Privacy Policy
Last updated: 17 August 2026
Your privacy matters, and this page explains in plain terms what happens to your data when you visit this website. If anything here is unclear, please just ask.
1. Who is responsible for your data
The controller responsible for processing personal data on this website is:
Aroma Essential Oils
Maria Popescu
Am Rosenberg 1, 1130 Vienna, Austria
Email: contact@aromaessentialoils.eu
We have not appointed a Data Protection Officer, as we are not required to do so.
2. What we collect, why, and on what legal basis
a) Server log files
When you open any page, our hosting provider automatically records technical information: your IP address, the date and time of the request, the page requested, the referring page, your browser type and version, and your operating system.
- Why: to deliver the website, keep it stable and secure, and investigate technical faults or attacks.
- Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in operating a secure, functioning website.
- Retention: log files are kept only for a short period by our hosting provider and are then deleted or overwritten automatically.
b) Contact form
If you send us a message through the contact form, we process the details you enter — typically your name, your email address and your message.
- Why: to read and answer your enquiry.
- Legal basis: Art. 6(1)(b) GDPR where your message concerns a possible or existing arrangement between us; otherwise Art. 6(1)(f) GDPR, our legitimate interest in responding to people who contact us.
- Retention: we keep enquiries for as long as needed to deal with them and to handle any follow-up, then delete them. Where statutory retention periods apply, we keep the data until those expire.
c) Contact by email, telephone, WhatsApp or social media
If you contact us directly by email, phone, WhatsApp, Facebook or Instagram, we process whatever information you choose to share in order to reply. Please note that WhatsApp, Facebook and Instagram are operated by Meta Platforms Ireland Ltd. and that messages sent through those services are also processed by Meta under its own privacy terms, which we do not control.
d) Website security
This website uses security software that records IP addresses and login attempts in order to detect and block attacks such as brute-force login attempts and spam.
- Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in site security.
e) Newsletter and delivery through Brevo
Our newsletter is sent through Brevo, a service of Brevo SAS, 106 boulevard Haussmann, 75008 Paris, France. Your email address and the details you give (optionally your country) are processed on servers within the European Union. A data processing agreement under Article 28 GDPR is in place with Brevo.
Subscription uses double opt-in: after you sign up you receive an email asking you to confirm. Your address is stored only after you confirm. The sign-up, the confirmation and their timestamps are logged so that consent can be evidenced.
The legal basis is your consent under Article 6(1)(a) GDPR. You may withdraw it at any time with future effect, through the unsubscribe link in every email or by writing to us. After withdrawal your address is deleted; the consent log is kept for as long as it is needed as evidence. We do not use Brevo website tracking.
3. Cookies, analytics and advertising
Beyond the storage strictly necessary to make the site work, this website uses services that store identifiers and process data for analytics and advertising. These are only loaded once you have given your consent via the banner, and you can change or withdraw your choice at any time using the settings link.
Legal basis for all non-essential storage: your consent — Art. 6(1)(a) GDPR and §165 TKG 2021. Withdrawing consent does not affect the lawfulness of processing carried out beforehand.
a) Google Analytics 4
We use Google Analytics, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand in aggregate how the site is used — which pages are read, how visitors arrive, and which content is worth developing.
Google Analytics processes information including a randomly generated identifier, your truncated IP address, the pages you view and your approximate location.
b) Google AdSense
This website displays advertising served by Google AdSense, a service of Google Ireland Limited. AdSense and its partners may process data — including your IP address, the pages you visit and interactions with adverts — to select and measure adverts. If you consent to personalised advertising, this may include building an interest profile.
You can review and change your Google advertising preferences at any time at adssettings.google.com.
c) Google Programmable Search
The search box on this site is provided by Google Programmable Search (Google Ireland Limited). When you use it, your search term and technical information about your device are transmitted to Google.
d) Website translation
This site offers machine translation of its content. Where translation is served through the provider servers, technical data about your request may be transmitted to them.
e) Transfers outside the EU
Although our contracting party for the Google services above is Google Ireland Limited, data may be transferred to and processed on servers of Google LLC in the United States. Google LLC is certified under the EU–U.S. Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection; transfers are additionally covered by the European Commission Standard Contractual Clauses. You should nonetheless be aware that data processed in the United States may in principle be accessible to US authorities, and that this is a recognised risk of consenting to these services.
4. Links to the official doTERRA shop
This website contains links to the official doTERRA online shop. When you follow one of these links you leave aromaessentialoils.eu, and any data you then provide — including any purchase, registration or payment details — is processed by dōTERRA and governed by dōTERRA own privacy policy, not by this one. We have no access to your doTERRA account, your order details, your payment information or your address.
If you purchase or enrol through one of these links, we may be credited as the referring Wellness Advocate and may receive commission or referral credit. What we can see as a result is limited to what dōTERRA makes available to Wellness Advocates in its own systems; we never receive your payment details.
5. Who else sees your data
We do not sell your personal data and we do not pass it to third parties for their own marketing. Data is shared only with:
- our hosting provider, Cloud Data Hosting S.R.L. (DataHost.ro), Str. Clopoțeilor 10, Cluj-Napoca, Romania, which stores the site and its data on our behalf;
- the service providers named in section 3, and only where you have consented;
- our email delivery provider, where used to send you a reply;
- public authorities, where we are legally obliged to disclose.
6. How long we keep things
We keep personal data only as long as necessary for the purpose it was collected for, or as long as statutory retention periods require. Log files and security records are kept short-term as described above; enquiries are deleted once they are resolved and no longer needed.
7. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17);
- restrict processing (Art. 18);
- receive your data in a portable format (Art. 20);
- object to processing based on our legitimate interests (Art. 21);
- withdraw consent at any time, with future effect (Art. 7(3)).
To exercise any of these, email contact@aromaessentialoils.eu. We will respond within one month.
You also have the right to complain to a supervisory authority. In Austria this is:
Österreichische Datenschutzbehörde
Barichgasse 40–42, 1030 Vienna, Austria
Email: dsb@dsb.gv.at · Web: dsb.gv.at
8. Children
This website is intended for adults. We do not knowingly collect personal data from children. Products and recipes described on this site are presented for general adult use.
9. No automated decision-making
We do not use your personal data for automated decision-making or profiling that produces legal effects for you.
10. Changes to this policy
We may update this policy when the site or the law changes. The current version is always available at this address, with the date of last revision at the top.