Cozy Garden Website: cozygarden.online Support: Support@cozygarden.online
Last Updated: 15/JUL/2026
1. Introduction
This Privacy Policy explains how cozy garden], doing business as Cozy Garden (“Cozy Garden,” “we,” “us,” or “our”), collects, uses, discloses, and protects personal information when you visit cozygarden.online (the “Site”), place an order, contact support, or otherwise interact with us.
By using the Site, you acknowledge that you have read this Privacy Policy. Where required by law, we rely on your consent, which you may withdraw at any time.
Data Controller: United States Support@cozygarden.online
2. Information We Collect
2.1 Information You Provide Directly
| Category | Examples | Why We Collect It |
| Identifiers | Name, email address, shipping address, billing address, phone number | Fulfilling and shipping your order, sending confirmations, support |
| Commercial information | Order history, products purchased, cart contents, returns and refund requests | Processing orders, handling claims, fraud review |
| Payment information | Card details, billing address, PayPal account identifier | Processing payment. See Section 2.4 — we do not store card numbers. |
| Account information | Username, password (hashed), preferences, saved addresses | Operating your account |
| Communications | Emails, support tickets, chat messages, product reviews | Responding to you, maintaining records |
| Marketing preferences | Email subscription status, SMS consent | Sending marketing you opted into; honoring opt-outs |
2.2 Information Collected Automatically
| Category | Examples |
| Device and technical data | IP address, browser type and version, operating system, device type, screen resolution, language, time zone |
| Usage data | Pages viewed, referring URL, search terms, clicks, scroll depth, session duration, timestamps |
| Transaction/fraud signals | IP geolocation at checkout, device fingerprint, AVS/CVV verification results, order velocity |
| Cookie and identifier data | Cookie IDs, pixel identifiers, advertising identifiers, session tokens |
2.3 Information From Third Parties
We may receive information from payment processors (transaction and fraud-screening results), shipping carriers (tracking and delivery status), analytics and advertising platforms (aggregated and pseudonymized audience data), and fraud-prevention services.
2.4 Payment Card Data — Important
We do not collect, process, or store full payment card numbers, CVV codes, or bank account credentials on our systems. Card data is transmitted directly to our PCI-DSS compliant payment processors (Stripe and/or PayPal), which act as independent controllers of that data under their own privacy policies. We receive only a tokenized reference, the last four digits, the card brand, the expiration date, and the authorization result.
2.5 Sensitive Personal Information
We do not intentionally collect sensitive personal information as defined under the CCPA/CPRA or special category data under the GDPR (such as racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, precise geolocation, or sexual orientation). Please do not include such information in support correspondence.
2.6 Children
The Site is not directed to children under 16 and we do not knowingly collect personal information from children under 16. We do not sell or share the personal information of consumers under 16. If you believe a child has provided us information, contact Support@cozygarden.online and we will delete it.
3. How We Use Your Information
We use personal information to:
- Process and fulfill orders — payment authorization, packing, shipping, delivery, tracking, returns, refunds.
- Communicate with you — order confirmations, dispatch notifications, delivery updates, and support responses (these are transactional messages and are sent regardless of marketing preferences).
- Provide customer support — investigating and resolving order issues, claims, and disputes.
- Prevent fraud and abuse — screening orders, verifying identity, investigating chargebacks and refund abuse, defending disputes, and protecting our business, customers, and payment processors.
- Operate and improve the Site — analytics, performance monitoring, debugging, A/B testing, and product development.
- Market to you — sending promotional emails where you have opted in, and displaying advertising on third-party platforms including Meta and Google.
- Comply with law — tax, accounting, export/import, and consumer protection obligations, and responding to lawful requests.
- Enforce our terms — establishing, exercising, or defending legal claims.
