Privacy Policy

1. Controller

-, -. Data protection contact: support@aroma66.com.

2. Data we process

• Order data: name, email, phone, shipping and billing address.
• Account data: email, hashed password, order history.
• Communication: contact and complaint form messages and attachments.
• Technical data: anonymised IP address, device type, cookies subject to consent.

3. Purposes and legal bases

• Fulfilling your order - performance of a contract (Art. 6(1)(b) GDPR).
• Accounting and tax obligations - legal obligation (Art. 6(1)(c)).
• Customer service and store security - legitimate interest (Art. 6(1)(f)).
• Analytics, marketing and newsletter - consent (Art. 6(1)(a)), withdrawable at any time.

4. Recipients

We share data only with processors needed to run the store:

• -
• -
• -
• -
• -

5. Retention

• Orders and invoices: as required by tax law.
• User account: until you delete the account.
• Contact messages and complaints: up to 3 years.
• Cookie consent records: up to 12 months.

6. Your rights

The details of the competent supervisory authority will be published here once confirmed.

• Access, rectification, erasure, restriction and portability.
• Objection to processing based on legitimate interest.
• Withdrawal of consent, without retroactive effect.
• Complaint to the competent data protection supervisory authority.

7. Security and international transfers

We use HTTPS encryption, restricted access and regular backups. Any transfer outside the EEA relies on standard contractual clauses.

8. Cookies

See the Cookie Policy for the full cookie table and consent settings.