Privacy Policy
This Policy explains what we collect, how we use it, and the choices you have when you use our website and services. By using the Site, you agree to this Policy.
Last updated: November 2, 2026
Controller: COA-pep is the controller of personal data collected through this Site.
This Policy covers visitors, account holders, and customers. It does not apply to third-party websites linked from our Site.
1) Information we collect
Data you provide Account details (name, email, password). Order & checkout details (billing/shipping info, email/phone). Support messages, forms, reviews, or survey responses. Newsletter opt-ins, optional SMS consent records, and marketing preferences. Data collected automatically Device & browser info (IP address, user agent, language). Usage data (pages viewed, clicks, referring URLs, session duration). Approximate location derived from IP (city/region level). Cookies, local storage, and similar technologies (see Cookies). Sensitive data We do not request or store protected health information, government IDs, or full payment card numbers. Payments are processed securely by our payment partners.2) How we use your information
Provide the Service: create/manage accounts, process orders, deliver products, and provide customer support.
Improve & secure: monitor performance, fix bugs, prevent fraud/abuse, maintain the Site.
Communicate: transactional emails (orders, shipping, account), and—if you opt in—newsletters, text messages, and promotions. You can unsubscribe or opt out as described below.
Compliance: tax/accounting, legal obligations, and enforcing our terms.
Legal bases (EU/UK) Contract performance, legitimate interests (running/defending the business, security, improvement), consent (marketing, non-essential cookies), and legal obligation.3) SMS & text messaging privacy
If you voluntarily opt in to COA-pep text messages, we may use the mobile number you provide to send the types of SMS messages you agreed to receive, including order confirmations, shipping notifications, customer service updates, or promotional offers. Marketing texts are sent only when you have expressly consented to marketing SMS.
Your choice and message details SMS consent is optional and is not a condition of purchase. Message frequency varies based on your orders and the messaging program you join. Message and data rates may apply. Reply STOP to any text to unsubscribe, or reply HELP for assistance. How we handle SMS information We may keep your phone number, opt-in status, consent timestamp, and related consent records to document your choices. We do not sell, rent, or share mobile phone numbers or SMS opt-in consent with third parties or affiliates for their marketing or promotional purposes. We may provide this information to contracted messaging providers solely to deliver messages on our behalf and operate the SMS program.You may withdraw your SMS consent at any time by replying STOP. For other questions or assistance, email +852 94460366. Opting out of SMS will not prevent you from placing orders or using our website.
4) Cookies & similar technologies
What we use Essential: site operation, cart, checkout, login. Analytics: measure traffic and performance. Preferences: remember settings and choices. Marketing: only if enabled by you (e.g., email tracking pixels or ad tags). Your control Manage or disable cookies in your browser. Where required, we ask consent for non-essential cookies. We honor GPC (Global Privacy Control) signals as an opt-out for sale/sharing where applicable.5) Data security
We use industry-standard protections including TLS/SSL encryption in transit, hardened hosting, access controls, and routine updates. No method of transmission or storage is 100% secure; if we become aware of a data incident affecting you, we will notify you and regulators as required by law.
6) When we share information
We do not sell your personal information. We share limited data with trusted service providers who help us operate the Site. They may only use it to perform services for us, and must protect it.
Common processors Payment processing: e.g., Stripe, PayPal (we don’t store full card numbers). Email & messaging: e.g., Brevo and contracted SMS providers (transactional & opted-in marketing). Shipping & fulfillment: e.g., carriers and logistics platforms. Analytics & infrastructure: web hosting/CDN, error monitoring, site analytics.We may also disclose information if required by law, to protect rights/safety, or in connection with a corporate transaction (e.g., merger or acquisition).
7) Data retention
Account & order records: kept as long as your account is active and as needed for tax/accounting, fraud prevention, and legal obligations (often 5–7 years for orders/invoices).
Support messages: retained as needed to resolve issues and improve service.
Marketing data: until you unsubscribe or request deletion, or after inactivity for a reasonable period. We may retain minimal SMS opt-in and opt-out records as needed to document consent and comply with legal obligations.
When data is no longer required, we delete or de-identify it.
8) Your rights & choices
Global rights Access a copy of your personal data. Correct inaccurate or incomplete data. Delete your data, subject to legal obligations. Portability (receive your data in a portable format, where applicable). Withdraw consent (e.g., marketing). Object/Restrict certain processing based on our legitimate interests. US State privacy (e.g., CA/CPRA, CO, CT, UT, VA) Right to know, access, correct, delete, and portability. Right to opt-out of targeted advertising, sale, or profiling. We do not sell personal information and do not share it for cross-context behavioral advertising. California: we honor browser-based opt-out signals (GPC). No discriminatory treatment for exercising your rights. How to exercise your rights Email +852 94460366 with “Privacy Request” in the subject. We may need to verify your identity. Authorized agents may submit requests as permitted by law. EU/UK users: you also have the right to lodge a complaint with your local supervisory authority.9) International transfers
We are in-house and may process data in the United States and other countries. When we transfer personal data from the EU/UK/EEA to countries without an adequacy decision, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (SCCs) or equivalent mechanisms.
10) Children’s privacy
Our Site is for adults (18+). We do not knowingly collect data from minors. If you believe a minor has provided information, contact us and we will delete it.
11) Changes to this policy
We may update this Policy to reflect changes to our practices or applicable laws. Updates will be posted here with a new “Last updated” date. Material changes will be highlighted or communicated where required.
12) Contact
Questions or requests? WhatsApp us at +852 94460366.
Email Privacy Request Go to Customer Support
English
French
Spanish