4. Legal Bases for Processing (GDPR / UK GDPR)
If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data on the following legal bases:
| Purpose | Legal Basis (Art. 6 GDPR) |
| Processing and fulfilling your order; transactional communications | Contract — Art. 6(1)(b): necessary to perform the contract you entered into |
| Customer support relating to an order | Contract — Art. 6(1)(b) |
| Fraud prevention, chargeback defense, network and information security | Legitimate interests — Art. 6(1)(f): protecting our business and customers from fraud and financial loss |
| Site analytics and product improvement | Consent — Art. 6(1)(a) where cookies are involved; otherwise legitimate interests — Art. 6(1)(f) |
| Marketing emails and advertising cookies/pixels | Consent — Art. 6(1)(a) |
| Tax, accounting, and legal record-keeping | Legal obligation — Art. 6(1)(c) |
| Establishing, exercising, or defending legal claims | Legitimate interests — Art. 6(1)(f) |
Where we rely on legitimate interests, we have carried out a balancing assessment and concluded that our interests are not overridden by your rights and freedoms. You may object to such processing (see Section 9). Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
5. Cookies, Pixels, and Analytics
5.1 What We Use
| Type | Purpose | Examples | Consent Required |
| Strictly necessary | Cart, checkout, session, security, load balancing | Session cookies, CSRF tokens | No |
| Functional | Remembering preferences, language, saved addresses | Preference cookies | Yes (in EEA/UK) |
| Analytics | Understanding traffic and site performance | Google Analytics 4 | Yes (in EEA/UK) |
| Advertising / Targeting | Measuring ad performance, retargeting, building audiences | Meta Pixel, Google Ads / Google Tag, TikTok Pixel (if enabled) | Yes (in EEA/UK); opt-out available in U.S. |
5.2 Meta Pixel and Conversions API
We use the Meta Pixel and may use Meta’s Conversions API to measure the effectiveness of our advertising and to build custom and lookalike audiences. This involves sharing event data — such as page views, add-to-cart, initiate-checkout, and purchase events, together with hashed identifiers such as your email address — with Meta Platforms, Inc. Meta processes this data as a controller for certain purposes under its own terms. Under the CCPA/CPRA and similar U.S. state laws, this activity may constitute “sharing” of personal information for cross-context behavioral advertising. See Section 8 for how to opt out.
5.3 Google Analytics
We use Google Analytics 4 to understand how visitors use the Site. Google may process this data on our behalf as a processor and, in some configurations, use it for its own purposes. You can opt out via the Google Analytics Opt-out Browser Add-on.
5.4 Managing Cookies
- In the EEA/UK: non-essential cookies are set only after you consent through our cookie banner. You can change or withdraw consent at any time via the cookie preferences link in the Site footer.
- In the U.S.: you can opt out of sale/sharing via the “Do Not Sell or Share My Personal Information” link in the Site footer.
- All users: you can block or delete cookies through your browser settings. Blocking strictly necessary cookies will prevent checkout from working.
5.5 Global Privacy Control
We honor the Global Privacy Control (GPC) browser signal as a valid opt-out of the sale and sharing of personal information for users in jurisdictions where this is required.
5.6 Do Not Track
We do not currently respond to browser “Do Not Track” signals, as no common standard has been adopted. We do honor GPC as described above.
6. Marketing Communications
6.1 Email Marketing. We send promotional emails only to individuals who have opted in. Every marketing email contains an unsubscribe link that takes effect promptly and in any event within 10 business days, as required by the CAN-SPAM Act. You can also unsubscribe by emailing Support@cozygarden.online.
6.2 Transactional Emails. Order confirmations, dispatch notices, delivery updates, and support replies are not marketing and will continue to be sent regardless of your marketing preferences, because they are necessary to perform our contract with you.
6.3 SMS. If we offer SMS marketing, you will be asked for separate express written consent at the point of collection, consistent with the Telephone Consumer Protection Act. Message and data rates may apply. Reply STOP to opt out.
6.4 Advertising. We advertise on third-party platforms. See Sections 5.2 and 8 regarding opting out of targeted advertising.
