Privacy policy

Privacy Policy

Last updated:
July 2, 2026

Protecting the privacy of Users is a priority for us. Our online store, operated by Zone Aroma, ensures the highest standards of personal data protection in accordance with the requirements of GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of personal data).

In connection with the above, and in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR), the company Zone Aroma has adopted this Privacy Policy in order to ensure the security of personal data.

This Privacy Policy sets out the rules for the processing and protection of personal data provided by Users when using the online store and other related websites, means of communication and services.

User means any person whose personal data is processed in connection with the use of the online store and other related websites, means of communication and services (hereinafter: the “User”).

The controller of personal data collected through the online store is:

Zone Aroma
SCD91 SERVICES LTD
CRN: 14720407
19 Gainsborough Avenue
South Shields
United Kingdom
NE34 8NR

To the extent necessary for the performance of the agreement concluded between the User and the Controller, as well as to take action at the User's request prior to concluding the agreement and to fulfill the legal obligations incumbent on the Controller, personal data is processed pursuant to Article 6(1)(b) and (c) of the GDPR, without the need to obtain the User's separate consent.

In all other cases, providing personal data is voluntary.

However, if consent to the processing of personal data is given solely for marketing purposes, providing such data is also voluntary. Failure to give consent or its withdrawal will result in the inability to inform the User about new offers and promotions.

I. USER CONSENT

In order to make full use of the online store, the User has the ability to independently manage the consents given for the processing of personal data.

Consent given may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal.

Using the online store means that the User accepts that the Controller collects, uses and discloses personal data and non-personal data in accordance with this Privacy Policy.

At the same time, the User retains control over how their data is used and disclosed. Detailed information can be found in Chapter V of this Privacy Policy, “User Rights”.

Users may exercise their rights by contacting the Data Protection Officer (DPO) or through the form available in the “My Account” tab on the website.

In addition, in the “Privacy” tab, the User can manage marketing consents and profiling settings.

If the processing of personal data is based on the User's consent, the User has the right to withdraw previously given consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

If this Privacy Policy is amended and the User continues to use the online store, this will mean that the User has read and accepted the new version of the Privacy Policy.

II. PERSONAL DATA PROCESSED BY THE CONTROLLER

Methods of collecting personal data

Personal data obtained directly from the User

The Controller obtains personal data in two ways.

The first is obtaining data directly from the User through:

  • sending a message via the online store's contact form;
  • registering a user account;
  • placing an order for goods or services;
  • contacting the Controller for technical support;
  • filing complaints;
  • other requests submitted by the User.

Personal data obtained from other sources

The Controller also obtains personal data indirectly:

  • by analyzing the use of the online store using cookies and other technologies;
  • by receiving error reports and information regarding the use of software installed on the User's device;
  • from partners with whom the Controller jointly offers goods and services or conducts marketing activities.

Categories of personal data processed

The Controller may process the following categories of personal data:

  • login;
  • first and last name;
  • company name;
  • first and last name of a sole proprietor;
  • first and last names of partners in a civil law partnership;
  • correspondence address;
  • phone number;
  • email address;
  • tax identification number (NIP);
  • device IP address;
  • payment data, if the User makes a purchase in the online store;
  • information contained in cookies and similar technologies regarding how the User uses the online store.

In addition, the Controller collects data contained in the User's files and messages, if this is necessary for order fulfillment and the provision of the user account service.

In particular, the following may be processed:

  • the subject and content of email messages;
  • the content of messages sent via messaging apps;
  • audio and video recordings;
  • voice recordings;
  • transcripts of voice messages;
  • text messages dictated by the User.

The Controller also processes information voluntarily provided by the User, including:

  • reviews;
  • ratings of products and services;
  • information provided during contact with technical support;
  • the content of correspondence with the Controller.

III. HOW DATA IS PROCESSED – PURPOSES OF PROCESSING PERSONAL DATA

The way personal data is processed depends on how the User uses the online store.

Orders and User account (performance of the agreement)

If the User decides to place an order for goods or services offered by the online store, the Controller processes personal data to the extent necessary to conclude a sales agreement or service agreement and to properly perform it.

If the User creates an account in the online store, the Controller uses their personal data to perform the agreement for the provision of electronic services, in particular for:

  • identifying the User;
  • authenticating the User;
  • providing access to the User's account.

