Privacy Policy

PRIVACY POLICY

1. WHO WE ARE

“Vita Coco,” “we,” “us” or “our” means The Vita Coco Company Inc., a Delaware corporation with its principal place of business located at 250 Park Avenue South, Floor 7, New York, NY 10003, and all brands hereunder, including but not limited to Vita Coco, Ever & Ever, Runa, PWR LIFT, and any other affiliates or subsidiaries.

2. WHAT WE COVER IN THIS PRIVACY POLICY

Your privacy is important to us, so we’ve developed this Privacy Policy (the “Privacy Policy” or “Policy”), which sets out how we collect, disclose, transfer and otherwise use (collectively, “process”) the personal data or personal information that you share with us on our website, http://www.vitacoco.com (the “Site”) and when you use our sites, purchase our products, and when you otherwise interact with us (collectively, the “Service”). Please take a moment to read through this Policy in its entirety. Please note that by continuing to use our Service, you signify that you have read and agreed to terms of this Policy.

If you have any questions, concerns or complaints regarding this Policy or our processing of your personal data or you wish to submit a request to exercise your rights as set out in Section 5, you can do so by contacting us via email: info@vitacoco.com.

This Privacy Policy was last revised on 9/20/2024

3. HOW WE COLLECT, USE AND DISCLOSE YOUR PERSONAL DATA

We collect information you voluntarily provide directly to us, information collected automatically when you interact with the Services, and information collected from third parties.  The categories of personal information that we collect and the purposes for which we collect that information are described below.

(a)  Analytics and Device Information

We use cookies, tracking pixels, tags or similar tools to collect information about your browser, device, geolocation, IP address, device ID and type, referral source, language settings, browser type, operating system, geographical location, length of visit, page views, information about the timing, frequency and pattern of your service use, as well as information regarding the way in which you interact with our site through the use of session replay and heat map tools, and interactions with the Services, Site, or emails. We may also collect information regarding product flavor or fragrance preferences that are automatically collected through your use of the Services.  For more information, please view the “Cookies/Do Not Track” section below.

We collect this information for the purposes of account creation and management, marketing and advertising (which may include targeted advertising and sales), analytics and research, customer service, and website security and maintenance.  We also collect this information for internal use, such as administering the Services, analyze trends, and identify problems with our Site. This information may be aggregated to provide more useful information.

 

We share this information with analytics providers and third party advertisers.

(b)  When You Create an Account with Us

We collect certain information when you create an account with us, including first name, last name, email address, phone number, password, date of birth, physical address, country, company name, job title, and industry.

We collect this information when you provide it directly to us such as signing up for the Services, requesting information about Vita Coco products, creating an account, or filling out a form.

We collect this information for the purposes of advertising and marketing (including targeted advertising and sales), analytics and research, and customer service.  

(c)   When You Use our Interactive Chat

If you engage with the chatbot feature on our Site, we will record the conversation. Please note that the information relating to your communications may be shared with our service provider. We collect this information for the purposes of providing customer service, administering the Services, and identifying problems with our Site. 

We share this information with our chatbot service provider.

(d)  When You Make a Purchase with Us

If you purchase something from us, we collect certain payment and commercial information from you including name, address, phone number, third-party payment service provider-related information, debit or credit card information, purchase and participation history, or other payment processing information.  Depending on the nature of your purchase, this information may include employment-related information such as your employer, workplace address, job title and job function.

We collect this information for the purposes of advertising and marketing (including targeted advertising and sales), customer service, order fulfillment, marketing and advertising, and administering the Services.

(e)   When You Scan a QR Code on Our Products

If you scan the QR code provided on our products, we collect information you provide if you create an account and scan your receipt. This information includes Loyalty Program information, first name, last name, email address, and phone number. We may also collect information related to your flavor and fragrance preferences when you scan your receipt.

We collect this information when you provide it directly to us for the purposes of marketing and advertising (including targeted advertising and sales), analytics and research, administering our Loyalty Program, and customer service.

(f)   When You Respond to Surveys and Questionnaires or Participate in Promotions

When you respond to surveys and questionnaires, we collect information you provide to us when you respond to marketing materials, promotions, contests, or other surveys.  This information includes first name, last name, telephone number, email address, shipping and billing address, and country.

We collect this information for the purposes of marketing and advertising (including targeted advertising and sales), analytics and research, and customer service.

(g)  When You Interact with Us on Social Media

If you post, upload, comment, or otherwise submit content on the Services, we may collect certain information about you such as your name and email address and products you may have purchased.  Be aware that as a default, any information you post on the Services, including without limitation reviews, comments, and text, may be available to and searchable by all users of the Services. 