7. Disclosure of Personal Information
We do not sell your personal information for money. We disclose personal information to the following categories of recipients:
| Recipient Category | Examples | Purpose |
| Payment processors | Stripe, Inc.; PayPal, Inc. | Payment authorization, settlement, fraud screening, dispute handling |
| Ecommerce platform / hosting | [WooCommerce/WordPress host — INSERT] / Shopify Inc. | Operating the Site and storing order data |
| Shipping and fulfillment | Carriers, fulfillment partners, customs brokers | Delivering your order and clearing customs |
| Email and messaging | [INSERT — e.g. Klaviyo, Mailchimp] | Transactional and marketing communications |
| Analytics | Google LLC (Google Analytics) | Site measurement |
| Advertising | Meta Platforms, Inc.; Google LLC; [TikTok, if used] | Advertising measurement and targeting |
| Fraud prevention | Processor-provided fraud tools, chargeback representment services | Detecting and defending against fraud and abusive disputes |
| Professional advisors | Attorneys, accountants, auditors | Legal and financial compliance |
| Authorities | Law enforcement, regulators, courts | Where required by law or to protect rights and safety |
| Successors | Acquirer in a merger, acquisition, or asset sale | Business transfer; you will be notified of any change in controller |
We require processors to handle personal information only on our documented instructions, to maintain appropriate security, and to be bound by written data processing agreements.
Fraud and chargeback disclosure: where you initiate a payment dispute, we will disclose to your bank, card issuer, and payment provider the order and delivery record described in Section 9 of our Refund & Returns Policy, including your IP address, device data, order timestamps, correspondence, and carrier tracking and delivery confirmation. This is necessary for the establishment, exercise, and defense of legal claims.
8. Your Rights — United States (CCPA / CPRA and Other State Laws)
If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, or another state with a comprehensive privacy law, you have the following rights, subject to the terms of the applicable law:
- Right to know / access — the categories and specific pieces of personal information we have collected, the sources, the business purposes, and the categories of third parties to whom we disclose it.
- Right to delete — request deletion of personal information we collected from you, subject to exceptions (including completing a transaction, detecting security incidents, fraud prevention, and complying with legal obligations).
- Right to correct — request correction of inaccurate personal information.
- Right to opt out of sale/sharing — we do not sell personal information for money, but our use of advertising pixels may constitute “sharing” for cross-context behavioral advertising. Use the “Do Not Sell or Share My Personal Information” link in the Site footer, or send a GPC signal, or email Support@cozygarden.online.
- Right to limit use of sensitive personal information — we do not collect sensitive personal information for purposes requiring this right.
- Right to non-discrimination — we will not deny you goods or services, charge you different prices, or provide a different level of quality because you exercised a privacy right.
- Right to appeal (Colorado, Connecticut, Virginia, and others) — if we decline your request, you may appeal by replying to our decision email. We will respond to appeals within 45 days.
Categories collected in the last 12 months: identifiers; commercial information; internet and network activity; geolocation data (approximate, IP-derived); and inferences drawn for advertising audiences. Sources, purposes, and recipients are set out in Sections 2, 3, and 7.
Categories “shared” in the last 12 months for cross-context behavioral advertising: identifiers (hashed email), commercial information (purchase events), and internet activity — with Meta and Google.
How to submit a request: email Support@cozygarden.online with the subject line “PRIVACY REQUEST” and state which right you are exercising. We will verify your identity by matching the information you provide against our records (typically your order number and the email address used at checkout). We respond within 45 days, extendable once by a further 45 days with notice.
Authorized agents: an authorized agent may submit a request on your behalf with written proof of authorization; we may still require you to verify your identity directly.
California “Shine the Light”: California residents may request information about disclosures of personal information to third parties for their direct marketing purposes. Send such requests to Support@cozygarden.online.
