Cocomob Ltd. ("Cocomob", "we", "our", or "us") is a global performance marketing company that provides managed digital advertising services, affiliate and cost-per-sale programme management, programmatic media buying, and growth consultancy to advertisers and brand partners worldwide.
This Privacy Policy explains how we collect, use, disclose, transfer, and protect personal data in connection with our website located at cocomob.com (the "Site") and in the course of delivering our services to clients. We are committed to handling personal data responsibly and in compliance with applicable data protection and privacy laws.
For the purposes of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the UK GDPR, Cocomob Ltd. is the data controller. Our registered address and primary contact for privacy matters is:
Cocomob Ltd.
Email: hello@cocomob.com
If you have questions about this Policy or wish to exercise your privacy rights, please contact us at the address above. We aim to respond to all legitimate requests within 30 days.
This Policy applies to personal data collected through the Site, through our marketing and business development activities, and through the operation of client campaigns where we act as a data processor or sub-processor on behalf of our advertising clients.
Depending on your location and the nature of our interaction, one or more of the following laws may apply to our processing of your personal data:
Where we act as a data processor on behalf of an advertiser client, the client's privacy policy and our Data Processing Agreement with that client govern our processing of end-user personal data. This Policy primarily addresses our activities as a data controller.
When you interact with our Site or contact us for business purposes, you may provide:
When you visit the Site, our servers and third-party analytics tools automatically collect certain technical and behavioural information, including:
In the course of managing advertising campaigns on behalf of our advertiser clients, we may receive or access personal data from third-party sources, including:
Where we receive personal data from third parties in our capacity as a data processor acting on behalf of an advertiser, we process that data solely in accordance with the applicable Data Processing Agreement and our client's documented instructions.
For personal data subject to the GDPR or UK GDPR, we rely on the following legal bases under Article 6:
Where we rely on legitimate interests, you have the right to object to such processing (see Section 9 below). For special categories of personal data (as defined in GDPR Art. 9), we rely on your explicit consent or another applicable condition under Art. 9(2). We do not intentionally collect special category data through the Site.
We use the personal data we collect for the following specific purposes:
We do not sell personal data. We may share personal data in the following circumstances:
We engage trusted third-party vendors and service providers who process personal data on our behalf under contractual data processing agreements. These include: cloud hosting and infrastructure providers; CRM and marketing automation platforms; email delivery services; analytics and tracking tools; cybersecurity and fraud detection services; legal, accounting, and audit firms; and payment processors.
In our role as a managed service provider, we access and operate within advertising platforms such as Google (including Google Ads, Display & Video 360, and Google Analytics), Meta (Facebook/Instagram), LinkedIn, TikTok, Amazon Advertising, and various programmatic DSPs and SSPs. These platforms act as independent data controllers or as data processors under their respective platform terms. We share campaign configuration data, audience lists, and conversion signals with these platforms as necessary to execute client campaigns. Their use of data is governed by their own privacy policies and terms.
We may disclose personal data to lawyers, auditors, insurers, or other professional advisors where necessary for the provision of their services to us, subject to appropriate confidentiality obligations. We may also disclose personal data when required by applicable law, regulation, legal process, or enforceable governmental request, or where necessary to protect our rights, property, or safety or those of our clients or others.
In the event of a merger, acquisition, asset sale, restructuring, or other corporate transaction involving Cocomob, personal data held by us may be transferred to the acquirer or successor entity. We will ensure that any such transfer is subject to appropriate confidentiality protections and that affected individuals are notified as required by applicable law.
Cocomob operates globally and may transfer personal data across national borders in the course of our business operations. When we transfer personal data from the EU/EEA, the United Kingdom, or other jurisdictions with transfer restrictions to countries that do not provide an equivalent level of data protection, we implement appropriate safeguards, which may include:
You may request further information about the specific safeguards applicable to international transfers of your personal data by contacting us at hello@cocomob.com.
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. Our retention periods are as follows:
| Data Category | Retention Period | Basis |
|---|---|---|
| Client contact and account records | Duration of contract + 7 years | Legal/tax obligation |
| Financial and billing records | 7 years from transaction date | Tax and accounting law |
| Marketing contact data (newsletter/B2B) | 3 years from last engagement, or until opt-out | Legitimate interests / consent |
| Website analytics data (GA4) | 14 months (rolling, per GA4 settings) | Legitimate interests |
| Server and access logs | 90 days | Security / legitimate interests |
| Contact form enquiries (non-converted) | 12 months | Legitimate interests |
| Campaign performance data (aggregated) | 5 years | Contractual / legitimate interests |
| Employee and contractor records | Duration of engagement + 6 years | Legal obligation |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised. We may retain data for longer periods if required by applicable law or for the establishment, exercise, or defence of legal claims.
Depending on your location and applicable law, you may have the following rights regarding your personal data. We honour these rights regardless of where you are located, to the extent technically and legally feasible.
