CONTENTS
1. Who is the controller
2. How do we receive your personal data
3. Types of personal data collected
4. Use of personal data and legal basis
5. Retention of personal data
6. Transfer of personal data
7. Disclosure of personal data
8. Security of personal data
9. Your rights
10. Want to exercise your rights, have questions or a complaint
11. Changes to this Privacy Policy
1. WHO IS THE CONTROLLER
COCŌN GROUP BV, with registered office at Waterhoenlaan 70, 9120 Beveren-Kruibeke-Zwijndrecht, registered with the Crossroads Bank for Enterprises under number 1024.000.393 (hereinafter referred to as “COCŌN”, “we”, “us” or “our”) operates the COCŌN studio, website and booking environment and is responsible for processing your data as described in this privacy policy ("Privacy Policy").
This Privacy Policy explains what personal data we collect, why we use it and what rights you have.
This Privacy Policy applies, inter alia, to (i) our website cocon-studioscom (hereinafter our "Website") and the services and activities associated with it and (ii) all relationships through any other means of communication between you and us.
2. HOW DO WE RECEIVE YOUR PERSONAL DATA
Personal data is data that can be used to directly or indirectly identify natural person. We may collect and process personal data in various ways, e.g. when:
• you create an account;
• purchase a Membership, credits or a Discovery Pack;
• you book or attend a session;
• contact us;
• subscribe to marketing.
Usually, you give us your personal data yourself. Sometimes we receive your contact details through third parties, e.g:
• an existing member or friend invites you to a class and provides us with your contact details for that purpose.
3. TYPES OF PERSONALDATA COLLECTED
3.1 PERSONAL DATA
Depending on how you use COCŌN, we may collect:
• name, e-mail address, phone number, date of birth and, where needed, billing details;
• Membership type, credits, Discovery Pack, bookings, attendance and waitlist activity;
• late cancellations, no-shows and related fees;
• purchase amounts, invoices, payment status and transaction references;
• messages you send us and relevant customer-service notes;
• marketing preferences and newsletter subscription status.
Full payment-card details are generally processed by the payment provider and are not stored directly by COCŌN.
3.2 HEALTH AND SAFETY INFORMATION
If you voluntarily tell us about an injury, pregnancy, physical limitation or other health information relevant to safe participation, we use that information only for that purpose. Please only share information that is necessary.
3.3 COOKIES
When you use our website, app or booking environment, certain technical information may be collected automatically, such as your IP address, browser or device type, operating system, pages visited, time and date of access and diagnostic data.
We use cookies and similar technologies to operate our website and remember certain preferences. If we use analytics or advertising cookies, they are activated according to the choices made through our cookie banner.
You can manage your cookie preferences through the cookie settings on our website. Some strictly necessary cookies cannot be disabled because they are required for the website to function.
4. USE OF PERSONAL DATA AND LEGAL BASIS
4.1 PERFORMANCE OF OUR CONTRACT WITH YOU
We use your data to:
• create and manage your account, Membership, credits, Discovery Pack and bookings;
• process payments, invoices and outstanding amounts;
• send booking confirmations, schedule changes and other service messages;
• manage attendance, late cancellations, no-shows and studio access;
• answer questions and provide customer support.
4.2 OUR LEGITIMATE INTERESTS
We use your data to:
• prevent fraud, misuse and security incidents;
• studio updates about similar services to existing clients, in accordance with the applicable soft opt-in rules;
• understand and improve how our website, app and booking environment are used.
4.3 COMPLIANCE WITH A LEGAL OBLIGATION
We use your data to:
• meet accounting, tax and other legal obligations.
4.4 YOUR CONSENT
Where you have given your consent, we use your data to:
• send marketing and studio updates, including our newsletter, to prospects or other individuals who are not yet clients;
• use relevant health information to support safe participation;
• use identifiable photos or video for marketing where the required consent has been obtained.
5. RETENTION OF PERSONAL DATA
We keep personal data only for as long as needed for the purpose for which it was collected and for any applicable legal or administrative retention period.
• Account, Membership, booking and attendance data is kept during the customer relationship and afterwards where needed for administration or disputes.
• Invoices and accounting data are kept for the statutory retention period.
• Marketing data is kept until you unsubscribe or withdraw consent.
• Health information is kept only while it remains relevant to safe participation or a related dispute.
• Technical and cookie data is kept according to the retention settings of the relevant website or app tools.