9. Your Rights — EEA, UK, and Switzerland (GDPR)
If you are in the EEA, UK, or Switzerland, you have the right to:
- Access your personal data and receive a copy;
- Rectification of inaccurate or incomplete data;
- Erasure (“right to be forgotten”), subject to our legal retention obligations;
- Restriction of processing in certain circumstances;
- Data portability — receive data you provided in a structured, commonly used, machine-readable format;
- Object to processing based on legitimate interests, and to object at any time to direct marketing (an absolute right);
- Withdraw consent at any time where processing is based on consent;
- Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (see Section 12);
- Lodge a complaint with your national supervisory authority, or with the UK Information Commissioner’s Office (ico.org.uk).
To exercise these rights, email Support@cozygarden.online. We respond within one month, extendable by two further months for complex requests, with notice.
EU/UK Representative: [APPOINT AND INSERT IF REQUIRED UNDER ART. 27 GDPR — required if you offer goods to EU/UK data subjects and have no EU/UK establishment.]
10. International Data Transfers
We are based in the United States and our service providers are located in the United States and other countries. If you are located outside the United States, your personal information will be transferred to and processed in the United States, which may not provide the same level of data protection as your home jurisdiction.
Where we transfer personal data out of the EEA or UK, we rely on:
- The EU-U.S. Data Privacy Framework and the UK Extension, where the recipient is certified; and/or
- The European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum), together with supplementary technical and organizational measures where appropriate.
You may request a copy of the relevant transfer safeguards by emailing Support@cozygarden.online.
11. Data Retention
We retain personal information only as long as necessary for the purposes described in this Policy:
| Data | Retention Period |
| Order and transaction records | 7 years from the transaction date (tax and accounting requirements) |
| Chargeback and dispute records | 2 years minimum, or the duration of the dispute plus applicable limitation periods |
| Customer support correspondence | 3 years from last contact |
| Account data | Duration of the account, plus 12 months after closure |
| Marketing consent records | Duration of consent, plus 3 years after withdrawal (to evidence compliance) |
| Fraud-prevention records | 5 years, to protect against repeat abuse |
| Analytics data | Per platform default; Google Analytics set to 14 months |
| Cookie data | Per the durations disclosed in our cookie banner |
Where deletion is not possible (for example, in backup archives), we isolate the data and place it beyond further processing until deletion is possible.
12. Automated Decision-Making
We use automated fraud-screening tools provided by our payment processors that may score an order and, in some cases, decline or flag it for manual review. A declined or flagged order is always available for human review — if your order is declined and you believe this is in error, email Support@cozygarden.online and a person will review it. We do not use automated decision-making for any purpose that produces legal effects concerning you other than order acceptance.
13. Security
We implement appropriate technical and organizational measures to protect personal information, including TLS/SSL encryption in transit, access controls and least-privilege permissions, hashed password storage, PCI-DSS compliant payment processing through third parties (we do not store card data), and regular software patching.
No method of transmission or storage is 100% secure. We cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for all activity under your account.
Breach notification: in the event of a personal data breach, we will notify affected individuals and applicable supervisory authorities where required by law and within the timeframes required (including within 72 hours to the lead supervisory authority under the GDPR where feasible).
14. Third-Party Links
The Site may contain links to third-party websites and services. We are not responsible for their privacy practices. Review their privacy policies before providing them with personal information.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the “Last Updated” date. Where changes are material, we will provide prominent notice on the Site and, where required by law, obtain your consent. Continued use of the Site after an update constitutes acceptance of the revised Policy to the extent permitted by law.
16. Contact Us
For any privacy question, request, or complaint:
Email: Support@cozygarden.online (subject line: PRIVACY REQUEST)
If you are unsatisfied with our response, you may lodge a complaint with your local data protection authority (EEA/UK) or your state Attorney General (United States).
Cozy Garden. All rights reserved.
