Privacy Policy
Effective date: 17 September 2026
Last updated: 17 September 2026
1. About this Privacy Policy
This Privacy Policy explains how COCOONFMS LIMITED (“CocoonFMS”, “we”, “us” or “our”) collects, uses, stores, shares and protects personal information.
COCOONFMS LIMITED is a company registered in England and Wales under company number 12818706.
Registered office:
C/O Breslins Lichfield Ltd
Lichfield DCH
Frog Lane
Lichfield
England
WS13 6YY
For the purposes of UK data protection law, COCOONFMS LIMITED is the Controller of personal information where we determine why and how that information is processed.
In some circumstances, particularly where our customers upload or process personal information through our software, CocoonFMS acts as a Processor on behalf of the customer. This is explained further in section 4.
This Privacy Policy should be read alongside our:
- Terms and Conditions;
- Data Processing Schedule;
- Cookie and Storage Technologies Policy; and
- any applicable product-specific agreement.
2. Data Protection Law
We process personal information in accordance with applicable UK data protection legislation, including:
- the UK General Data Protection Regulation (“UK GDPR”);
- the Data Protection Act 2018;
- the Data (Use and Access) Act 2025;
- the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), where applicable; and
- legislation which amends or replaces those laws.
Where data protection legislation in another jurisdiction also applies to particular processing, we will comply with the applicable requirements of that legislation.
3. Who this Policy Applies To
This Policy may apply to personal information relating to:
- visitors to our websites;
- people who contact us;
- prospective customers;
- customers;
- employees and representatives of our customers;
- users of CocoonFMS software;
- suppliers and business partners;
- people attending exhibitions or events;
- business contacts;
- people receiving our marketing communications;
- people who interact with us through social media;
- users of customer portals or other CocoonFMS services; and
- other individuals whose personal information we process for our own business purposes.
Our products and websites are primarily intended for businesses and business users and are not directed at children.
4. When CocoonFMS Acts as a Processor
Our software products may allow our customers to upload, store, transmit, calculate, extract or otherwise process information relating to their own customers, employees, suppliers, consignors, consignees, drivers, contacts and other individuals.
This may occur through products and services including:
- CocoonOPS;
- CocoonTMP®;
- CocoonCarbon®;
- CocoonDEM;
- CocoonFlow;
- APIs;
- integrations;
- document-processing services;
- customer portals; and
- related CocoonFMS services.
Where a customer determines the purposes and means of processing that personal information, the customer is normally the Controller and CocoonFMS acts as its Processor.
In those circumstances:
- our customer is primarily responsible for determining the lawful basis for processing;
- our customer is responsible for providing appropriate privacy information to affected individuals;
- CocoonFMS processes the information in accordance with the customer’s documented instructions and our Data Processing Schedule; and
- requests relating to that information may need to be referred to the relevant customer.
CocoonFMS may separately act as a Controller for personal information associated with administering the customer relationship, such as user-account information, billing information, security records and business contact information.
5. Personal Information We May Collect
Depending upon your relationship with us, we may collect the following categories of personal information.
5.1 Identity Information
This may include:
- name;
- job title;
- position;
- employer;
- company name; and
- business role.
5.2 Contact Information
This may include:
- business email address;
- telephone number;
- business address;
- postal address; and
- other business contact details.
5.3 Account Information
Where you use our software or customer portals, this may include:
- username;
- account identifier;
- user role;
- permissions;
- authentication information;
- login history;
- security information; and
- account preferences.
We do not have access to your password in readable form where passwords are appropriately secured through our authentication systems.
5.4 Customer and Contract Information
This may include:
- company details;
- products purchased;
- subscriptions;
- number of users;
- subscription level;
- account history;
- quotations;
- contracts;
- correspondence;
- support requests;
- renewal information; and
- service usage information.
5.5 Billing and Transaction Information
This may include:
- billing contact details;
- invoice information;
- payment status;
- transaction references;
- subscription charges;
- payment history; and
- information required for accounting and taxation.
Where payments are processed by a payment service provider, we may not receive or retain full payment-card or bank-account information.
5.6 Technical Information
When you access our websites or software we may collect:
- IP address;
- device information;
- browser type;
- operating system;
- login timestamps;
- application logs;
- security logs;
- diagnostic information;
- website activity;
- referring website;
- session information; and
- other information necessary to operate, monitor and secure our systems.
An IP address may constitute personal information where it relates or can reasonably be linked to an identifiable individual.
5.7 Website and Analytics Information
Subject to applicable cookie and privacy rules, we may collect information about:
- pages visited;
- duration of visits;
- website navigation;
- links clicked;
- source of website traffic;
- device type;
- interactions with our content;
- forms completed;
- campaign performance; and
- website performance.
