aromaneo
DE
Legal

Privacy Policy

It matters to us that you know which data we process, when, and why. You'll find all the details here.

This is a courtesy translation for our English-speaking visitors. The German-language privacy policy ("Datenschutzerklärung") is the legally binding version under the EU General Data Protection Regulation (GDPR). In case of any discrepancy between the two versions, the German text governs.

1. Controller

The controller responsible for data processing on this website is:

Ioannidis & Ioannidis GbR
Ottonenstraße 9B
55218 Ingelheim am Rhein, Germany
Email: info@aromaneo.com

2. Hosting

This website is hosted by an external provider: Hostinger International Ltd. (Larnaca, Cyprus, EU). When you access this website, our hosting provider automatically collects technical data (so-called server log files), including IP address, date and time of access, page accessed, browser used, and operating system. This data is technically necessary to display the website to you without errors and is automatically deleted after a short period. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and functional provision of the website).

3. Fonts

This website and our shop use fonts that are stored locally on our own server. No connection to third-party servers (e.g. Google) is established for this purpose when you visit our pages.

4. Cookies and local storage

We do not use cookies or similar technologies for analytics, statistics or marketing purposes. That is why we do not show a cookie banner – there is nothing we would need your consent for.

We only use storage that is strictly necessary to operate the website and the shop (Section 25(2) no. 2 TDDDG; the legal basis for the related processing is Art. 6(1)(b) and (f) GDPR):

  • Cart and order: Our shop (WooCommerce) sets cookies so that your cart is kept and checkout works (e.g. woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_…). They are deleted at the end of the session or after 48 hours at the latest.
  • Customer account: If you log in to your customer account, WordPress sets login cookies for the duration of the session (up to 14 days with “Remember me”).
  • Payment: So that payment works, our shop loads scripts from PayPal and Stripe (js.stripe.com) in the cart and at checkout, which may use cookies or similar technologies of the respective provider for secure payment processing and fraud prevention. See Section 6 for details.
  • Your browser's local storage: We store, for example, whether your cart contains items and whether you have already subscribed to the newsletter. This information stays on your device.

You can delete or block cookies in your browser at any time. However, the cart and checkout will then no longer work.

Audience measurement without cookies

To understand which pages and products are of interest, we count page views and individual clicks (e.g. “Add to cart” or “Notify me”) using our own script, which is evaluated on our server at Hostinger. No cookies are set and nothing is stored on your device. We record the page visited, the website you came from (domain name only) the approximate screen width (phone, tablet or computer) and the country of origin. The country is determined from your IP address directly on our server using a locally stored country database (DB-IP Lite); the IP address is not transmitted to anyone for this purpose and is not stored. To count visitors per day, a shortened check value is generated from your IP address and browser identifier together with a random value that is newly created each day; it is deleted after 25 hours at the latest. We do not store your IP address itself for this purpose. Only aggregated figures that do not allow any conclusions about you are stored, and no data is passed on to third parties. The legal basis is our legitimate interest in designing our offer according to demand (Art. 6(1)(f) GDPR). If your browser sends a “Do Not Track” signal, no counting takes place.

5. Contacting us by email and contact form

If you contact us by email, we store your details (email address, and where applicable your name and message) for the purpose of processing your inquiry. The legal basis is Art. 6(1)(b) GDPR (initiation or performance of a contract) or Art. 6(1)(f) GDPR (legitimate interest in responding to your inquiry). The data is deleted as soon as it is no longer required for processing.

For the contact form on our home page we use the service Web3Forms (web3forms.com). The data you enter (name, email address, message) is transmitted to Web3Forms and forwarded to us by email; your IP address is also processed for technical reasons. The legal basis is Art. 6(1)(b) GDPR (enquiry related to a contract) or Art. 6(1)(f) GDPR (legitimate interest in answering your enquiry). Where data is transferred to a country outside the EU, this only takes place on the basis of appropriate safeguards (e.g. EU standard contractual clauses).

Enquiries via the “For businesses” form: If you send us a business enquiry via this form, we process your details (name, company, email address, phone number if provided, volume and message) to handle your enquiry. The details are forwarded by our web server as an email to our business mailbox, which is hosted by Google (Gmail, Google Ireland Limited); a transfer to the USA cannot be ruled out (Google is certified under the EU-US Data Privacy Framework). The legal basis is Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR (legitimate interest in handling business enquiries). We delete the details once the enquiry has been completed, unless statutory retention obligations apply.

6. Orders through our online shop

Purchases of our products are made through our online shop at aromaneo.com/shop, operated with the WooCommerce shop software on our own hosting. We process the resulting order data (e.g. name, delivery address, ordered items) to fulfil your order (Art. 6(1)(b) GDPR).