Privacy Policy
Cozy Garden Website: cozygarden.online Support: Support@cozygarden.online
Effective Date: [INSERT DATE] Last Updated: [INSERT DATE]
1. Introduction
This Privacy Policy explains how [LEGAL ENTITY NAME], a [STATE] [limited liability company / corporation], doing business as Cozy Garden (“Cozy Garden,” “we,” “us,” or “our”), collects, uses, discloses, and protects personal information when you visit cozygarden.online (the “Site”), place an order, contact support, or otherwise interact with us.
By using the Site, you acknowledge that you have read this Privacy Policy. Where required by law, we rely on your consent, which you may withdraw at any time.
Data Controller: [LEGAL ENTITY NAME] [STREET ADDRESS] [CITY, STATE, ZIP], United States Support@cozygarden.online
2. Information We Collect
2.1 Information You Provide Directly
| Category | Examples | Why We Collect It |
| Identifiers | Name, email address, shipping address, billing address, phone number | Fulfilling and shipping your order, sending confirmations, support |
| Commercial information | Order history, products purchased, cart contents, returns and refund requests | Processing orders, handling claims, fraud review |
| Payment information | Card details, billing address, PayPal account identifier | Processing payment. See Section 2.4 — we do not store card numbers. |
| Account information | Username, password (hashed), preferences, saved addresses | Operating your account |
| Communications | Emails, support tickets, chat messages, product reviews | Responding to you, maintaining records |
| Marketing preferences | Email subscription status, SMS consent | Sending marketing you opted into; honoring opt-outs |
2.2 Information Collected Automatically
| Category | Examples |
| Device and technical data | IP address, browser type and version, operating system, device type, screen resolution, language, time zone |
| Usage data | Pages viewed, referring URL, search terms, clicks, scroll depth, session duration, timestamps |
| Transaction/fraud signals | IP geolocation at checkout, device fingerprint, AVS/CVV verification results, order velocity |
| Cookie and identifier data | Cookie IDs, pixel identifiers, advertising identifiers, session tokens |
2.3 Information From Third Parties
We may receive information from payment processors (transaction and fraud-screening results), shipping carriers (tracking and delivery status), analytics and advertising platforms (aggregated and pseudonymized audience data), and fraud-prevention services.
2.4 Payment Card Data — Important
We do not collect, process, or store full payment card numbers, CVV codes, or bank account credentials on our systems. Card data is transmitted directly to our PCI-DSS compliant payment processors (Stripe and/or PayPal), which act as independent controllers of that data under their own privacy policies. We receive only a tokenized reference, the last four digits, the card brand, the expiration date, and the authorization result.
2.5 Sensitive Personal Information
We do not intentionally collect sensitive personal information as defined under the CCPA/CPRA or special category data under the GDPR (such as racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, precise geolocation, or sexual orientation). Please do not include such information in support correspondence.
2.6 Children
The Site is not directed to children under 16 and we do not knowingly collect personal information from children under 16. We do not sell or share the personal information of consumers under 16. If you believe a child has provided us information, contact Support@cozygarden.online and we will delete it.
3. How We Use Your Information
We use personal information to:
- Process and fulfill orders — payment authorization, packing, shipping, delivery, tracking, returns, refunds.
- Communicate with you — order confirmations, dispatch notifications, delivery updates, and support responses (these are transactional messages and are sent regardless of marketing preferences).
- Provide customer support — investigating and resolving order issues, claims, and disputes.
- Prevent fraud and abuse — screening orders, verifying identity, investigating chargebacks and refund abuse, defending disputes, and protecting our business, customers, and payment processors.
- Operate and improve the Site — analytics, performance monitoring, debugging, A/B testing, and product development.
- Market to you — sending promotional emails where you have opted in, and displaying advertising on third-party platforms including Meta and Google.
- Comply with law — tax, accounting, export/import, and consumer protection obligations, and responding to lawful requests.
- Enforce our terms — establishing, exercising, or defending legal claims.
