Privacy policy

Last updated: October 2026

The protection of your personal data matters to us. This privacy policy explains which personal data we process when you visit our online shop Aromahain (https://aromahain.com/en-ie) and when you place an order, for which purposes, on which legal basis, and which rights you have. We are a business established in the European Union and process personal data in line with the EU General Data Protection Regulation (GDPR). We offer the rights described below to all customers, including customers in Ireland.

1. Controller

Alessandro Brozzi (sole trader)
Aromahain
Via della Magliana 188
00146 Rome
Italy
Email: info@aromahain.com
VAT ID: IT18319051001

No data protection officer has been appointed because the legal requirements for doing so are not met. For questions about data protection, please contact us directly at the details above.

2. General information on data processing

We process personal data only as far as this is necessary to provide a working online shop, to handle orders, to meet legal obligations or, based on your consent, for marketing. Depending on the processing, the legal bases are: your consent (for example marketing cookies, newsletter); performance of a contract or steps before a contract (for example order handling, customer account, enquiries); compliance with legal obligations (for example tax and commercial record keeping); and our legitimate interests (for example security and stability of the shop, fraud prevention, establishing legal claims).

Where information is stored on or read from your device (cookies and similar technologies), technically unnecessary storage and access take place only with your consent.

3. Hosting and shop system: Shopify

Our online shop runs on the e-commerce platform Shopify. The provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland, a subsidiary of Shopify Inc., 151 O'Connor Street, Ground floor, Ottawa, ON, K2P 2L8, Canada.

Shopify provides the technical infrastructure of the shop (hosting, content delivery network, database, checkout, customer accounts, shipping and order management). All data collected in the shop, in particular order, customer and usage data, is processed on Shopify's servers. Shopify processes this data on our behalf as a processor, under a data processing addendum we have concluded with Shopify. Shopify may also process data on servers outside the EU/EEA, in particular in Canada and the USA, relying on an adequacy decision for Canada, on the standard contractual clauses of the European Commission and, where the recipient is certified, on the EU-U.S. Data Privacy Framework. More information: https://www.shopify.com/legal/privacy.

4. Server log files

When you open our shop, Shopify automatically records information that your browser sends, in so-called server log files: IP address of the requesting device, date and time of access, page or file requested and amount of data transferred, referrer URL, browser type and version, operating system and language settings. This is done to ensure a smooth connection, for system security, error analysis and fraud prevention, based on our legitimate interests. The data is not merged with other data sources and is deleted after a short time unless it is needed longer for security purposes.

5. Cookies and consent management (cookie banner)

Our shop uses cookies and similar technologies (for example local storage, pixels). Cookies are small text files stored on your device.

Strictly necessary cookies are required to run the shop, for example for the cart, login to the customer account, checkout, storing your cookie settings, security and fraud prevention. They do not need consent.

Analytics and marketing cookies (see sections 12 and 13) are used only if you have agreed to them in our cookie banner. To manage your consent we use the cookie banner integrated into Shopify (Customer Privacy). You can decline, choose individual categories or accept all. You can withdraw or change your consent at any time with effect for the future by opening the cookie settings again through the "Cookie settings" link in the footer of our shop, where it is shown. You can also manage and delete cookies in your browser settings; if you disable all cookies, the shop may not work fully.

6. Orders and performance of the contract

When you order in our shop, we collect the data needed to perform the contract: first and last name, billing and delivery address, email address and, where needed, phone number (for delivery queries and shipping notifications), order data (products, quantity, price, order number, order date), payment data or chosen payment method (the actual payment details such as card numbers are processed only by the respective payment provider), and IP address and time of the order (for proof and fraud prevention).

The purpose is to carry out the contract of sale, including payment, shipping, invoicing, handling returns, consumer guarantee cases and customer enquiries. The legal basis is performance of the contract; storing the IP address for fraud prevention is based on our legitimate interests. We pass data on only as far as necessary to perform the contract, in particular to our supplier dōTERRA and the carrier (section 8) and the payment providers (section 9).

We are legally required to keep invoices and business correspondence under commercial and tax law, which is usually several years under Italian law. After the periods end, the data is deleted unless other legal retention duties or legitimate interests (for example ongoing consumer guarantee cases) require otherwise.

7. Customer account

You can optionally create a customer account in our shop. For this we process your email address and, depending on the login method, a password or a one-time code sent by email. Your orders, addresses and settings are stored in the account so that you do not have to enter them again. You can have your account deleted at any time by writing to info@aromahain.com. Data we must keep because of legal retention duties is blocked until the periods end and then deleted.

8. Delivery by our supplier dōTERRA and carriers

Your order is shipped to you by our supplier dōTERRA through a parcel carrier. For this we pass your name, delivery address, the ordered items and, where needed for delivery, your telephone number to dōTERRA (dōTERRA International, LLC, 389 South 1300 West, Pleasant Grove, UT 84062, USA, or the dōTERRA company responsible for the dispatch) and the carrier. The data is passed on because it is necessary to perform the contract. Passing your email address or phone number to the carrier for tracking, parcel announcement or arranging a delivery time takes place, where legally required, only with your consent, which you can give at checkout and withdraw at any time with effect for the future. Transfers to the USA rely on the EU-U.S. Data Privacy Framework or on standard contractual clauses.

9. Payment providers

For payment we use, depending on the payment method you choose at checkout, the payment providers integrated into the Shopify checkout (for example Shopify Payments, which uses Stripe, and PayPal). We pass on the data needed to process the payment (name, billing address, email address, order amount, currency, order number and, where needed, cart contents and delivery address). You enter the payment details themselves directly with the payment provider; they are not stored on our systems. The legal basis is performance of the contract. Where payment providers process data for fraud prevention, they do so as independent controllers based on their legitimate interests. The providers' own privacy policies apply, for example https://stripe.com/privacy and https://www.paypal.com/webapps/mpp/ua/privacy-full.

10. Contacting us (email, phone, contact form)

If you contact us by email, phone or a contact form, we process the data you give us (name, email address, phone number if given, order number and the content of your message) to handle your enquiry. The legal basis is performance of the contract where the enquiry relates to a contract, otherwise our legitimate interest in answering enquiries. The data is deleted once the enquiry is finally dealt with and no legal retention duties apply.

11. Transactional emails and newsletter

Transactional emails: as part of order handling we send you emails needed to perform the contract (order confirmation, shipping confirmation, invoice, refund confirmation, information on the customer account).

Newsletter: if you sign up for our newsletter, we use your email address (and optionally your name) to send you information on products and news from Aromahain. Sign-up uses a double opt-in procedure: you receive an email with a confirmation link, and the newsletter is sent only after you confirm. We log the sign-up (time, IP address) as proof of consent. The legal basis is your consent. Sending uses Shopify Email (processor: Shopify, see section 3). You can unsubscribe at any time with the link at the end of every email or by writing to info@aromahain.com.

Abandoned cart reminders: if you entered your email address at checkout but did not complete the order, we send a reminder email only if you agreed at checkout to receive marketing emails.

12. Web analytics

12.1 Shopify Analytics. Shopify provides us with statistics on the use of the shop (for example page views, conversion rate, origin of visitors, devices used). Where cookies that are not strictly necessary are used for this, this happens only with your consent in the cookie banner. Without consent, analytics data is processed only in aggregated or anonymised form.

12.2 Google Analytics 4. If you have consented, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It uses cookies and similar technologies to analyse the use of our shop (for example pages viewed, time spent, approximate location, device, interactions, purchases). Google Analytics 4 shortens the IP address by default and does not store it. The information is usually transferred to servers of Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework; standard contractual clauses are also used. The legal basis is your consent, which you can withdraw at any time in the cookie settings. User and event data are stored for 14 months. More information: https://policies.google.com/privacy.

13. Online marketing and advertising

We use the following marketing tools only with your consent, given in our cookie banner and revocable at any time in the cookie settings. Without your consent the technologies below are not loaded.

13.1 Google Ads and conversion tracking. We use Google Ads of Google Ireland Limited to advertise our shop in Google search results and the Google advertising network. If you reach our shop through a Google ad, Google sets a conversion cookie that lets us see whether you took a certain action after clicking the ad (for example a purchase). We receive only statistics and cannot identify you personally. We may also use Google Ads remarketing and enhanced conversions, where hashed order data (for example an email address) is sent to Google to improve conversion measurement. Data may be transferred to Google LLC in the USA (EU-U.S. Data Privacy Framework, standard contractual clauses). More information and settings: https://policies.google.com/privacy and https://adssettings.google.com.

13.2 Meta pixel (Facebook / Instagram) and Conversions API. We use the Meta pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. It lets us follow the behaviour of visitors after they reach our shop by clicking a Facebook or Instagram ad, measure the effect of our ads and show interest-based ads to visitors of our shop on Facebook and Instagram (custom audiences, retargeting). Captured are, among others, page views, product views, cart and purchase events, device information and, if you are logged in to Meta, the link to your Meta account. The Conversions API may also be used, sending event data (for example a hashed email address, order value) from the server through Shopify to Meta. We and Meta are joint controllers for the collection and transfer of the data; further processing by Meta is under its sole responsibility (https://www.facebook.com/legal/controller_addendum). Data may be transferred to Meta Platforms, Inc. in the USA. More information: https://www.facebook.com/privacy/policy; ad settings: https://www.facebook.com/adpreferences.

13.3 Google Shopping / Google Merchant Center. Our products may be listed in Google Shopping through the Google Merchant Center. For this we send product data (no personal customer data) to Google. If you reach our shop through Google Shopping, section 13.1 applies.

14. Social media presences

We maintain profiles on social networks (for example Instagram, Facebook) to communicate with customers and interested people. When you visit these profiles, the network operator processes your data under its own responsibility; we receive only aggregated statistics. Our website has no social media plugins that transmit data merely by loading a page; links to our profiles are plain links.

15. Recipients and transfers to third countries

Recipients of your data are only the service providers named in this policy (Shopify as processor, payment providers, carriers and our supplier dōTERRA, marketing and analytics providers) and, where legally required, authorities, tax advisers or legal advisers. Data is transferred to countries outside the EU/EEA only if there is an adequacy decision of the EU Commission (for example Canada, EU-U.S. Data Privacy Framework), appropriate safeguards such as standard contractual clauses have been agreed, or you have expressly consented.

16. Storage period

Unless stated otherwise in this policy, we store personal data only as long as necessary for the respective purpose. Contract and invoice data is deleted after the legal retention periods end. Data processed on the basis of consent is deleted after you withdraw consent, unless another legal basis allows further storage. Cookie data is deleted after the respective cookie lifetime.

17. Your rights

You have the following rights regarding your personal data: access (including a copy of the data); rectification of inaccurate data; erasure where the legal conditions are met; restriction of processing; data portability for data you gave us that we process by automated means based on consent or a contract; objection, at any time, to processing based on legitimate interests, and to processing for direct marketing; withdrawal of consent at any time with effect for the future (cookie consents in the cookie settings, newsletter with the unsubscribe link, otherwise a message to info@aromahain.com); and the right not to be subject to a decision based solely on automated processing. We make no decisions based solely on automated processing that have legal effect.

To exercise your rights, an informal message is enough: Alessandro Brozzi, Via della Magliana 188, 00146 Rome, Italy, email info@aromahain.com. In cases of doubt we may ask for proof of identity to protect your data from unauthorised access.

18. Right to complain to a supervisory authority

You have the right to complain to a data protection supervisory authority if you believe that the processing of your personal data breaches the GDPR. The authority responsible for us is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy, https://www.garanteprivacy.it. You can also contact the data protection authority of your country of residence.

19. Obligation to provide data

Providing your personal data is not required by law or contract. To conclude and carry out a contract of sale, however, the data named in section 6 is necessary; without it we cannot fulfil your order. Giving consent for analytics and marketing is always voluntary and does not affect your ability to shop in our store.

20. Data security

Data in our shop is transmitted encrypted via TLS/SSL (shown by "https://" and the lock symbol in your browser's address bar). We and our processors use technical and organisational measures to protect your data against loss, misuse and unauthorised access.

21. Changes to this privacy policy

We may adapt this privacy policy so that it always meets current legal requirements or reflects changes to our services. The version current at your next visit applies.

22. Note on dōTERRA

Aromahain is an independent retailer (Independent Wellness Advocate). dōTERRA® is a registered trademark of dōTERRA Holdings, LLC. This shop is not operated by dōTERRA. We pass your data to dōTERRA only to the extent described in section 8 so that the goods can be delivered to you; dōTERRA does not use it for advertising.