Privacy & cookies

Who we are

Cocana OÜ is responsible for the personal data described in this notice. Registry code: 17435541. Registered address: Suur-Liiva tn 15-30, 90503 Haapsalu, Estonia. Contact: info@cocana.eu or +372 51993538.

This notice covers the current COCANA presentation website and related enquiries. Purchasing, public customer registration and programme enrolment are not open. We will update this notice before introducing services that process additional personal data.

When you visit

Our infrastructure receives technical connection and request information to deliver pages and protect the website. Web logs can include your IP address, request time, requested URL, response status, referring page and browser information.

We use this information for website operation, fault diagnosis and security. Our legal basis is our legitimate interest in providing a reliable website and preventing misuse. You may object to this processing as explained below.

For authorised administration, sign-in, session and security-audit information can also include the attempted account email, IP address and browser information.

When you contact us

We use your name, contact details, message and information you choose to provide to respond and manage the requested follow-up. Ordinary enquiry handling is based on our legitimate interest in communicating with you. Where you personally ask us to take steps towards a contract with you, we process information necessary for those steps on that basis.

Providing information is voluntary, but we need enough detail to respond. An enquiry does not subscribe you to marketing. Please do not send sensitive health information that is unnecessary for your enquiry.

Cookies & browser preferences

Optional analytics is off. The current public website does not load analytics or advertising trackers. Fonts and website images are served with the site; Facebook and Instagram are ordinary links, not embedded tracking widgets.

ENTER is an entrance experience, not consent. It is remembered only for the current page document and does not create a persistent visitor identifier.

Saved privacy choice: cocana-privacy-v1

If already present, this local-storage record is read to respect a previous choice. Its validity is limited to 180 days from that choice; simply browsing does not renew it. No new choice is saved merely by visiting or opening Privacy choices. You can remove it using the control below.

Previous analytics identifiers

While analytics is off, the site removes rybbit-visitor-id and rybbit-user-id from local storage, and rybbit-replay-sampled from session storage, where your browser permits access. Clearing browser identifiers does not erase historical server records.

Necessary administration

Authorised administration can use sign-in and security cookies for the authenticated session. These are separate from optional analytics and are not used for advertising.

You can also manage cookies and site storage in your browser. If browser settings prevent storage access, analytics stays off. Any future optional analytics will require an updated notice and your explicit permission before it starts.

Service providers & locations

Zone Media OÜ provides our current website hosting, business mailbox and DNS services. Zone states that its hosting data centres are in the European Union, in Estonia and the Netherlands. Access to our application and recovery copies is restricted to authorised administration.

Some correspondence is also handled using Google Gmail and OpenAI’s AI-assisted tools to review information, summarise, translate and prepare replies. People oversee the handling of enquiries and outgoing replies. These tools are not website visitor trackers.

Administrative and communication services can involve processing outside the European Economic Area, including in the United States. The providers describe their roles and applicable transfer arrangements, including adequacy decisions and standard contractual clauses, in their published information: Zone, Google Privacy Policy, Google transfer frameworks and OpenAI EU Privacy Policy. Contact us for information about the safeguards relevant to your data.

We may disclose information when required by law or where necessary to establish, exercise or defend legal claims. Following an external link takes you to a service with its own privacy practices.

How long information is kept

Website logs. Zone rotates web logs daily and makes operational history available through support for up to three months. Our account also contains older legacy log archives retained during the hosting transition. We review these transition archives when migration verification is complete and remove our copies no longer needed for a documented recovery or security matter. Application diagnostic logs rotate daily or by size, with up to 30 archives per log; this is an archive limit, not a promise that every record is deleted after 30 days. Administration audit records do not currently expire automatically; we review their continued need when an access, security or accountability matter closes. Records needed for a documented incident or legal claim may be kept for that matter.

Enquiries. We keep correspondence for the time needed to answer an enquiry and manage its requested follow-up. We review it when the matter closes. Information necessary for a legal obligation or claim is retained for that purpose until the applicable obligation or claim period ends.

Recovery copies. Our encrypted daily backup process retains 14 completed daily backup dates. Separate protected migration snapshots and restricted local recovery copies held by our authorised administrator are not automatically deleted by that daily limit. They are kept for migration verification, recovery or a documented incident and reviewed when that need ends. Provider system backups follow the provider’s separate backup cycle. We do not use recovery copies for routine marketing or visitor profiling.

Previous hosting & analytics

The former application server, managed by STMI Digital OÜ on Hetzner infrastructure in Finland, temporarily forwards visitors whose DNS information still points there. Such requests can enter that server’s operational logs. Its last confirmed routine web-log retention was seven days. Previous hosting data and recovery copies have not all been deleted.

Before analytics was disabled on 15 October 2026, this website used Rybbit through STMI Digital OÜ on infrastructure in Finland. Earlier records can include visited pages, page titles, referrers, URL parameters, outgoing-link clicks, language, screen size and a pseudonymous browser identifier. Session recording, form tracking and clipboard tracking were disabled.

Historical visit records may still be held in that system. At our last verified check, visit records had no automatic deletion period; bot records had a reported three-month period. New analytics collection is disabled, and deletion of historical records has not yet been confirmed. Contact info@cocana.eu about these records or to exercise your rights.

Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction of processing or a portable copy of your data. You may object to processing based on legitimate interests and withdraw consent where consent is the legal basis. Withdrawal does not affect the lawfulness of earlier consent-based processing. We do not use the current website to make solely automated decisions with legal or similarly significant effects on you.

Contact info@cocana.eu. We may need to confirm your identity. We normally respond within one month; if a lawful extension is necessary, we will explain it within that month.

You may complain to the Estonian Data Protection Inspectorate or to the supervisory authority where you live, work or believe an infringement occurred.

Updates

We will update this notice when our processing changes. The date above identifies this version. Company & contact