4. Legal Bases for Processing (GDPR / UK GDPR)
If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data on the following legal bases:
| Purpose | Legal Basis (Art. 6 GDPR) |
| Processing and fulfilling your order; transactional communications | Contract — Art. 6(1)(b): necessary to perform the contract you entered into |
| Customer support relating to an order | Contract — Art. 6(1)(b) |
| Fraud prevention, chargeback defense, network and information security | Legitimate interests — Art. 6(1)(f): protecting our business and customers from fraud and financial loss |
| Site analytics and product improvement | Consent — Art. 6(1)(a) where cookies are involved; otherwise legitimate interests — Art. 6(1)(f) |
| Marketing emails and advertising cookies/pixels | Consent — Art. 6(1)(a) |
| Tax, accounting, and legal record-keeping | Legal obligation — Art. 6(1)(c) |
| Establishing, exercising, or defending legal claims | Legitimate interests — Art. 6(1)(f) |
Where we rely on legitimate interests, we have carried out a balancing assessment and concluded that our interests are not overridden by your rights and freedoms. You may object to such processing (see Section 9). Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
5. Cookies, Pixels, and Analytics
5.1 What We Use
| Type | Purpose | Examples | Consent Required |
| Strictly necessary | Cart, checkout, session, security, load balancing | Session cookies, CSRF tokens | No |
| Functional | Remembering preferences, language, saved addresses | Preference cookies | Yes (in EEA/UK) |
| Analytics | Understanding traffic and site performance | Google Analytics 4 | Yes (in EEA/UK) |
| Advertising / Targeting | Measuring ad performance, retargeting, building audiences | Meta Pixel, Google Ads / Google Tag, TikTok Pixel (if enabled) | Yes (in EEA/UK); opt-out available in U.S. |
5.2 Meta Pixel and Conversions API
We use the Meta Pixel and may use Meta’s Conversions API to measure the effectiveness of our advertising and to build custom and lookalike audiences. This involves sharing event data — such as page views, add-to-cart, initiate-checkout, and purchase events, together with hashed identifiers such as your email address — with Meta Platforms, Inc. Meta processes this data as a controller for certain purposes under its own terms. Under the CCPA/CPRA and similar U.S. state laws, this activity may constitute “sharing” of personal information for cross-context behavioral advertising. See Section 8 for how to opt out.
5.3 Google Analytics
We use Google Analytics 4 to understand how visitors use the Site. Google may process this data on our behalf as a processor and, in some configurations, use it for its own purposes. You can opt out via the Google Analytics Opt-out Browser Add-on.
5.4 Managing Cookies
- In the EEA/UK: non-essential cookies are set only after you consent through our cookie banner. You can change or withdraw consent at any time via the cookie preferences link in the Site footer.
- In the U.S.: you can opt out of sale/sharing via the “Do Not Sell or Share My Personal Information” link in the Site footer.
- All users: you can block or delete cookies through your browser settings. Blocking strictly necessary cookies will prevent checkout from working.
5.5 Global Privacy Control
We honor the Global Privacy Control (GPC) browser signal as a valid opt-out of the sale and sharing of personal information for users in jurisdictions where this is required.
5.6 Do Not Track
We do not currently respond to browser “Do Not Track” signals, as no common standard has been adopted. We do honor GPC as described above.
6. Marketing Communications
6.1 Email Marketing. We send promotional emails only to individuals who have opted in. Every marketing email contains an unsubscribe link that takes effect promptly and in any event within 10 business days, as required by the CAN-SPAM Act. You can also unsubscribe by emailing Support@cozygarden.online.
6.2 Transactional Emails. Order confirmations, dispatch notices, delivery updates, and support replies are not marketing and will continue to be sent regardless of your marketing preferences, because they are necessary to perform our contract with you.
6.3 SMS. If we offer SMS marketing, you will be asked for separate express written consent at the point of collection, consistent with the Telephone Consumer Protection Act. Message and data rates may apply. Reply STOP to opt out.