We collect this information when you engage with our accounts on social media, click on the social media icons on our Site, or otherwise interact with us on a blog on a social media platform. 

We collect this information for the purposes of advertising and marketing (including targeted advertising and sales), analytics and research, website security and maintenance, and customer service.

(h)  When You Opt-In to Receive Marketing Messages

When you opt in to receive marketing text messages, we collect information such as your opt-in consent to receive marketing messages from us through short codes or similar means.  We collect this information for internal use only. We do not share this information with third parties.

(i)    Other Ways We May Collect, Use, or Share the Information

We may also reserve the right to collect, use or share personal information for the following purposes:

  • To Provide the Services. We will use your personal information to provide the Services, including to improve operations and offerings, and for security purposes.
  • To Present the Site. We will use personal information to present our Site and its contents in a suitable and effective manner for you and your device.
  • For Legal Purposes. We reserve the right to cooperate with local, provincial, state, federal and international officials in any investigation requiring either personal information or reports about lawful or unlawful user activity on this site.  We also reserve the right to share your personal information to establish, exercise, or defend our legal and property rights, including providing information to others for the purposes of fraud prevention.  We may also share your personal information with any person who we reasonably believe may apply to a court or other competent authority for disclosure of that personal information where, in our reasonable opinion, such court or authority would be reasonably likely to order disclosure of that personal information.
    • If we are ordered by a legal process or government to provide data about one or more individual users, we will notify those users of our compliance with that order, to the extent permitted by law.
  • So Others Can Market to You. As detailed more fully below, we use certain cookies or pixels that may collect personal information so that it can be used in connection with the marketing efforts of third parties.  In those instances, your personal information may be used for third parties to serve unsolicited information, services, or products to you.
  • Business Partners and Affiliates. We may collect personal information from and share personal information with our business partners and affiliates,  co-branded partners, and other third parties.  We may combine that information with other information we collect about you, but we will always use the information as described in this Policy.  We may also share information with our affiliates, subsidiaries, joint ventures or other companies under common control.
  • Business Transactions or Mergers. We reserve the right to share your personal information to third parties as part of any potential business or asset sale, merger, acquisition, investment, round of funding, or similar type of transaction.  Additionally, if we are entering into a corporate transaction with a third party, we may receive personal information in connection with the diligence.  If we close a transaction, the third party may transfer personal information, which we would use as described in this Policy.
  • Bankruptcy or Insolvency. In the event of bankruptcy, insolvency, or dissolution proceedings, we may share your personal information with third parties as part of the sale or reorganization process.
  • Customer Service. We will use your personal information, which includes your information collected when you interact with our chatbot, to provide you with customer service to troubleshoot issues and respond to requests, questions, or comments.
  • Provide Information and Opportunities. We will use your personal information to advertise opportunities, promotions, products, events, or Service that we think may be of interest to you.
  • Service Providers. We use service providers to perform various functions on our behalf.  Such service providers will be under contractual obligations to safeguard your personal information and only process it in accordance with our instructions, or as otherwise permitted by applicable laws.  We may also receive personal information from service providers.

4. RETENTION OF YOUR DATA AND DELETION

Your personal information will not be kept for longer than is necessary for fulfilling the processing purposes listed in this Policy. Generally, we retain your information for as long as we have a relationship with you and, after our relationship with you has ended, if there is an ongoing business need to retain it. This includes retention to comply with our legal, regulatory, tax, accounting and/or billing and collection obligations, to resolve disputes, enforce our policies and establish, exercise and defend our rights and any claims. We generally retain information (including the following terms identified by the CCPA identifiers: personal information, inferences, network activity, geolocation data, professional or employment related information, inferences, internet and other similar network activity, and sensitive information) for approximately 3 years after our relationship with you has ended, but this term may differ, based on our data retention policies and applicable laws.

If you stop using our services or if you delete your account with us, we will store your information in an aggregated and anonymized format; we may use this information indefinitely without further notice to you.

5. UNITED STATES PRIVACY RIGHTS

Under certain privacy laws, some state residents are entitled to various privacy rights. Although they may not all apply to us, the states with privacy laws that will be in effect in 2024 include California, Colorado, Connecticut, Montana, Nevada, Oregon, Texas, Utah, and Virginia. For more information specific to California, review the “California Residents” section below.

(a)           Consumer Rights

We value our customers’ privacy, and we therefore afford these rights to all users regardless of their state of residency. The chart below explains these rights, although some exceptions may apply. 

Consumer Right

Explanation

Right to Know/Access

You have the right to confirm whether we are processing your personal data, to know the categories of personal data we are processing or have processed, specific pieces of personal data we have collected about you, and the right to access that data.  You also have the right to know the third parties to whom we have disclosed your personal data.

