1. Who we are — the data controller

The following entities are joint controllers within the meaning of Article 4(7) GDPR:

• Cosmotrend BV KBO BE 0891.559.167 - Ringlaan 7, 9900 Eeklo, Belgium
• Cosmofarma BV — Ringlaan 7, 9900 Eeklo, Belgium

Together, they operate under the name Cosmogroup EU. The ultimate responsibility for processing personal data lies with Cosmogroup EU's management team — not with a single individual.

For privacy-related questions or requests: info@cosmogroup.eu

2. What data do we process?

2.1 Website Visitors

• IP address (truncated — cannot be traced back to an individual)
• Browser type, screen resolution, language setting
• Page views, session duration, referring page
• Cookie Preferences

2.2 Contact Form & Requests

• Last Name, First Name
• Professional email address
• Institution or organization
• Message Content

2.3 Portal Users — Healthcare Professionals (FarmacoBiomics)

• Professional account information (name, institution, RIZIV number—optional)
• Study IDs for analyses — never use patients' names
• Uploaded documents (only with explicit permission)
• Report Downloads and Timestamps

2.4 Biological Analysis Data (My InnerSelfie, FarmacoBiomics, CosmoPulse)

2.5 CosmoPulse — Sports Performance Data

• CRAS scores, PDI values, Pulse Types — pseudonym (player code)
• Linked to a team account — not to a public identity

3. Why and on what grounds

Processing	Goal	Legal basis (GDPR)
Website visits — anonymous statistics	Website Improvement	Art. 6(1)(f) — legitimate interest
Contact Form	Responding to requests	Art. 6(1)(b) — performance of contract / pre-contractual
Portal access healthcare professionals	Service delivery	Art. 6(1)(b) — performance of contract
Biological analysis data	Multi-omics analysis and reporting	Art. 9(2)(a) — explicit consent · Art. 9(2)(h) — medical care
CosmoPulse Performance Data	Performance intelligence for the club/organization	Art. 6(1)(b) — agreement with the club
Analytical cookies	Website optimization	Art. 6(1)(a) — consent via cookie banner
Marketing cookies (LinkedIn)	B2B reach	Art. 6(1)(a) — explicit consent
Invoicing and accounting	Legal obligation	Art. 6(1)(c) — legal obligation

4. Retention Periods

Datatype	Retention period	In the long run
Anonymous website statistics	13 months	Automatically deleted
Contact Form	2 years since last contact	Removed at request or automatically
My InnerSelfie analyzed data	6 months after report creation	Automatically removed — report remains in account as long as account is active
Full Monty analyzed data	1 year after report creation	Automatically removed — report remains in account
FarmacoBiomics analyzed data	6 months after report	Automatically removed — report in portal while account is active
CosmoPulse Performance Data	1 month after entry	Automatically deleted
Portal accounts	As long as the account is active	Deleted within 30 days of cancellation
Invoice date	7 years (legally required)	Archived in accordance with Belgian accounting law
Cookie consent log	12 months	Automatically deleted

5. Third parties and international transfers

Cosmogroup EU works with the following processors. A data processing agreement (DPA) has been concluded with each processor in accordance with Article 28 GDPR:

Processor	Roll	Location
Amazon Web Services (AWS)	Cloud hosting — all platforms	EU — Ireland (eu-west-1). No transfer outside EEA.
Netlify	Hosting portal & Intel platform	CDN Global — Data Storage EU
Airtable	Data Management Portal	VS — SCCs finalized + EU data residency
WordPress (self-hosted)	Website CMS	EU (Amsterdam)
Shopify	Transactional platform — kits	VS — SCCs completed · payment dates via Shopify Payments

Cosmogroup EU sells never personal data to third parties and does not share data for third-party advertising.

6. Your Rights

Under GDPR, you have the following rights:

• Right of access (art. 15) — you can request which data we process about you
• Right to rectification (Art. 16) - you can have incorrect data corrected
• Right to erasure (art. 17) — you can request deletion ("right to be forgotten")
• Right to restriction (Art. 18) - You can have the processing restricted
• Right to transferability You can receive your data in a readable format.
• Right of objection (art. 21) - you can object to processing based on legitimate interest
• Right to withdraw consent — you can withdraw given consent at any time

Requests are answered within 30 days. During identity verification, additional information may be requested. Send your request to: info@cosmogroup.eu

7. Security

• All data encrypted in transit (TLS 1.3) and at rest (AES-256)
• Biological analysis data always anonymized — never stored in plain text
• Access control via role-based access — minimal rights per user
• AWS infrastructure in Ireland — ISO 27001, SOC 2, GDPR compliant
• Belgian DPA 72-hour data breach protocol — notification to the Data Protection Authority
• Regular security audits

8. Cookies

Cosmogroup EU uses three categories of cookies: necessary, analytical, and marketing. You can set your preferences via the cookie banner on your first visit or via the cookie icon at the bottom left of each page. See our full Cookie Policy for a detailed overview per cookie.

9. Health data — special category (Art. 9 GDPR)

• Based on explicit consent (Art. 9(2)(a)) of the data subject via the treating professional
• In the context of medical care or treatment (art. 9(2)(h)) by a healthcare professional
• With a Study ID system — Never name or BSN/INSZ in the Cosmogroup system
• Met mandatory informed consent prior to any analysis
• Comply with the Belgian DPA protocol — report a breach within 72 hours

The linking of a Study ID to a patient identity rests solely with the treating professional and falls outside the scope of Cosmogroup EU's data processing responsibility.

10. Contact & Complaints