The rules published herein disclose our policy (“Policy”) concerning the personal data, which we collect through the websites  (“Website”) in connection with the use of the Website, its services, content and resources. The collection, processing and storing of personal data of the Users of the Services shall be carried out by “Aroma ” AD in its capacity of a personal data controller (“Controller”, “We”, “Us”)

Entry into effect: March 31 2021

Please read this Policy carefully before accessing the Website or its services. If you disagree with any of the terms, you should not access the Website or use our services products in any way or form. 

  1. Who are we?

Aroma AD is a company duly incorporated and operating according to the law of the Republic of Bulgaria with UIC 831643066  and seat and registered address at Sofia, 12 “Kiril Blagoev” Str.

  1. Validity and effect

This Policy determines what happens to your personal data that you provide through the Website during the process of using its services and resources.

“Data processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of your personal data.

The use of the Website, its services and resources requires confirmation that you are aware of and understand the nature and importance of this Policy and that you agree to be bound by it. Before using the services of the Website you must provide us with your express consent and agreement in the form of an affirmative opt-in that we may process your personal data in the ways set out in this Privacy Policy. You may provide your consent for the abovementioned actions by clicking on the “I agree” button when making a registration on the Website, when making a purchase without registration or when sending an inquiry using the contact form available on the Website.

The use of the Website and its services and resources requires the provision of your consent with the hereby Policy.

The collection, processing and storage of your personal data is done in compliance with the Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data, as well as with the applicable Bulgarian and European legislation.

We reserve our right to make amendments to this Policy at any given time at our own discretion. The new versions will be published on the Website.

In case you disagree with the changes you should notify us in writing, after which your data stored will be deleted.

 “Personal data” are all data which contains identifiable information (e.g. name, address, telephone number, email, etc.). Before we collect and process your personal data we must receive your explicit, freely given, specific, informed and unambiguous consent.

The Policy published herein is applicable and valid for all users of the services of the Administrator, available through the Website. This Policy does not apply to social networks, other websites, platforms or companies, which the Administrator does not control but which give a link to or are connected directly or indirectly with the provided Services. You should be informed that those websites, platforms and companies have their own policies for the protection of personal data, for which we are not liable. You should become acquainted with the privacy policies of those other websites, platforms and companies before providing your personal data to them.

  1. Data we collect about you

You have the right to access the Website without providing your personal data or registration. However, the access to the services of the Website requires the provision of personal data,
Data provided by you

The use of the Website requires for you to be above the age of 16.

When sending an inquiry using the contact form available on the Website, you will be asked to provide the following data:

  • first and last name;
  • email address;
  • subject and description of your inquiry.

Providing us with optional data during the process of using the Website services is entirely on the user’s discretion. All optional data which you provide us with when using the Website or in another form of communication with us, which we did not explicitly ask for but you provided us with, will be treated as personal data, provided after explicit consent for processing. Such personal data will be treated in a legal fashion by applying the principles of minimization and limitation.

The user is liable for the provided contact information and other data which are incorrect, false or are regarding third persons (in any case whenever those third persons did not give their consent), as well as for all kinds of illegal or malicious processing of personal data and information.

We do not collect personal data which:

  • reveals racial or ethnic background;
  • reveals political, religious or philosophic beliefs;
  • reveals membership in political parties or organizations or other religious, philosophical, political or syndicate structures;
  • is regarding the user’s health condition, sex life or the human genome unless in the cases when a signal for unwanted side effects as a result of the use of the cosmetics is received;
  • is provided by users under the age of 16 without the consent of their parents or legal guardians. The Administrator will delete all information provided by or regarding users who are under the age of 16 and did not receive the consent of their parents or legal guardians for the use of the Website, its services and content.

Data we collect automatically

Each time you visit the Website, we will automatically collect the following data:

Device Information

  • We collect device-specific information (such as your hardware model, operating system version, unique device identifiers).

