Privacy Notice

Last updated : 21-08-2026

​

1. Introduction  

With this privacy notice, TogetherCocoa, Rue du Rhône 65, c/o MLL Legal AG, succursale de Genève, 1204 Genève (hereinafter referred to as we) informs you how we collect, use, disclose and otherwise process personal data when you use our website. This is not necessarily an exhaustive description; other privacy notices, individual notices or information may apply to specific matters. Personal data is understood to be all information that relates to a specific or identifiable natural person. 

 

2. Data we collect and process 

Depending on how you use our services, the categories of personal data that we collect and process about you may include, in particular, the following data:  

• Personal and contact details, such as name address, phone number (if provided), postal address, user name, profile picture, language preferences.  

• Account information: registration data, login credentials, account settings and preferences  

• Communication data such as correspondence with us (e.g., emails, contact form submissions, support tickets), communication history 

• Technical and device data such as IP address, device identifiers (e.g., device ID, operating system), browser type and version, screen resolution, language settings 

• Usage data such as pages and content accessed, date and time of access, duration of visit, referrer URL, click behavior, search terms used, functions used within the app 

• Data related to marketing activities such as preferences and interests, newsletter opt-ins and opt-outs, responses to marketing activities, invitations and participation in events and activities 

• Location data such as approximate location derived from IP address; precise geolocation if enabled in the app

• Cookies and similar technologies, such as data collected through cookies, pixels, and comparable technologies (see section 5 below) 

We may collect personal data in particular from the following sources: 

• Directly from you, for example when you visit our website, create an account, contact us, subscribe to a newsletter, or otherwise interact with our services; 

•  Automatically, for example through cookies, analytics tools, and similar technologies when you use our website (see section 5 below); 

•  From third parties, for example social media platforms if you use social login. 

 

3. Why we process your data  

We may process your personal data in accordance with applicable data protection law for the following purposes:  

• Provide and operate our website  

• Provide our services 

• Create and manage your account 

• Improve, develop and optimize our website  

• Respond to customer inquiries and support requests 

• Send important service notifications 

• Send newsletters and marketing communications 

• Comply with legal obligations, such as statutory retention and documentation obligations and regulatory requirements 

• Respond to requests from competent authorities 

• Prevent fraud and abuse and maintain security 

• Assert, exercise or defend legal claims 

 

4. Legal basis  

Where required under applicable data protection law, we process personal data on the basis of the following legal bases:  

• It is necessary to provide our services. for the performance of contracts, and you may also be affected as an employee or other representative of a contractual partner of us 

• You have given consent: If you have given us consent to process your personal data for certain purposes (for example, when you register to receive newsletters), we process your personal data within the scope of and based on this consent, unless we have another legal basis and we require such a basis. Consent given can be revoked at any time, but this has no effect on data processing that has already taken place 

•  We have legitimate business interests, such as providing our services, website and application, improving and securing our website and application, analyzing usage behavior, preventing fraud, communicating with third parties and the processing of their requests, and asserting or defending legal claims 

• We are legally required to process the information, including to comply with our legal or regulatory obligations 

 

5. Cookies  

We use cookies on our website. Cookies are small text files that are stored on your device and allow us to recognize your browser or device or to 

receive information on your response to website offerings and other marketing activities. This allows us to better understand user behavior and preferences, e.g. to provide our services in a technically error-free, secure, user-friendly and demand-oriented manner. 

 

Through the use of cookies, your browser receives an identifier and transmits it upon request. We use so-called session cookies. These save your entries while you navigate on the website within the same session. Session cookies are automatically deleted after your visit to our website. We also use permanent cookies that remain stored on your device for several sessions over a defined term and allow us to recognize your browser the next time you visit the website (and, for example, to perform an automatic log-in or to display the website in your preferred language and according to your preferences). We use permanent cookies to remember your preferences, to help us understand how you use our services and content. Permanent cookies are deleted when their expiration date is reached or if you delete them beforehand. Most browsers are set to accept cookies by default. 

 

Cookies generally do not provide personal data, but only anonymous traffic data related to your device (e.g., your IP address) and statistical data (e.g., number and type of website visits). However, to the extent that the identifiers collected are classified as personal data by applicable law, we treat them as such. By using our website, you accept the use of the above-mentioned technologies. If you do not wish to do so, you can block or delete the cookies and similar technologies via the privacy settings of your browser and e-mail program, whereby this may under certain circumstances affect the use of our website. 

