Cookie Policy

This Cookie Policy ("Policy") explains how COCO JOJO LLC, operating the COCOJOJO brand (including, but not limited to, websites, applications, customer portals, and other digital properties bearing the COCOJOJO brand), together with its affiliates, subsidiaries, service providers, and authorized partners (collectively, "COCOJOJO," "Company," "we," "us," or "our") use cookies, pixels, tags, scripts, software development kits (SDKs), device identifiers, local storage, session replay technologies, fingerprinting technologies, and other similar technologies (collectively, "Tracking Technologies") on our websites, mobile websites, applications, customer portals, advertisements, and other digital properties we control or operate (collectively, the "Services").

This Policy is designed to comply with applicable privacy laws, including without limitation the California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act ("CPRA"), and the regulations promulgated by the California Privacy Protection Agency ("CPPA"), as well as the General Data Protection Regulation ("GDPR"), the ePrivacy Directive, and other applicable U.S. state and international privacy laws.

Please read this Policy together with our Privacy Policy and Terms of Service. Capitalized terms not defined here have the meanings given in our Privacy Policy.

1. What Are Cookies and Tracking Technologies?

Cookies are small text or data files placed on your browser, computer, mobile device, or other internet-connected device when you visit a website or use a digital service. "Tracking Technologies" is a broader term that includes cookies and similar tools, including without limitation:

• Cookies (first-party and third-party; session and persistent)
• Pixels, web beacons, and clear GIFs
• Advertising tags and conversion trackers
• Session replay, heatmap, and scroll-tracking technologies
• Browser storage (HTML5 local storage, IndexedDB, sessionStorage)
• Device identifiers (including IDFA, AAID, and similar)
• Software Development Kits (SDKs) and Application Programming Interfaces (APIs)
• Scripts and embedded third-party content
• Device, browser, and canvas fingerprinting technologies
• Log files, diagnostic, and debugging tools
• Analytics, audience measurement, and attribution technologies
• AI-assisted personalization and optimization technologies
• Fraud-prevention and security-monitoring technologies
• Cross-device and cross-context tracking technologies
• Other similar or successor technologies, whether now existing or later developed

2. Categories of Cookies We Use

We classify the Tracking Technologies we use into the following categories. The table below summarizes their purpose and typical retention period.

The retention periods above represent the minimum periods for which Tracking Technologies and the data they collect may be retained. Actual retention may be longer where necessary or permitted for legitimate business, security, fraud-prevention, legal, tax, accounting, or compliance purposes. We periodically review retention periods to ensure they remain appropriate for the purposes for which the data was collected.

3. Categories of Personal Information Collected, Sold, or Shared

In the preceding 12 months, we have collected, and may continue to collect, the following categories of personal information through Tracking Technologies, as defined under Cal. Civ. Code Section 1798.140. The table below identifies which categories we "sell" or "share" within the meaning of the CCPA/CPRA.

Note on "Sale" vs. "Share": COCOJOJO does not "sell" personal information for monetary consideration. The "Yes" entries in the "Shared?" column above reflect "sharing" within the meaning of Cal. Civ. Code Section 1798.140(ah) (i.e., disclosure for cross-context behavioral advertising). California residents may opt out of all such sharing using the methods described in Section 7. Once information is received by a third party, that third party may independently process, use, share, or sell the information in accordance with its own policies, over which COCOJOJO has no control (see Section 5).

We do not knowingly sell or share the personal information of consumers under 16 years of age without affirmative authorization (opt-in consent) as required by Cal. Civ. Code Section 1798.120(c).

We do not use or disclose sensitive personal information for purposes other than those specified in 11 CCR Section 7027(m).

4. Purposes for Which We Use Tracking Technologies

We and our service providers use Tracking Technologies for the following purposes:

• Operating, maintaining, and securing the Services
• Authenticating users and protecting against fraud, abuse, and unauthorized access
• Enabling shopping cart, checkout, and account functionality
• Remembering preferences, language, and settings
• Measuring traffic, performance, and how visitors use the Services
• Delivering, measuring, and optimizing advertising on and off the Services
• Engaging in cross-context behavioral advertising and retargeting
• Building and refining audience segments and lookalike audiences
• Measuring engagement with marketing emails and SMS
• Diagnosing technical issues and improving the Services
• Complying with legal obligations, enforcing our terms, and protecting our rights

In addition to the purposes listed above, COCOJOJO may also use Tracking Technologies for any lawful operational, commercial, security, compliance, research, debugging, fraud-prevention, product-development, marketing-attribution, analytics, or business purpose, whether expressly enumerated herein or not.

