COS

Sekretesspolicy

Who is responsible for processing of your personal data?
The Swedish company, H & M Hennes & Mauritz GBC AB is primarily responsible for the processing of personal data within the scope of this Privacy Notice. Under certain circumstances the responsibility for data protection and your privacy is shared with one or several other legal entities, either being an H&M Group affiliate or a third party.

Identity of H&M Group controller(s):
H & M Hennes & Mauritz GBC AB
Mäster Samuelsgatan 46
106 38 Stockholm
Sweden

Companies register: Bolagsverket/Swedish Companies Registration Office
Authorised representative: Helena Helmersson
VAT registration number: VAT NO. SE556070171501

The named H&M Group controller(s) above are throughout this Privacy Notice individually or collectively referred to as “COS”, “we” or “us”.

Where do we store your data?
The personal data that we collect from you is generally stored within a country of the European Union or the European Economic Area (“EU/EEA”) but may also, whenever necessary, be transferred to and processed in a country outside of the EU/EEA. Any such transfer of your personal data will be carried out in compliance with applicable laws and without undermining your statutory rights.

From time to time we may transfer personal data from the EU/EEA to a third country not being approved by European commission as a safe country for such transfer (adequacy decision). Whenever applicable H&M Group will use Standard Contractual Clauses to ensure an equivalent level of protection as granted within the EU/EEA or other lawful grounds for transfer.

Who has access to your data?
Your personal data is available and accessible only by those who need the data to accomplish the intended processing purpose. To the extent necessary, your personal data may be shared between the companies and brands within the H&M Group, with suppliers, sub-contractors and independent third-parties (acting as processors and sub-processors) carrying out certain tasks on COS’ behalf.

Data Protection Officer:
We have appointed a Data Protection Officer to ensure that we continuously process your personal data in an open, accurate and legal manner. You can contact our Data Protection Officer by emailing customer service at customerservice@cosstores.com and write DPO as subject matter.

Right to complain with a supervisory authority:
If you have complaints about the way H&M Group processes and protects your personal data and privacy you have the right, at any time, to make a complaint to the Swedish Data Protection Authority the competent supervisory authority in your country of residence: the Information Commissioner's Office.

Updates to our Privacy Notice:
We may need to update our Privacy Notice. The latest version of the Privacy Notice is always available on our website. We will communicate any material changes to the Privacy Notice, for example the purpose of why we use your personal data, the identity of the Controller or your rights.

PURCHASE ONLINE
Why do we use your personal data?
We will use your personal data to be able to process your purchase order and payment transactions and to manage your deliveries, claims, returns and refunds in a secure and effective manner.

How do we use your personal data?
The personal data obtained from you when placing a purchase order will be used by us to process and deliver the order.

Who has access to your personal data?
We may share your data within the H&M Group. Your personal data is also forwarded to third parties in order to provide you with the services mentioned above.

Please be aware that many of these recipient companies have an independent right or obligation to process your personal data.

What is the legal ground to process your personal data?
When making products and services available to you, COS will process your personal data necessary for concluding a contract with you and to fulfil any obligations derived from that contract, whether the contract refers to a purchase order and payment, or the use of other services provided by us or third parties.

How long do we keep your data?
We will process your personal data no more than necessary for us to perform our contractual obligations.
For Tax & Accounting purpose we will save your data according to applicable legislation.