We hereby inform you that the service provider Cocoon B.V. (located at: Koraalrood 153, 2718 SB Zoetermeer, The Netherlands, Company Registration Number: 28089969) processes your personal data in the following manner and for the following purposes.
When processing data, we act in accordance with applicable legislation – specifically Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
This Privacy Policy applies to the following website: https://cocoon.nl
We reserve the right to modify this Policy at any time; any changes will take effect upon publication.
Identification of the Data Controller
- Name: Cocoon B.V.
- Registered Address: Koraalrood 153, 2718 SB Zoetermeer, The Netherlands
- Email: info@cocoon.nl
Legal Grounds for Data Processing
- Performance of a contract (GDPR Art. 6(1)(b))
- Compliance with a legal obligation (GDPR Art. 6(1)(c))
- Legitimate interest of the controller or a third party (GDPR Art. 6(1)(f))
- Consent of the data subject (GDPR Art. 6(1)(a))
- Public interest or exercise of official authority (GDPR Art. 6(1)(e))
- Compliance with administrative and tax obligations (e.g., GDPR Art. 6(1)(c), other relevant national legislation)
- Defense, establishment, or substantiation of legal claims (GDPR Art. 6(1)(f))
Data processed during website use:
| Processed data | Purpose of processing |
| contact forms | |
| name | contact forms |
| phone number | contact forms |
Information about the Hosting Provider
Data is processed and stored by the following hosting provider for the operation of the service.
- Hosting provider name: Blauwe Nacht
- Address: Blauwe Nacht, Carol Vogesgracht 12, 1336 KE Almere
- Email: hallo@blauwenacht.nl
- Website: https://blauwenacht.nl/hosting/
Cookies
While browsing the website, so-called cookies may be stored on the user’s computer. These cookies contain technical information and are primarily intended to enable convenient and personalized browsing. However, the site may also use cookies for analytical, remarketing, or media purposes.
Essential
Essential cookies and services provide basic functionality and are necessary for the proper functioning of the website. These cookies and services do not require user consent under the GDPR.
Required
These cookies and services are necessary for the proper functioning of the website, but their use requires user consent. This may include payment gateways, captcha services, and integrated booking services.
Analytics
Statistics cookies collect usage information, providing us with insight into how our visitors interact with our website.
Marketing
Marketing services are used by third-party advertisers or publishers to display personalized advertisements. They do this by tracking visitors across different websites.
Media
These cookies and services are necessary to display certain media elements, such as embedded videos, maps, social media posts, etc.
Other Services
This category includes all cookies, domains, and services that do not fall into the other specific categories or have not been clearly categorized.
Cookies used on this site
| Cookie name | Purpose |
|---|---|
| mhcookie | essential |
| wordpress_logged_in_* | essential |
| wp-settings-* | essential |
| wp-settings-time-* | essential |
Users can manage or disable the use of cookies in their browser settings; however, this may affect certain functions of the website.
Data of Minors
Our service is not specifically directed at individuals under the age of 16. If we nevertheless collect and process data from minors, this only occurs when required by law (consent or permission from a parent/guardian).
Parents and guardians may at any time request the modification or deletion of data relating to them or minors under their supervision.
Contact Forms
The forms on the website record the data that the user voluntarily provides, which we use to establish contact or handle requests.
- name
- phone number
Retention Periods
We retain data only for the necessary duration or the period prescribed by applicable law. Thereafter, the data is deleted or anonymized.
Transfer of Data to Third Parties
We only transfer your data to third parties if you have given express consent, or if this is required by law or by a decision of a competent authority.
Automated Decision-Making, Profiling
In some cases, the service provider may use automated decision-making systems or profiling (e.g., for marketing purposes or risk assessment). The essence of such processes is to make certain conclusions without human intervention, but you have the right to challenge or supplement this at any time.
- Akismet Anti-Spam – Purpose: Spam detection.
If you believe that the automated decision leads to an incorrect result, you have the right to request human intervention and to object to the decision.
Security Measures
When processing data, both the controller and the processors implement organizational and technical protective measures, taking into account modern technological possibilities and the characteristics of the data processing (purpose, scope, circumstances) and the varying degree of risk to natural persons. The goal is to ensure data protection in proportion to the risks.
These measures may include, for example, encrypting data, ensuring the availability, confidentiality, and integrity of systems and services, and guaranteeing sufficient resilience. We pay special attention to restoring the availability of and access to data as quickly as possible in the event of physical or technical problems.
Through regular evaluation and testing of security measures, we guarantee that the safeguards are not merely theoretical but provide an appropriate level of protection in practice. We store data in a manner that prevents unauthorized access; paper documents are therefore kept in a closed, secure environment, while electronic data is only accessible to individuals with correctly defined access rights.