Right of Correction

You have the right to correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of the personal data.

Right of Deletion

You have the right to delete your personal data provided by you or obtained about you.

Right of Portability

Up to two times per calendar year, you have the right to obtain your personal data in a portable and—to the extent technically feasible—readily usable format that allows you to transmit the data to another entity without hindrance.

Right to Opt-out:

You have the right to opt-out of the processing of your personal data for the purposes of:

(1)  Targeted advertising or sharing;

(2)  The sale of personal data; and/or

(3)  Profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. 

To opt-out, please contact us using the information in the “Contact Us” section below or through the Your Privacy Choices links on our websites as described in our Cookie Policies.

(b)           Sensitive Data

We will process Sensitive Data (as the term or its equivalent is defined by applicable privacy laws) in accordance with any applicable privacy laws.  In some instances, that means we will not collect Sensitive Data without first obtaining your consent or providing you with the right to opt out.

If we process Sensitive Data as defined by California law, we will only do so for the purposes specifically authorized by California law and in a manner that is necessary and proportionate for those purposes.  As such, we do not perform any processing for which a Right to Limit request is available.  

(c)    Exercising Your Rights

If you wish to exercise one of the above rights, please visit our “Make a Data Subject Request” or email us at info@vitacoco.com.   We will respond to access, deletion, correction, and portability requests, if applicable, within 45 days of receipt of the request and without undue delay.  If we need to extend this period, we will notify you of the delay and explain the reasonably necessary justifications for our delay. 

We will provide responses to your requests free of charge unless certain exclusions apply, depending on the state in which you reside.  

To exercise your right to opt out of targeted advertising, please click on the Your Privacy Choices button on the bottom left corner of the Site, or follow the directions in the applicable Cookie Policy.  Please note that the use of certain popup blockers or privacy settings can impact the functionality and visibility of the Your Privacy Choices button.

We recognize the Global Privacy Control.  Your browser must be able to support the Global Privacy Control for us to recognize your opt-out preference signal.

(d)           Verification and Authorized Agents

To ensure the protection of your personal information, we may need to verify that the individual submitting a request is the consumer to whom the request relates prior to processing the request, or an authorized agent.  To verify a consumer’s identity, we may request up to three pieces of personal information about you when you make a request to compare against our records. 

Making a verifiable consumer request does not require you to create an account with us.  However, we may require that you access a previously existing account where necessary to submit the request.

We will only use personal information provided in your request to verify your identity and will delete any information you provide after processing the request.  We reserve the right to take additional steps as necessary to verify the identity of consumers where we have reason to believe a request is fraudulent.

You may choose a person or a business that you authorize to act on your behalf to submit your requests (“Authorized Agent”).  If you choose to use an Authorized Agent, we require that you provide the Authorized Agent with written permission to allow them to submit your request and that you verify your identity directly with us.  Failure to do so may result in us denying your request.

(e)            Appealing a Rights Request Decision

If we deny or fail to take action on your request to exercise your applicable consumer privacy rights, you may appeal our decision.  To do this, you may email us at info@vitacoco.com.  In the email appeal, please specify the right(s) you requested to exercise and the date you made such a request. 

We will inform you in writing within 45 days of any action taken or not taken in response to the appeal.  We will also provide a written explanation of the reasons for our decisions regarding your request(s).

(f)            Right to Non-Discrimination

You have the right not to receive discriminatory treatment for exercising the privacy rights conferred by law.  We will not discriminate against you because you exercised any of your privacy rights, including, but not limited to, by: denying goods or services to you; charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; providing a different level of quality of goods or services to you; or suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services. 

6. CALIFORNIA RESIDENTS

If you are a California resident, you have certain rights with respect to the collection, use, transfer, and processing of your personal information, as defined by the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq., as amended by the California Privacy Rights Act (collectively “CCPA”) and implementing regulations. 

In the preceding 12 months, we have collected personal information from the following categories identified in Section 3(a), which are described using the terms identified under the CCPA: identifiers, personal information, commercial information, internet or other similar network activity, geolocation data, professional or employment related information, inferences, and sensitive personal information. We process these categories of personal information for the purposes identified in Section 3(b). Finally, we may disclose your personal information as described under section 3(c). We will retain information in accordance with the “Retention of Your Data and Deletion” section above.

Your personal information will not be kept for longer than is necessary for fulfilling the processing purposes listed in this Policy.

