Privacy Policy
1. Who is responsible for your data?
The controller responsible for CocoaIntel’s processing of personal data is:
„Глобал Комодити Интелиджънс“ ЕООД
Registered foreign-language spelling: Global Commodity Intelligence
Trading as: CocoaIntel
UIC/EIK: 208950526
Registered office and management address: 30 Vasil Levski Blvd., Floor 5, Apartment 6, Sredets District, 1142 Sofia, Bulgaria
Email: hello@cocoaintel.com
Telephone: +359 897 976 737
The company is registered in the Bulgarian Commercial Register and Register of Non-Profit Legal Entities.
2. Scope and sources of information
This policy covers the CocoaIntel website, free and paid memberships, newsletters, customer communications, billing, analytics, embedded content and community administration.
We receive information directly from you, automatically when your browser requests resources, and from service providers involved in operating your account, processing payments or delivering requested features.
Depending on your interaction, the information may include:
- Name, email address, billing address and country.
- Organisation name and relevant registration or tax details where needed for an invoice.
- Membership status, subscription plan, billing periods and account identifiers.
- Payment status, amounts, currency, transaction references, refunds and disputes.
- Invoice details and delivery records.
- Communications, attachments and support history.
- Authentication, security, newsletter delivery and unsubscribe records.
- IP address, browser and device information, requested resources, timestamps and diagnostic data.
- Privacy preferences and, where consented to, analytics information.
- Information visible when you voluntarily participate in the WhatsApp community.
We do not request payment-card details by email. Do not send sensitive personal information unless it is necessary for a specific request.
3. Purposes and legal bases
We process personal data for the following purposes:
- Accounts and subscriptions: creating accounts, authenticating access, providing purchased content and administering renewals and cancellations. The basis is Article 6(1)(b) GDPR where necessary to perform a contract with you.
- Business contacts: administering an organisation’s subscription and communicating with its representatives. Where the representative is not personally party to the contract, the basis is our legitimate interest under Article 6(1)(f).
- Billing and statutory records: issuing invoices and complying with applicable accounting and tax obligations, under Article 6(1)(c).
- Service communications: sending account, payment, access, cancellation and other necessary contract notices, under Article 6(1)(b) or 6(1)(c), as applicable.
- Optional newsletters and marketing: consent under Article 6(1)(a). You may unsubscribe at any time.
- Optional analytics and relevant embeds: consent under Article 6(1)(a), as described below.
- Security, troubleshooting and fraud prevention: our legitimate interests under Article 6(1)(f) in protecting the website, accounts and payments.
- Enquiries, complaints and legal claims: contractual steps, legal obligations or legitimate interests in responding and protecting rights, depending on the circumstances.
Our legitimate interests do not override your rights where the law requires otherwise.
4. Ghost: website, membership and publication delivery
We use Ghost(Pro) for publishing, member authentication, membership administration and email publication delivery.
Ghost processes member information on our behalf under its applicable data-processing agreement. It may process separate information for its own account-management, security or legal purposes.
Membership information may be linked to Stripe subscription identifiers so that access reflects the subscription’s status.
You can unsubscribe from optional newsletters using their unsubscribe links. Newsletter unsubscription does not itself cancel a paid subscription. Cancelling renewal does not necessarily delete the remaining account.
Further information:
https://ghost.org/privacy/
https://ghost.org/dpa/
5. Stripe: payments and subscription billing
Stripe processes payments and recurring subscription billing.
Payment information is entered through Stripe’s payment interface. CocoaIntel does not receive or store your full payment-card number or card security code.
We may receive limited payment-method information, transaction and customer identifiers, payment status, amounts, currency, billing information and subscription, refund or dispute records.
Stripe may process information as our service provider and also as an independent controller for purposes such as meeting its legal obligations and protecting its payment systems.
Banks, card networks and other payment participants may receive information necessary to complete or investigate a transaction.
Further information:
6. Make and inv.bg: invoice preparation and delivery
We use Make to transfer relevant billing information between Stripe and inv.bg and to administer the invoicing workflow.
Depending on the transaction, this may include your name, email address, billing address, customer and invoice identifiers, subscription description, amount, currency and relevant business or tax information.
Make may also process execution records, error information and workflow-status records. These records can contain personal data included in the transaction.
We use inv.bg to prepare, maintain and deliver invoices and related accounting documents. Invoice records may be provided to authorised accounting advisers or public authorities where necessary.