We offer payment in advance (bank transfer), PayPal and credit/debit card, Klarna, Apple Pay and Google Pay (via WooPayments / Stripe). If you pay in advance, we process the payment data transmitted to us by our bank. If you choose PayPal (including the payment methods offered via PayPal, e.g. direct debit, credit/debit card or “Pay Later”), we transmit the data required for payment (including name, address, email address, order number and invoice amount) to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal may carry out an identity and credit check, in particular for direct debit, card payment or “Pay Later”. To display the payment buttons and for fraud prevention, our shop loads a script from PayPal, through which PayPal receives technical data (including IP address and browser information). Where data is transferred to PayPal companies in the USA, this is done on the basis of appropriate safeguards (EU-US Data Privacy Framework or EU Standard Contractual Clauses). More information: paypal.com/de/legalhub/privacy-full. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (fraud prevention).

Credit/debit card, Klarna, Apple Pay and Google Pay (WooPayments / Stripe): We process these payment methods via WooPayments, a service of the Automattic group (for the EU: Aut O’Mattic A8C Ireland Ltd., Business Centre, No. 1 Lower Mayor Street, International Financial Services Centre, Dublin 1, Ireland), with the payment service provider Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). If you choose one of these methods, we transmit the data required for payment (including name, billing and delivery address, email address, order number, invoice amount) to Automattic and Stripe. You enter your card details directly into a secure Stripe field; they are not transmitted to us. For fraud prevention our shop loads a Stripe script (js.stripe.com) at checkout, through which Stripe receives technical data (e.g. IP address, device and browser information). More information: stripe.com/privacy and automattic.com/privacy.

Klarna: If you choose Klarna, the order and contact data mentioned above are transmitted via Stripe to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Klarna may carry out an identity and credit check; details: klarna.com/privacy-policy.

Apple Pay and Google Pay: When paying with Apple Pay (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland) or Google Pay (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) you confirm the payment in your wallet; the payment itself is processed via Stripe and we do not receive full card details. The privacy notices of Apple and Google apply to their processing.

Where these providers transfer data to the USA, this is based on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (fraud prevention).

To ship your order, we pass on the necessary data (name, delivery address) to the shipping company we use (DHL). Legal basis is Art. 6(1)(b) GDPR.

Order processing and invoicing. To process your order (order, invoice, stock and shipping), we automatically transfer the order data (name, billing and delivery address, email address, items ordered, payment method) to our enterprise resource planning system Odoo, which we operate ourselves on a server of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany). Order and shipping confirmations and your invoice are sent by email via our email provider IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany). These service providers process the data only on our behalf and according to our instructions (Art. 28 GDPR). The legal basis is Art. 6(1)(b) and (c) GDPR.

Storage period. We retain order and invoice data due to commercial and tax law obligations (§ 257 HGB, § 147 AO): invoices and accounting records for 8 years, commercial correspondence for 6 years, each from the end of the calendar year (Art. 6(1)(c) GDPR). The data is then deleted. Providing the data required for the order is necessary to conclude the contract; without it we cannot fulfil your order. We do not use automated decision-making, including profiling (Art. 22 GDPR).

To protect our shop against attacks and misuse, we use the security plugin Wordfence by Defiant, Inc. (USA). Access data such as IP address, pages visited and time are processed and compared against lists of known attackers; this may involve a transfer of IP addresses to Defiant, Inc. in the USA, which takes place on the basis of appropriate safeguards (e.g. EU standard contractual clauses). The legal basis is our legitimate interest in the security of our shop (Art. 6(1)(f) GDPR).

7. Customer account, product reviews and blog

Customer account. When ordering, you can choose to create a customer account. For this we store your email address, name, address details and orders; you receive your password by email and can change it at any time. In your account you can see your orders and review products you have bought. The legal basis is your consent and the performance of the user relationship (Art. 6(1)(a) and (b) GDPR). You can have your account deleted at any time – a short message to info@aromaneo.com is enough. Data we must keep for tax and commercial law reasons (e.g. invoices) remains stored until the statutory retention periods expire.

Product reviews. If you review a product you have bought, we store and publish your star rating, your review text, the name you provide and the date. Your email address is not published. Only customers who have bought the product from us and are logged in to their customer account can leave a review; to check this, we match the review against your orders. The legal basis is your consent by submitting the review (Art. 6(1)(a) GDPR) and our legitimate interest in genuine, verifiable customer reviews (Art. 6(1)(f) GDPR). You can ask us to delete your review by email at any time.

Hearts, poll and topic suggestions on the blog. On our blog you can mark posts with a heart, take part in a short topic poll and send us topic suggestions. No cookies are set and nothing is stored on your device. We only store the post or the chosen answer and – for suggestions – your text. So that a vote is not counted more than once, we derive a non-reversible daily key from your IP address and browser identifier, which is deleted after two days at the latest; we do not store your IP address itself. The legal basis is our legitimate interest in a blog that follows our readers’ wishes (Art. 6(1)(f) GDPR).