We disclose personal information in the following categories: identifiers, personal information, commercial information, internet or other similar network activity, geolocation data, and inferences with service providers. We disclose content posted on our social media platforms (e.g., if a consumer “comments” on a story) with other consumers. Such posts may include information in the category of personal information and identifiers, but the content depends on the individual posts.

We may disclose all of our information, including your personal information, to our subsidiaries and affiliates in connection with providing the Service to you or otherwise in connection with business operations.

In the preceding 12 months, we have shared for cross-contextual behavioral advertising personal information in the following categories: identifiers, personal information, commercial information, and internet or similar networking activity.

In the preceding twelve (12) months, we have not sold the personal information of any consumer for monetary consideration.  However, our use of cookies and other tracking technologies may be considered a sale of personal information under the CCPA.  Categories of personal information that we have sold under the CCPA include the following: identifiers, personal information, commercial information, internet or similar network activities, geolocation data, and inferences.  Categories of third parties to whom personal information is sold under the CCPA include data analytics providers and advertising and marketing providers.

In the preceding 12 months, we have not knowingly collected or processed personal information pertaining to children under the age of 16.

7. UK AND EEA USER RIGHTS

This section of our Privacy Policy is applicable to persons located in the European Union (“EU”), an European Economic Area member state (“EEA”), United Kingdom (“UK”), or Switzerland as well as to persons whose personal information is processed in or transferred from the EU, EEA, UK, or Switzerland.  You are entitled under the EU General Data Protection Regulation and UK General Data Protection Regulation (collectively, the “GDPR”), to the information in this section of our Privacy Policy.

  • Your Rights

You are entitled by law to access, correct, amend, or delete personal information about you that we hold.  A summary listing these rights appears below.  Please note that these rights are not absolute and certain exemptions may apply to specific requests that you may submit to us.

To exercise these rights, please contact us using the information below in the “Contact Us” section.  For your protection, we may need to verify your identity before responding to your request.  In the event that we refuse a request, we will provide you a reason as to why.

(i) Asking Us to Access Your Personal Information

You have the right to obtain from us confirmation as to whether or not we are processing personal information about you, and if so, the right to be provided with the information contained in this Policy.  You also have the right to ask us for copies of your personal information.  When making a request, please provide an accurate description of the personal information to which you want access. Where requests are repetitive or manifestly unfounded or excessive, we may charge a reasonable fee based on administrative cost.

(ii)         Asking Us to Rectify Your Personal Information

You have the right to ask us to rectify information you think is inaccurate.  You also have the right to ask us to complete information you think is incomplete.

(iii)       Asking Us to Delete Your Personal Information

You have the right to ask us to erase your personal information if:

  • We no longer need it for the purposes for which we collected it;
  • We have been using it with no valid legal basis;
  • We are obligated to erase it to comply with a legal obligation to which we are subject;
  • We need your consent to use the information and you withdraw consent; or
  • You object to us processing your personal information where our legal basis for doing so is our legitimate interests and there are no overriding legitimate grounds for the processing.

However, this right is not absolute.  Even if you make a request for deletion, we may need to retain certain information for legal or administrative purposes, such as record keeping, maintenance of opt-out requirements, defending or making legal claims, or detecting fraudulent activities.  We will retain information in accordance with the “Retention of Your Data and Deletion” section above.

If you do exercise a valid right to have your personal information deleted, please keep in mind that deletion by third parties to whom the information has been provided might not be immediate and that the deleted information may persist in backup copies for a reasonable period (but will not be available to others).

(iv)       Asking Us to Restrict Our Use of Your Personal Information

You have the right to ask us to place a restriction on our use of your personal information if one of the following applies to you:

  • You contest the accuracy of the information that we hold about you, while we verify its accuracy;
  • We have used your information unlawfully, but you request us to restrict its use instead of erasing it;
  • We no longer need the information for the purpose for which we collected it, but you need it to deal with a legal claim; or
  • You have objected to us using your information, while we check whether our legitimate grounds override your right to object.

(v)         The Right to Transfer Your Personal Information to Another Service Provider

You have the right to ask that we transfer the personal information you gave us from one organization to another, or give it to you (i.e., data portability).  This applies to personal information we are processing to service a contract with you and to personal information we are processing based on your consent.

(vi)       The Right to Withdraw Consent 

If we obtain your written consent to collect and process your personal information, you can subsequently withdraw such consent as to any further processing of such information.

(vii)      The Right to Lodge a Complaint with a Supervisory Authority 

If you believe your rights under the GDPR have been violated, the GDPR gives you the right to file a complaint with your supervisory authority. A list of supervisory authorities is available here:  EEA and EU Data Protection Authorities (DPAs); Swiss Federal Data Protection and Information Commissioner (FDPIC); UK Information Commissioner’s Office (ICO).