Please see our Cookie and Storage Technologies Policy for further information.
5.8 Communications
We may retain information contained in communications with us, including:
- email correspondence;
- support requests;
- contact-form submissions;
- meeting information;
- sales enquiries;
- telephone notes;
- social-media communications; and
- other correspondence.
5.9 Business Marketing Information
For business-to-business marketing and sales activity, we may process information such as:
- name;
- business email address;
- job title;
- company;
- business telephone number;
- professional profile information;
- industry;
- company website;
- publicly available company information;
- marketing preferences;
- communications history; and
- whether you have asked us not to contact you.
6. Information Processed Through Our Software
Our customers may use CocoonFMS software to process information connected with freight, transport, logistics and associated commercial activities.
Depending on the product being used, Client Data may include information contained within:
- shipment records;
- consignment records;
- quotations;
- bookings;
- invoices;
- supplier invoices;
- purchase orders;
- customs information;
- shipping documentation;
- transport documentation;
- bills of lading;
- airway bills;
- customer records;
- supplier records;
- carrier records;
- contact information;
- customer portal information;
- carbon-emissions calculations;
- demurrage and detention records;
- accounting information; and
- other documents uploaded by customers.
Where personal information contained in these records is processed on behalf of a CocoonFMS customer, CocoonFMS normally acts as Processor rather than Controller.
7. CocoonFlow and AI-Assisted Processing
Some CocoonFMS products, including CocoonFlow and other software features, may use artificial intelligence, machine learning, optical character recognition or automated processing to assist with activities such as:
- extracting information from documents;
- recognising suppliers;
- identifying shipment or consignment references;
- matching information;
- classifying documents;
- creating draft records;
- preparing purchase orders;
- identifying exceptions; and
- automating workflows.
Where personal information contained in Client Data is processed through these functions, CocoonFMS normally processes it on behalf of the relevant customer.
We may use specialist technology providers to support certain AI or automated functions. Where those providers process personal information on our behalf, appropriate data-protection requirements apply to their appointment and use.
Our customers remain responsible for determining whether automated functionality is appropriate for their particular processing activity and for applying appropriate human review where required.
8. Where We Obtain Personal Information
We may obtain personal information directly from you when you:
- contact us;
- request information;
- request a demonstration;
- sign up for a trial;
- purchase a product;
- create an Account;
- use our software;
- complete a form;
- contact support;
- attend an event;
- subscribe to communications;
- interact with us through social media; or
- otherwise communicate with us.
We may also receive business contact information from:
- your employer or organisation;
- another user within your organisation;
- customers;
- referrals;
- business partners;
- professional networking platforms;
- public business websites;
- Companies House and other public registers;
- industry directories;
- event or exhibition information;
- publicly available professional information; and
- reputable business-data or data-enrichment providers.
Where we obtain personal information indirectly, we process it in accordance with applicable data protection law and provide privacy information where required.
9. How and Why We Use Personal Information
We only process personal information where we have an appropriate purpose and lawful basis.
The principal purposes for which we process personal information are set out below.
9.1 Providing Our Services
We may process information to:
- establish and manage customer Accounts;
- provide software subscriptions;
- authenticate users;
- provide access to our software;
- implement customer systems;
- configure products;
- provide technical support;
- communicate service information; and
- administer customer relationships.
Depending on the circumstances, our lawful basis may be:
- performance of a contract;
- steps taken before entering into a contract; or
- our legitimate interests in operating and administering our business.
9.2 Billing and Financial Administration
We process information to:
- raise invoices;
- collect payments;
- administer Direct Debits;
- reconcile payments;
- manage subscriptions;
- maintain financial records; and
- comply with accounting and taxation requirements.
Our lawful bases may include:
- performance of a contract;
- compliance with legal obligations; and
- our legitimate interests in managing our financial affairs.
9.3 Customer Support
We process information to:
- answer questions;
- investigate technical issues;
- resolve support requests;
- investigate errors;
- provide customer assistance; and
- maintain records of support interactions.
Our lawful bases may include:
- performance of a contract; and
- our legitimate interests in providing effective customer service and improving our products.
9.4 Security and Fraud Prevention
We may process personal information to:
- protect our systems;
- authenticate users;
- monitor access;
- investigate suspicious behaviour;
- detect attempted misuse;
- prevent fraud;
- prevent cyberattacks;
- investigate security incidents;
- maintain audit records; and
- protect customers and other users.
Our lawful bases may include:
- legitimate interests in securing our services and business;
- compliance with legal obligations; and
- where applicable, another lawful basis permitted by data protection legislation.