Communication (performance of the agreement and the Controller's legitimate interest)

The Controller uses the User's personal data to conduct personalized communication.

This communication includes, among others:

  • sending email messages;
  • displaying notifications on the website;
  • using other means of communication available in the online store and within the User's account;
  • sending SMS messages;
  • sending push notifications.

The information provided may relate in particular to:

  • the products and services offered;
  • service availability;
  • how to use the services;
  • personal data security;
  • updates to the online store;
  • reminders;
  • offers and recommendations from the Controller.

Communication also includes User support.

Personal data is used for the purpose of:

  • providing assistance to the User;
  • resolving reported issues;
  • handling complaints;
  • responding to the User's questions and requests.

In addition, the Controller uses personal data to allow the User to publish comments and reviews regarding the operation of the online store and the products and services offered.

Marketing (User consent and the Controller's legitimate interest)

The Controller uses the User's personal data to present personalized marketing content if:

  • the User has given consent to this,
  • or a business relationship exists between the User and the Controller that allows for direct marketing in accordance with applicable law.

Marketing materials relate to the products and services offered by the Controller.

Advertisements presented to the User are individually tailored (profiling) only after obtaining the appropriate consent.

The following may be used for profiling purposes:

  • data provided directly by the User;
  • data collected while using the online store;
  • information received from third parties;
  • data derived from advertising technologies, including cookies;
  • web beacons;
  • tracking pixels;
  • advertising tags;
  • mobile device identifiers.

The Controller does not disclose the User's personal data to external advertisers or advertising networks without the User's prior consent.

Improving the online store (User consent)

The Controller uses personal data to conduct statistical analyses and research aimed at continuously improving the online store, the products and services offered, and implementing new features and solutions.

Personal data may also be used for:

  • conducting marketing research;
  • public opinion research;
  • economic analyses;
  • improving the quality of the online store's operation.

After obtaining the appropriate consent, personal data may also be used to conduct surveys regarding the level of satisfaction with purchases made.

Such research may be carried out by:

  • CENEO.PL Sp. z o.o., ul. Legnicka 48A, 54-202 Wrocław;
  • OPINEO Sp. z o.o., ul. Marii Curie-Skłodowskiej 12, 50-381 Wrocław.

Security (the Controller's legitimate interest)

The Controller processes the User's personal data for the purpose of:

  • monitoring security;
  • preventing fraud;
  • detecting fraudulent activities;
  • conducting investigations into abuses;
  • protecting other Users;
  • ensuring the security of networks and IT systems.

If there are reasonable grounds to suspect that a crime has been committed or that the provisions of this Privacy Policy have been violated, personal data may be used to clarify the circumstances of the case.

Pursuing claims (the Controller's legitimate interest)

If the User uses the online store, in particular:

  • creates an account;
  • places orders;
  • uses the services offered,

the Controller may process personal data to the extent necessary for:

  • pursuing any claims related to the business conducted;
  • protecting its rights;
  • analyzing cases of violation of the rules for using the online store.

Tax and accounting documentation (legal obligation)

If the User places an order through the online store, the Controller processes personal data to the extent necessary for:

  • maintaining tax documentation;
  • maintaining accounting documentation;
  • settling concluded agreements;
  • performing other obligations arising from applicable law.

IV. TRANSFER AND ENTRUSTMENT OF PERSONAL DATA PROCESSING

If personal data is transferred outside the European Economic Area (EEA), the Controller applies Standard Contractual Clauses (SCC) approved by the European Commission to ensure an adequate level of protection for personal data.

The User's personal data may be disclosed, on the basis of concluded agreements or applicable law, to the following categories of recipients:

  • courier, postal, telecommunications and transport service providers;
  • payment operators processing payments for goods and services;
  • advertising and marketing service providers – for the purpose of marketing the Controller's own products and services;
  • law firms, accounting offices, consulting firms and other entities providing services to the Controller, including in the area of debt collection and protection of the Controller's rights;
  • entities processing personal data on behalf of the Controller, in particular providers of technical infrastructure ensuring the operation of the online store;
  • public administration authorities, courts and law enforcement agencies – in cases provided for by applicable law.

V. USER RIGHTS

The User may exercise their rights by contacting the Data Protection Officer or through the form available in the “My Account” tab on the website.