(viii)    Rights Related to Automated Decision-Making 

To the extent that we engage in decision-making based solely on automated processing, including profiling, which produces legal effects concerning you or which significantly affects you, you have the right not to be subject to such decision-making.

(ix)       Right to Object to Processing

You have the right to object to the processing of your personal information that is based on legitimate interests or your consent (rather than when the reason for using it is to perform an obligation due to you under a contract with us).  If you make such an objection, we will cease to process the personal information unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or we can demonstrate the processing is for the establishment, exercise, or defense of legal claims.  You can object to the processing of your personal information by contacting us using the information in the “Contact Us” section below. 

  • Legal Basis for Processing Your Personal Information

We collect your personal information to provide our products and services to you; otherwise, we may not be able to process the transactions you request.  We will only process your personal information when we have a lawful basis for doing so.  If you are in a country in the EU, EEA, UK, or Switzerland, you are entitled to an explanation of the legal basis we rely on to process your personal information.  The legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it, which is discussed below.

  • We may process your personal information based on your consent such as when you purchase a service or ask us to send you certain kinds of marketing communications.  You have the right to withdraw your consent at any time without affecting the lawfulness of the processing based on consent before its withdrawal. 
    • Children’s Consent. We do not knowingly process data of EU, EEA, UK, or Switzerland residents under the age of 16 without reasonably verified parental consent.
  • Our Legitimate Interests. We may process your personal information if doing so is necessary for our legitimate interests relating to our business purposes arising from your relationship with us, and your rights as an individual do not override those legitimate interests.  For example, our legitimate interests include but are not limited to when we process your personal information to carry out fraud prevention activities and activities to increase network and information security, identify usage trends, determine the effectiveness of promotional campaigns, expand our business activities and improve our services and the content and functionality of our Services.  Our legitimate interests also include providing you with the products and services you request, view, engage with, or purchase and communicating with you regarding your account or transactions with us.
  • To Perform a Contract. We may process your personal information to administer and fulfill contractual obligations to you.  We will also collect and process your personal information as necessary for the performance of a contract to which you are a party.
  • To Enable Us to Comply With a Legal Obligation. We may process your personal information to comply with legal obligations to which we are subject.  This may include any requirement to produce audited accounts, any legal obligation to share information with law enforcement agencies, public or governmental authorities, and to comply with legal process.
  • Necessary for the Exercise or Defense of Legal Claims. If you bring a claim against us or we bring a claim against you, we may process your personal information in relation to that claim.

Depending on the situation, we may be the controller or the processor for personal information collected from residents of the EU, EEA, UK or Switzerland.  If you have any questions about or need further information concerning the legal basis on which we collect and use your personal information for any specific processing activity, please contact us using the “Contact Us” section below.

  • Cross-Border Transfers of Personal Information

Our Services are operated in the United States.  Personal information about you provide while in the EU, an EEA member state, the UK, or Switzerland may be transferred to the United States.  The United States does not have an adequacy decision or adequacy regulation.  The GDPR permits such transfers when necessary for the performance of a contract between you and us, if we obtain your explicit consent to such transfer, or if it is in our legitimate interest to transfer the personal information.  The laws in the United States may not be as protective as the GDPR or the laws of other jurisdictions where you may be located.  If we transfer personal information from the EU, EEA, UK, or Switzerland, or another country with cross-border transfer obligations, we will provide an appropriate safeguard, such as using standard contractual clauses.

8. COOKIES / DO NOT TRACK

We use cookies and other tracking technologies (collectively referred to as “cookies”) on our website. Cookies are small text files that uniquely identify your browser or device. The cookie file is stored on your browser on your computer or mobile device. When you return to that website (or visit websites that use the same cookies) these websites recognize the cookies and your browsing device. Cookies have many different functions, like letting you navigate between pages efficiently, remembering your preferences, and generally improving the user experience or providing us information about how users navigate through our website.  To learn more about cookies and their purposes, review the relevant cookie policy below:

• Vita Coco US
• Vita Coco UK
• PWR LIFT
• Ever & Ever
• Runa

9. AMENDMENTS TO THE PRIVACY POLICY

We may revise this Privacy Policy, from time to time, in which case we will update the last revised date from Section 2 above. You will always be able to consult the most recent version of the Privacy Policy on the website. If we make a significant or material change to this Policy we will notify you via email. Please check back regularly to keep informed of any updates or changes. Your continued use of the Service constitutes acceptance of the most current version of this Policy.

10. CONTACT US

If you have any questions about this Policy, please contact us by email at info@vitacoco.com or at 250 Park Avenue South, Floor 7, New York, NY 10003.