Legal Notice

Privacy Policy

1. Data Controller and Contact Details

The controller of your personal data is:

Tijara Essence s.r.o.
Company ID / VAT ID: CZ23592087
Registered office: Soukenická 877/9, Moravská Ostrava, 702 00 Ostrava
Czech Republic

Contact regarding personal data protection: biuro@aromaflav.com

2. Categories of Personal Data and Sources

We process the following categories of personal data:

  • identification, contact and address data,
  • user account data,
  • order-related data, including payment identifiers,
  • logistics data, including shipment numbers and delivery status,
  • statements and consents, including acceptance of our Terms and Conditions,
  • technical logs, including IP address, device identifiers and timestamps,
  • data collected through cookies and SDKs.

Personal data is collected directly from customers, payment service providers, shipping carriers and from customers' devices through cookies and SDKs.

3. Purposes and Legal Basis for Processing

  • Performance of a contract, including account registration, order processing, payments, deliveries, returns and complaints – Article 6(1)(b) GDPR.
  • Compliance with legal obligations, including accounting, tax settlements, the OSS scheme, archiving, product safety and cooperation with public authorities – Article 6(1)(c) GDPR.
  • Age verification, fraud prevention and establishment, exercise or defence of legal claims – Article 6(1)(c) and (f) GDPR.
  • Communication regarding statutory obligations, such as reminders concerning required formalities related to orders – Article 6(1)(b) and (c) GDPR.
  • Analytics and personalisation based on your consent (Article 6(1)(a) GDPR) or our legitimate interest (Article 6(1)(f) GDPR), while respecting applicable privacy laws.
  • Maintenance and security of the Website, including logging, fraud prevention and testing – Article 6(1)(f) GDPR.

4. Data Recipients

Your personal data may be shared with:

  • payment service providers,
  • logistics operators and shipping carriers,
  • hosting and IT service providers,
  • CRM and customer support system providers,
  • accounting service providers,
  • legal advisors,
  • analytics service providers,
  • public authorities where disclosure is required by applicable law, including tax and customs authorities.

5. Transfers of Personal Data Outside the European Economic Area (EEA)

If any of our service providers are located outside the European Economic Area, we ensure that appropriate legal safeguards are in place, including the European Commission's Standard Contractual Clauses, and we apply appropriate technical and organisational security measures.

A copy of the safeguards may be obtained by contacting us.

6. Data Retention Periods

  • Account information and purchase history are retained for the duration of the customer account and subsequently for the period required by accounting regulations and statutory limitation periods.
  • Tax documentation and records required for the OSS scheme are retained in accordance with applicable legal requirements, generally for 10 years from the end of the relevant tax year.

7. Your Rights

You have the right to:

  • access your personal data,
  • rectify inaccurate or incomplete data,
  • request erasure of your data,
  • request restriction of processing,
  • receive your data in a portable format,
  • object to processing,
  • withdraw your consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

You also have the right to lodge a complaint with the competent supervisory authority responsible for data protection in your country of residence or with the Polish Personal Data Protection Office.

8. Automated Decision-Making and Profiling

We do not make decisions producing legal effects solely on the basis of automated processing.

We may use profiling for analytics and personalised offers. You have the right to object to such processing at any time.

9. Cookies and Similar Technologies

Our Website uses cookies and similar technologies, including local storage, to ensure proper functionality and to analyse website traffic.

We use a cookie consent mechanism that allows you to choose between the following categories:

  • Necessary cookies,
  • Analytics cookies.

You can change your cookie preferences at any time using the settings available in the website footer.

Cookie data may be linked to your customer account after logging in, but only where you have provided the appropriate consent.

10. Security and Personal Data Breaches

We implement appropriate technical and organisational measures, including encryption, access control, pseudonymisation and regular security testing, to protect your personal data.

In the event of a personal data breach, we act in accordance with the GDPR requirements. Where a breach is likely to result in a high risk to your rights and freedoms, we will inform affected individuals without undue delay.

11. Changes to this Privacy Policy and Contact

We reserve the right to update this Privacy Policy. Any significant changes will be announced on our Website and, where appropriate, by email.

If you have any questions regarding the processing of your personal data, please contact us at:
biuro@aromaflav.com