1. Who we are
Bathing Aromas (“we”, “us”) operates the webshop at https://aromasalt.shop and is responsible for the processing of personal data collected through it (the “data controller” under the EU General Data Protection Regulation, GDPR). Our registered address is Ijbruglaan 1495, 1087 KM Amsterdam, the Netherlands. For any privacy question you can contact us at [email protected].
2. What data we collect
Depending on how you use our shop, we may process:
- Account and order data: name, email address, billing and shipping address, phone number, order history.
- Payment data: transaction details and the last digits of your payment instrument. Full card data is processed by our payment providers; we do not store it ourselves.
- Technical data: IP address, device and browser type, pages visited and time of visit, collected through server logs and cookies.
- Communication data: messages you send to us by email or through contact forms.
3. Why we process your data and on what legal basis
- To perform our contract (Art. 6(1)(b) GDPR): processing orders, delivering products, handling returns and providing customer support.
- To comply with legal obligations (Art. 6(1)(c) GDPR): tax, accounting and record-keeping duties.
- For our legitimate interests (Art. 6(1)(f) GDPR): securing our website, preventing fraud, and improving our products and services.
- With your consent (Art. 6(1)(a) GDPR): where you subscribe to a newsletter or accept non-essential cookies. You can withdraw consent at any time.
4. Cookies
We use essential cookies that are necessary for the shop to function (for example, the shopping cart and login session). With your consent we also use analytics and marketing cookies to understand how the site is used and to show relevant advertising. You can manage your cookie preferences at any time through the cookie banner or your browser settings.
5. Who we share data with
We share personal data only where necessary, and only with parties that process it on our behalf or have an independent legal basis:
- Payment service providers, to process your payment securely.
- Shipping carriers, to deliver your order.
- IT and hosting providers that operate our website and email.
- Accounting and tax advisers, where required by law.
Where a provider processes data outside the EEA, we ensure appropriate safeguards such as the EU Standard Contractual Clauses.
6. How long we keep your data
We keep order and invoice data for as long as required by Dutch tax law (generally seven years). Account data is kept while your account is active and deleted on request. Marketing data is kept until you unsubscribe. Server logs are kept for a short, limited period for security purposes.
7. Your rights
Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent at any time. You can exercise these rights by contacting us at [email protected]. You also have the right to lodge a complaint with a supervisory authority; in the Netherlands this is the Autoriteit Persoonsgegevens.
8. Security
We take appropriate technical and organisational measures to protect your data, including encrypted transport (HTTPS), access controls and regular updates. No method of transmission over the internet is completely secure, but we work continuously to safeguard your information.
9. Children
Our shop is not directed at children. We do not knowingly collect personal data from children under the age of 16. If you believe a child has provided us with personal data, please contact us so we can delete it.
10. Changes to this policy
We may update this Privacy Policy from time to time. The current version is always published on this page.
Last updated: 2026.