Privacy Policy
Last updated: 16 July 2026
This policy explains what personal data we process when you visit cozelia.com, why we process it, who may receive it and how you can exercise your rights under Regulation (EU) 2016/679 (the GDPR).
Cozelia presents affiliate offers and collects order requests. When you submit a cash-on-delivery order, Cozelia sends the information required to process it to the relevant fulfilment or partner seller. That partner handles confirmation, dispatch, delivery, payment collection and after-sales support. Cozelia may earn a commission, at no additional cost to you.
1. How Cozelia works and what this means for your data
Cozelia selects and presents home products through product pages, comparisons and guides. For offers completed directly on cozelia.com, we collect the order request and transmit it to the relevant fulfilment or partner seller. Cozelia does not collect card payments, dispatch parcels or administer product warranties.
The partner processes the order for confirmation, delivery, cash-on-delivery collection and after-sales support under the information supplied at the point of order. Where a product link instead redirects you to a third-party website, processing on that website is governed by the third party's own terms and privacy notice.
2. Data controller
The controller of personal data collected through this website is:
- Registered name: «[full registered name]»
- Legal form and registered office: «[legal form and registered address]»
- VAT / tax identification number: «[VAT / tax number]»
- Business Register / REA details: «[REA / Chamber of Commerce details]»
- Contact email: assistenza@cozelia.com
- Certified email address (PEC): «[PEC address]»
Data Protection Officer, if appointed: «[DPO name and contact details]». Privacy requests may be sent to assistenza@cozelia.com.
3. Categories of personal data
3.1 Technical and navigation data
Systems supporting the website may process data transmitted as part of normal Internet communications, including IP address, browser and device type, operating system, requested pages, request date and time, referring page and security logs. We use this data to deliver the website, protect it against misuse, diagnose faults and produce aggregated technical statistics.
3.2 Cookies and similar technologies
The website may use first-party storage and, only where enabled and lawfully permitted, third-party analytics, advertising and affiliate technologies. This includes Google Signals, Google Analytics audiences, Meta Pixel and Meta Conversions API for campaign attribution, advertising personalisation, remarketing and suppression of people who already completed a relevant action. Meta browser and server events use matching identifiers for deduplication. For selected accepted forms, contact and location identifiers may be normalised and one-way hashed on the server for Meta event matching; form messages, passwords and payment-card data are not included. Non-essential technologies are controlled by the website consent choice. Details of categories, purposes, providers and duration are set out in our Cookie Policy.
3.3 Data you provide voluntarily
If you submit an order, contact us by form or email, we process the information needed for that request. Depending on the form, this may include name, email address, telephone number, delivery address, city, postcode, country, product, quantity, order value, order reference and message. Please do not send payment-card data or other unnecessary sensitive information.
3.4 Affiliate data
For an order submitted on cozelia.com, the relevant partner receives the customer and delivery data required by its offer form together with product, market, attribution, IP address, User-Agent and pseudonymous correlation identifiers. These technical fields support routing, fraud prevention, deduplication, status reconciliation and commission attribution. The partner returns an order identifier and operational status so Cozelia can reconcile the request. The partner acts under the applicable contractual and privacy framework for its processing.
4. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Deliver pages, maintain security and prevent abuse | Technical, device, network and log data | Legitimate interests in providing and protecting the website; performance of a requested service |
| Reply to enquiries and provide website support | Contact details, message and any order reference supplied | Taking steps at your request; legitimate interests in managing correspondence |
| Transmit and reconcile cash-on-delivery orders | Customer and delivery details, product, value, market, IP address, User-Agent and pseudonymous order/device identifiers | Taking steps at your request and performance of the requested transaction; fraud prevention and operational security |
| Remember privacy and interface choices | Consent and preference data | Compliance with legal obligations; legitimate interests for strictly necessary preferences |
| Measure audience and improve content | Analytics identifiers and usage events, where enabled | Consent where required; otherwise legitimate interests only where permitted by law |
| Measure advertising or affiliate performance | Advertising or affiliate identifiers and conversion events, where enabled | Consent where required |
| Personalise advertising and create remarketing or suppression audiences | Pseudonymous analytics and advertising identifiers, interaction categories and, for selected accepted events, one-way hashes of matching identifiers; free-text form contents, passwords and payment-card data are excluded | Consent where required |
| Establish, exercise or defend legal claims | Relevant account, communication and technical records | Legitimate interests and compliance with legal obligations |
Where processing relies on consent, you may withdraw it at any time without affecting processing carried out before withdrawal. Where processing relies on legitimate interests, we balance those interests against your rights and reasonable expectations.
