Privacy Policy
This policy explains what we do with your personal data when you visit cohoo.co, contact us or place an order. It is written for visitors in the EU, EEA and the United Kingdom, whose data is protected by the GDPR and the UK GDPR.
1. Who is responsible
The controller of your personal data is:
Elif Isik – Cohoo Tasarim Studyosu
Cankaya, Ankara, Türkiye
info@cohoo.co
Write to that address for anything to do with your data, including the rights listed in section 6.
2. What we collect and why
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Name, delivery and billing address, email, phone | To take, produce, ship and invoice your order and to handle returns | Performance of a contract; legal obligation (accounting) | 10 years (tax records) |
| Order contents, amounts, order history | Same as above; customer service | Performance of a contract; legal obligation | 10 years |
| Payment data | Processed by iyzico. We receive only the result and the last digits of the card — never the full card number | Performance of a contract | As above |
| Email address for our newsletter or a saved basket reminder | To send you our newsletter or remind you of an unfinished basket | Consent, which you can withdraw at any time | Until you unsubscribe |
| Messages you send us through the contact form or WhatsApp | To answer you | Legitimate interest in replying to enquiries | 3 years |
| Usage and device data, cookie identifiers | To keep the site and basket working, and — only with your consent — for statistics and advertising measurement | Necessity for the service; otherwise consent | See section 4 |
3. Who we share it with
We share only what each recipient needs:
- iyzico — payment processing (Türkiye)
- Carriers and customs brokers — name, address, phone, contents and value of your parcel, so it can be delivered and cleared through customs
- Brevo — email delivery and newsletters (EU)
- Hostinger — website hosting
- Google (Analytics, Tag Manager, Search Console) and Meta — only where you have consented to statistics and marketing cookies
- Our accountant, and public authorities where the law requires it
We do not sell your personal data.
4. Cookies
Cookies that are strictly necessary — keeping you logged in, remembering your basket, security — are set without consent because the site cannot work without them. Statistics and marketing cookies (Google Analytics, Meta Pixel) are set only if you agree, and you can change your mind at any time through the cookie settings on the site or by clearing cookies in your browser.
5. Where your data goes outside the EU/EEA
We are established in Türkiye. When you send us your details to place an order or write to us, you are dealing with us directly, so this is not an “international transfer” under Chapter V of the GDPR — but the GDPR still applies to us under Article 3(2), because we offer goods to people in the EU, and everything in this policy applies in full.
Where we pass your data on to service providers outside the EEA, Chapter V does apply and we rely on:
- the European Commission’s Standard Contractual Clauses for providers with no adequacy decision;
- the EU–US Data Privacy Framework adequacy decision for certified US providers, with Standard Contractual Clauses kept in place as a fallback.
Where a transfer is necessary to perform the contract you have asked us to enter into — for example passing your address to a carrier or customs broker so your order can be delivered and cleared — we may also rely on Article 49(1)(b).
6. Your rights
You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent at any time without affecting processing already carried out. Write to info@cohoo.co and we will answer within one month.
You also have the right to lodge a complaint with the data protection authority in the EU or EEA country where you live or work.
7. Security
The site runs over HTTPS. Access to order data is limited to the people who need it. Card details are handled by iyzico and never reach our systems.
8. Changes
If we change this policy we will update the date below and, where the change is significant, tell you by email.
Last updated: 13 September 2026