), and your interactions with our social media pages. You can find more information about how we process your data on our social media pages in Section 12 and about how tracking works on our Site in Section 11.
Other data:We also collect data about you in other situations. For example, we process data that may relate to you in the context of administrative or legal proceedings (e.g., for evidentiary purposes). We may take or obtain photos, videos, and audio recordings in which you may be identifiable (for example, during events, marketing activations, or contests). We may also collect data on who enters certain buildings and when, on individuals with access rights, and on those who use our infrastructure and systems.
Most of the data mentioned in this Section 2 is provided to us directly by you (e.g., when you contact us or order a COOMS product). You are not required to provide us with your data, except in specific cases (e.g., legal obligations). However, if you wish, for example, to enter into contracts with us, you must provide us with certain data. We may also collect data ourselves (e.g., technical data when you use our Site). To the extent permitted, we may also collect data from publicly available sources or obtain it from authorities or third parties. This includes, in particular, the following categories of data: basic data, contractual data, and other data, but potentially all other categories of data described above, as well as data derived from correspondence and discussions with third parties. If you work for a company, a client, or another person who has a business relationship with us or is otherwise in contact with us, they may also provide us with access to data about you.
3. For what purposes do we process your data?
We process your data for the following purposes:
Use of Our Site:You can browse our Site and learn about our offerings without telling us who you are. However, to ensure the security and stability of our Site, we collect technical data that allows us to at least recognize you. We also use cookies and other similar technologies (see Section 11).
Communication:We process your data to communicate with you, for example, to respond to your inquiries, to contact you if we have questions, and to provide customer service. To this end, we use, among other things, communication data and personal information. Our communication with you generally falls within the scope of other processing purposes, such as enabling us to provide services or fulfill a contract.
Contract Performance: We process your data in connection with the conclusion, management, and performance of contracts, for example, to determine whether to enter into a contract with you, to prepare and deliver Products, to arrange for in-store pickup, to handle order-related inquiries, to organize contests, and, where applicable, to assert claims arising from contracts (debt collection, legal proceedings, etc.). For this purpose, we use, in particular, master data, contractual data, communication data, and technical data when necessary for the fulfillment of the order.
Market research, service improvement, and product development:We strive to continuously improve our products and services (including our Website) and to respond quickly to changing needs. We therefore process personal data to conduct market research, improve our services, and develop our products. To this end, we process, in particular, basic data, preference data, communication data, as well as information from customer surveys or studies. Where possible, we use pseudonymized or anonymized data for these purposes.
Marketing and Relationship Management:We process your data for marketing and relationship management purposes, such as to send you written or electronic communications and offers, and to conduct marketing campaigns. Like most companies, we personalize certain communications so that we can provide you with information and offers about our products, contests, and other news that may be of interest to you, particularly as part of marketing campaigns related to our community on Instagram, WhatsApp, newsletters, or other direct communication channels. To this end, we use, in particular, basic data (e.g., your name, email address, and phone number) and other contact details that we obtain in connection with the conclusion or performance of a contract or during a registration (e.g., a contest entry), contractual data, communication data, and, where applicable, preference data. You may object to such communications or withdraw your consent to be contacted for advertising purposes at any time by notifying us in writing at the email address listed in Section 1.
If you sign up for our marketing communications (newsletter, WhatsApp, or other), your data will be used for this purpose based on your consent, which you may withdraw at any time.
Compliance with legal requirements:We aim to create the necessary conditions to comply with legal requirements. We therefore also process personal data to comply with legal requirements, prevent violations, and identify them in a timely manner. This includes, for example, receiving and processing complaints, complying with judicial or administrative decisions, and taking measures to detect and investigate abuse. This may involve all categories of personal data mentioned in Section 2.
Other purposes:We may process your data for other purposes, such as security and prevention (e.g., to ensure IT security, prevent theft, fraud, and abuse), as well as for quality assurance and training purposes. We may also process your data to protect our rights and defend against third-party claims, as well as to protect our legitimate interests. This may involve all categories of personal data mentioned in Section 2.
4. On what basis do we process your data?
To the extent that the GDPR applies in a specific case and we need a legal basis for processing personal data, we generally rely on one or more of the following legal bases, depending on the purpose of the processing:
Entering into or performing a contract:The processing is necessary for the purpose of entering into or performing a contract with you or the entity you represent.
Legitimate interests:The processing is necessary for our legitimate interests or those of a third party, in particular to carry out the processing for the purposes described in Section 3 and to disclose the data in accordance with Sections 7 and 8, as well as to achieve the related purposes. Our legitimate interests also include compliance with legal regulations, to the extent that this is not already recognized as a legal basis under applicable data protection laws. This also includes the marketing of our products and services, our desire to better understand our markets, and the management and development of our business, including its operations, in a secure and efficient manner.
