Customer support:+420 776 566 876aroma@aromaglobal.cz
    Currency
    CZK
    Language
    English
    Home / PRIVACY POLICY

    PRIVACY POLICY

    PRIVACY POLICY

    Aroma Global s.r.o. | Sale of fragrances, fragrance oils and related products

    I. GENERAL PROVISIONS

    1. The controller of personal data within the meaning of Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter referred to as the "GDPR") is Aroma Global s.r.o., Company ID No.: 21349584, VAT ID No.: CZ21349584, with its registered office at Lohniského 845/23, Hlubočepy, 152 00 Prague 5, Czech Republic (hereinafter referred to as the "Controller").
    2. Contact details of the Controller:
      • Address: Lohniského 845/23, Hlubočepy, 152 00 Prague 5, Czech Republic
      • Email: aroma@aromaglobal.cz
      • Phone: +420 773 911 191
    3. The Controller processes the personal data of customers and visitors to the online store www.aromaglobal.cz in accordance with the GDPR and related legal regulations.

    II. SOURCES AND CATEGORIES OF PERSONAL DATA PROCESSED

    1. The Controller processes personal data provided by customers, particularly when placing an order, communicating with the Controller or using the online store.
    2. This includes in particular:
      • first name and surname,
      • billing and delivery addresses,
      • email address and telephone number,
      • information relating to orders, payments and delivery of goods,
      • information relating to complaints and customer communication,
      • technical data associated with the use of the online store, including IP addresses and cookies, where such data is processed.
    3. The Controller processes personal data only to the extent necessary for the specified purposes.

    III. LEGAL BASES AND PURPOSES OF PERSONAL DATA PROCESSING

    1. The Controller processes personal data on the following legal bases:

    • a) Performance of a contract pursuant to Article 6(1)(b) of the GDPR, particularly for the purposes of receiving and processing orders, accepting payments, delivering goods and communicating with customers.
    • b) Compliance with legal obligations pursuant to Article 6(1)(c) of the GDPR, particularly obligations arising from accounting, tax and consumer protection legislation.
    • c) Legitimate interests of the Controller pursuant to Article 6(1)(f) of the GDPR, particularly for the purposes of protecting legal claims, securing the online store and conducting direct marketing towards existing customers under the conditions established by applicable legislation.
    • d) Consent of the data subject pursuant to Article 6(1)(a) of the GDPR, where consent is required for specific processing activities, particularly when sending marketing communications to persons for whom the statutory exception applicable to existing customers cannot be used, or when processing data through selected analytical and marketing tools.

    2. Providing personal data necessary for processing an order is a contractual requirement. Without providing such data, the order cannot be properly processed.

    3. Consent to the processing of personal data is not required for the conclusion and performance of a purchase contract itself.

    4. Marketing communications may be sent to existing customers under the conditions set out in Section 7(3) of Act No. 480/2004 Coll., particularly where such communications concern the Controller's own similar products or services and the customer has been given the opportunity to refuse such communications both when their contact details were obtained and in each individual marketing communication. In other cases, marketing communications are sent only on the basis of the relevant consent.

    5. The Controller does not carry out automated individual decision-making that would produce legal or similarly significant effects on customers within the meaning of Article 22 of the GDPR.

    IV. PERSONAL DATA RETENTION PERIOD

    1. Personal data is retained only for the period necessary for the purposes for which it was collected or for the period required by applicable legislation.
    2. Data relating to orders is retained for the period necessary to process the order and subsequently to the extent required to comply with legal obligations and protect the Controller's legal claims.
    3. Accounting and tax documents containing personal data are retained for the period specified by applicable legislation, generally 5 or 10 years depending on the type of document.
    4. Data processed for the purpose of protecting legal claims is retained for the period during which the relevant claims may be asserted or, where applicable, for the duration of their resolution.
    5. Personal data used for marketing purposes on the basis of consent is processed until consent is withdrawn or until the specified processing period expires. Data processed for direct marketing on the basis of legitimate interests is retained for as long as this purpose continues, but no longer than until an objection to such processing is raised.
    6. After the relevant retention period expires, personal data is deleted or anonymised unless another lawful basis for its retention exists.