 

6. Sharing information  

We do not sell your personal data.  We may share information, in particular, with the following categories of recipients, for the purposes indicated: 

Recipient category

• Cloud/hosting providers

• Analytics providers

• Newsletter/email service providers

• Customer support tools

• Authorities, courts

 

Purpose

• Hosting and operating our website

• Understanding usage and improving services

• Sending communications

• Handling inquiries

• Compliance with legal obligations, legal proceedings

​

All service providers are required to protect your information appropriately.  

 

7. Information data transfers  

Recipients of personal data may be located in Switzerland or abroad. We may disclose personal data to recipients in the EU/EEA, the UK, the USA or any other country of the world, whereby the location of the recipient depends on the matter at hand and may in particular include countries in which our service providers process their data (such as EU/EEA member states, UK, USA). 

If we disclose personal data to a country without adequate data protection legislation, we will ensure that this is done in compliance with applicable data protection law. In particular, we may disclose personal data to such countries in the following circumstances: 

• You give your express consent 

•  It is necessary for the execution of a contract with you or of a contract in your interest 

•  It is necessary for the fulfillment of a legal obligation 

• It is necessary to safeguard overriding public interests, to establish, exercise or enforce legal claims or to protect the life or physical integrity of you or third parties 

• You have made the personal data generally accessible and do not expressly prohibit processing 

•  The personal data originate from a register provided for by law, which is public or accessible to persons with an interest worthy of protection, insofar as the legal requirements for inspection are met in the individual case 

• We ensure adequate protection, namely by means of sufficient contractual guarantees such as the standard contractual clauses of the European Commission or by relying on another legal transfer tool 

 

8. Data retention  

We process and store personal data as long as it is necessary for the processing purpose for which we collected it. Typically, this is for the term of our relationship with you and thereafter, as long as we have a legitimate interest in retaining the information (e.g., for applicable statutes of limitation, for record retention and know-how purposes). In addition, there may be a contractual or legal obligation to retain or document data (e.g. in accordance with the Swiss Code of Obligations, Value Added Tax Act, etc.). It is possible that personal data will be stored for the time during which claims can be asserted against us and insofar as we are otherwise legally obligated to do so or legitimate business interests require this (e.g. for evidence and documentation purposes). If the personal data is no longer required, it will be deleted or anonymized as far as possible. Subject to an express written agreement, we are under no obligation to you to retain personal data for a specific period of time. 

 

9. Your rights  

In accordance with and as far as provided by applicable law (as is the case where the GDPR is applicable), you have the right to access, rectification and erasure of your personal data, the right to restriction of processing or to object to our data processing in addition to the right to receive certain personal data for transfer to another controller (data portability). Please note, however, that we reserve the right to enforce statutory restrictions on our part, for example if we are obliged to retain or process certain data, have an overriding interest (insofar as we may invoke such interests), or need the data for asserting claims. If exercising certain rights incurs costs for you, we will notify you thereof in advance. We have already informed you of the possibility to withdraw consent in section 4 above. 

 

In general, exercising these rights requires that you are able to prove your identity (e.g., by a copy of identification documents when your identity is not evident otherwise or cannot be verified in another way). In order to assert these rights, please contact us at the address provided in section 12 below. 

 

You have the right to enforce your claims in court or to file a complaint with the competent data protection authority. The competent data protection authority in Switzerland is the Federal Data Protection and Information Commissioner (http://www.edoeb.admin.ch). 

 

10. Data security  

We implement appropriate technical and organizational measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction, such as the issuance of warnings, training, IT and network security solutions, access controls and restrictions, encryption of data media and transmissions, pseudonymization, controls. 

 

11. Children’s privacy  

Our services are not intended for children under the applicable legal age without parental consent.  

 

12. Controller and contact information  

The controller responsible for the data processing described in this Privacy Notice is:
TogetherCocoa, Rue du Rhône 65, c/o MLL Legal AG, succursale de Genève, 1204 Genève  

 

You can contact us at the above address with any data protection related questions or concerns, including to exercise your rights (see section 9 above).  

 

13. Changes to this policy notice 

We may update this Privacy Notice from time to time. The current version published on this page shall apply.