Privacy Policy

PRIVACY POLICY

Last updated: November 1, 2026

Cosmelia operates this store and website, including all related information, content, features, tools, products and services, in order to provide you, the customer, with a curated shopping experience (the "Services"). Cosmelia is powered by Shopify, which enables us to provide the Services to you. This Privacy Policy describes how we collect, use and disclose your personal information when you visit, use or make a purchase or other transaction using the Services, or otherwise communicate with us. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy prevails with respect to the collection, processing and disclosure of your personal information.

Please read this Privacy Policy carefully.

Data controller
The party responsible for processing your personal information is:
SOILIHI – Cosmelia
4 Rue de la Pareille, 42000 Saint-Étienne, France
Email: hola@cosmeliaoff.com
Phone: +33 6 18 17 94 16

Personal information we collect or process
"Personal information" means any information that identifies you or can reasonably be linked to you or another person. It does not include information collected anonymously or de-identified information that cannot be linked to you. Depending on how you interact with the Services, where you live and what is permitted or required by applicable law, we may collect or process the following categories of personal information, including inferences drawn from it:

- Contact details: name, address, billing address, shipping address, phone number and email address.
- Financial information: credit and debit card numbers, payment card information, account details, transaction details, payment method, payment confirmation and other payment-related information.
- Account information: username, password, security questions, preferences and settings.
- Transaction information: items you view, add to your cart or wishlist, purchase, return, exchange or cancel, and your past transactions.
- Communications with us: information you include in your communications with us, for example when you contact customer support.
- Device information: information about your device, browser or network connection, your IP address and other unique identifiers.
- Usage information: information about how and when you use and navigate the Services.

Sources of personal information
We may collect personal information from the following sources:
- Directly from you, for example when you create an account, visit or use the Services, communicate with us or otherwise provide us with information.
- Automatically through the Services, for example from your device when you use our products or services or visit our website, including through cookies and similar technologies.
- From our service providers, when we engage them to provide certain technologies or when they collect or process personal information on our behalf.
- From our partners or other third parties.

How we use your personal information
Depending on how you interact with us and which Services you use, we may use your personal information for the following purposes:

- Providing, personalizing and improving the Services: to provide the Services to you, including to perform our contract with you, process payments, fulfill orders, remember your preferences and favorite items, send you account-related notifications, process purchases, returns, exchanges and other transactions, create and manage your account, arrange shipping, allow you to post reviews and offer you a personalized shopping experience, such as product recommendations based on your purchases.
- Marketing and advertising: to send you promotional and marketing communications by email, text message or postal mail – where you have consented or as permitted by law – and to show you online advertising for products or services on the Services or other websites, including based on items you have purchased or added to your cart.
- Security and fraud prevention: to authenticate your account, provide a secure shopping and payment experience, detect, investigate and prevent potentially fraudulent, illegal or harmful activity, and protect the security of our Services. If you create an account, you are responsible for keeping your login details confidential. Please never share your username, password or other access details with anyone.
- Communicating with you: to provide customer support, respond to your requests and maintain our business relationship with you.
- Legal reasons: to comply with applicable laws, respond to lawful requests from authorities, participate in legal proceedings, and enforce or investigate potential violations of our terms or policies.

Legal bases for processing (EU, EEA and UK residents)
If you are located in the European Union, the European Economic Area or the United Kingdom, we process your personal information on the following legal bases under the General Data Protection Regulation (GDPR):
- Art. 6(1)(b) GDPR – to perform our contract with you (e.g. order processing, shipping, payment, customer support);
- Art. 6(1)(a) GDPR – based on your consent (e.g. newsletter, certain cookies and personalized advertising); you may withdraw your consent at any time with effect for the future;
- Art. 6(1)(c) GDPR – to comply with legal obligations (e.g. tax and commercial record-keeping requirements);
- Art. 6(1)(f) GDPR – based on our legitimate interests (e.g. fraud prevention, security and improving our Services).

How we disclose personal information
In certain circumstances, we may disclose your personal information to third parties for legitimate purposes and in accordance with this Privacy Policy. These include:
- To Shopify, vendors and other third parties who perform services on our behalf (e.g. IT management, payment processing – for example through Shopify Payments, PayPal or Klarna –, data analytics, customer support, cloud storage, fulfillment and shipping).
- To business and marketing partners, to provide marketing services and show you advertising. For example, we use Shopify to support personalized advertising through third-party services based on your online activity across different merchants and websites. Our business and marketing partners use your information in accordance with their own privacy notices. Depending on where you live, you may have the right to direct us not to share your information for personalized advertising.
- When you direct, request or otherwise consent to the disclosure of certain information to third parties, for example to ship products to you or when you use social media widgets or login integrations.
- With our affiliates or within our corporate group.
- In connection with a business transaction such as a merger or bankruptcy, to comply with legal obligations (including responding to subpoenas, search warrants or similar requests), to enforce our Terms of Service or policies, and to protect the Services, our rights and the rights of our users or others.