6.4 Advertising. We advertise on third-party platforms. See Sections 5.2 and 8 regarding opting out of targeted advertising.
7. Disclosure of Personal Information
We do not sell your personal information for money. We disclose personal information to the following categories of recipients:
| Recipient Category | Examples | Purpose |
| Payment processors | Stripe, Inc.; PayPal, Inc. | Payment authorization, settlement, fraud screening, dispute handling |
| Ecommerce platform / hosting | [WooCommerce/WordPress host — INSERT] / Shopify Inc. | Operating the Site and storing order data |
| Shipping and fulfillment | Carriers, fulfillment partners, customs brokers | Delivering your order and clearing customs |
| Email and messaging | [INSERT — e.g. Klaviyo, Mailchimp] | Transactional and marketing communications |
| Analytics | Google LLC (Google Analytics) | Site measurement |
| Advertising | Meta Platforms, Inc.; Google LLC; [TikTok, if used] | Advertising measurement and targeting |
| Fraud prevention | Processor-provided fraud tools, chargeback representment services | Detecting and defending against fraud and abusive disputes |
| Professional advisors | Attorneys, accountants, auditors | Legal and financial compliance |
| Authorities | Law enforcement, regulators, courts | Where required by law or to protect rights and safety |
| Successors | Acquirer in a merger, acquisition, or asset sale | Business transfer; you will be notified of any change in controller |
We require processors to handle personal information only on our documented instructions, to maintain appropriate security, and to be bound by written data processing agreements.
Fraud and chargeback disclosure: where you initiate a payment dispute, we will disclose to your bank, card issuer, and payment provider the order and delivery record described in Section 9 of our Refund & Returns Policy, including your IP address, device data, order timestamps, correspondence, and carrier tracking and delivery confirmation. This is necessary for the establishment, exercise, and defense of legal claims.
8. Your Rights — United States (CCPA / CPRA and Other State Laws)
If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, or another state with a comprehensive privacy law, you have the following rights, subject to the terms of the applicable law:
- Right to know / access — the categories and specific pieces of personal information we have collected, the sources, the business purposes, and the categories of third parties to whom we disclose it.
- Right to delete — request deletion of personal information we collected from you, subject to exceptions (including completing a transaction, detecting security incidents, fraud prevention, and complying with legal obligations).
- Right to correct — request correction of inaccurate personal information.
- Right to opt out of sale/sharing — we do not sell personal information for money, but our use of advertising pixels may constitute “sharing” for cross-context behavioral advertising. Use the “Do Not Sell or Share My Personal Information” link in the Site footer, or send a GPC signal, or email Support@cozygarden.online.
- Right to limit use of sensitive personal information — we do not collect sensitive personal information for purposes requiring this right.
- Right to non-discrimination — we will not deny you goods or services, charge you different prices, or provide a different level of quality because you exercised a privacy right.
- Right to appeal (Colorado, Connecticut, Virginia, and others) — if we decline your request, you may appeal by replying to our decision email. We will respond to appeals within 45 days.
Categories collected in the last 12 months: identifiers; commercial information; internet and network activity; geolocation data (approximate, IP-derived); and inferences drawn for advertising audiences. Sources, purposes, and recipients are set out in Sections 2, 3, and 7.
Categories “shared” in the last 12 months for cross-context behavioral advertising: identifiers (hashed email), commercial information (purchase events), and internet activity — with Meta and Google.
How to submit a request: email Support@cozygarden.online with the subject line “PRIVACY REQUEST” and state which right you are exercising. We will verify your identity by matching the information you provide against our records (typically your order number and the email address used at checkout). We respond within 45 days, extendable once by a further 45 days with notice.
Authorized agents: an authorized agent may submit a request on your behalf with written proof of authorization; we may still require you to verify your identity directly.
California “Shine the Light”: California residents may request information about disclosures of personal information to third parties for their direct marketing purposes. Send such requests to Support@cozygarden.online.