Location information

  • When you use the Website, we may collect and process information about your actual location. We use various technologies to determine location, including IP address, GPS, Wi-Fi access points and cell towers

Information we collect during the use of the Website services

  • Information regarding other websites, which link to the Website, as well as such which the Website links to, date and hour of visit, visit duration, loading speed of the Website and other data regarding your interaction with the Website.


  • This Website uses cookies. A cookie is a file containing an identifier (a string of letters and numbers) that is sent by a web server to a web browser and is stored by the browser. The identifier is then sent back to the server each time the browser requests a page from the server.
  • Cookies do not typically contain any information that personally identifies a user, but personal information that we store about you may be linked to the information stored in and obtained from cookies.
  • This website uses the following types of cookies:
    • “session cookies” which are erased when the user closes the browser;
    • “persistent cookies” which remain on the user’s computer/device for a pre-defined period of time;
    • “first-party cookies” which are set by the web server of the visited page and share the same domain;
    • “third-party cookies” stored by a different domain to the visited page’s domain. This can happen when the webpage references a file, such as JavaScript, located outside its domain.
  • We may permit third parties, such as advertisers or analyst providers, to collect information using these technologies directly from our Website. The data which they collect is subject to the applicable privacy policy of the respective third party.
  • This Website uses the marketing services of Google Analytics for Display, more specifically the remarketing service. This service allows the targeting of advertisements to visitors of the Website.
    You have the right to block advertisements from Google Analytics for Display and your exposure to advertisements from the Google Display Network. To do so, visit the Ads Preferences Manager ( and install the Analytics Opt-out Browser Add-on (
    The Website uses remarketing for the purposes of online advertising, which means that users who did not refuse Google Display Network’s access in one of the abovementioned methods, may be exposed to advertisements of the Website in Google’s content network. Third parties like Google or Facebook may display advertisements of the Website in the websites from their content network (like Google Analytics and DoubleClick cookies) which contributes to the optimization of advertising based information, received from previous visit by users on the Website.
  • Every user has the option to accept or decline the use of cookies by clicking on one of the available options when accessing the Website for the first time: “I accept the use of cookies”/”I decline the use of cookies”. You should be informed that there are certain categories of cookies which are necessary for the integral and full provision of the services of the Website. In case you decline the use of cookies, you should be informed that your access to the services and resources of the website may be completely or partially restricted.
  • Users always have the option to decline the use of cookies by changing the settings of their browser. To learn more on cookie setting for a specific browser, read here:
  • You should be informed that declining the use of cookies by the User may result in disruptions in the functionalities and the Services of the Website.
  1. For what purposes do we process your personal data?

We need the collected personal data to provide you with quality services and to provide timely technical and other assistance upon request.

We use the provided data as follows:

  • To provide the normal functioning of all services of the Website,
  • To provide secure and reliable use of services and content by verifying your access rights to the requested services and resources;
  • To improve permanently the quality of our products and services by receiving your proposals, advices and ideas for improvement of the existing and the launching of new products and services through our Website;
  • To send to you news, e-bulletins, , interesting and useful information and other notifications;
  • To invite you to take part in questionnaires and surveys of the opinion of users about the quality and the satisfaction with the offered Services and our website;
  • For other purposes not forbidden by law regarding the quality provision of all current and future services and resources on the Website.

In case of a change in the purposes we will inform you and require your explicit consent for the processing of your personal data in accordance with the new purposes.

  1. Who has access to your personal data?

Your personal data will not be transferred to third parties, unless

  • we have your express authorization for this;
  • the third parties in question provide support to us, under an agreement, for the supply of our products or the provision of our services to you;
  • it is required by law or when requested by a public authority;
  • when this is necessary to protect the rights, property and security of users of the Website or other public interest; or
  • in connection with the sale of a business, our company or its assets, subject to confidentiality obligations.