9.5 Improving Our Products and Services
We may use appropriate information to:
- understand how our products are used;
- identify errors;
- improve performance;
- develop functionality;
- improve usability;
- plan system capacity; and
- improve customer experience.
Where possible, we may use aggregated or anonymised information for these purposes.
Where personal information is required, we rely upon an appropriate lawful basis, which may include our legitimate interests in developing and improving our products.
10. Our Legitimate Interests
Where we rely upon legitimate interests, those interests may include:
- operating and growing our business;
- providing and improving our software;
- communicating with customers and business contacts;
- maintaining customer relationships;
- developing new products;
- protecting our systems and customers;
- preventing fraud and misuse;
- maintaining network and information security;
- managing our commercial relationships;
- recovering debts;
- protecting our legal rights;
- understanding demand for our products;
- carrying out proportionate B2B sales and marketing; and
- measuring business and marketing performance.
Before relying upon legitimate interests where required, we consider:
- the interest being pursued;
- whether processing is necessary for that purpose; and
- whether the individual’s interests, rights or freedoms override our interests.
We may maintain Legitimate Interests Assessments where appropriate.
11. Business-to-Business Marketing
CocoonFMS supplies business software and carries out business-to-business marketing.
We may use business contact information to communicate with organisations and professional contacts who we reasonably believe may have an interest in our products or services.
Where we process an individual’s business contact information for direct marketing, we require a lawful basis under UK data protection law.
Depending upon the circumstances, we may rely upon our legitimate interests in promoting our products and services to relevant businesses, provided that those interests are not overridden by the rights and interests of the individual.
Electronic marketing is also subject to PECR.
For marketing sent to corporate subscribers, such as limited companies and limited liability partnerships, PECR does not generally require prior consent for B2B marketing emails, although UK data protection law continues to apply where personal information is processed.
Different rules apply to sole traders and certain partnerships. Where PECR requires consent for electronic marketing, we will obtain the required consent unless another applicable exception, such as the soft opt-in, lawfully applies.
Every marketing email we send will identify us and provide an appropriate method of opting out.
Your right to object to direct marketing
You have an absolute right to object to the use of your personal information for direct marketing.
If you ask us to stop sending you direct marketing, we will stop.
We may retain limited information on a suppression list so that we can ensure that we respect your request and do not add you back to future marketing campaigns.
12. Marketing Sources and Business Intelligence
We may identify organisations which could reasonably have an interest in CocoonFMS products using:
- publicly available business information;
- company websites;
- professional networking platforms;
- business directories;
- industry information;
- event information;
- referrals; and
- reputable B2B data providers.
Where information identifies an individual, UK data protection law applies even when the information is publicly available.
We do not treat the fact that personal information appears online as meaning that it can be used without restriction.
We will consider the source of the information, the reasonable expectations of the individual and the likely impact of our processing.
13. Cookies, Analytics and Website Technologies
We use cookies and other Storage and Access Technologies in accordance with applicable law.
Depending upon their purpose, these may be used for:
- essential website functions;
- security;
- preferences;
- website analytics;
- statistical measurement;
- marketing measurement; and
- embedded third-party content.
Where consent is legally required, the relevant technology will not be used until the required consent has been obtained.
Further information is available in our Cookie and Storage Technologies Policy.
14. Who We Share Personal Information With
We do not sell personal information.
We may disclose personal information where reasonably necessary to organisations providing services to us or supporting the delivery of our products.
These may include:
IT and Infrastructure Providers
Providers of:
- cloud hosting;
- databases;
- data storage;
- backups;
- cybersecurity;
- monitoring;
- software development infrastructure; and
- technical services.
Customer and Business Systems
Providers of:
- customer relationship management systems;
- customer-support systems;
- helpdesk software;
- business communications;
- productivity software; and
- project-management systems.
Communications and Marketing Providers
Providers which assist with:
- business email;
- email campaigns;
- communications;
- website analytics;
- marketing measurement; and
- management of marketing preferences.
Payment and Financial Providers
Providers which assist with:
- Direct Debit;
- payment processing;
- accounting;
- banking;
- invoicing; and
- financial administration.
Product and Integration Providers
Our software may integrate with third-party systems selected by us or our customers, including:
- accounting platforms;
- customs systems;
- carrier systems;
- tracking providers;
- insurance platforms;
- artificial-intelligence providers;
- document-processing providers; and
- other logistics technology.
Where an integration is initiated or authorised by a customer, information may be transmitted to that provider in accordance with the customer’s instructions.