5. Recipients and processors
Personal data may be handled by authorised staff and by service providers acting on our instructions where necessary. Depending on the services enabled, recipients may include:
- hosting, content-delivery, security and technical-support providers;
- email and customer-support providers;
- Google Ireland Limited and Meta Platforms Ireland Limited for enabled analytics, advertising, attribution, remarketing and conversion measurement;
- affiliate networks, fulfilment providers and partner sellers where required to validate, route, confirm, deliver and reconcile an order;
- professional advisers, courts, supervisory authorities or public bodies where required by law or necessary to protect legal rights.
Processors are appointed under appropriate contractual terms. Third-party sellers and platforms generally act as independent controllers for activity on their own websites.
6. International transfers
Some providers may process data outside the European Economic Area. Where this occurs, transfers are based on an adequacy decision, the European Commission's Standard Contractual Clauses or another lawful safeguard under Chapter V of the GDPR. Additional technical or organisational measures are used where appropriate. Information about a specific provider's transfer arrangements is available in that provider's privacy notice.
7. Retention
| Record | Indicative retention |
|---|---|
| Security and server logs | Normally up to 12 months, unless longer retention is required to investigate an incident or comply with law |
| General enquiries | For the time needed to answer and normally no longer than 24 months after closure |
| Consent and preference records | For as long as needed to demonstrate and apply the preference, subject to periodic renewal |
| Analytics and advertising data | According to the period stated in the Cookie Policy and the relevant Google and Meta settings; current Google Analytics audience membership ranges from 7 to 180 days |
| Legal and compliance records | For the applicable statutory limitation period or as required by law |
Data is deleted or anonymised when it is no longer needed, unless preservation is required by law or for the establishment, exercise or defence of legal claims.
8. Your rights
Subject to the conditions set by the GDPR, you may request:
- access to your personal data and information about its processing;
- correction of inaccurate or incomplete data;
- erasure of data where the legal requirements are met;
- restriction of processing;
- portability of data you provided, where processing is automated and based on consent or contract;
- objection to processing based on legitimate interests, including objection to direct marketing at any time;
- withdrawal of consent at any time;
- information about safeguards used for international transfers;
- not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, where Article 22 applies.
Send a request to assistenza@cozelia.com. We may request proportionate information to verify identity. We normally respond within one month, subject to the extensions allowed by the GDPR.
9. Complaints
You may lodge a complaint with the Italian Data Protection Authority (the Garante) or with the supervisory authority in the EU Member State of your habitual residence, place of work or place of the alleged infringement. The Italian authority's website is www.garanteprivacy.it.
10. Children
The website is intended for a general adult audience and is not designed to collect personal data from children. If you believe that a child has provided data without appropriate authorisation, contact us so that we can investigate and take appropriate action.
11. Security
We apply technical and organisational measures appropriate to the nature of the data and the risks involved. No Internet transmission or storage system can be guaranteed completely secure. Please use caution when deciding what information to send.
12. Changes to this policy
We may update this policy to reflect legal, technical or organisational changes. The current version is the one published on this page, identified by the date above. Material changes may be highlighted through the website where appropriate.
13. Contact
Questions about this policy or the processing of personal data may be sent to assistenza@cozelia.com or to «[PEC address]». If a Data Protection Officer has been appointed, the relevant details are: «[DPO name and contact details]».