This Privacy Policy explains how Our Cocomo Pte. Ltd., trading as COCOMO (“COCOMO”, “we”, “us” or “our”), collects, uses, discloses, retains, transfers and protects personal data when you visit cocomo.sg, purchase from us, create or use an account, contact us, submit content or otherwise interact with our products and services (collectively, the “Services”).

In this Policy, “you” means the individual using the Services, including a customer, prospective customer, website visitor or person who communicates with us. “Personal data” means information about an identified or identifiable individual.

We are responsible for personal data under our possession or control, subject to the respective roles of service providers and other parties described below. Our online store is powered by Shopify, which processes certain personal data to provide its platform and consumer services. You can learn more in the Shopify Consumer Privacy Policy.

Where applicable law requires consent, we will seek consent before collecting, using or disclosing personal data for the relevant purpose. This Policy should be read together with our Terms of Service and other policies linked on our Site.

Depending on how you interact with COCOMO, we may collect the following categories of personal data:

• Identity and contact information, such as your name, email address, telephone number, billing address and delivery address.
• Order and transaction information, such as products ordered, order value, discounts, delivery method, returns, refunds, payment status and transaction identifiers.
• Account and preference information, such as account details, saved addresses, wish lists, loyalty activity, gift-card activity, referrals, language, currency and marketing preferences.
• Payment-related information. Payment providers generally process full card or payment credentials directly. We may receive limited details such as payment status, payment method, transaction reference and fraud-screening results.
• Shopping and usage information, such as products viewed or searched, cart activity, purchases, interactions with pages and messages, referral URLs and approximate location derived from an IP address.
• Device and technical information, such as IP address, browser, device type, operating system, cookie identifiers, network information and diagnostic or security data.
• Communications and support information, including messages, order enquiries, feedback and information you choose to share about product preferences, skincare or hair concerns, sensitivities and your experience with our products.
• User-generated content, such as reviews, ratings, photographs, videos, comments or social-media content you submit or authorise us to use.

Please do not send full payment-card numbers, account passwords, government identification or other highly sensitive information through ordinary email, WhatsApp or website forms unless we specifically request it through an appropriate secure method.

We collect personal data through the following sources:

• Directly from you, including when you place an order, create an account, subscribe to marketing, contact customer support, participate in a promotion, submit a review or communicate with us.
• Automatically through the Services, using cookies, pixels, tags, local storage, server logs and similar technologies.
• From Shopify and service providers, including payment, fraud-prevention, delivery, fulfilment, analytics, customer-support, marketing and technology providers.
• From platforms and partners, such as social-media services, advertising partners, referral partners or third-party integrations, where permitted by your settings and applicable law.

If you provide us with personal data about another individual, you are responsible for ensuring that you are authorised to do so and that the individual has been informed as required.

We may collect, use or otherwise process personal data for purposes that include:

• processing payments, orders, deliveries, self-collections, returns, refunds and exchanges;
• creating and administering customer accounts, loyalty features, promotions and saved preferences;
• providing customer service, responding to enquiries and communicating about orders or policy changes;
• personalising content, recommendations and the shopping experience;
• sending marketing communications where you have opted in or where otherwise permitted by law;
• measuring website and campaign performance, conducting analytics and improving our products, Services and operations;
• detecting, investigating and preventing fraud, abuse, security incidents, policy violations and unlawful activity;
• maintaining business records, resolving disputes, enforcing agreements and protecting legal rights;
• complying with tax, accounting, consumer-protection, regulatory, court and law-enforcement requirements; and
• carrying out another purpose disclosed to you at the time of collection or with your consent.

We limit collection, use and disclosure to purposes that a reasonable person would consider appropriate in the circumstances and as permitted by applicable law.

We and our partners, including Shopify, use cookies and similar technologies to operate the Site, remember preferences, understand performance, prevent fraud, personalise experiences and, where permitted, support advertising.

• Essential technologies support functions such as security, checkout, cart contents, account access and network management.
• Analytics and performance technologies help us understand how visitors use the Site and where improvements are needed.
• Functional technologies remember choices and support enhanced or personalised features.
• Advertising technologies may help measure campaigns or show more relevant advertising, subject to consent and other rights that apply in your region.

You can manage available choices through our cookie banner or Cookie preferences link, where displayed, and through your browser settings. Blocking essential cookies may prevent parts of the Services from working correctly. Because there is no universally accepted standard for browser “Do Not Track” signals, we do not respond to them in a uniform way. We honour Global Privacy Control signals where required and supported by our configured privacy tools.

Shopify hosts our store and provides ecommerce, checkout, security, analytics and related services. Shopify may process information about your device, browsing activity, cart, purchases, account, payment choices and interactions with COCOMO in accordance with its own privacy notices and its role in providing services to us and to consumers.

Depending on the Shopify features enabled for our store, Shopify Network Intelligence may use customer information across Shopify services to provide enhanced functions such as fraud prevention, store performance, personalisation and advertising. Shopify states that consent, deletion and opt-out choices submitted through compatible Shopify privacy tools are applied to eligible processing.

For choices relating directly to Shopify consumer services, you may also use the Shopify Privacy Portal.

If you subscribe to marketing, we may send news, product information, restock notices, promotions and other updates through the channels you selected. You can unsubscribe from email marketing using the unsubscribe link in a marketing email or contact us at info@cocomo.org.