In addition, in the “Privacy” tab, the User can manage marketing consents and profiling settings.

To exercise their rights, the User may contact the Data Protection Officer electronically at: info@zonearoma.com

The Controller ensures the User can exercise the following rights:

  • the right to access personal data;
  • the right to rectification of personal data;
  • the right to erasure of personal data;
  • the right to restriction of the processing of personal data;
  • the right to data portability;
  • the right to object;
  • the right to lodge a complaint with a supervisory authority.

The User independently decides on the scope of personal data provided, including privacy settings.

However, it should be remembered that refusing to provide certain data may prevent the use of selected features of the online store or services provided by the Controller.

The User may also exercise their rights by contacting the Controller at the email address: info@zonearoma.com

Some rights can be exercised independently through the User's account in the online store.

Right to access personal data

The User has the right to obtain confirmation from the Controller as to whether their personal data is being processed.

If the data is being processed, the User has the right to access information regarding its processing, in particular:

  • the purposes of processing;
  • the categories of personal data processed;
  • the recipients or categories of recipients of the data;
  • the planned data retention period;
  • the rights available to the User;
  • the source of the data, if it was not collected directly from the User;
  • information required by the GDPR.

Right to rectification of data

The User has the right to demand the immediate rectification of inaccurate personal data.

The User may also request:

  • the correction of incorrect data;
  • the completion of incomplete data;
  • the removal of inaccuracies;
  • the updating of data.

However, it is not permissible to replace existing data with other data if the new data would also be incorrect.

If the data is incomplete, the User may submit an additional supplementary statement.

Such a statement may be submitted in any form, including electronically.

A User with an account in the online store can edit their data independently in the tab:

My Account → Personal Data

Right to erasure of data (“the right to be forgotten”)

The User has the right to request the erasure of their personal data if at least one of the following conditions is met:

  • the data is no longer necessary for the purposes for which it was collected or processed;
  • the User has withdrawn the consent on which the processing was based, and there is no other legal basis;
  • the User has objected to the processing;
  • the data was processed unlawfully;
  • erasure of the data is necessary to comply with an obligation under European Union law or the law of a Member State;
  • the data was collected in connection with the provision of information society services.

To delete an account created in the online store, please send an email with the subject:

“Account cancellation”

to the address: info@zonearoma.com

The message should be sent from the email address assigned to the User's account.

Deleting the account does not mean the automatic deletion of all personal data.

The account may also be deleted using a special interactive link provided in correspondence between the Controller and the data subject.

The right to be forgotten applies only when the Controller has previously made public the personal data whose erasure the User requests.

Right to restriction of processing

The User has the right to request the restriction of the processing of personal data if:

  • the accuracy of the data is contested – for a period enabling the Controller to verify its accuracy;
  • the processing is unlawful, but the User objects to the erasure of the data;
  • the Controller no longer needs the data for processing purposes, but it is needed by the User to establish, exercise or defend legal claims;
  • the User has objected to the processing – pending verification of whether the Controller's legitimate grounds override those of the User.

During the period of restriction, the Controller may process the data (apart from storing it) only:

  • with the User's consent;
  • for the establishment, exercise or defense of legal claims;
  • for the protection of the rights of another natural or legal person;
  • for reasons of important public interest of the European Union or a Member State.

Right to data portability

The User has the right to receive the personal data concerning them that was provided to the Controller, in a structured, commonly used and machine-readable format.

The User also has the right to transmit this data to another controller.

Where technically feasible, the User may request that the Controller transmit the data directly to another controller.

Right to object

The User has the right, at any time, to object to the processing of personal data for reasons related to their particular situation, if the processing is carried out:

  • in the public interest;
  • in the exercise of official authority vested in the Controller;
  • for direct marketing purposes, including related profiling;
  • on the basis of the Controller's legitimate interest.

The handling of an objection and any related correspondence are free of charge.

An objection may also be submitted electronically.

Right to lodge a complaint

The User has the right to lodge a complaint with the competent supervisory authority for the protection of personal data, in particular in the European Union Member State of:

  • their habitual residence;
  • their place of work;
  • the place of the alleged infringement of personal data protection regulations.

VI. COOKIES AND OTHER TECHNOLOGIES USED BY THE CONTROLLER

Our online store uses cookies to enhance the functionality of the site, personalize content, and analyze site traffic.