Our employees and consultants will have access to your personal data for the purposes of managing the Website and services, but are bound by a confidentiality obligation regarding the data to which they have access as part of the relevant operations.

Our employees and consultants are duly informed of the importance of the compliance with such confidentiality legal duty and are liable for the compliance with that obligation.

We may share data which does not identify you personally with our market partners (medias, marketing agencies and other business partners who have accepted to be bound by this Policy) with the purpose of providing you, after receiving your consent, with information regarding products and services, as well as promotions and offers.

We may disclose your personal data where such disclosure is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person. We may also disclose your personal data where such disclosure is necessary for the establishment, exercise or defense of legal claims, whether in court proceedings or in an administrative or out-of-court procedure. In case of disclosing personal data to a public authority in relation to an investigation or proceedings against a user, we are not obliged to notify said user for this disclosure.

  1. Your rights

Under the legislation in force, you are entitled to object, at any time and free of charge, to the processing of your personal data, by sending us a written request or by notifying us on the following email address:

You are entitled to be informed every time before your personal data is transferred for the first time to third parties for the purposes of direct marketing, or when they are used on behalf of third parties. You are also entitled to object to this transfer or use, at any time and free of charge.

You are entitled to receive access upon notification to the personal data we store about you in a structured, commonly used and machine-readable format, by sending us a written request or by notifying us on the following email address:

You are entitled to request the portability of your personal data to another data controller by sending us a written request or by notifying us on the following email address:

If any of the data we have about you is incorrect or inaccurate, you may correct it by changing the information on your profile, by sending us a written request or by notifying us on the following email address:

You are also entitled to request the complete erasure of your personal data by sending us a written request or by notifying us on the following email address:

You may also request a restriction on the processing of your personal data with regard to specific actions on collection, processing or transferring by sending us a written request or by notifying us on the following email address:

You are also entitled to request that third parties are notified about the rectification, erasure or restriction on the processing of your data so that these third parties comply with the respective request made by you.

In addition, you are entitled to file a complaint with the controlling authority which in Bulgaria, is the Commission for personal data protection  (CPDP) with address: 1592 Sofia, 2 “Tsvetan Lazarov” Blvd..

  1. Personal data storage and retention period

The data we collect about you will be stored on servers located within the Republic of Bulgaria.

We shall store the personal data provided by you for a period not longer than necessary for the accomplishment of the abovementioned purposes or until the termination of the Services and/or the Website.

By exception, we are entitled to further retention of the personal data where it is necessary, for exercising the right of freedom of expression and information, for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority vested in us in our capacity of Controller, on the grounds of public interest in the area of public health, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or for the establishment, exercise or defence of legal claims.

  1. Technical and organizational security measures. Risks

Being a personal data controller, we shall take all required technical and organizational measures in order to protect the data from accidental or illegal destruction or from accidental loss, from unauthorized access, amendment or distribution, as well as other illegal forms of processing.

Measures are consistent with the modern technological achievements and ensure level of protection, which corresponds to the risks associated with the processing and the type of the data, which must be protected.

All the information we receive from you will be stored on secure servers and we will implement technical and organizational measures that are suitable and necessary for your personal data to be protected with an appropriate level of security that will guarantee, in particular, the confidentiality and integrity of the data and prevent the destruction, the accidental or unlawful loss or changes, or the unauthorized disclosure or access of data.

Notwithstanding the measures implemented to protect your data, you should be aware that the transfer of data through the Internet or other open networks is never completely secure and there is the risk that your data will be seen and used by unauthorised third parties.

  1. Contacts

For additional information, complaints or requests for exercising of your legal rights, you can contact us at:

  • address: Sofia, 12 “Kiril Blagoev” Str.;
  • telephone: 02/9350304;
  • email:;
  • Contact form;

For direct contact with our Data Protection Officer:

This policy enters into effect on March 31 2021 and is in compliance with the requirements of Regulation (EU) 2016/679 of the European parliament and the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).