| Right | Applicable Law(s) | Description |
|---|---|---|
| Right of Access | GDPR, UK GDPR, CCPA, LGPD, PIPEDA, PDPA | Request a copy of the personal data we hold about you, along with information about how it is used and shared. |
| Right to Rectification | GDPR, UK GDPR, LGPD, PDPA | Request correction of inaccurate or incomplete personal data. |
| Right to Erasure ("Right to be Forgotten") | GDPR, UK GDPR, CCPA (deletion), LGPD, PDPA | Request deletion of your personal data, subject to applicable legal retention requirements and other lawful grounds for continued processing. |
| Right to Data Portability | GDPR, UK GDPR, LGPD | Receive a structured, commonly used, machine-readable copy of personal data you have provided to us, and request that we transmit it to another controller where technically feasible. |
| Right to Restrict Processing | GDPR, UK GDPR | Request that we limit our processing of your personal data in certain circumstances, such as while accuracy is contested or an objection is being assessed. |
| Right to Object | GDPR, UK GDPR, LGPD | Object at any time to processing based on legitimate interests, including profiling for direct marketing purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds. |
| Right to Withdraw Consent | GDPR, UK GDPR, LGPD, PDPA, PIPEDA | Withdraw consent at any time where processing is consent-based, without affecting the lawfulness of prior processing. |
| Right to Know / Right to Opt Out of Sale or Sharing | CCPA/CPRA | California residents may request disclosure of personal information collected, disclosed, or "shared" (for cross-context behavioural advertising), and opt out of the sale or sharing of their personal information. |
| Right to Non-Discrimination | CCPA/CPRA | You will not receive discriminatory treatment for exercising your CCPA rights. |
| Right to Correct (CPRA) | CPRA | California residents may request correction of inaccurate personal information. |
| Right of Access and Correction | PIPEDA (Canada) | Individuals may request access to their personal information and challenge its accuracy. |
To exercise any of these rights, please submit a request to hello@cocomob.com with the subject line "Privacy Rights Request." We will verify your identity before processing your request and aim to respond within 30 days (or such shorter period as required by applicable law). We do not charge a fee for reasonable requests. If you are dissatisfied with our response, you have the right to lodge a complaint with your applicable supervisory authority (e.g., the ICO in the UK, your EU Member State's Data Protection Authority, the CNIL in France, or equivalent).
We implement a comprehensive set of technical and organisational security measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include: TLS/SSL encryption for all data in transit; AES-256 encryption for sensitive data at rest; role-based access controls and the principle of least privilege; multi-factor authentication for all system access; regular security assessments and penetration testing; data loss prevention (DLP) controls; vendor security reviews; incident response and breach notification procedures; and staff training on data protection and information security.
No method of electronic transmission or storage is completely secure. While we take commercially reasonable precautions, we cannot guarantee absolute security. In the event of a data breach affecting your rights and freedoms, we will notify you and applicable supervisory authorities as required by law.
Our Site and services are directed exclusively at businesses and business professionals. We do not knowingly collect personal data from individuals under the age of 16 (or under 13 in jurisdictions where that is the applicable age threshold, including the United States). If we become aware that we have inadvertently collected personal data from a minor, we will promptly delete it. If you believe we have collected personal data from a child, please contact us at hello@cocomob.com.
Our Site may contain links to third-party websites, social media platforms, advertising platforms, and other online resources. These third parties have their own privacy policies and practices, for which we are not responsible. We encourage you to review the privacy policies of any third-party sites you visit. The inclusion of a link on our Site does not constitute an endorsement of that third party's privacy practices.
We may send commercial email communications to business contacts who have either provided consent or with whom we have an existing business relationship and a legitimate interest basis for direct marketing. Every marketing email we send includes a clearly visible unsubscribe link. You may also opt out at any time by:
Opting out of marketing communications does not affect our ability to send you transactional or service-related communications (such as invoices, contract updates, or security notices).
We do not make decisions about individuals that produce significant legal or similarly significant effects based solely on automated processing, without human involvement. In the course of managing advertising campaigns for clients, programmatic advertising systems operated by advertising platforms (such as Google's DV360 or Meta's Advantage+ systems) may perform automated bidding and audience optimisation based on pseudonymous identifiers. These automated processes are subject to the applicable platform's own terms and privacy policies. If you wish to understand or object to such automated processing in the context of advertising, please refer to the respective platform's privacy settings and opt-out mechanisms.
This section applies to California residents. In the preceding 12 months, Cocomob has collected, disclosed, and in limited circumstances "shared" (for cross-context behavioural advertising purposes) the following categories of personal information:
| Category (CCPA) | Examples | Business Purpose | Sold? | Shared (CPRA)? |
|---|---|---|---|---|
| Identifiers | Name, email, IP address, cookie ID | Service delivery, analytics, security | No | Limited (ad platform pixels) |
| Commercial information | Service agreements, billing records | Contractual obligations | No | No |
| Internet/electronic network activity | Browsing history on Site, cookie data | Analytics, personalisation | No | Limited (Google Analytics, ad pixels) |
| Geolocation data | Approximate location from IP address | Analytics, fraud prevention | No | No |
| Professional/employment information | Job title, company name | B2B service delivery, CRM | No | No |
| Inferences | Interests and preferences inferred from usage | Marketing personalisation | No | No |
California residents may submit CCPA rights requests to hello@cocomob.com. We will not discriminate against you for exercising any CCPA rights. We do not have actual knowledge that we sell or share personal information of minors under 16 years of age.
We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or the services we offer. When we make material changes, we will post the updated Policy on this page and update the "Last Updated" date at the top of the document. For significant changes, we may also provide additional notice such as an email notification to registered contacts or a banner on our Site. We encourage you to review this Policy periodically. Your continued use of the Site after changes are posted constitutes your acknowledgment of the updated Policy.
For all privacy-related enquiries, rights requests, or concerns, please contact us at:
Cocomob Ltd. — Privacy Team
Email: hello@cocomob.com
Where required by applicable law, we have designated a Data Protection Officer (DPO). You may contact our DPO directly at the email address above, marking your correspondence "For the attention of the DPO." If you are located in the EU/EEA or UK and are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with your local data protection supervisory authority. A list of EU supervisory authorities is available at the European Data Protection Board website (edpb.europa.eu). The UK supervisory authority is the Information Commissioner's Office (ico.org.uk).