Users can manage cookie settings through their web browser configuration.

Cookies are used to improve the functioning of the online store, ensure its continuous development, and provide Users with content best suited to their needs.

Cookies are small text files created in response to HTTP requests sent to our server. They are saved by the browser on the User's device while using the online store.

The information stored in cookies allows analysis of how Users use the online store.

Types of cookies used

The online store uses two basic types of cookies.

Session cookies

These are temporary files stored on the User's device until:

  • the User logs out of the site;
  • the web browser is closed.

After the session ends, the information stored in these files is automatically deleted.

Persistent cookies

These files remain stored on the User's device for the period specified in their parameters or until deleted by the User.

Other data storage technologies

In addition to cookies, the online store also uses browser data storage technologies, in particular:

  • Session Storage;
  • Local Storage.

The Controller also uses analytical tools provided by third parties, which may save cookies in their own domains.

For example, the following services are used:

  • Google Analytics;
  • Google Ads;
  • Meta Pixel;
  • Stripe;
  • PayPal;
  • Cloudflare;
  • Shopify / WooCommerce;
  • Mailchimp;
  • Brevo.

Detailed information regarding the cookies used, their storage periods, and the list of trusted partners can be found in the relevant tables available on the website.

What is a cookie?

A cookie is a small text file saved by a web browser on the User's device at the request of the website being visited.

It may store, among other things, information regarding:

  • the selected language;
  • login data;
  • the User's preferences.

The Controller uses both its own cookies (first-party cookies) and third-party cookies, used mainly for marketing and advertising purposes.

Purposes of using cookies and similar technologies

Cookies and similar technologies are used for the purpose of:

  • recognizing the User while using the online store;
  • remembering the User's preferences;
  • displaying personalized content;
  • presenting advertisements tailored to the User's interests.

These technologies enable faster, more convenient, and more effective use of the online store.

They also allow personalized content to be displayed without the User having to re-enter the same information.

Technical cookies

Technical cookies are necessary for the proper functioning of the online store.

In particular, they serve to:

  • authenticate the User;
  • recognize the User after logging in;
  • ensure proper navigation between pages without the need to log in again;
  • present content in accordance with the User's saved preferences.

The Controller uses technical cookies for the purpose of:

  • ensuring the security of the purchasing process;
  • maintaining an active session after logging in;
  • properly displaying the site on various devices;
  • adapting the operation of the online store to the technical parameters of the User's device;
  • remembering consents regarding the display of specific content.

Analytical cookies

Analytical cookies are used for the purpose of:

  • cooperation with trusted partners;
  • assessing the effectiveness of marketing activities;
  • analyzing the operation of the online store without directly identifying the User.

The Controller uses analytical cookies, among other things, for:

  • analyzing site visit statistics;
  • determining traffic sources;
  • detecting fraud attempts;
  • identifying artificial traffic (bots);
  • detecting DDoS attacks;
  • limiting unwanted marketing activities;
  • assessing the effectiveness of advertising campaigns conducted through Google, affiliate programs, and other websites;
  • settling advertising services provided by trusted partners based on actions taken by Users (e.g., ad clicks).

Marketing cookies

Marketing cookies are used only after obtaining the User's consent.

Their primary purpose is to present advertisements tailored to the interests of a specific User.

These files may be used to profile advertisements:

  • on third-party websites;
  • directly in the online store.

The selection of advertisements is based on:

  • the User's preferences;
  • the products viewed;
  • how the online store is used;
  • other information available to the Controller.

During the first visit to the online store, the User may refuse consent to the use of analytical and marketing cookies.

In such a case:

  • the Controller will not be able to keep detailed statistics regarding site usage;
  • personalized advertisements will not be displayed.

Regardless, the User will still receive general advertisements both in the online store and on other websites.

Google and Meta (Facebook) technologies are used to display advertisements.

The Controller recommends independently setting advertising profiling preferences through the appropriate privacy settings provided by Google and Meta.

VII. DISABLING COOKIES AND OTHER TECHNOLOGIES

Users may also use the instructions provided on the official support pages of web browser manufacturers. The Controller recommends reviewing the privacy settings of the browser used.

By default, most web browsers allow cookies to be saved.