9. Your Rights — EEA, UK, and Switzerland (GDPR)
If you are in the EEA, UK, or Switzerland, you have the right to:
- Access your personal data and receive a copy;
- Rectification of inaccurate or incomplete data;
- Erasure (“right to be forgotten”), subject to our legal retention obligations;
- Restriction of processing in certain circumstances;
- Data portability — receive data you provided in a structured, commonly used, machine-readable format;
- Object to processing based on legitimate interests, and to object at any time to direct marketing (an absolute right);
- Withdraw consent at any time where processing is based on consent;
- Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (see Section 12);
- Lodge a complaint with your national supervisory authority, or with the UK Information Commissioner’s Office (ico.org.uk).
To exercise these rights, email Support@cozygarden.online. We respond within one month, extendable by two further months for complex requests, with notice.
EU/UK Representative: [APPOINT AND INSERT IF REQUIRED UNDER ART. 27 GDPR — required if you offer goods to EU/UK data subjects and have no EU/UK establishment.]
10. International Data Transfers
We are based in the United States and our service providers are located in the United States and other countries. If you are located outside the United States, your personal information will be transferred to and processed in the United States, which may not provide the same level of data protection as your home jurisdiction.
Where we transfer personal data out of the EEA or UK, we rely on:
- The EU-U.S. Data Privacy Framework and the UK Extension, where the recipient is certified; and/or
- The European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum), together with supplementary technical and organizational measures where appropriate.
You may request a copy of the relevant transfer safeguards by emailing Support@cozygarden.online.
11. Data Retention
We retain personal information only as long as necessary for the purposes described in this Policy:
| Data | Retention Period |
| Order and transaction records | 7 years from the transaction date (tax and accounting requirements) |
| Chargeback and dispute records | 2 years minimum, or the duration of the dispute plus applicable limitation periods |
| Customer support correspondence | 3 years from last contact |
| Account data | Duration of the account, plus 12 months after closure |
| Marketing consent records | Duration of consent, plus 3 years after withdrawal (to evidence compliance) |
| Fraud-prevention records | 5 years, to protect against repeat abuse |
| Analytics data | Per platform default; Google Analytics set to 14 months |
| Cookie data | Per the durations disclosed in our cookie banner |
Where deletion is not possible (for example, in backup archives), we isolate the data and place it beyond further processing until deletion is possible.
12. Automated Decision-Making
We use automated fraud-screening tools provided by our payment processors that may score an order and, in some cases, decline or flag it for manual review. A declined or flagged order is always available for human review — if your order is declined and you believe this is in error, email Support@cozygarden.online and a person will review it. We do not use automated decision-making for any purpose that produces legal effects concerning you other than order acceptance.
13. Security
We implement appropriate technical and organizational measures to protect personal information, including TLS/SSL encryption in transit, access controls and least-privilege permissions, hashed password storage, PCI-DSS compliant payment processing through third parties (we do not store card data), and regular software patching.
No method of transmission or storage is 100% secure. We cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for all activity under your account.
Breach notification: in the event of a personal data breach, we will notify affected individuals and applicable supervisory authorities where required by law and within the timeframes required (including within 72 hours to the lead supervisory authority under the GDPR where feasible).
14. Third-Party Links
The Site may contain links to third-party websites and services. We are not responsible for their privacy practices. Review their privacy policies before providing them with personal information.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the “Last Updated” date. Where changes are material, we will provide prominent notice on the Site and, where required by law, obtain your consent. Continued use of the Site after an update constitutes acceptance of the revised Policy to the extent permitted by law.
16. Contact Us
For any privacy question, request, or complaint:
Email: Support@cozygarden.online (subject line: PRIVACY REQUEST)
If you are unsatisfied with our response, you may lodge a complaint with your local data protection authority (EEA/UK) or your state Attorney General (United States).
Cozy Garden. All rights reserved.