Privacy policy

Last updated: November 8, 2026

This notice describes how personal information is handled in connection with aromessas.com.

Aromessas is the name used by the online store. Privacy-related enquiries can be directed to info@aromessas.com.

Information associated with an order

When a customer purchases from the store, information needed to complete the transaction may include their name, email address, telephone number, billing address, delivery address and details of the products ordered.

We may also process order references, payment confirmations, delivery information and refund records.

Payment credentials required to complete transactions are handled by the relevant payment services.

Information submitted voluntarily

If you send an enquiry, request assistance with an order or report a problem with a product, we may receive the information you choose to provide.

For example, a customer reporting a damaged serum bottle might submit an order number, photograph of the packaging and explanation of the issue.

Such information is used to address the relevant enquiry.

Please avoid sending unnecessary sensitive information, medical records or complete payment card details through our contact channels.

Purposes and legal bases

Personal data is processed only where an appropriate legal basis applies.

Purchase and delivery: Information necessary to accept and fulfil an order is processed for performance of the purchase contract.

Customer assistance: Enquiries, returns and complaints are handled where necessary to perform contractual obligations, comply with legal duties or pursue legitimate interests in assisting customers.

Accounting and regulatory compliance: Certain transaction records are retained to meet legal obligations.

Website operation and protection: Technical information may be processed where necessary for legitimate interests in website reliability, security and prevention of misuse.

Marketing: Where consent is legally required, promotional communications and non-essential marketing technologies are used only with the appropriate consent. Consent can be withdrawn.

Technical data and cookies

Visiting the website may involve the processing of technical information, including browser characteristics, IP address, device information and usage data.

Essential cookies may be needed to maintain shopping cart and checkout functions.

Non-essential cookies and similar technologies used for advertising or analytics must comply with applicable consent requirements.

Where consent is required, visitors must be able to accept or reject the relevant technologies and subsequently change their choices.

The website's cookie information should identify the technologies in actual use, their purposes and applicable retention periods.

Organisations involved in store operations

Personal information may be disclosed to service providers where necessary for the relevant service, including payment processing, website hosting, delivery, information technology support and customer communications.

Disclosure may also occur when required by law.

Where personal data is transferred outside the European Economic Area, the relevant transfer mechanism and safeguards must meet applicable data protection requirements.

Retention of information

Different records may need to be kept for different periods.

Purchase records may be retained where required by accounting, tax or consumer protection law.

Customer correspondence, website security records and marketing preferences are subject to the retention requirements relevant to their purposes.

Personal data should be deleted or anonymised when it is no longer needed, unless continued retention is legally justified.

Your privacy rights

Under the General Data Protection Regulation, you may have rights to access personal data, correct inaccurate information, request erasure, restrict certain processing, object to processing or receive eligible information in a portable format.

Where processing relies on consent, you may withdraw that consent.

To submit a request, contact info@aromessas.com. We may need to confirm your identity before responding to requests involving personal information.

Requests will be handled within the applicable statutory time limits.

Individuals may also submit a complaint to a competent data protection authority, including the Commission Nationale de l'Informatique et des Libertés (CNIL) in France.

Visitors from California

The store currently offers delivery within Metropolitan France.

If California privacy legislation applies to any of our processing activities, eligible individuals may exercise the rights provided under that legislation, subject to its conditions and exceptions.

Related enquiries can be sent to info@aromessas.com.