Tracking Technologies may evolve over time and may include future-developed technologies not specifically described in this Policy. This Policy applies to all current, future, modified, replacement, or successor technologies that perform functions substantially similar to those described above, whether or not specifically identified herein.

5. Third-Party Tracking Technologies

We use the following categories of third-party services on our Services. These third parties may set their own Tracking Technologies and process information independently as separate businesses under the CCPA. Their use of information is governed by their own privacy policies.

• Analytics: analytics services, Cloudflare Web Analytics
• Advertising: third-party technology providers Ads, third-party advertising providers (social media platforms/social media platforms), social media platforms, LinkedIn, YouTube
• Email & CRM: email and SMS service providers
• Infrastructure & Security: Cloudflare, hosting and CDN providers
• Payment Processing: Card networks and processors (no card numbers stored by COCOJOJO)
• E-commerce & Shipping: AfterShip, ShipStation, Shippo
• Customer Support & UX: Customer support, session replay, and heatmap providers

6. Session Replay and Heatmap Technologies

We use session replay and heatmap tools to understand how visitors interact with the Services, troubleshoot issues, and improve usability. These tools may record clicks, mouse movements, scrolling, page navigation, and form interactions, but are configured to:

• Mask passwords, payment card numbers, and other sensitive form fields by default
• Suppress keystroke-level capture in free-text fields
• Limit retention to the periods stated in Section 2
• Restrict access to authorized personnel for permitted business purposes only

By using the Services, you acknowledge that these technologies may be used as described above. You may opt out of session replay by emailing [email protected] or by using the methods described in Section 8.

7. Your California Privacy Rights

If you are a California resident, the CCPA, as amended by the CPRA, gives you the following rights with respect to your personal information:

• Right to Know: Request the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: Request deletion of personal information we have collected about you, subject to certain exceptions.
• Right to Correct: Request that we correct inaccurate personal information we maintain about you.
• Right to Opt Out of Sale or Sharing: Direct us not to sell or share your personal information, including for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information: Although we do not currently use sensitive personal information beyond the purposes permitted by 11 CCR Section 7027(m), you may still submit a request.
• Right to Non-Discrimination: We will not deny goods or services, charge different prices, or provide a different level of quality because you exercised a privacy right.
• Right to Appeal: If we deny your request, you may appeal by replying to our response or contacting [email protected] with the subject line "Privacy Rights Appeal."

How to Submit a Request

You may submit a verifiable consumer request through any of the following methods. We provide at least two designated methods as required by Cal. Civ. Code Section 1798.130(a)(1):

• Webform: www.COCOJOJO.com/privacy-request
• "Do Not Sell or Share" link: www.COCOJOJO.com/do-not-sell-or-share
• "Limit Use of Sensitive PI" link: www.COCOJOJO.com/limit-sensitive-info
• Email: [email protected]

We will confirm receipt of your request within 10 business days and respond substantively within 45 calendar days, with one 45-day extension where reasonably necessary, as permitted by Cal. Civ. Code Section 1798.130(a)(2). We will take reasonable steps to verify your identity before fulfilling requests. You may also designate an authorized agent to submit requests on your behalf in accordance with 11 CCR Section 7063.

Global Privacy Control (GPC)

COCOJOJO recognizes and honors the Global Privacy Control ("GPC") browser signal as a valid request to opt out of the sale and sharing of personal information for California residents, in accordance with Cal. Civ. Code Section 1798.135(b) and 11 CCR Section 7025. When we detect a GPC signal from your browser, we will treat it as an opt-out for that browser and device.

8. Managing Cookies and Opting Out

You can manage Tracking Technologies in several ways:

• Email Request: Email [email protected] to request that non-essential cookies and Tracking Technologies be rejected or limited. Please include the device and browser you use to access the Services so we can apply your preferences appropriately.
• Browser Controls: Most browsers let you block or delete cookies through their settings. Disabling cookies may affect site functionality.
• Mobile Device Controls: Use "Limit Ad Tracking" (iOS) or "Opt out of Ads Personalization" (Android) to limit mobile advertising IDs.
• Industry Opt-Outs: Digital Advertising Alliance (optout.aboutads.info), Network Advertising Initiative (optout.networkadvertising.org), and European Interactive Digital Advertising Alliance (youronlinechoices.eu).
• Platform Settings: third-party technology providers Ad Settings (adssettings.third-party technology providers.com), third-party advertising providers Ad Preferences, social media platforms Privacy Settings, LinkedIn Ad Settings.
• analytics services Opt-Out: tools.third-party technology providers.com/dlpage/gaoptout

9. Do Not Track Signals

Because there is no consistent industry standard for "Do Not Track" ("DNT") browser signals, the Services do not respond to DNT signals at this time. However, as described in Section 7, we do honor Global Privacy Control (GPC) signals for California residents.