Comments on the blog. Only logged-in customers can comment. We store your comment, the post, the date and time and the link to your customer account. A comment only appears after we have approved it; we are notified of new comments by email (the email contains the comment text). We publish your comment, your first name and the first letter of your last name; your email address is not published. The legal basis is the use of the comment function as part of your customer account (Art. 6(1)(b) GDPR) and our legitimate interest in a moderated exchange (Art. 6(1)(f) GDPR). Comments are stored for as long as they are shown on the blog. You can ask us to remove your comment at any time – a short message to info@aromaneo.com is enough.

8. Address suggestions at checkout (Google Maps Places)

At checkout you can optionally activate address suggestions. The Google Maps Places service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is only loaded once you click "Adressvorschläge aktivieren" (activate address suggestions). From that point on, what you type into the address field and technical data (including your IP address) are transmitted to Google in order to suggest matching addresses; a transfer to Google LLC in the USA cannot be ruled out. The legal basis is your consent given by clicking (Art. 6(1)(a) GDPR). Without a click, no data is transmitted, and you can always enter your address without this feature. More information: policies.google.com/privacy.

9. Newsletter

If you subscribe to our newsletter, we use your email address to send you information about our products, recipes and news. We send it using Hostinger Reach by Hostinger International Ltd. (Larnaca, Cyprus, EU). We also send some newsletters directly via our email provider IONOS SE (see section 6) – in that case as a blind copy (BCC), so that no recipient can see the addresses of others, and only to addresses subscribed to the newsletter at that time. Subscription uses a double opt-in procedure: you first receive an email in which you confirm your subscription. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every email or by writing to info@aromaneo.com. We store your data until you unsubscribe. Optionally, you can tell us which topics interest you most when subscribing (e.g. recipes or news from the harvest). We store this information together with your email address on our server to tailor the newsletter content, and delete it when you unsubscribe.

Notification when a product becomes available

For products that are currently out of stock or coming soon, you can ask to be notified. For this purpose, we store your email address, the product you are interested in, the language you chose and the time of your sign-up and confirmation on our server (hosting, see section 2). The double opt-in procedure applies here as well: only after you click and confirm the link in our confirmation email do we add you to the waiting list. As soon as the product is available, you receive exactly one email about it; after that we delete the entry. We delete unconfirmed sign-ups after 7 days and confirmed ones after 12 months at the latest. We send these emails via our email provider IONOS SE (see section 6). The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time via the “Cancel the notification” link in the confirmation email or by writing to info@aromaneo.com. To prevent misuse, we store a hashed value of your IP address for one hour to limit the number of requests (Art. 6(1)(f) GDPR). The notification is independent of the newsletter: you only receive the newsletter if you additionally select it and confirm it separately.

10. Online withdrawal (“Withdraw from contract”)

If you withdraw from your contract using our withdrawal function at aromaneo.com/vertrag-widerrufen-en.html, we process your name, order number, email address, your optional message and the date and time of receipt in order to process the withdrawal and confirm its receipt by email. To prevent misuse, your IP address is processed briefly (for no more than one hour). The legal basis is Art. 6(1)(c) GDPR in conjunction with § 356a BGB and Art. 6(1)(b) GDPR. We store this information together with your order data for the duration of the statutory retention periods.

11. External links

This website contains links to external sites (e.g. to our growing partner Aroma Mediterraneo). We have no influence over the content or data processing of these external sites; each site's own privacy policy applies.

12. Your rights

You have the right at any time to information about the personal data we hold about you (Art. 15 GDPR), to rectification of inaccurate data (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR), to data portability (Art. 20 GDPR), and to object to processing (Art. 21 GDPR). To exercise these rights, please contact info@aromaneo.com.

Withdrawing your consent (Art. 7(3) GDPR): You can withdraw any consent you have given (e.g. for the newsletter or address suggestions) at any time with effect for the future, e.g. by email to info@aromaneo.com. This does not affect the lawfulness of processing carried out before the withdrawal.

Right to object (Art. 21 GDPR): Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

13. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (LfDI RLP)
Hintere Bleiche 34, 55116 Mainz, Germany
www.datenschutz.rlp.de

14. Changes to this privacy policy

We reserve the right to amend this privacy policy if the legal situation, the website, or the type of data processing changes. The version currently published on this page shall apply.

Last updated: October 2026

Customer reviews

If you leave a review after an order, we process your order number and the email address used for the order to check that the review belongs to a genuine order (Art. 6(1)(f) GDPR – legitimate interest in genuine, verifiable reviews). Only the name you provide, your star rating, your text and the date are published – based on your consent (Art. 6(1)(a) GDPR). Your email address is never published. You can withdraw your consent at any time by emailing info@aromaneo.com; we will then remove the review.