If the User does not want to receive cookies, they can change the appropriate settings of their browser on the computer or other device used to access the online store.

Continuing to use the online store without changing browser settings means consent to the use of technical cookies, which are necessary for the proper functioning of the site.

Most modern browsers allow:

  • viewing saved cookies;
  • deleting selected or all cookies;
  • managing their storage settings.

It should be noted that blocking the saving or reading of cookies may limit or prevent the use of certain features of the online store.

If the User uses multiple devices (e.g., a computer, smartphone, and tablet), it is recommended to configure cookie settings separately on each device and in each browser used.

Instructions for disabling cookies

Google Chrome

  1. Click the “Customize and control Google Chrome” icon (three dots in the top right corner of the window).
  2. Select “Settings”.
  3. Go to the “Privacy and security”.
  4. Open “Cookies and other site data”.
  5. You can choose one of the following options:
    • block all cookies;
    • block third-party cookies;
    • block websites' ability to track activity.

Detailed information can be found on Google's official help page.

Mozilla Firefox

  1. Open the Firefox menu.
  2. Select “Settings”.
  3. Go to the “Privacy and security”.
  4. In the “History” section, select custom settings.
  5. To enable cookies – check the corresponding box.
  6. To disable them – uncheck the box.

It is also possible to specify the cookie retention period:

  • until they expire;
  • until Firefox is closed;
  • every time, upon confirmation by the User.

Once the settings are saved, the changes will be applied automatically.

Safari

  1. Open Safari → Preferences.
  2. Go to the “Privacy”.
  3. Select the appropriate cookie settings.

Available options include, among others:

  • preventing cross-site tracking;
  • blocking all cookies.

More information can be found on Apple's support page.

Opera

  1. Click the “Settings”.
  2. Go to “Full browser settings”.
  3. Open the “Privacy and security”.
  4. Select “Cookies and other site data”.

You can:

  • block all cookies completely;
  • block third-party cookies;
  • block websites' ability to track activity.

Detailed instructions are available on Opera's official help page.

Microsoft Edge

  1. Click “Settings and more” (three dots).
  2. Select “Settings”.
  3. Go to the “Cookies and site permissions”.
  4. Open “Manage cookies and site data”.
  5. Turn off the option:

“Allow sites to save and read cookie data”.

More information can be found in Microsoft Edge's official documentation.

VIII. OTHER IMPORTANT INFORMATION

Protection of personal data

The Controller applies appropriate technical and organizational measures to ensure the security of Users' personal data.

The security of the services provided is ensured by systems and procedures designed to prevent unauthorized access to data, its disclosure, or its use by unauthorized persons.

In particular:

  • the systems used are regularly monitored;
  • potential security threats are monitored;
  • only authorized persons have access to personal data.

All personal data is stored in IT systems to which only authorized persons have access.

Personal data retention period

The personal data retention period depends on the purpose of its processing.

Different retention periods may apply to individual categories of data.

In particular:

  • data used for marketing purposes – for a period of 5 years from the last contact with the User;
  • data related to order fulfillment – for a period of 6 years, in accordance with applicable tax and accounting regulations;
  • data used for analytical purposes – for a period of 3 years from the completion of the analyses.

In addition, personal data is processed:

  • for analytical and statistical purposes – for the period necessary for the development and improvement of the online store;
  • for the performance of agreements – for the duration of the agreement and until the limitation periods for any claims expire;
  • for the performance of obligations arising from legal provisions (e.g., tax and accounting) – for the period required by applicable regulations;
  • for marketing purposes – until the end of the business relationship with the User or until an effective objection to such processing is raised.

After the specified periods have elapsed, personal data may be stored only to the extent necessary to pursue or defend the Controller's claims, if applicable law so permits.

Once all retention periods have ended, the data will be permanently deleted or anonymized.

Changes to the Privacy Policy

This Privacy Policy may be periodically updated to ensure its compliance with applicable law and the current manner of processing personal data.

If changes are made, the “last updated” date indicated at the beginning of the document will be updated.

Users will be informed of any significant changes:

  • through a notice posted on the store's website;
  • through direct notification, if required or justified.

The Controller recommends regularly reviewing the current version of the Privacy Policy.

Contact details

If you have any questions, concerns, or comments regarding the processing of personal data or this Privacy Policy, the User may contact the Controller: