Privacy policy

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:

Represented by: Christoph Chojnicki
Phone: +49 163 1762744
Email: mediect@aromabath.de

No data protection officer has been appointed, as the legal requirements for doing so (Art. 37 GDPR, Section 38 BDSG) are not met. Please direct any data protection questions to the contact details above.

2. Overview

We have deliberately designed this website to collect as little data as possible:

• We use no cookies or similar technologies that store information on your device.
• We use no analytics, tracking or marketing services (e.g. Google Analytics, Meta Pixel) and no social media plugins.
• Fonts, scripts and images are loaded exclusively from our own server; no third-party content (e.g. Google Fonts, YouTube, Google Maps) is embedded.

We therefore only process personal data to the extent technically necessary to deliver the website, or where you provide it to us in an enquiry.

3. Hosting and server log files

This website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. When you access the website, the web server automatically processes information transmitted by your browser in server log files:

• IP address of the requesting device,
• date and time of access,
• page or file requested and amount of data transferred,
• HTTP status code,
• referrer URL (previously visited page), if transmitted,
• browser and operating system used (user agent).

Purpose: delivering the website, ensuring stability and security (e.g. defending against attacks) and error analysis. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and error-free operation of the website. The data is not combined with other data sources or analysed for marketing purposes.

Retention: Log files are kept only as long as necessary for these purposes and are then deleted or anonymised. Data whose further retention is required for evidential purposes (e.g. following a security incident) is exempt from deletion until the matter has been resolved.

A data processing agreement pursuant to Art. 28 GDPR is in place with the host. The servers are located in Germany or the European Union.

4. TLS encryption

For security reasons and to protect the transmission of confidential content – such as your enquiries – this website uses TLS encryption. You can recognise an encrypted connection by “https://” in your browser’s address bar.

5. Contact and B2B enquiries

If you contact us via the enquiry form, by email or by phone, we process the data you provide. For the enquiry form, this is:

• Required: company, contact person’s name, business email address, country, channel, message and confirmation that you are acting as a business;
• Optional: phone number, website, product interests.

Purpose: processing your enquiry, sending information, documentation and offers and, where applicable, initiating a business relationship.

The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry relates to the conclusion or performance of a contract; otherwise Art. 6(1)(f) GDPR, based on our legitimate interest in handling business enquiries effectively.

Technical implementation: Form data is transmitted in encrypted form to our web server, where it is not stored in a database but forwarded directly by email to our mailbox (mediect@aromabath.de). To protect against automated spam, we use an invisible check field and a timing check; no third-party CAPTCHA services are used. The mailbox and web server are operated by IONOS SE as a processor.

Retention: We delete your enquiry once it has been fully processed and no further communication is expected, generally no later than twelve months. If a business relationship is established, or if the communication qualifies as a commercial or business letter, statutory retention periods apply (Section 257 HGB, Section 147 AO: six or ten years).

6. Business relationships

In the context of existing business relationships with customers, suppliers and partners, we process contact and contract data of the respective contact persons (e.g. name, role, business contact details, order and invoice data). The legal bases are Art. 6(1)(b) GDPR (performance of contract), Art. 6(1)(c) GDPR (statutory retention obligations) and Art. 6(1)(f) GDPR (communication with contact persons at our business partners). The data is deleted after the end of the business relationship and the expiry of statutory retention periods.

Where necessary to perform a contract, we share data with service providers such as logistics and shipping companies, tax advisers or banks.

7. Cookies and device access

This website sets no cookies and does not access information on your device beyond what is technically necessary to display it (Section 25(2) No. 2 TDDDG). A consent banner is therefore not required. The scripts used serve only to operate the site (menu, product filter, form helper) and store no data.

8. Fonts

The fonts used on this website (“Instrument Serif”, “Manrope”, SIL Open Font License) are hosted locally on our server. No connection to Google or other third-party servers is established when you visit our pages.

9. Recipients and transfers to third countries

Apart from us, recipients of your data are exclusively our hosting and email provider (IONOS SE) as a processor and – in business relationships – the service providers named in section 6. This website does not transfer data to countries outside the EU/EEA. If you contact us from a third country or request information to be sent to a recipient in a third country, data is only transferred insofar as necessary to handle your enquiry (Art. 49(1)(b) GDPR).

10. Your rights

You have the following rights regarding your personal data:

• right of access (Art. 15 GDPR),
• right to rectification (Art. 16 GDPR),
• right to erasure (Art. 17 GDPR),
• right to restriction of processing (Art. 18 GDPR),
• right to data portability (Art. 20 GDPR),
• right to withdraw consent with effect for the future (Art. 7(3) GDPR).

To exercise your rights, simply send an informal message to mediect@aromabath.de.

11. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The supervisory authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
www.lda.bayern.de

12. Further information

Obligation to provide data

You are not legally or contractually obliged to provide your data. Without the data marked as required, however, we cannot process your enquiry.

Automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

External links

This website contains links to third-party websites (e.g. the supervisory authority). Data is only transferred to the respective provider once you click such a link; that provider alone is responsible for its data processing.

Changes

We will update this privacy policy whenever changes to the website or the legal situation require it. The version published here applies.