10. Children's Privacy

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13 in violation of the Children's Online Privacy Protection Act ("COPPA"). For consumers between 13 and 16, we will not sell or share personal information without affirmative opt-in consent.

11. International Users and Data Transfers

COCOJOJO operates in the United States. If you access the Services from outside the United States, you understand that information collected through Tracking Technologies may be transferred to, stored in, and processed in the United States or other jurisdictions whose data protection laws may differ from those of your country.

Where required by GDPR or other applicable laws, we rely on appropriate safeguards (including Standard Contractual Clauses) for cross-border data transfers.

Prior Consent for EEA, UK, and Swiss Users

For users located in jurisdictions requiring prior consent for the use of non-essential cookies and tracking technologies - including, without limitation, the European Economic Area (EEA), the United Kingdom, and Switzerland - users who wish to reject non-essential cookies and Tracking Technologies (including analytics, advertising, retargeting, session replay, and similar technologies) may do so by sending a request to [email protected]. Upon receipt and verification of such a request, COCOJOJO will take commercially reasonable steps to honor the user's preference.

Strictly necessary cookies required for the operation of the Services do not require consent and may be set on a service-essential basis. COCOJOJO is a United States-based business with its primary operations in California; users accessing the Services from outside the United States do so on their own initiative and are responsible for compliance with the laws of their own jurisdictions.

12. Data Retention

We retain information collected through Tracking Technologies for at least the periods specified in Section 2 (Categories of Cookies We Use), and may retain such information for longer periods where necessary or permitted for legitimate business, security, fraud-prevention, legal, tax, accounting, or compliance purposes (including, without limitation, legal holds and records-retention obligations). When data is no longer needed for any such purpose, we delete, anonymize, or aggregate it in accordance with our records-retention practices.

13. Security

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

14. Changes to This Cookie Policy

We may update this Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will update the "Last Updated" date at the top of this Policy and, where required by law, provide additional notice (such as a banner on the Services or a direct communication). We encourage you to review this Policy periodically.

15. No Guarantee Regarding Third-Party Technologies

COCOJOJO does not guarantee, represent, or warrant that third-party Tracking Technologies, consent management platforms, cookie banners, opt-out mechanisms, browser controls, privacy preference signals (including Global Privacy Control), industry opt-out tools, or any other privacy-related technologies will operate error-free, uninterrupted, continuously, completely secure, or effective in all browsers, devices, operating systems, network environments, or jurisdictions.

Users acknowledge and agree that internet, browser, operating system, device, network, and third-party platform limitations - as well as user-side configurations, extensions, ad blockers, VPNs, and similar tools - may impact the availability, accuracy, transmission, recognition, or effectiveness of cookies, consent choices, opt-out preferences, and other privacy controls. COCOJOJO disclaims all liability arising from such limitations to the fullest extent permitted by applicable law.

Nothing in this Section limits any non-waivable rights you may have under applicable law, including the CCPA/CPRA, GDPR, UK GDPR, or other consumer protection or privacy statutes.

16. Dispute Resolution and Incorporation of Terms

Any disputes, claims, or controversies arising out of or relating to this Cookie Policy, the Services, or the use of Tracking Technologies shall be governed by, and resolved in accordance with, the dispute-resolution provisions, mandatory arbitration clauses, class-action and collective-action waivers, jury-trial waivers, limitations of liability, indemnification provisions, governing-law provisions, and forum-selection clauses contained in our Terms of Service, which are incorporated herein by reference in their entirety and made a part of this Cookie Policy.

To the fullest extent permitted by applicable law, by accessing or using the Services, you agree to be bound by such provisions. If any term of this Cookie Policy conflicts with the Terms of Service, the Terms of Service shall control with respect to dispute resolution, arbitration, waivers, and limitations of liability, except where applicable law (including the CCPA/CPRA, GDPR, or UK GDPR) provides otherwise or grants you non-waivable rights.

17. Contact Information

If you have questions about this Cookie Policy or our privacy practices, please contact our Privacy Officer:

2026 COCO JOJO LLC. All rights reserved.