Privacy Notice

Website: cosmall.eu
Last updated: 14 July 2026

1. General Provisions and Data Controller

This Privacy Notice explains how SIA VV Invest (referred to as "Cosmall", "we", "us") processes the personal data of visitors to cosmall.eu (the "Website"), customers, suppliers and their staff, and any other information relating to you. It also describes your rights regarding this processing.

For the purposes of this Notice, personal data means any information relating to you that identifies or could identify you, including your name, address, phone number, and similar details. Please read this document carefully.

2. Data Controller

SIA VV Invest is the sole data controller for personal data processed through the Website in relation to all orders and enquiries, regardless of the date they were placed.

3. What Personal Data We Collect and Process

We collect, use, and process:

• Information you provide directly (e.g. when creating an account, completing forms on the Website, placing an order, taking part in surveys or marketing activities, or contacting us);
• Information we generate about you in the course of our relationship (e.g. in our customer and order management systems);
• Website usage data (device type, operating system, browser type and version, IP address, pages visited, time on site, errors) — collected via cookies and similar technologies, see Section 5;
• Contact details (postal address, phone number, email);
• Financial and transactional information (order amount and details, payment information, recipient details);
• Marketing and communication preferences (consent to receive newsletters, records of support enquiries and calls).

Providing the data required to place and fulfil an order is mandatory: without it, we cannot enter into or perform a contract with you.

4. Third-Party Sources of Personal Data

We may receive personal data about you from third parties, including but not limited to social media platforms, messaging apps, and email providers, where you interact with us through those channels.

5. Cookies

We use cookies and similar technologies on the Website. For details on which technologies are used and how to manage them, please see our Cookie Policy.

6. How and on What Basis We Use Your Data

We process personal data on the following legal bases under Article 6 of the General Data Protection Regulation (GDPR):

• Performance of a contract (Art. 6(1)(b)): to process and fulfil orders placed on the Website, including payment and delivery;
• Compliance with legal obligations (Art. 6(1)(c)): to comply with applicable tax, accounting, and consumer protection law;
• Legitimate interests (Art. 6(1)(f)): to operate and secure the Website, handle enquiries and complaints, perform system administration, analyse Website usage, improve our products and services, and prevent fraud;
• Consent (Art. 6(1)(a)): to send direct marketing communications and to use certain cookies. You may withdraw your consent at any time; this does not affect the lawfulness of processing carried out before withdrawal.

7. Data Retention

• Order-related data (including financial and tax records) is retained for the period required by applicable Latvian accounting and tax legislation — generally at least 5 years from the date of the transaction.
• Account data is retained for as long as the account is active and for up to 12 months after deletion or last activity, unless a longer retention period is required by law.
• Data processed on the basis of consent (e.g. for marketing communications) is retained until consent is withdrawn.
• Once the applicable retention period expires, personal data is deleted or anonymised.

8. Sharing Data with Third Parties

In performing our contractual and legal obligations, your personal data may be shared with the following categories of recipients:

• Swotzy — a multi-carrier shipping platform that aggregates postal and courier operators to deliver orders across Europe;
• Viva Payments S.A. ("Viva.com") — the payment service provider through which online payments are processed;
• Insurers, accountants, auditors, and financial advisers — for accounting and audit purposes;
• Lawyers and legal advisers;
• IT, hosting, cloud storage, and software service providers.

All data processors we engage are required to comply with the GDPR and applicable law and may only process data under our instructions and for the stated purposes.

International data transfers. Some of our service providers may be located outside the European Economic Area (EEA) or may process data on infrastructure located outside the EEA. In such cases, we ensure an adequate level of data protection through appropriate safeguards under the GDPR (such as the European Commission's Standard Contractual Clauses or adequacy decisions). A copy of the applicable safeguards can be requested by contacting us using the details in Section 2.

We do not sell or share your personal data with third parties for their own marketing purposes.

9. Your Rights

Under the GDPR, you have the right to:

• request access to your personal data and obtain a copy of it;
• request the correction of inaccurate or incomplete data;
• request the erasure of your data ("right to be forgotten") where legally applicable;
• request the restriction of processing;
• receive your data in a structured, machine-readable format and transmit it to another controller (right to data portability);
• object to processing carried out on the basis of legitimate interest, including for direct marketing purposes;
• withdraw your consent to processing at any time, without affecting the lawfulness of processing carried out before withdrawal;
• not be subject to a decision based solely on automated processing (including profiling) that produces legal effects or similarly significantly affects you; we do not currently apply such decision-making processes.

To exercise any of these rights, please contact us at support@cosmall.eu. We will respond within the period required by applicable law, generally no later than one month from receipt of your request.

10. Right to Lodge a Complaint with a Supervisory Authority

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a data protection supervisory authority — in particular, the Data State Inspectorate of Latvia (Datu valsts inspekcija):

You may also contact the data protection supervisory authority of your country of habitual residence or place of work.

11. Children's Data

The Website and our services are not intended for individuals under the age of 18, and we do not knowingly collect personal data from such individuals. If you become aware that a minor has provided us with their data, please contact us so that we can take steps to remove it.

12. Changes to this Notice

We may update this Privacy Notice from time to time to reflect changes in our practices or legal requirements. The current version, together with its last-updated date, is always available on this page.

13. Contact

SIA VV Invest
Blaumaņa iela 7, Rīga, LV-1011, Latvia
Email: support@cosmall.eu
Phone: +371 24 204 007