Consent:The processing is based on your consent. In this case, we will inform you separately of the relevant processing purposes. You may withdraw your consent at any time, with effect for the future, by sending us a written notice; you will find our contact information in Section 1. To withdraw your consent to online tracking, please refer to Section 11. As soon as we receive notification of the withdrawal of your consent, we will no longer process your information for the purpose(s) to which you consented, unless we have another legal basis for doing so. However, the withdrawal of consent does not affect the lawfulness of processing based on consent prior to withdrawal.
In some cases, other legal bases may apply, and if so, we will notify you separately.
5. Do we use profiling?
“Profiling” refers to the automated processing of personal data to analyze personal characteristics or make predictions.
To date, COOMS does not engage in profiling as defined by applicable data protection laws.
If COOMS were to implement profiling activities in the future, such activities would be limited to purposes such as basic personalization of offers, audience measurement, or marketing targeting, and would be carried out in accordance with applicable law.
6. Do we make automated individual decisions?
“Automated individual decisions” are decisions made exclusively on the basis of automated processing of personal data—that is, without human intervention—and which have legal consequences for the individuals concerned or otherwise significantly affect them. We do not currently use this practice, but we will notify you separately if we are required to make automated individual decisions in certain cases. In such cases, you have the option to have the decision reviewed by a human if you dispute it.
7. Who do we share your data with?
As part of our data processing activities, we may disclose your personal data to third parties, including the following categories of recipients:
Service Providers:We work with service providers in Switzerland and abroad. These service providers generally process your personal data on our behalf as “data processors.” Our processors are required to process personal data in accordance with our instructions and to take appropriate measures to ensure data security. Some service providers are also jointly responsible with us or act independently (for example, certain payment providers or delivery platforms).
Contractual partners:We share your data with our contractual partners to the extent that such sharing is required under the relevant contracts. These recipients also include the contractual partners with whom we collaborate, such as delivery service providers, meal ordering or delivery platforms, technical service providers, and partners involved in organizing contests or promotional campaigns, to the extent necessary for the performance of the relevant relationship.
Authorities:We may disclose your personal data to authorities when we are legally required to do so or when it appears necessary to protect our interests.
Other parties:We may also share your information with other parties, such as service recipients and third-party payers that you have designated.
8. Is your data transferred abroad?
We process and store personal data primarily in Switzerland and within the European Economic Area (EEA). In certain cases, however, we may also disclose personal data to service providers and other recipients (see Section 7) who are located outside this area or who process personal data outside this area, in principle in any country worldwide. The countries in question may not have laws that protect your personal data to the same extent as in Switzerland or the EEA. If we transfer your personal data to such a country, we will ensure the protection of your personal data in an appropriate manner. To this end, we use, in particular, the European Commission’s standard contractual clauses, unless the recipient is already subject to a set of legally accepted rules to ensure data protection or we can invoke an exception. We draw your attention to the fact that these contractual measures partially compensate for lower or absent legal protection, without, however, allowing all risks to be entirely ruled out. In exceptional cases, we may transfer your personal data to countries that do not have an adequate level of data protection based on an exemption, for example if you consent to the data transfer, in the context of legal proceedings abroad, or if it is necessary for the performance of a contract.
9. How long do we retain your data?
We process your data for as long as is necessary to fulfill the purposes of processing (see Section 3), comply with statutory retention periods, or protect our legitimate interests, or as long as it is technically necessary. Upon the expiration of these periods, we will delete or anonymize your data, provided that no legal or contractual obligations prevent us from doing so.
For example, we adhere to the following retention periods, which may be waived on a case-by-case basis:
COOMS Customer Account:Personal data associated with your customer account, if any, is retained for as long as the account exists, subject to applicable retention requirements.
Master and Contractual Data:We generally retain master and contractual data for ten years from the date of the last contractual activity or the end of the contract. However, this period may be extended if necessary for evidentiary purposes, due to legal or contractual provisions, or for technical reasons. Transaction data related to contracts (e.g., invoices) is generally retained for ten years.
Participation in contests:Data collected in connection with contests is retained for as long as necessary to administer the contest, and is then deleted or anonymized within a reasonable period of time, generally within 12 months of the contest’s conclusion, unless otherwise required by law or the participant has consented to receive marketing communications.
Communication records:Emails and written correspondence are generally retained for ten years. However, this period may be extended if necessary for evidentiary purposes, due to legal or contractual requirements, or for technical reasons.
Technical data:We generally retain technical data for between six months and one year. The retention period for cookies and similar technologies (see Section 11) is generally between a few days and three years if they are not deleted immediately at the end of the session.
Other data:The retention period for other data depends on the purpose of the processing and is limited to what is necessary.