Professional Advisers
We may provide information where necessary to:
- accountants;
- auditors;
- solicitors;
- insurers;
- financial advisers; and
- other professional advisers.
Authorities and Legal Requirements
We may disclose information to:
- courts;
- law-enforcement authorities;
- regulators;
- government departments;
- tax authorities; or
- other competent bodies
where required or permitted by law.
Corporate Transactions
If CocoonFMS is involved in a genuine investment, financing, restructuring, merger, acquisition or sale of all or part of its business, relevant information may be disclosed under appropriate confidentiality arrangements where reasonably necessary for the transaction.
15. Subprocessors
Where CocoonFMS acts as Processor on behalf of a customer, we may appoint subprocessors to assist us in providing the Services.
Where required by applicable data protection law, we:
- carry out appropriate due diligence;
- enter into appropriate contractual arrangements;
- require relevant data-protection safeguards;
- remain responsible for our obligations as required by law; and
- provide customers with appropriate information about material subprocessors.
Further provisions are contained in our Data Processing Schedule.
16. International Transfers
Some of our technology or service providers may process personal information outside the United Kingdom.
Where a transfer of personal information from the UK is subject to international-transfer restrictions, we use an appropriate lawful transfer mechanism.
Depending upon the destination and provider, this may include:
- UK adequacy regulations;
- the UK Extension to the EU-US Data Privacy Framework, where applicable;
- the UK International Data Transfer Agreement;
- the UK Addendum to approved Standard Contractual Clauses; or
- another transfer mechanism permitted by UK data protection law.
Where required, we also consider whether additional safeguards are appropriate having regard to the nature and circumstances of the transfer.
17. Data Security
We take the security of personal information seriously.
We maintain technical and organisational measures designed to protect personal information against:
- unauthorised access;
- unlawful processing;
- accidental loss;
- alteration;
- disclosure;
- destruction; and
- damage.
Measures may include, as appropriate:
- access controls;
- user permissions;
- authentication controls;
- encryption;
- secure communications;
- network security;
- monitoring;
- backups;
- system logging;
- vulnerability management;
- security updates;
- staff confidentiality obligations; and
- incident-response procedures.
Access to personal information is restricted to people who reasonably require access for legitimate business purposes.
No online or electronic system can be guaranteed to be completely secure, and this Policy does not constitute a guarantee that a security incident can never occur.
18. Backups and Business Continuity
We maintain backup and recovery arrangements appropriate to the nature of our Services and the information processed.
Backup copies may continue to contain information for a limited period after information is deleted from a live system.
Where this occurs, backup information remains subject to appropriate security controls and is not ordinarily restored or processed except where required for legitimate recovery, security or legal purposes.
19. How Long We Keep Personal Information
We do not keep personal information for longer than reasonably necessary for the purpose for which it was collected.
The appropriate retention period depends upon factors including:
- the purpose for which the information was collected;
- whether there is an ongoing customer relationship;
- contractual requirements;
- accounting and taxation obligations;
- applicable limitation periods;
- regulatory requirements;
- security requirements;
- the need to establish, exercise or defend legal claims; and
- whether an individual has requested that we stop contacting them.
Customer contracts, invoices and financial records may be retained after the end of a customer relationship where reasonably necessary to meet tax, accounting and legal requirements.
Sales enquiries and prospect information are periodically reviewed and deleted or anonymised when they are no longer reasonably required.
Marketing suppression information may be retained for as long as reasonably necessary to ensure that we continue to respect an opt-out.
Security and system logs are retained for periods appropriate to their security and operational purpose.
Cookie and analytics retention periods are described in our Cookie and Storage Technologies Policy or Cookie Settings.
Where CocoonFMS acts as Processor, Client Personal Data is returned or deleted in accordance with the relevant contract and Data Processing Schedule.
20. Special Category Information
Our business systems and Services are not generally designed to require special category personal information such as information concerning:
- health;
- racial or ethnic origin;
- political opinions;
- religious or philosophical beliefs;
- trade-union membership;
- genetic information;
- biometric information used for identification; or
- information concerning a person’s sex life or sexual orientation.
Customers should not upload special category information to our Services unless:
- it is genuinely necessary;
- there is a lawful basis and an applicable condition permitting the processing; and
- the relevant CocoonFMS Service is appropriate for the intended processing.
Where CocoonFMS processes such information on behalf of a customer, the customer remains responsible for determining the applicable lawful basis and condition unless otherwise required by law.
21. Automated Decision-Making and Profiling
CocoonFMS software includes automation and AI-assisted functionality, but this does not necessarily amount to automated decision-making about an individual.