These services process relevant information on our behalf for invoicing and administration, subject to applicable contractual arrangements. They may separately process their own account, security and legal-compliance information.
Our invoicing workflow does not require full payment-card numbers or card security codes.
Provider information:
https://www.make.com/en/privacy-notice
https://inv.bg/
7. Zoho Mail and correspondence
We use Zoho Mail for business correspondence through hello@cocoaintel.com. Our mail account uses Zoho’s EU region.
Zoho processes email addresses, message content, attachments and associated delivery and security information as necessary to provide the service.
Selecting an EU region does not mean that every support activity, subprocessor or onward transfer is necessarily confined to the EU.
Further information:
https://www.zoho.com/privacy.html
8. Website delivery and security
Ghost, Cloudflare and relevant infrastructure providers process technical request information to deliver pages, operate dashboards, maintain availability and prevent abuse.
This may include IP addresses, browser information, URLs, timestamps and security logs.
The basis is our legitimate interest in operating a secure publication, together with contractual necessity or legal obligations where applicable.
9. Consent preferences
The website stores your Analytics preference in browser local storage under cocoaintel_cookie_consent_v2. If local storage is unavailable, it may use cocoaintel_cookie_consent_fallback.
The record contains the choice, consent version and timestamp. It is treated as valid for up to 180 days, after which a new choice may be requested.
This storage remembers and respects your preference. You can change it through Cookie Settings in the footer.
10. Google Analytics
Google Analytics 4 is activated only after you grant Analytics consent.
It may process cookie identifiers, page views, session and interaction information, referral and campaign information, browser and device characteristics and approximate location.
Google states that GA4 uses IP addresses during collection but does not log or store individual IP addresses.
Our current configuration does not link the property to Google Ads. Google Signals and advertising personalisation are disabled. Analytics event-data retention is set to 14 months.
You may withdraw consent through Cookie Settings. The website stops further Analytics collection initiated through its implementation and attempts to remove accessible first-party Analytics cookies.
Further information:
https://policies.google.com/privacy
https://policies.google.com/technologies/partner-sites
11. Datawrapper charts
Datawrapper interactive charts are treated as optional Analytics content and are blocked until you grant Analytics consent.
Once a chart loads, your browser connects to Datawrapper and its delivery infrastructure. Technical connection information is processed to deliver the chart. Datawrapper’s own published-chart measurement may also involve cookies or similar technologies.
After consent is withdrawn and the page reloads, these charts are blocked again.
Further information:
https://www.datawrapper.de/privacy
12. TradingView widgets
Some pages contain TradingView market-data widgets, which may load independently of the Analytics choice.
TradingView states that its widgets do not set cookies. It processes information such as the embedding-page URL, widget type, market symbol and IP address for delivery and protection of the service.
Our basis for using these functional widgets is our legitimate interest in presenting relevant market information, to the extent that consent is not separately required.
TradingView acts as an independent controller for its own processing.
Further information:
https://www.tradingview.com/privacy-policy/
https://www.tradingview.com/widget-docs/faq/general/
13. Google Calendar
The embedded Google Calendar loads only when you select Load Google Calendar after the accompanying notice.
Loading establishes a connection to Google, which may receive IP address, browser and other technical information. If you are signed into Google, processing may be associated with your account.
The calendar is optional. You can avoid further loading by leaving or reloading the page and not selecting the load button again.
Further information:
https://policies.google.com/privacy
14. Research dashboards and external resources
Weather, COT, trade-flow and other dashboards use Cloudflare infrastructure.
Relevant dashboards may load software or resources from UNPKG, jsDelivr, Plotly and OpenStreetMap infrastructure, including map tiles. These functional requests may occur independently of Analytics consent.
The operators receive technical connection information needed to deliver and protect the requested resources. Our basis is our legitimate interest in providing research tools, to the extent consent is not separately required.
Further information:
https://www.cloudflare.com/privacypolicy/
https://osmfoundation.org/wiki/Privacy_Policy
https://github.com/jsdelivr/jsdelivr/blob/master/Privacy%20Policy.md
https://plotly.com/privacy/
15. WhatsApp community
Joining the external WhatsApp group is voluntary.
Your phone number, profile information and messages may be visible to administrators and other participants, depending on WhatsApp’s features and your settings. Participants may retain or share copies of messages.
We may use information visible in the group to administer and moderate the community on the basis of our legitimate interests.
