AromaPrime Data and Privacy Policy

This notice explains what personal data AromaPrime collects, why we collect it, who we share it with and what control you have over it. It applies to our customers, trade contacts and anyone who visits aromaprime.com.

Who we are

AromaPrime Ltd, a company registered in England and Wales under number 15038531. We are the controller of the personal data described here, which means we decide how it is used and we are responsible for it.

• Address: Bridge End Mills, Tong Lane, Whitworth, Rochdale, OL12 8BG, United Kingdom
• Phone: 0161 327 2857
• Email for anything about your data: info@aromaprime.com

We have not appointed a Data Protection Officer because the law does not require one for a business of our size. Any data question comes straight to the team above.

What data we collect

We only collect what we need to sell to you, deliver to you and keep in touch.

• Contact details: name, job title, company name, billing and delivery addresses, email address and phone number.
• Order details: what you bought, when, how much you paid, invoices and any returns.
• Payment details: we see the payment method and confirmation. Your full card or bank details are handled by our payment providers and we do not store them.
• Communications: emails, calls and messages you send us, including fragrance briefs and project notes.
• Marketing preferences: whether you have subscribed or unsubscribed, and when.
• Website data: IP address, browser type and how you use aromaprime.com, collected through cookies (see the cookies section).

We do not knowingly collect sensitive data such as health information, and we do not sell products to children.

How we use your data and our lawful basis

UK data protection law says we need a lawful reason for every use of your data. Here is each one.

Where we rely on legitimate interests, we have checked that our interest (running and growing a small business) does not override your rights. You can object at any time.

Marketing and the soft opt in

We send emails about new fragrances, offers and scenting ideas. How we are allowed to email you depends on how we got your details, under the Privacy and Electronic Communications Regulations (PECR).

If you have bought from us: the soft opt in

If you buy from us, or ask us for a quote, we may send you marketing emails and texts about our own similar products and services without asking for separate consent. This is called the soft opt in. We only use it when all of these are true:

1. We got your contact details when you bought from us, or while discussing a purchase with you.
2. The marketing is about AromaPrime products and services similar to what you bought or asked about (for example fragrance oils, diffusers, scent machines and scenting services).
3. When we collected your details, we gave you a clear chance to say no. At checkout, this is an unticked box: "Please do not send me news and offers from AromaPrime."
4. Every marketing email or text we send has a one click unsubscribe link (or a STOP reply for texts).

The soft opt in never covers marketing from other companies. We will never pass your details to anyone else for their marketing.

If you signed up on our website

If you joined our mailing list without buying from us, we email you because you gave consent. You can withdraw it at any time.

If you are a business contact

If we hold your work email at a limited company, public body or other organisation, we may send you relevant business marketing on the basis of legitimate interests. Every email lets you opt out. If you are a sole trader or a partnership, the soft opt in or consent rules above apply to you instead.

Phone and post

Before calling anyone for marketing, we check the Telephone Preference Service (TPS) and Corporate TPS registers and our own do not call list. We may send occasional marketing by post to existing customers on the basis of legitimate interests.

How to stop marketing

Click unsubscribe in any email, reply STOP to any text, or contact us at [privacy@aromaprime.com] or 0161 327 2857. We will stop within [5] working days and keep a note of your choice so you are not contacted again. Stopping marketing does not affect order emails such as dispatch notices.

Who we share your data with

We do not sell your data. We share it only with the service providers we need to run the business, and each one may use it only to provide that service to us.

We may also share data with HMRC, the police, a court or our professional advisers (lawyers, insurers) when the law requires it or to protect our legal rights. If we sell or restructure the business, customer data may pass to the new owner, who must use it in line with this notice.

International transfers

Some of our providers store data outside the UK, mainly in the USA and the EU. When that happens we make sure one of these protections is in place:

• the country has UK "adequacy" status (this covers the EU and EEA), or
• the provider is certified under the UK Extension to the EU US Data Privacy Framework, or
• They are internationally recognised companies who are likely to have the ICO's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses in place.

If we deliver to you outside the UK, your name and address go to the courier in your country so they can deliver. Ask us at info@aromaprime.com if you want details of the protection used for a specific provider.

How long we keep your data

We keep data only as long as we need it, then delete it or make it anonymous.

We review what we hold once a year and delete what we no longer need.

Security and data breaches

We protect your data with password protected accounts, two step verification on our main systems, access limited to staff who need it, encrypted payment processing through our providers, and regular software updates.

If a breach happens that is likely to put your rights at risk, we will report it to the Information Commissioner's Office (ICO) within 72 hours of finding out. If the risk to you is high, we will also tell you directly, without undue delay, explaining what happened and what you can do to protect yourself. We keep a record of every breach, however small.

Your rights

You have the right to:

• Access a copy of the data we hold about you.
• Correct anything that is wrong or incomplete.
• Erase your data, where we have no legal reason to keep it (we must keep invoices for tax, for example).
• Restrict how we use your data while a concern is being looked into.
• Port data you gave us to another provider in a common format.
• Object to us using your data on the basis of legitimate interests.
• Stop direct marketing at any time. This right is absolute: we will always stop.
• Withdraw consent where we rely on it, without affecting anything we did before.

To use any of these rights, email [privacy@aromaprime.com], call 0161 327 2857 or write to us. It is free. We may ask you to confirm your identity first. We will reply within 1 month, and confirm the outcome by email. If your request is complex we may extend this by up to 2 more months, and we will tell you why within the first month.

Cookies

aromaprime.com uses essential cookies to run the shop, such as remembering your basket and keeping checkout secure. These do not need consent.

We only use analytics or advertising cookies if you accept them in the cookie banner. You can change your choice at any time through the cookie settings link at the bottom of every page. Our [cookie notice] lists each cookie and what it does.

Complaints and changes to this notice

If you are unhappy with how we have handled your data, please tell us first at [privacy@aromaprime.com] so we can put it right.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

We will update this notice when the way we use data changes, for example when we move to a new website platform. The date at the top shows when it was last updated. If a change affects you significantly, we will tell you by email.