aromaneo
DE|EN
Legal

Privacy Policy

It matters to us that you know which data we process, when, and why. You'll find all the details here.

This is a courtesy translation for our English-speaking visitors. The German-language privacy policy ("Datenschutzerklärung") is the legally binding version under the EU General Data Protection Regulation (GDPR). In case of any discrepancy between the two versions, the German text governs.

1. Controller

The controller responsible for data processing on this website is:

Ioannidis & Ioannidis GbR
Ottonenstraße 9B
55218 Ingelheim am Rhein, Germany
Email: info@aromaneo.com

2. Hosting

This website is hosted by an external provider: Hostinger International Ltd., based in Lithuania (EU). When you access this website, our hosting provider automatically collects technical data (so-called server log files), including IP address, date and time of access, page accessed, browser used, and operating system. This data is technically necessary to display the website to you without errors and is automatically deleted after a short period. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and functional provision of the website).

3. Fonts

This website and our shop use fonts that are stored locally on our own server. No connection to third-party servers (e.g. Google) is established for this purpose when you visit our pages.

4. Cookies and local storage

We do not use cookies or similar technologies for analytics, statistics or marketing purposes. That is why we do not show a cookie banner – there is nothing we would need your consent for.

We only use storage that is strictly necessary to operate the website and the shop (Section 25(2) no. 2 TDDDG; the legal basis for the related processing is Art. 6(1)(b) and (f) GDPR):

  • Cart and order: Our shop (WooCommerce) sets cookies so that your cart is kept and checkout works (e.g. woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_…). They are deleted at the end of the session or after 48 hours at the latest.
  • Customer account: If you log in to your customer account, WordPress sets login cookies for the duration of the session (up to 14 days with “Remember me”).
  • Payment: For card payment, Klarna and express payment methods, our payment service provider Stripe loads a script that sets cookies for fraud prevention (__stripe_mid, __stripe_sid). See Section 6 for details.
  • Your browser's local storage: We store, for example, whether your cart contains items and whether you have already subscribed to the newsletter. This information stays on your device.

You can delete or block cookies in your browser at any time. However, the cart and checkout will then no longer work.

5. Contacting us by email and contact form

If you contact us by email, we store your details (email address, and where applicable your name and message) for the purpose of processing your inquiry. The legal basis is Art. 6(1)(b) GDPR (initiation or performance of a contract) or Art. 6(1)(f) GDPR (legitimate interest in responding to your inquiry). The data is deleted as soon as it is no longer required for processing.

For the contact form on our home page we use the service Web3Forms (web3forms.com). The data you enter (name, email address, message) is transmitted to Web3Forms and forwarded to us by email; your IP address is also processed for technical reasons. The legal basis is Art. 6(1)(b) GDPR (enquiry related to a contract) or Art. 6(1)(f) GDPR (legitimate interest in answering your enquiry). Where data is transferred to a country outside the EU, this only takes place on the basis of appropriate safeguards (e.g. EU standard contractual clauses).

6. Orders through our online shop

Purchases of our products are made through our online shop at aromaneo.com/shop, operated with the WooCommerce shop software on our own hosting. We process the resulting order data (e.g. name, delivery address, ordered items) to fulfil your order (Art. 6(1)(b) GDPR).

For payment processing we use the payment service provider Stripe (Stripe Payments Europe, Ltd., Ireland). Via Stripe we offer card payment and Klarna; if you pay with Klarna, your order and contact details are additionally transmitted to Klarna Bank AB (publ), Sweden, which may carry out an identity and credit check. For fraud prevention, our shop loads a script from Stripe, through which Stripe receives technical data (including IP address and browser information). If you pay in advance by bank transfer, we process the payment data transmitted to us by our bank. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (fraud prevention).

To ship your order, we pass on the necessary data (name, delivery address) to the shipping company we use (DHL). Legal basis is Art. 6(1)(b) GDPR.

To protect our shop against attacks and misuse, we use the security plugin Wordfence by Defiant, Inc. (USA). Access data such as IP address, pages visited and time are processed and compared against lists of known attackers; this may involve a transfer of IP addresses to Defiant, Inc. in the USA, which takes place on the basis of appropriate safeguards (e.g. EU standard contractual clauses). The legal basis is our legitimate interest in the security of our shop (Art. 6(1)(f) GDPR).

7. Customer account and product reviews

Customer account. When ordering, you can choose to create a customer account. For this we store your email address, name, address details and orders; you receive your password by email and can change it at any time. In your account you can see your orders and review products you have bought. The legal basis is your consent and the performance of the user relationship (Art. 6(1)(a) and (b) GDPR). You can have your account deleted at any time – a short message to info@aromaneo.com is enough. Data we must keep for tax and commercial law reasons (e.g. invoices) remains stored until the statutory retention periods expire.

Product reviews. If you review a product you have bought, we store and publish your star rating, your review text, the name you provide and the date. Your email address is not published. Only customers who have bought the product from us and are logged in to their customer account can leave a review; to check this, we match the review against your orders. The legal basis is your consent by submitting the review (Art. 6(1)(a) GDPR) and our legitimate interest in genuine, verifiable customer reviews (Art. 6(1)(f) GDPR). You can ask us to delete your review by email at any time.

8. Address suggestions at checkout (Google Maps Places)

9. Newsletter

At checkout you can optionally activate address suggestions. The Google Maps Places service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is only loaded once you click "Adressvorschläge aktivieren" (activate address suggestions). From that point on, what you type into the address field and technical data (including your IP address) are transmitted to Google in order to suggest matching addresses; a transfer to Google LLC in the USA cannot be ruled out. The legal basis is your consent given by clicking (Art. 6(1)(a) GDPR). Without a click, no data is transmitted, and you can always enter your address without this feature. More information: policies.google.com/privacy.

10. Security of our shop (Wordfence)

If you subscribe to our newsletter, we use your email address to send you information about our products, recipes and news. We send it using Hostinger Reach by Hostinger International Ltd. (based in Lithuania, EU). Subscription uses a double opt-in procedure: you first receive an email in which you confirm your subscription. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every email or by writing to info@aromaneo.com. We store your data until you unsubscribe.

11. External links

This website contains links to external sites (e.g. to our growing partner Aroma Mediterraneo). We have no influence over the content or data processing of these external sites; each site's own privacy policy applies.

12. Your rights

You have the right at any time to information about the personal data we hold about you (Art. 15 GDPR), to rectification of inaccurate data (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR), to data portability (Art. 20 GDPR), and to object to processing (Art. 21 GDPR). To exercise these rights, please contact info@aromaneo.com.

13. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (LfDI RLP)
Hintere Bleiche 34, 55116 Mainz, Germany
www.datenschutz.rlp.de

14. Changes to this privacy policy

We reserve the right to amend this privacy policy if the legal situation, the website, or the type of data processing changes. The version currently published on this page shall apply.

As of: September 2026