Relationship with Shopify
The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve the Services for you. Information you submit through the Services will be transmitted to and shared with Shopify as well as third parties that may be located in countries other than your own. To help protect, grow and improve our business, we also use certain advanced Shopify features that incorporate data from your interactions with our store, with other merchants and with Shopify. In these cases, Shopify is responsible for processing your personal information, including responding to your requests to exercise your rights. To learn more about how Shopify uses your personal information and any rights you may have, please visit the Shopify Consumer Privacy Policy: https://www.shopify.com/legal/privacy/customers. Depending on where you live, you may exercise certain rights here: https://privacy.shopify.com/en

Third-party websites and links
The Services may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated with or controlled by us, we recommend that you review their privacy and security policies and other terms. We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness or reliability of the information found there. Information you share in public or semi-public areas, including on third-party social media platforms, may be visible to other users. The inclusion of such links does not imply any endorsement of the content on those platforms or of their operators, unless expressly stated in the Services.

Children's data
The Services are not intended for children, and we do not knowingly collect personal information from anyone who is a minor under the law of their country. If you are the parent or guardian of a child who has provided us with personal information, you may contact us using the details below to request its deletion. As of the effective date of this Privacy Policy, we have no actual knowledge that we "share" or "sell" (as those terms are defined under applicable law) personal information of individuals under 16 years of age.

Security and retention
Please be aware that no security measure is perfect or impenetrable, and we cannot guarantee "absolute security". In addition, information you send to us may not be secure while in transit. We recommend that you do not use insecure channels to send us sensitive or confidential information.

How long we retain your personal information depends on various factors, such as whether we need it to maintain your account, provide the Services, comply with legal obligations (e.g. tax record-keeping requirements), resolve disputes or enforce other applicable contracts and policies. After that, the information is deleted.

Your rights
Depending on where you live, you may have some or all of the rights listed below in relation to your personal information. These rights are not absolute; in certain cases, we may decline your request as permitted by law.

- Right to access / know: You can request access to the personal information we hold about you.
- Right to delete: You can request that we delete the personal information we hold about you.
- Right to correct: You can request that we correct inaccurate personal information.
- Right to portability: You can receive a copy of your personal information and, in certain circumstances, request that we transfer it to a third party.
- Right to object and restrict processing: You can ask us to stop or restrict processing your personal information for certain purposes.
- Right to withdraw consent: Where processing is based on your consent, you can withdraw it at any time. This does not affect the lawfulness of processing carried out before you withdrew it.
- Managing your communication preferences: We may send you promotional emails. You can unsubscribe at any time using the unsubscribe link in our emails. Even if you unsubscribe, we may still send you non-promotional emails, for example about your account or your orders.

U.S. state privacy rights
If you are a resident of California or another U.S. state with a consumer privacy law, you may also have the following rights:
- Right to opt out of the sale or sharing of your personal information, including for targeted (cross-context behavioral) advertising. We may "share" personal information with advertising partners as described above, but we do not sell personal information for money. You can opt out at any time using the "Your Privacy Choices" link in the footer of our website, or by enabling the Global Privacy Control (GPC) signal in your browser, which we honor as an opt-out request.
- Right to limit the use of sensitive personal information: We do not use or disclose sensitive personal information for purposes that would require us to offer this right.
- Right to appeal: If we decline your request, you may appeal our decision by replying to our response or contacting us using the details below.

You can exercise these rights at any time by contacting us using the details below. To learn more about how Shopify uses your personal information and any rights you may have regarding data processed by Shopify, please visit https://privacy.shopify.com/en.

We will not discriminate against you for exercising any of these rights. We may need to verify your identity before we can process your request, as permitted or required by applicable law. You may designate an authorized agent to make requests on your behalf; in that case, we will require proof of authorization and may ask you to confirm your identity directly with us. We will respond to your request within the timeframe required by law – generally within one month for EU/UK residents and within 45 days for U.S. residents.

Complaints
If you have complaints about how we process your personal information, please contact us using the details below. If you are located in the EU or EEA, you also have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State where you live. A list of data protection authorities in the EEA is available here: https://edpb.europa.eu/about-edpb/about-edpb/members_en. If you are located in the UK, you can contact the Information Commissioner's Office (ICO).

International transfers
Please note that we may transfer, store and process your personal information outside the country where you live. When we transfer personal information out of the European Economic Area (EEA) or the United Kingdom, we rely on recognized transfer mechanisms such as the European Commission's Standard Contractual Clauses (SCCs) or equivalent contracts, unless the transfer is to a country that has been found to provide an adequate level of protection.

Changes to this Privacy Policy
We may update this Privacy Policy from time to time, for example to reflect changes to our practices or for other operational, legal or regulatory reasons. We will post the updated version on this website, update the "Last updated" date and notify you of changes as required by law.

Contact
If you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of your rights, please call us at +33 6 18 17 94 16, email us at hola@cosmeliaoff.com, or write to us at: SOILIHI – Cosmelia, 4 Rue de la Pareille, 42000 Saint-Étienne, France.