Withdrawing from marketing does not stop service messages that are necessary for an order, account, delivery, security matter, policy update or customer-support request. We may retain a limited suppression record so that we can respect your opt-out.

We may disclose personal data only where reasonably necessary for the purposes described in this Policy, including to:

• Shopify and ecommerce providers that host or support our store, checkout, accounts and related functionality;
• payment and fraud-prevention providers that authorise transactions and assess risk;
• couriers, fulfilment and logistics providers that process and deliver orders or support returns;
• technology, cloud, security, communications and customer-support providers that operate systems on our behalf;
• analytics, advertising and marketing providers, subject to applicable consent and opt-out requirements;
• professional advisers, insurers, auditors and financial institutions where necessary for business or legal purposes;
• government, regulatory, court or law-enforcement authorities where required or authorised by law; and
• parties to a corporate transaction, such as a merger, financing, restructuring, acquisition or sale, subject to appropriate confidentiality and legal safeguards.

We may also disclose information at your direction or with your consent. Service providers are permitted to process personal data only for authorised purposes and remain subject to contractual and legal obligations applicable to their roles.

COCOMO does not sell personal data for money. However, privacy laws in some jurisdictions define “sale”, “sharing” or “targeted advertising” broadly. Certain disclosures involving cookies, advertising services, analytics partners or Shopify enhanced services may fall within those definitions.

Where applicable, you may opt out through our Data sharing opt-out page, cookie preferences, a recognised Global Privacy Control signal or by contacting us. Availability and the effect of these choices depend on your region and the technologies used.

We do not use or disclose sensitive personal data for purposes other than those reasonably necessary to provide the Services, prevent fraud, comply with law or carry out a purpose to which you have consented.

{% if data_sale_opt_out_enabled %} {% endif %}

If you submit a review, photograph, video, comment or other content for public display, that content and any profile information you choose to associate with it may be visible to others. Do not include information in public content that you do not want others to see or use.

The Services may link to websites, apps or platforms operated by other parties. We do not control their privacy or security practices. Review the relevant third party’s privacy policy before providing personal data.

We retain personal data only for as long as it is reasonably needed for the purpose for which it was collected, to maintain our relationship with you, to meet legal, tax, accounting, fraud-prevention and operational requirements, to resolve disputes or to enforce agreements.

Retention periods vary according to the type of data, the sensitivity of the data, the nature of the relationship, legal requirements and whether the data is needed for an actual or anticipated claim. When personal data is no longer required, we take reasonable steps to delete, destroy or anonymise it. Residual copies may remain temporarily in secure backups until they are overwritten in the ordinary course.

We use reasonable administrative, technical and physical safeguards appropriate to the nature of the personal data we handle. These measures are designed to reduce risks such as unauthorised access, collection, use, disclosure, copying, modification, loss, disposal or similar risks.

No method of transmission or storage is completely secure. You are responsible for protecting your account credentials and for using secure channels. If you believe that your account or personal data may have been compromised, contact us promptly.

We maintain processes to assess and respond to suspected data breaches. Where required by applicable law, we will notify the relevant authority and affected individuals within the required timeframes.

COCOMO is based in Singapore, while Shopify and other providers may process or store personal data in other countries. Those countries may have privacy laws that differ from the laws where you live.

Where the Singapore Personal Data Protection Act applies, we take reasonable steps to ensure that personal data transferred outside Singapore receives a standard of protection comparable to that required under the Act. Where other transfer rules apply, we rely on appropriate contractual, organisational or legal safeguards, including recognised contractual clauses where relevant.

Our Services are not directed to children under 16, and we do not knowingly collect personal data from children under 16 without appropriate authorisation. If you are a parent or guardian and believe a child has provided personal data to us, contact us so that we can review and, where appropriate, delete it.

Depending on your location and subject to applicable exceptions, you may have rights relating to your personal data. These may include the right to:

• request access to personal data we hold about you and information about how it has been used or disclosed;
• request correction of inaccurate or incomplete personal data;
• withdraw consent to future collection, use or disclosure based on that consent;
• request deletion, restriction, objection or portability where those rights apply;
• opt out of certain marketing, sale, sharing or targeted advertising activities; and
• make a complaint to us or to a competent data-protection authority.

To submit a request, email info@cocomo.org with the subject “Privacy Request”. We may request information reasonably necessary to verify your identity, authority and the scope of your request. We will respond within the period required by applicable law.

Withdrawal of consent does not affect processing already carried out lawfully. Depending on the nature of the request, we may no longer be able to provide part of the Services. We may retain information where required or permitted by law.

We may update this Privacy Policy to reflect changes to our practices, Services, technology or legal obligations. The revised version will be posted on this page with a new “Last updated” date. Where required, we will provide additional notice or seek consent for material changes.

For questions, access or correction requests, withdrawal of consent, complaints or other privacy matters, contact our Data Protection Officer / Privacy Contact:

Our Cocomo Pte. Ltd.
Trading as COCOMO
7030 Ang Mo Kio Avenue 5, #07-39
Northstar @ Ang Mo Kio, Singapore 569880
Email: info@cocomo.org

Please include enough information for us to understand your request, but do not send account passwords or full payment-card details. We may contact you to verify your identity before acting on a request.