10. How do we protect your personal data?
We take appropriate technical and organizational security measures to ensure the necessary security of your data and to safeguard its confidentiality, integrity, and availability; to protect it against any unjustified or unlawful processing; and to minimize the risk of loss, accidental alteration, unintended disclosure, or unauthorized access. Like all companies, however, we cannot completely rule out the possibility of a data breach; certain residual risks are unavoidable.
11. What cookies and similar technologies do we use, and how can they be disabled?
We use various technologies on our Site that allow us or third parties we engage to recognize you when you visit our Site and potentially track you across multiple visits. This section provides information about this.
Cookies are files that your browser automatically stores on your device when you visit our Site. Cookies contain a unique identifier (ID) that allows us to distinguish each visitor from others, generally without identifying them. Depending on the purpose for which they are used, cookies may also contain other information, such as the pages visited and the time spent on those pages. We use both session cookies, which are deleted as soon as the browser is closed, and persistent cookies, which remain stored for a certain period after the browser is closed (generally between a few days and three years) and are used to recognize visitors during subsequent visits.
We may also use similar technologies such as pixel tags, fingerprinting, and other technologies to store data in the browser. Pixel tags are small, usually invisible images or pieces of code that are loaded from a server and transmit certain information to the server operator, such as whether and when a website was visited. Fingerprinting refers to information about the configuration of your device or browser collected during your visit to a website, which allows your device to be distinguished from others. Most browsers also use other browser data storage technologies similar to cookies, which we may also use (e.g., “Web Storage”).
We use the following types of cookies and similar technologies:
Strictly necessary cookies:Certain cookies are essential for using the Site and its features. These cookies ensure that the Site’s essential features work properly, such as allowing you to navigate from page to page without the items in your shopping cart disappearing. These cookies have an expiration period of up to 12 months.
Cookies to improve the user experience:Cookies to improve the user experience collect information about how our Site is used and allow us to analyze its usage, such as the most frequently visited pages and how visitors navigate our Site. These cookies are used to simplify and speed up visits to the Site and, overall, to improve the user experience and convenience. We use third-party analytics services for this purpose. These cookies have an expiration period of up to 24 months.
Marketing cookies:Marketing cookies help us show you ads on our Site or on other websites for offers or services that may interest you, or display our ads as you continue browsing the internet after leaving our Site—in other words, to show you targeted ads. These cookies have an expiration period ranging from a few days to 12 months, depending on the circumstances.
In the privacy settings, you can disable certain categories of cookies by adjusting the relevant settings.
You can also configure your browser settings to block certain cookies or similar technologies, or to delete existing cookies and other data that your browser has stored. You can also install software (“plugins”) in your browser that blocks tracking by certain third parties. You can find more information on this in your browser’s help pages (usually under the keyword “data protection”). Please note that the functionality of our Site may be limited if you block certain cookies and similar technologies.
12. What data do we process on our social media pages?
We manage our own pages on social media and other similar third-party platforms (e.g., Instagram, Facebook, TikTok). If you contact us through these pages or comment on or share our content, we collect the relevant information and process it for the purposes described in Section 3, specifically for communication, marketing, and market research purposes.
When you visit our social media pages, data (e.g., regarding your user behavior) may also be transmitted directly to the relevant service provider or collected by that provider and processed together with other data already in its possession, in particular for its own marketing and market research purposes and to personalize its platform. In some cases, certain data about you will be transferred to the United States. You can find more information about data processing by social media providers in the privacy policies of the respective social media platforms.
13. What are your rights?
Applicable data protection laws give you the right to object to the processing of your data under certain circumstances, including processing for direct marketing purposes and other legitimate interests in the processing.
To help you control how your personal data is processed, you have the following rights regarding our processing of your data, in accordance with applicable data protection laws:
- the right to request access to the data we have stored about you;
- the right to have inaccurate or incomplete personal data corrected;
- the right to request the deletion of your data;
- the right to receive the personal data you have provided to us in a commonly used, machine-readable, structured format, or to have us transfer that data to another data controller;
- the right to withdraw your consent with future effect, to the extent that our processing is based on your consent;
- the right to receive, upon request, additional information relevant to the exercise of these rights;
- the right to express your point of view in cases of automated individual decision-making (Section 6) and to request that the decision be reviewed by a human.
If you wish to exercise your rights, you may contact us in writing at the email address listed in Section 1. To prevent any misuse, we must verify your identity (e.g., by providing a copy of your ID card, if identification cannot be verified otherwise).
Please note that these rights may, in certain cases, be limited, excluded, or subject to certain conditions. We will inform you of this on a case-by-case basis.
You may also file a complaint with the competent supervisory authority if you have concerns about the lawfulness of the processing of your personal data. The competent supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC). If the GDPR applies, you may also contact the competent supervisory authority in the relevant country.
14. Can we update this Policy?
This Policy applies regardless of any contract we may have with you. We may modify this Policy at any time without notice. The version posted on our Site is the current version.