6. TRANSFER OF PERSONAl DATA
In principle, we use your personal data only for providing the services you request. If we use external service providers to provide these services, these service providers also have access to your personal data exclusively within the scope of their services. We have implemented necessary technical and organizational measures to ensure compliance with data protection regulations and also require external service providers to adhere to these provisions. We have entered into data processing agreements with relevant third parties, which include necessary safeguards regarding the confidentiality and privacy compliance of your personal data.
Notwithstanding the foregoing, it is possible that COCŌN may disclose your personal data to competent authorities (i) if COCŌN is required to do so by law or legal process and/or (ii) to protect and defend our rights.
In principle, we aim to store your personal data on IT systems in the European Economic Area (“EEA”).
If personal data are transferred to countries or organisations outside the EEA, appropriate safeguards will always be provided. Any transfer of personal data outside the EEA to a recipient in a country not covered by a decision of the European Commission to provide an adequate level of protection, will be subject to the provisions of a data transfer agreement, which will include (i) the standard contractual clauses issued by the European Commission, or (ii) any other mechanism in accordance with the GDPR, or any other regulation relating to the processing of personal data such as the EU-U.S. Data Privacy Framework for transfers to the U.S. If you have any questions regarding these safeguards or their accessibility, please contact us by e-mail or post using the details below (under title 10).
7. DISCLOSURE OF PERSONAL DATA
7.1 BUSINESS OPERATIONS
We may share personal data with companies that support our booking, payment, website, e-mail, accounting, legal or IT activities, but only to the extent needed for those activities.
This includes Mindbody, which is used for account, Membership, booking, attendance and payment administration, including the COCŌN branded app and booking environment.
7.2 LEGAL REQUIREMENTS
We may disclose personal data where necessary to:
• comply with a legal obligation or request from a competent authority;
• protect the rights, property or safety of COCŌN, our clients or others;
• prevent or investigate fraud, misuse or security incidents;
• establish, exercise or defend a legal claim.
We do not sell or rent your personal data.
8. SECURITY OF PERSONAL DATA
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or disclosure. Access is limited to people and organisations that need the data for their work.
No online system can be guaranteed to be completely secure. If you believe your COCŌN account has been compromised, please contact us by e-mail or post using the details below (under title 10).
9. YOUR RIGHTS
You have several rights:
• You have a right to access your personal data. This allows you to check what personal data we process about you;
• You have a right to correct your personal data. This allows you to correct or supplement any incorrect or incomplete personal data we process about you;
• You have a right to erasure of your personal data. This allows you to permanently erase personal data that we process about you. We are not always obliged to erase your personal data at your request – this right only applies in the cases and to the extent provided by law;
• You have a right to restrict the processing of your personal data. This allows you to freeze our use of your personal data without erasing it. We are not always obliged to restrict your personal data at your request – this right applies only in the cases and to the extent provided for by law;
• You have the right to object to the processing of your personal data. This allows you to object to the further processing of your personal data. We are not always obliged to honor your objection – this right only applies when we process your personal data based on our legitimate interests;
• You always have the right to withdraw your consent when the processing of your personal data is based on your consent;
• You always have the right to object the processing of your personal data for direct marketing purposes;
• You have the right to data portability. This allows you to transfer, copy or forward personal data smoothly from one controller to another. This right can only be exercised if the processing is based on your consent or on an agreement with you.
If you wish to exercise any of the rights listed above, please contact us by e-mail or post using the details below (under title 10).
When you make a request to exercise your rights, we will first verify your identity through the appropriate and least privacy-intrusive means. We do this to prevent your data from falling into the wrong hands.
The exercise of your rights is in principle free of charge. If your request is manifestly unfounded or excessive, we may charge you a reasonable fee in light of the administrative costs incurred by us. In such cases, however, we may also choose not to comply with your request. You will be notified of the reasons for this, if applicable.
In any case, we will always inform you of the outcome of your request no later than within one month. For complex or multiple requests, this period may be extended by two months, but we will also inform you of this necessary extension within the initial month.
10. WANT TO EXERCISE YOUR RIGHTS, HAVE QUESTIONS OR A COMPLAINT
If you have questions about this Privacy Policy or the way we use your personal data, contact us at:
COCŌN GROUP BV
Brand Whitlocklaan 87, 1200 Sint-Lambrechts-Woluwe, Belgium
hello@cocon-studios.com
You also have the right to lodge a complaint with the Belgian Data Protection Authority:
Data Protection Authority / Gegevensbeschermingsautoriteit
Rue de la Presse 35 / Drukpersstraat 35, 1000 Brussels
contact@apd-gba.be
11. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time. The latest version will be available on our website and will show the effective date.