Unless we specifically tell you otherwise, CocoonFMS does not use personal information in our capacity as Controller to make solely automated decisions about individuals which produce legal or similarly significant effects.
Our customers may configure or use CocoonFMS software as part of their own business workflows.
Where a customer determines the purpose of such processing and CocoonFMS acts as Processor, responsibility for determining the lawful basis, transparency requirements and appropriate safeguards primarily rests with that customer.
Where CocoonFMS itself introduces automated decision-making producing legal or similarly significant effects, we will comply with the applicable requirements of UK data protection law, including appropriate safeguards and transparency.
22. Your Data Protection Rights
Depending upon the circumstances and the lawful basis being relied upon, you may have the following rights.
Right to be Informed
You have the right to receive clear information about how your personal information is used.
Right of Access
You may request confirmation that we process your personal information and request access to that information.
This is commonly known as a Subject Access Request.
Right to Rectification
You may request correction of inaccurate personal information and completion of incomplete information.
Right to Erasure
In certain circumstances you may request that your personal information is deleted.
This right is not absolute.
Right to Restrict Processing
In certain circumstances you may ask us to restrict the way in which we process your personal information.
Right to Data Portability
Where the applicable legal conditions are satisfied, you may have the right to receive personal information which you provided to us in a structured, commonly used and machine-readable format or have it transferred to another organisation.
Right to Object
You may have the right to object to processing based upon legitimate interests.
Where an objection is made, we will stop the relevant processing unless there are compelling legitimate grounds permitting us to continue or processing is required for legal claims.
Direct marketing
Your right to object to the processing of personal information for direct marketing is absolute.
If you object to direct marketing, we will stop using your personal information for that purpose.
Right to Withdraw Consent
Where processing is based upon consent, you may withdraw your consent at any time.
Withdrawal does not affect processing lawfully undertaken before consent was withdrawn.
Rights Relating to Automated Decision-Making
Where applicable, you have rights and safeguards in relation to significant decisions made solely through automated processing.
23. Exercising Your Rights
You may exercise your data protection rights by contacting us at:
COCOONFMS LIMITED
C/O Breslins Lichfield Ltd
Lichfield DCH
Frog Lane
Lichfield
England
WS13 6YY
Email: [email protected]
Telephone: +44 (0) 2038 599262
We may need to request information reasonably necessary to verify your identity before responding to a request.
You are not normally required to pay a fee to exercise your rights.
We will respond without undue delay and within the time period required by applicable data protection legislation, normally within one calendar month.
Where legislation permits additional time because a request is complex or multiple requests have been made, we will tell you.
Some rights are subject to exemptions and do not apply in every circumstance.
24. Data Protection Complaints
If you believe that we have not handled your personal information correctly, you may make a data protection complaint to us.
You can submit a complaint using the contact details in section 23.
We will:
- provide a way for you to make a complaint;
- acknowledge receipt of a data protection complaint within 30 days;
- take appropriate steps to investigate the complaint without undue delay;
- keep you appropriately informed; and
- inform you of the outcome without undue delay.
We would welcome the opportunity to address your concerns directly.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator responsible for data protection.
Information about making a complaint and current ICO contact details is available from the Information Commissioner’s Office.
Your right to complain to the ICO is not dependent upon first completing our internal complaints process, although the ICO may ask whether you have raised the matter with us.
25. Links to Other Websites
Our websites may contain links to websites, services or platforms operated by other organisations.
Once you leave a CocoonFMS website, the relevant third party is responsible for its own privacy practices.
We recommend reviewing the privacy information provided by those organisations.
We are not responsible for the privacy practices of independent third-party websites merely because we provide a link to them.
26. Social Media
If you interact with CocoonFMS through a social-media platform, information may be processed both by us and by the relevant platform.
The social-media provider acts in accordance with its own terms and privacy information.
We may process information received through social media for purposes including:
- responding to enquiries;
- communicating with business contacts;
- customer service;
- marketing; and
- managing our business relationships.
27. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect:
- changes to our products;
- changes to the way we process information;
- changes to service providers;
- changes to legislation;
- changes to regulatory guidance; or
- changes to our business.
The date at the top of this Policy shows when it was most recently updated.
Where a proposed change materially affects the way we use personal information and additional notification or consent is legally required, we will take appropriate steps before the new processing begins.
28. Contact CocoonFMS
For questions about this Privacy Policy, your personal information or your data protection rights, please contact:
COCOONFMS LIMITED
C/O Breslins Lichfield Ltd
Lichfield DCH
Frog Lane
Lichfield
England
WS13 6YY
Company number: 12818706
Telephone: +44 (0) 2038 599262
Email: [email protected]