    V. RECIPIENTS OF PERSONAL DATA

    1. For the proper operation of the online store and fulfilment of contractual and legal obligations, personal data may be disclosed or transferred, to the extent necessary, particularly to:
      • providers of transport and delivery services, such as PPL CZ s.r.o.,
      • payment service providers and payment gateway operators,
      • providers of technical and hosting services, particularly the operator of the Shoptet platform,
      • providers of accounting, tax and other professional services,
      • public authorities where required by applicable legislation.
    2. Transport companies are provided primarily with the data necessary to deliver shipments, namely the customer's first name and surname, delivery address, telephone number and email address.
    3. Depending on the nature of the services provided, individual recipients may act either as independent personal data controllers or as personal data processors.
    4. The Controller does not transfer personal data to third parties for their own marketing purposes without an appropriate legal basis.
    5. Any transfer of personal data outside the European Economic Area may take place only under the conditions established by the GDPR, particularly where an adequate level of personal data protection is ensured. Specific information about such transfers and the safeguards applied will be provided by the Controller to the persons concerned if such transfers take place.

    VI. USE OF COOKIES

    1. The online store may use cookies and similar technologies to ensure its operation, security, traffic analysis and, where applicable, marketing activities.
    2. Cookies used may be divided into the following categories:

    a) Essential cookies – these ensure the basic functions of the online store, such as the operation of the shopping cart or website security. Consent is not required for their use if they meet the applicable legal conditions.

    b) Analytical cookies – these are used to evaluate website traffic and the use of the online store. If they are not technically necessary, they are used only with the visitor's prior consent.

    c) Marketing cookies – these may be used to personalise advertising messages and evaluate marketing activities. They are used only with the visitor's prior consent unless otherwise provided by law.

    3. Visitors may grant or refuse consent to the use of individual categories of cookies requiring consent through the cookie settings.

    4. Consent granted may be withdrawn at any time through the cookie settings available on the website. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

    5. More detailed information about the specific cookies used, their providers and their validity periods is available through the cookie settings on the website, where such technologies are used.

    VII. RIGHTS OF DATA SUBJECTS

    1. Under the conditions established by the GDPR, data subjects have in particular:
      • the right of access to their personal data pursuant to Article 15 of the GDPR,
      • the right to rectification of inaccurate personal data pursuant to Article 16 of the GDPR,
      • the right to erasure of personal data pursuant to Article 17 of the GDPR,
      • the right to restriction of processing pursuant to Article 18 of the GDPR,
      • the right to data portability pursuant to Article 20 of the GDPR,
      • the right to object to processing pursuant to Article 21 of the GDPR,
      • the right to withdraw consent at any time where processing is based on consent.
    2. Data subjects may object at any time to the processing of personal data for direct marketing purposes. In such cases, personal data will no longer be processed for this purpose.
    3. Data subjects may exercise their rights using the Controller's contact details provided in Section I of this Privacy Policy.
    4. Data subjects also have the right to lodge a complaint with the Czech Office for Personal Data Protection (www.uoou.gov.cz) if they believe that the processing of their personal data violates applicable legal regulations.

    VIII. PERSONAL DATA SECURITY

    1. The Controller has adopted appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration or other unauthorised processing.
    2. Access to personal data is restricted to persons who require such access to perform their employment or contractual duties.
    3. Persons authorised to access personal data are required to maintain confidentiality to the extent established by applicable legislation and relevant contractual relationships.
    4. When securing personal data, the Controller takes into account the nature and scope of processing, available technical resources and associated risks.

    IX. FINAL PROVISIONS

    1. This Privacy Policy serves to fulfil the Controller's information obligations pursuant to Article 13 of the GDPR.
    2. Separate customer consent to this Privacy Policy is not required for the processing of personal data necessary to fulfil an order.
    3. The Controller is entitled to update this Privacy Policy, particularly in response to changes in legislation or the methods of personal data processing.
    4. The current version of this Privacy Policy is published on the website www.aromaglobal.cz.
    5. This Privacy Policy takes effect on the date of its publication.