We also ensure that data can be irrevocably deleted when the retention period has expired or when other reasons require deletion. Paper documents are destroyed using special paper shredders or via an external partner specializing in document destruction. When decommissioning or disposing of electronic data carriers, we also ensure that the data is permanently erased.
Protection of Paper Documents
For data kept in paper form, we ensure physical security, including secure, dry storage and lockable rooms. Only authorized employees have access to the relevant documents. If paper documents are also digitized, the same rules apply as for digitally processed documents. Anyone working with data must not leave the workplace before ensuring that the entrusted materials are locked away and inaccessible to unauthorized persons.
The building and the rooms where paper documents are stored are equipped with suitable fire and property security systems, reducing the risk of physical damage.
IT Security
The computers and mobile devices involved in data processing are equipped with suitable antivirus protection and access control. To protect electronically stored information, we use up-to-date backup and archiving solutions and ensure that these backups are available if necessary.
Only authorized persons with defined access rights can connect to the central server. The computers used for work, as well as the data stored on them, are protected with passwords and other protective measures against unauthorized access.
Incident Management and Notification of Data Breaches
If an event occurs that exposes personal data to unauthorized access, damage, or loss, we will immediately take measures to further protect this data and limit the damage. If the situation suggests that the incident may involve a high risk to the rights and freedoms of individuals, we will inform the data subjects without undue delay and clearly explain the nature of the incident and the measures we have taken or plan to take to resolve it.
We may refrain from direct notification to the data subjects if we have previously applied security measures (e.g., encryption) that render the personal data unintelligible to unauthorized persons, or if we significantly reduce the likelihood of risk through additional steps. In certain cases, a public notice instead of an individual notification may be sufficient if individual notification would require disproportionate effort.
According to applicable regulations, if a data breach occurs that is likely to pose a risk to the rights and freedoms of natural persons, the controller shall report this incident to the competent supervisory authority within 72 hours of becoming aware of it. If the notification is made outside this period, the reasons for the delay must also be provided.
User Rights
As a data subject (user), you have the following rights regarding the processing of your personal data:
- Right of access (GDPR Art. 15)
You have the right to know whether we process data about you and, if so, which details. You can request information about the purpose, legal basis, and other relevant circumstances of the data processing. - Right to rectification (GDPR Art. 16)
You have the right to request the correction or completion of incorrect or incomplete data. - Right to erasure (“right to be forgotten”) (GDPR Art. 17)
If the data is no longer necessary, or if there are legal grounds for its removal, you can request that it be erased as soon as possible. - Right to restriction of processing (GDPR Art. 18)
In certain cases, you can request that we only store the data without further processing it (e.g., if you contest the accuracy of the data but do not wish for it to be immediately erased). - Right to data portability (GDPR Art. 20)
You have the right to receive the data stored by us in a machine-readable format or to request that we transfer it to another service provider, if technically feasible. - Right to object (GDPR Art. 21)
You can object to the further processing of your personal data if you believe that our legitimate interests (or another legal ground) do not sufficiently justify this processing. - Right not to be subject to automated decision-making (GDPR Art. 22)
You can request not to be subject to a decision based solely on automated processing (including profiling) and that you are able to request human intervention in such procedures.
To exercise these rights, you can contact us (email: info@cocoon.nl). We strive to respond to incoming requests as quickly as possible. Usually, we respond within one month of receiving your request, but in some cases – for example, with complex requests – this period may be extended by a further two months. We will inform you of the reasons for the extension within this initial one-month period.
If we cannot honor your request, we will also inform you of this within the set period and provide the reason. In that case, you can file a complaint with the supervisory authority or seek judicial remedies.
Complaint Procedure, Legal Remedies
If you believe that your personal data has been misused, you can file an official complaint via the following contact details:
- Email: info@cocoon.nl
- Mailing address: Koraalrood 153, 2718 SB Zoetermeer, The Netherlands
We carefully investigate incoming complaints and will inform you of the outcome of our investigation and the measures taken. If no specific legal period exists for handling complaints, we evaluate at least once every three years the extent to which our complaint procedure and process meet the purpose of the data processing and applicable legislation.
You also have the right to file a complaint with the competent supervisory authority:
- Authority name: Dutch Data Protection Authority (Autoriteit Persoonsgegevens)
- Address: Bezuidenhoutseweg 30, 2594 AV Den Haag, Netherlands
- Phone: +31-70-888-8500
- Email: info@autoriteitpersoonsgegevens.nl
Date of last update: September 3, 2026