WhatsApp operates under its own privacy notice. Leaving the group does not automatically delete information previously received by others.
https://www.whatsapp.com/legal/privacy-policy-eea
16. Recipients
Information is shared only as relevant to the service or interaction. Recipients may include:
- Authorised persons operating CocoaIntel.
- Ghost, Stripe, Make, inv.bg and Zoho.
- Cloudflare and the infrastructure and embedded-content providers described above.
- Banks and payment-system participants.
- Accountants, legal advisers and security specialists where necessary.
- Courts, regulators and public authorities where legally required.
- A successor in a business transfer, subject to appropriate safeguards and notice where required.
We do not sell personal data or provide customer contact lists to third parties for their own direct-marketing campaigns.
17. International transfers
Some providers, subprocessors or support operations may process information outside the European Economic Area.
Where we are responsible for a restricted transfer, an appropriate GDPR transfer mechanism is required. Depending on the recipient, this may involve an applicable adequacy decision, Standard Contractual Clauses or another lawful mechanism, with additional safeguards where necessary.
Contact hello@cocoaintel.com for information about the safeguards applicable to a particular transfer and how to obtain a copy.
Independent controllers, including payment or external-platform providers, explain their own transfers in their notices.
18. Retention
We retain information for the period needed for its purpose and any applicable legal obligations.
- Member records: while the account remains active, followed by limited retention where required for outstanding subscriptions, requests, disputes or legal obligations.
- Billing and accounting records: for the applicable statutory retention period, taking account of the type of record and any audit or proceedings. Cancellation or account deletion does not automatically permit destruction of required accounting documents.
- Workflow records: Detailed execution logs in Make are retained for 7 days under our current Free plan. Separate workflow-status and duplicate-prevention records stored in Make Data Stores are retained for as long as necessary to administer invoicing and prevent duplicate invoices, and are reviewed for deletion when no longer needed. Invoice records in inv.bg follow the applicable accounting retention requirements.
- Correspondence: while handling the matter and afterwards where reasonably necessary for follow-up or legal claims.
- Unsubscribe records: the minimum information needed to respect the request and prevent further unwanted marketing.
- Consent preferences: up to 180 days in the browser.
- Google Analytics event data: 14 months under the current setting.
- Security logs: according to the relevant configuration and the period necessary to investigate incidents, protect the service or meet legal obligations.
Where a fixed period cannot be stated, we consider the purpose, legal requirements, limitation periods, sensitivity and necessity of the information.
Information is deleted or irreversibly anonymised when no longer needed. Limited backup copies may remain until overwritten under the applicable backup cycle.
19. Required and optional information
An email address is needed for membership and authentication. Relevant billing information is required to process purchases and issue accurate invoices.
If necessary information is not provided, we may be unable to create the account, complete a purchase or issue the requested invoice.
Analytics consent, optional marketing and participation in external community features are voluntary. Refusing Analytics does not prevent access to core public content or the core subscription, although consent-dependent charts remain blocked.
20. Your rights
Subject to applicable conditions, you may request access, correction, deletion, restriction, portability or information about processing. You may object to processing based on legitimate interests and to direct marketing.
You may withdraw consent at any time without affecting the lawfulness of earlier processing.
Contact hello@cocoaintel.com. No particular form or subject line is required. We may ask for proportionate information to verify your identity.
We normally respond within one month. If a lawful extension is necessary, we will explain it within that period.
Necessary accounting retention, unresolved claims and other legal exceptions may limit deletion.
21. Complaints
You may complain to the Bulgarian Commission for Personal Data Protection:
2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria
https://cpdp.bg/en/
You may also complain to another competent supervisory authority, particularly where you habitually reside, work or where an alleged infringement occurred.
You do not have to contact CocoaIntel before approaching an authority.
22. Automated processing
We use automation to synchronise subscription status, restrict access after payment or subscription changes and prepare invoices.
CocoaIntel does not use readership analytics to make solely automated decisions with legal or similarly significant effects.
Payment providers may operate automated fraud and security systems under their own notices. If an account or payment outcome appears incorrect, contact us so that we can investigate the part we control.
23. Security and children
We use risk-appropriate technical and organisational safeguards, including access restrictions and encrypted connections. No system can guarantee absolute security.
CocoaIntel is intended for adults and is not directed at children. Contact us if you believe a child has provided personal information.
24. Changes and contact
We update this policy when processing activities or relevant requirements change. Material changes will be communicated where required, and new consent will be obtained where necessary.
For privacy enquiries, contact hello@cocoaintel.com.
Our Cookie Policy provides further information about browser storage and consent controls: